Germany’s government is preparing to give its foreign intelligence service, the Bundesnachrichtendienst (BND), far broader powers over online surveillance and hacking than it has ever had before.
A draft amendment to the BND Act, circulating by German media, would transform the agency’s reach by authorizing it to break into foreign digital systems, collect and store large portions of internet traffic, and analyze those communications retroactively.
At the core of this plan is Frankfurt’s DE-CIX internet exchange, one of the largest data junctions on the planet.
For thirty years, global traffic has passed through this node, and for just as long, the BND has quietly operated there under government supervision, scanning international data streams for intelligence clues.
More: Germany Turns Its Back on Decades‑Old Privacy Protections with Sweeping Surveillance Bill
Until now, this monitoring has been limited. The agency could capture metadata such as connection records, but not the full content of messages, and any data collected had to be reviewed and filtered quickly.
The proposed legal reform would overturn those restrictions.
The BND would be permitted to copy and retain not only metadata but also entire online conversations, including emails, chats, and other content, for up to six months.
Officials expect that roughly 30 percent of the world’s internet traffic moving through German collection points could be subject to capture.
A two-step process would follow. First, the BND would stockpile the data. Later, analysts could open and inspect specific content after the fact.
Supporters in the Chancellery say that this is not a radical expansion but a modernization that brings Germany into alignment with foreign partners. They claim that other countries’ intelligence services already hold data for longer periods, two years in the Netherlands, four years in France, and indefinitely in Britain and Italy.
The government’s view is that the BND must have comparable tools to operate independently rather than relying on allied services for insight.
Yet the amendment goes far beyond storage. It would also legalize direct hacking operations against companies and infrastructure that do not cooperate voluntarily with BND requests.
Under the term “Computer Network Exploitation,” the agency could secretly access the systems of online providers like Google, Meta, or X.
These intrusions would be permitted both abroad and, in some circumstances, within Germany itself, especially if justified as a defense against cyberattacks.
Another provision would sharply reduce existing privacy protections for journalists. At present, reporters enjoy near absolute protection from state surveillance.
The draft law, however, introduces an exception. Employees of media organizations tied to “authoritarian” governments could be monitored, with the justification that such journalists might be acting on behalf of their states rather than as independent observers.
The Chancellery has declined to comment publicly, saying only that the amendment is still under internal review.
But the direction is unmistakable. Germany appears ready to embed mass interception and hacking powers into law, effectively normalizing surveillance once viewed as excessive during the Snowden era.
While the government frames this as a strategic update, the effect would be the routine collection and long-term storage of personal communications flowing through German networks.
Such a structure risks making mass surveillance a permanent feature of the digital world, one that alters the balance of power further away from individual privacy and toward an intelligence system designed to watch nearly everything that passes through its cables.
