Germany’s Proposed Hack-Back Powers and Outsourced Surveillance Are Testing Constitutional Limits

In August, on the same day the White House announced a program enlisting private companies in cyber operations, Germany’s Cabinet approved what it calls the most far-reaching overhaul of its intelligence laws in the history of the Federal Republic. This and other reforms are set to introduce and expand the state’s hacking and surveillance powers. In exceptional cases, hack-backs, where the state breaks into IT systems to fend off cyberattacks, could even be triggered fully automatically.

Unlike the United States, Germany does not plan to outsource hack-backs to private companies. When it comes to surveillance, however, the private sector is already deeply involved: the Federal Criminal Police Office (BKA) and, according to media reports, the Federal Intelligence Service (BND) use Pegasus, powerful spyware created by the Israeli cyber company NSO Group. And the new bills go further, allowing some security agencies to have biometric matching on the internet carried out by private providers, including providers outside the European Union, thereby circumventing EU and German constitutional standards.

With hybrid attacks and cybercrime becoming more prevalent, states must be able to act. But not at the cost of fundamental and human rights. Yet that is exactly the risk posed by these new hacking powers that allow German intelligence services to not only watch but to act in secret, and by outsourcing surveillance to private companies.

What Exactly Is Germany Planning?

Several bills are currently before parliament. One concerns a comprehensive reform of the intelligence services; another goes under the heading of strengthening cybersecurity. Among other things, the legislation would give various German security agencies powers to intrude into IT systems in order to stop or mitigate cyberattacks.

The German government calls these powers “active cyber defense” and explicitly rejects the term “hack-back.” Under the definitions used in the International Cyber Law: Interactive Toolkit, however, active cyber defense means proactive defensive measures taken outside the defended infrastructure, and a hack-back is one form of it: action against an identified source. Since that is what the bills would allow, this article refers to these powers as hack-backs. The powers envisaged for the intelligence services may go further still, covering operations that are not tied to an ongoing attack. Where both are meant, this article speaks of intrusive cyber operations: operations that go beyond obtaining information and interfere with the target or the attacking system itself. In the terms of the Trump administration memorandum, all of these actions count as “cyber effects operations.” They are to be distinguished from government hacking for surveillance purposes, that is, the use of government spyware, known in Germany as “state trojans.” The terms “state hacking” and “hacking powers” are used here to cover all of these.

The following table gives an overview of the bills discussed in this article.

Under these bills, numerous German agencies could conduct hack-backs in parallel. The Federal Police and the BKA, for instance, would be authorized to take various measures in response to cyberattacks. They would be allowed to intrude, including covertly, into IT systems that pose a threat in order to read, delete, and alter data. The intelligence services are to receive similar powers. In addition to powers to hack devices to obtain information, operational powers are also envisaged for them. Particularly alarming is the fact that hack-backs may, even if only in exceptional cases, be triggered automatically, that is, directly by software, without any human review in between. Beyond this, the reform raises a host of further problems, notably the expansion of mass surveillance tools and the weakening of effective oversight mechanisms. The Society for Civil Rights (GFF) has addressed these, but they are beyond the scope of this article.

Another legislative package would equip the federal police forces and law enforcement with sweeping AI surveillance powers. These include powers to deploy Palantir-style data analysis, as already practiced in several German states. They also authorize the training of AI systems on police data. This data may even be transferred to private companies to develop, test, modify, or train IT products, including self-learning systems. In addition, authorities would be allowed to conduct biometric matching on the internet. For example, if the police have an image of a person suspected of a crime, they could search the internet for that person by comparing biometric templates. The proposed legislation would permit biometric matching against all publicly accessible data, including on social media platforms. The bill provides extensive options for having the matching carried out by other public bodies and by private providers in Germany and abroad, including outside the EU. The intelligence reform contains a similar provision: the intelligence services, too, would be allowed to have biometric matching carried out by public bodies and private third parties outside the EU. These services are likely unlawful under EU data protection and AI rules, which exist to protect fundamental rights. The bills would allow German authorities to use them anyway.

