Germany Rewrites the Rules on State Power: Cyber-Counterattack Authority and the Erosion of Post-War Separation Principles

Berlin grants intelligence agencies offensive cyber capabilities and covert entry powers, deliberately weakening the post-WWII firewall between police and intelligence—a structural shift justified by hybrid warfare stats.

Germany's Bundestag has passed a sweeping reform package granting the Federal Intelligence Service (BND) authority to conduct offensive cyberattacks against foreign adversaries. The permitted range runs from data deletion and manipulation to disabling entire systems and physically destroying weapons platforms like drones. The domestic security agencies also gain covert entry powers for premises—without force against people, but a significant expansion from their prior surveillance mandate. An independent oversight board is to be established, though its powers and composition remain undefined in the reporting.

The political engine behind this is Interior Minister Alexander Dobrindt (CSU), who framed the package as a defensive necessity: "Anyone who attacks us must know that we are prepared to strike back." The coalition of CDU/CSU and SPD voted the reforms through. Opposition lawmakers raised concerns about scope, but lacked the votes to block or meaningfully amend. At the center of the debate sits Germany's "separation principle"—the post-WWII institutional firewall between police (who investigate) and intelligence services (who gather information). BKA President Holger Münch has long argued the principle hampers effective response to hybrid threats, where state-sponsored and criminal actors blur together. Historian Sönke Neitzel went further, calling the principle "nonsense" given decades of stable constitutional democracy. Dobrindt's position is more calibrated: preserve the principle in form while expanding data exchange between agencies and transforming them into "real intelligence services." The numbers Münch cited to justify urgency are striking: crime originating from abroad rose 24% in the first half of 2026 compared with the same period a year earlier, while fewer than 5% of those cases were solved. That solve rate is the real signal—it suggests a structural enforcement gap that existing institutions cannot close with current authorities or methods. Whether offensive cyber capabilities address that gap, or whether the 24% rise is being weaponized to justify a pre-existing policy wish list, is the question the Bundestag did not adequately interrogate. The historical weight of the separation principle cannot be overstated. It was imposed by the Allied powers specifically because the Gestapo's fusion of police and intelligence functions enabled the Nazi terror apparatus. Every erosion of this principle—however justified by contemporary threats—shifts Germany's institutional architecture toward the model its postwar order was explicitly designed to prevent. The oversight board is the critical variable: if it has genuine independence, subpoena power, and public reporting obligations, this is a modernization. If it's advisory and opaque, it's a power grab with a fig leaf. Dobrindt's stated ambition to create "real intelligence services" is the tell. This is not a one-off response to a specific cyber incident. It's the beginning of a structural transformation of Germany's security state, from a deliberately constrained postwar model to something closer to the Five Eyes paradigm—agencies with broad authority, offensive capabilities, and deeper inter-agency data sharing. The question is whether German democratic institutions are robust enough to absorb this expansion without the oversight failures that have plagued even mature intelligence states like the US and UK. The 24% rise in foreign-origin crime and the sub-5% solve rate are real problems. But the legislative response bundles genuine defensive needs (cyber resilience) with expansive new authorities (covert entry, offensive destruction of physical assets) that have no obvious connection to solving cross-border cybercrime. The packaging is the extraction mechanism: legitimate threat statistics used to justify a scope of powers that extends well beyond the stated threat.