Germany writes supply-chain sabotage into statute

Germany's cabinet approved legislation on Wednesday that would let its intelligence services hack foreign systems, sabotage adversaries' supply chains and feed false information to extremists inside Germany, in what The Record describes as the biggest overhaul of the country's spy laws of the postwar era ^[1]. For anyone who maintains a bill of materials, the load-bearing detail is that a European government has put component substitution in writing rather than leaving it to be inferred from incident reports.

Chancellery chief Nina Warken said the new powers could allow the agencies to substitute faulty components into deliveries, use cyber operations to sabotage drone factories or chemical weapons laboratories, and disable servers run by hostile state-sponsored hackers and disinformation operators ^[2]. Interior Minister Alexander Dobrindt told reporters after the cabinet meeting that the government was "expanding the technical capabilities of the intelligence services and granting them active, operational powers," and that it was "about being able to take active measures against our attackers and adversaries" ^[3].

The 732-page bill has not yet cleared parliament ^[4]. It rewrites the laws governing both the foreign service, the BND, and the domestic agency for the protection of the constitutional order, the BfV ^[5]. Its immediate legal origin is not the threat picture the government cites but a Federal Constitutional Court ruling that struck down a state intelligence law on the grounds that surveillance powers had to be calibrated to the intrusiveness of the measure ^[6].

The controls are worth reading closely. BND disruption operations would require the agency's president to declare formally that a named foreign power was persistently and systematically threatening German interests; the declaration expires after 12 months and must be reviewed every six ^[7], which means at least one mandatory review inside the life of each declaration ^[8]. Operations must be directed at the responsible state rather than individuals, and conducted outside Germany wherever that would be equally effective ^[9]. The bill bars measures intended to endanger a person's life or physical safety, leaving the BND without anything resembling the paramilitary capabilities of France's DGSE or the CIA's Special Activities Center ^[10]. On The Record's reading, the explicit German text is narrower than what counterparts in Paris, Washington and London can draw on, including the British statutory immunity provision that lets the government authorise otherwise unlawful acts abroad ^[11][12].

The domestic side is the bigger break with practice. Until now the BfV has principally been empowered to gather intelligence rather than intervene operationally ^[13]. Under the draft it could block or reroute data traffic, alter transmissions in transit, corrupt data stored for use in a plot, and disable equipment about to be used in an attack ^[14]. It could also feed false information to the people involved, a domestic disinformation power for which The Record says no equivalent statutory authority exists in British, French or American law ^[15].

Carriers are conscripted. Telecommunications and digital service providers could be compelled to assist, with compensation, and non-compliance backed by fines or suspension of the service ^[16][17].

Watch the parliamentary passage, and whether the declaration mechanism produces anything visible to oversight. Watch too the provisions placing statutory controls on inferences drawn from collected data, which The Record notes go beyond how Britain, France and the United States regulate collection and processing ^[18].