Bundestag passes law letting German security agencies strike back at cyberattacks

Bundestag approves active cyber defence

The Bundestag passed a law that for the first time allows German security authorities to respond actively to attacks coming from the internet. CDU/CSU and SPD voted in favour, while AfD, Die Linke and the Greens voted against. The draft gives the Federal Office for Information Security (BSI), the federal police and the Federal Criminal Police Office (BKA) additional tools to fend off cyberattacks. The BKA and the federal police may restrict the operation of IT systems, redirect data traffic and take down servers abroad that launch attacks. As a last resort they may access attackers' systems to read, delete or alter data, including with technical means and without the knowledge of those affected. The draft also prohibits operating IT systems that can redirect traffic and read, delete or alter data.

The measures are not classic hackbacks, meaning retaliation for its own sake. Their target is solely the servers from which attacks are launched.

Government rationale and industry costs

The government argues that Germany, as the leading economic nation in Europe, faces growing focus from cyberattacks that can have large effects. Bitkom, the industry association, most recently put the damage to the German economy from cyberattacks within one year at between 160.4 and 205.8 billion euros (a range it gave, not a single figure). In the closing debate, Interior Minister Alexander Dobrindt (CSU) said:

“We are arming ourselves in cyberspace.”

Low end of Bitkom estimate160.4

High end of Bitkom estimate205.8

Low end of Bitkom estimate

160.4 billion euros

High end of Bitkom estimate

205.8 billion euros

Data from the article text

Dobrindt linked the powers to a wider set of threats, naming attacks on infrastructure, the food supply and blood banks. He told the chamber:

“We strike back, we destroy his digital infrastructure, and we take him out of the game digitally.”

Changes made during the parliamentary process

Parliament added points to the government draft. The BKA may now use the new instruments against real-world dangers, for example by cutting the link to control units of drones or internet-controlled explosive devices. Proportionality requirements and protection of private IT systems were tightened. Where doubt exists over whether a system is used privately or commercially, it counts as private and gets higher protection standards.

Opposition criticism

Opposition critics said the responsibilities of the authorities are unclear during a counterattack and that the new powers go too far with too little oversight. AfD MP Steffen Janich argued for exclusive competence for the BSI and said companies cannot be asked to shut down their IT systems for a long time on a security authority's order, since customers' interests matter too. SPD MP Daniel Baldy replied that the draft contains no long-term shutdown and that the principle of proportionality applies. He added that cybersecurity concerns everyone, since hackers now attack even supermarket fridges. Greens intelligence expert Konstantin von Notz called the coalition's plan counterproductive, describing 'duplicate structures' and saying the draft came too late and was underdeveloped. Dobrindt rejected the criticism and said the aim is to disarm attackers, warning that anyone who does not want disarmament provokes the next attack.

What comes next

Bundesrat consent is still outstanding before the law can take effect. Separately, a draft by Dobrindt covers the intelligence services, with the BND and the Verfassungsschutz set to receive more powers, including to search and to strike back.