The German Interior Minister Alexander Dobrindt wants to grant secret services new “operative” powers. The radical draft law running to 700 pages would also expand surveillance, facial recognition and offensive cyber capabilities – and cost hundreds of millions of euros a year.

Earlier this year, federal Interior Minister Alexander Dobrindt (CSU) announced that he wanted to give Germany’s intelligence services “operative” powers in future – the kind that until now only the federal police forces have held. The ministry has now presented a corresponding draft bill on the “reform of intelligence service law”. The package concerns the Federal Intelligence Service (BND) and the Federal Office for the Protection of the Constitution (BfV) and would radically restructure both agencies. Dobrindt wants the plans passed by the cabinet before the summer break.

The draft, published last week, runs to more than 700 pages. Should it pass through the Bundestag unchanged, the foreign intelligence service would be permitted to disrupt foreign computer systems or manipulate data stored on them. For these long-planned “hack-backs”, the BND would be able to cooperate with foreign partner services and exploit vulnerabilities in software and hardware that the Federal Office for Information Security (BSI) is otherwise supposed to disclose publicly – and thereby make fixable.

For such operations, the foreign intelligence service could demand support from other agencies and even from private companies. In certain cases, interventions are also meant to happen without human involvement: the draft bill provides that automated analyses could in future directly trigger operative protective measures, for instance when a cyberattack “cannot otherwise be repelled, or not in time”.

Exceptions for domestic wiretapping

The permission to monitor telecommunications is also being massively expanded. At the BND this is known as “strategic reconnaissance” and has, since Edward Snowden’s revelations more than a decade ago, largely been limited to connection data. Now the BND is to be allowed to evaluate and store the content of communications on a much larger scale as well.

The supposed “limit” states that internet espionage must be restricted to 15 per cent of the total capacity of all networks. But because networks are never fully utilised, the rule could in practice allow the collection of the entire traffic flow.

The collection of purely domestic communication remains prohibited in principle, implementing a ruling by the Federal Constitutional Court. However, it is unclear how the BND is meant to define internet traffic as “domestic”. The Federal Interior Ministry has also built several exceptions into the draft: to fend off ongoing cyberattacks or “imminent dangers”, communications could also be intercepted even where those involved are located in Germany.

Facial recognition and data manipulation

New intervention powers to counter drones are also planned for both agencies: both the BND and the BfV would be allowed to combat unmanned systems themselves on their premises and within a radius of 100 metres. For the domestic intelligence service, this would even be possible while deployed elsewhere, “in the event of an approach towards its deployed staff or covert auxiliary personnel”.

Dobrindt also wants to grant the intelligence services facial recognition powers similar to those planned for the police under the planned “security package”: both the BND and the domestic intelligence agency would then be able to track people in real time in public spaces using artificial intelligence. Private operators could even be obliged to grant the services access to the relevant footage. In addition, the BND and BfV would in future be allowed to identify people by facial features online, including by searching social media.

Dobrindt also wants to enable “hack-backs” for the domestic intelligence service. The draft refers to the “redirection or blocking of data traffic” as well as the “alteration of transmission content”. Unlike the police, the BfV would not have to inform those affected afterwards about the manipulation of private chat messages or emails – on the contrary, the service would even be permitted to disguise its activities by “providing false information to those involved”.

This “covert intervention on objects” appears as a so-called “protective measure” in Section 60 of the new law and is to be permitted whenever the domestic intelligence service identifies a “particular threat” to a “particularly significant legal interest”. This includes activities that endanger security, terrorist endeavours, or work carried out on behalf of a foreign intelligence service.

New central oversight body

The procedure for the “protective measures” is to be multi-tiered. In cases of imminent danger, the presidents of the BfV can act immediately. In all other cases, the classification of a “particular threat” is to be made by the agency’s leadership and then confirmed by the Independent Oversight Council (UKRat). This would give the top-level federal authority, established at the start of 2022, new powers as well: until now, the Oversight Council has only been responsible for the BND’s technical intelligence gathering.

There are also plans to dissolve the existing G10 Commission, which decides on interventions in the privacy of correspondence, post and telecommunications, and to transfer its duties to the Independent Oversight Council as well. This would strip the Federal Commissioner for Data Protection and Freedom of Information of a large part of her existing responsibilities in the area of constitutional protection. At the same time, the UKRat would also become responsible for the Military Counter-Intelligence Service (MAD).

The draft bill provides for a series of changes to other laws, including the already embattled Freedom of Information Act: in future, information would always be exempt from the duty to disclose if it concerns intelligence service proceedings or activities, even where it is also held by another authority.

Hundreds of millions of euros a year

For the BND, Dobrindt’s “reform” budgets one-off costs of at least €40 million and annual costs of at least €35 million. For the BfV, one-off IT costs of around €94 million and annual operating costs of around €269 million are planned, plus annual personnel costs of around €25 million. The Independent Oversight Council is to be funded with around €8.9 million a year.

Exactly when the draft is to be passed by the cabinet remains unclear. After the summer break, the relevant Bundestag committees would then deal with it, and the relevant associations are meant to comment on the law before then. Members of the Bundestag could still vote on it definitively this year.

Published in German in „nd“.

Image: The BND headquarter in Berlin (Steven Lilley, BY-NC-SA 2.0).