How the Constitutional Court Shapes German Security Law

German security law has long been shaped by the case law of the Federal Constitutional Court, Germany’s highest court. The Court’s decisions are binding on all, and it can declare laws unconstitutional. New intrusive powers, particularly surveillance powers, regularly end up before the Court. There are also decisions specifically on state hacking that mark constitutional limits. So far, however, these decisions explicitly concern only surveillance powers, not hack-backs or other intrusive cyber-operations that go beyond obtaining information.

In a 2008 decision, the Court recognized a new  “fundamental right to protection of the confidentiality and integrity of information technology systems,” often called the “IT fundamental right”. It is a distinct manifestation of the general right of personality, which derives from the constitutional guarantees of human dignity and personal freedom to protect aspects of private life that no specific right covers. The IT fundamental right  protects both the confidentiality of the data created, processed, and stored in a system and the integrity of the system itself. The mere act of infiltrating a system thus interferes with this right, because it is already “the critical technical step that enables spying, monitoring or manipulation activities in relation to this system.” In two decisions on state trojans in 2025, the Court confirmed and refined these standards.

In a 2021 order, the Court also attributed a duty-to-protect dimension to this right. The state must protect its citizens from, for example, criminals exploiting security vulnerabilities that are not yet known to manufacturers (so-called zero-days). The state can fulfill this duty by promptly reporting such vulnerabilities so that they can be closed. If, however, security agencies also have hacking powers, they have an incentive not to have vulnerabilities closed but to exploit them themselves. This creates a tension between two objectives. That is not prohibited as such, but the state must then establish a statutory balancing process.

The constitutional standards the Court has developed for the intrusive powers of intelligence services rest on a fundamental separation between police and intelligence services. Intelligence services may conduct surveillance under lower thresholds than the police, even when no threat is yet foreseeable, because they have no operational powers. For the use of spyware for surveillance, however, the constitutional hurdles are just as high as for the police, because the spyware yields particularly extensive information and allows for a nearly  comprehensive picture of a person’s personality.

The Court has repeatedly affirmed that outsourcing state powers entails particular risks, such as an increased risk of abuse. This applies especially to  cooperation with foreign intelligence services, where the Court has stressed that the limits of the Basic Law, Germany’s constitution, must not be undermined in their substance through data exchange. The European Court of Human Rights has likewise held that the protection offered by the European Convention on Human Rights would be meaningless if states could escape their obligations simply by turning to foreign actors. It therefore requires effective guarantees against such circumvention.

Circumventing Legal Limits by Turning to the Private Sector

By outsourcing biometric internet matching to private companies, the German state would effectively circumvent a provision of the AI Act, an EU regulation that entered into force in 2024. Article 5(1)(e) of the AI Act prohibits the use of AI systems that create or expand facial recognition databases through the untargeted scraping of facial images from the internet. In Europe, providers such as PimEyes and Clearview AI are likely in breach not only of the GDPR, a comprehensive EU privacy law, but also of the AI Act. A law that permits the state to rely on providers in third countries allows the state to use a service that is unlawful in the EU. Here, the German legislature is quite evidently attempting to use the category of “national security” to create leeway and circumvent regulation. The Court of Justice of the EU, however, has drawn the scope of the national security exception narrowly.

The power to transfer police data to private companies for AI training likewise shows that the private sector is playing an ever-more important role for security agencies. This power is particularly dangerous because companies gain access to highly sensitive information stored in police databases.

In such sensitive areas of fundamental rights, the state is responsible for ensuring that its power is used proportionately. By relying on private companies that European data protection authorities are already pursuing for legal violations, it gives up that responsibility. Oversight and safeguards then become meaningless.

While the United States engages vetted American companies, the German government is creating legal bases that rely on private providers outside the EU. In the context of Europe’s debate on digital sovereignty, this move seems anything but sensible. Rights-intrusive measures must not be outsourced to providers whose services would be unlawful in the EU or that escape effective oversight.

