Berlin's Cabinet Adopts the Intelligence Reform Giving BND and BfV Active Measures Under One Control Council
Berlin, 12 August 2026
Key points
- The federal cabinet adopted the Gesetz zur Reform des Nachrichtendienstrechts on 12 August — a single omnibus act containing a new Bundesverfassungsschutzgesetz, a new BND-Gesetz and, for the first time, a statute for the Unabhängiger Kontrollrat (Independent Control Council)
- Active measures: the BND may counter immediate threats found in its operations and, with Kontrollrat approval and under defined threat conditions, disable state-affiliated hacker infrastructure or sabotage weapons facilities; the BfV may act on objects — the ministry's own example is swapping explosive components for harmless powder
- Retention in strategic collection: communications content up to six months, traffic data up to twelve; new legal bases for AI analysis, biometric image matching and data sharing including with the Bundeswehr
- Oversight now split across four bodies is consolidated at the Kontrollrat, which absorbs the G10 Commission's functions and must approve intrusive measures in advance; it reports to the parliamentary control panel
- Interior minister Alexander Dobrindt: "Sabotage, espionage, cyberattacks and covert actions by foreign powers demand new answers." The bill goes to the Bundesrat, then the Bundestag. The MAD is not in this package — it received its own new law earlier this year
Germany's cabinet approved on 12 August the most extensive rewrite of its intelligence law since the services were founded, giving the BND and the BfV authority to act against threats — not only to observe and report them — under a single oversight body with advance approval.
Dobrindt's framing was that the reform turns the agencies into "real secret services" (echte Geheimdienste) — a phrase chosen for its contrast with the post-war settlement, in which German services collect and refer while action belongs to police and prosecutors. The enumerated cases are narrow and the government's examples are concrete: deleting a victim's data from a hacker's system, taking a state-linked server offline, disabling a chemical-weapons laboratory or a drone factory abroad in a defined threat situation, or, domestically, rendering a planted device inert. Online searches, expanded source-telecommunications interception including archived communications and access to vehicle telemetry are in the same text.
The compensating change is that control, currently divided among the Kontrollrat, the parliamentary panel, the G10 Commission and the data-protection commissioner, is bundled at the Kontrollrat with prior approval of intrusive powers and ex-post review of active measures. Critics on the left and among data-protection lawyers object to the separation principle (Trennungsgebot) being eroded; the government's rationale is sabotage, espionage and hybrid attack.
The law moves the boundary from collection to operation; the capabilities that would fill the space are not created by it. The reform arrives in a summer in which the Generalbundesanwalt took over an explosive drone found on the Leipzig-Halle cargo apron (Großwald recorded the case) and the Bundeswehr's Inspector General said hybrid attacks are taking place "every day" — and in each of those cases the German answer legally terminated at observation and referral. Großwald carried the cabinet decision in Signal No. 123. Two clauses decide how much of this survives committee: whether the Bundestag narrows the enumerated active-measures cases, and whether the Kontrollrat's advance-approval scope emerges intact. A weakened approval clause with the powers left whole would be the worse outcome, and it is the one lobbying tends to produce.