Beyond Surveillance: Intrusive Cyber Operations as a Constitutional Challenge 

If the intelligence services are now granted operational powers, in particular hack-back powers, the line between intelligence and police work becomes blurred. Yet it is adhering to  this line that, according to the Federal Constitutional Court, justifies a lower surveillance threshold for the intelligence services.

Another fundamental problem is secrecy. Intelligence services by nature operate in the shadows. That may be justifiable as long as they are only watching. Once they act, however, those affected may never learn that the state has interfered with their rights. A state that acts against its citizens in secret, without them ever knowing, leaves them without any means of defense or recourse.

There is no doubt that the IT fundamental right is affected by intrusive cyber operations. Existing case law, however, concerns surveillance measures, not operations of this kind. Yet access to an IT system already overcomes the decisive technical hurdle; the integrity of the system is compromised. Since attacks frequently run through hijacked systems of uninvolved third parties, hack-backs may interfere with the IT systems of uninvolved persons.

It is particularly serious that hack-backs could be triggered automatically, without human control, albeit only in exceptional cases. Taking a human out of the loop entails an enormous risk of error which, in the worst case, could lead to interstate escalation and considerable physical damage, for instance, if critical infrastructure is affected. Fully automated, intrusive cyber operations must therefore be ruled out without exception. Erroneous attribution or a misjudgment of the actual effects, for example, could have consequences under international law.

This potential for escalation also raises the largely unresolved question of whether, and to what extent, intrusive cyber operations require parliamentary approval, as deployments of the armed forces abroad do.

Fueling the Vulnerability Market

With the new hacking powers, the German government is also creating further incentives to deliberately keep zero-day vulnerabilities open rather than having them closed, even though the legislation is meant to increase cybersecurity. The same vulnerabilities that are to be used for state hacking can, of course, also be exploited at any time by the very criminals or states from which the German government is supposed to protect its citizens. The government is thus knowingly accepting risks to its citizens. Most German police laws and the Code of Criminal Procedure already authorize the use of state trojans, so this tension is not new. Vulnerability management, as required by the Federal Constitutional Court, is therefore long overdue, yet none of the new bills provide for it.

How state trojans are deployed in practice, and which private sector products the authorities rely on, remains largely unknown. The BKA’s use of Pegasus is one of the few cases that has become public. Vulnerability management must therefore also cover government procurement. Where the state buys vulnerabilities or commercial spyware services, and this is not prohibited altogether, it must at least put safeguards in place so that such purchases cannot be used to circumvent the state’s duty to protect fundamental rights.

A legal opinion commissioned by GFF has examined how such vulnerability management should be anchored in law and how it could be designed, including rules for the use of commercial spyware.

The intelligence reform also obliges the Federal Office for Information Security (BSI), Germany’s cybersecurity authority, to share information with the intelligence services. This obligation is general, but it would also cover vulnerabilities. Researchers and companies often report vulnerabilities to the BSI so that they can be closed in a coordinated manner. The BSI is seen as a trustworthy authority in this context. Researchers and companies will think twice if their reports run the risk of ending up with an intelligence service that would rather exploit the reported vulnerabilities. During the legislative process, an exception was added for vulnerabilities reported to the BSI, but it only lifts the obligation: the BSI may still share reported vulnerabilities voluntarily. If the legislature wants to preserve trust in its cybersecurity authority, it must put a stop to transfers of vulnerabilities.

Conclusion

The proposed German reforms enter uncharted constitutional territory. They undoubtedly come at a time of new threats, during which authorities must be able to act to avert dangers to democracy and fundamental rights. Germany, too, must of course find ways to be prepared for hybrid attacks and growing cybercrime. It also needs to be equipped to prevent damage effectively, and to protect its citizens from such attacks. But this requires more than introducing risky hack-back powers.

Precisely because the threats are real, statutory vulnerability management must be established. Second, a clear allocation of responsibilities for intrusive cyber operations is needed; parallel responsibilities risk hampering rapid responses. Third, powers must be consistent with fundamental and human rights and must neither exceed legal limits nor circumvent them by turning to private companies. And fourth, investment in resilient systems is essential; hack-backs can make only a small contribution to cybersecurity.