Civil liberties group and Bitkom call for strict vulnerability management

A planned intelligence reform is raising concerns among experts about IT security in Germany. The restructuring of the security architecture would give Germany’s Federal Intelligence Service (Bundesnachrichtendienst, BND) and Federal Office for the Protection of the Constitution expanded powers in cyberspace. These include tools for active cyberdefense. The Society for Civil Rights (Gesellschaft für Freiheitsrechte, GFF) and IT industry association Bitkom warn of major risks. In a joint paper, they call for binding rules governing how the government handles IT security vulnerabilities.

Lawmakers must prevent agencies from developing an interest in keeping vulnerabilities open or delaying their remediation, Bitkom and GFF say. Every known but unpatched security vulnerability puts citizens, companies, government agencies and critical infrastructure at risk. Criminals or foreign intelligence services could also exploit them. That puts not only the security of digital systems at stake, but also the fundamental right to the confidentiality and integrity of IT systems, the paper says.

GFF and Bitkom make three key demands for how government agencies handle vulnerabilities they discover. Fixing them must take priority. Responsible disclosure and protecting affected systems should come first. When intelligence agencies discover a vulnerability, that must not automatically lead them to exploit it operationally or delay its remediation.

The authors therefore call for vulnerability management to be enshrined in law. If a vulnerability is to remain open in exceptional cases, that decision must follow a strict, binding and structured assessment. The risks of further spread and exploitation must be weighed against the specific operational benefit. The process needs clearly defined criteria, mandatory risk-mitigation measures and effective oversight of decisions. Legal safeguards must not be circumvented or weakened through contracts or cooperation with third parties.

Protect trusted reporting channels

Another focus of the paper is protecting confidential reporting channels. Security researchers, companies and institutions must be able to trust that information about vulnerabilities they share with Germany’s Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI) as part of its reporting and coordination duties will remain protected. GFF and Bitkom therefore call for a legal ban on sharing such information with intelligence agencies under any circumstances.

If that trust were damaged, security researchers and companies could be discouraged from reporting vulnerabilities they discover. Critical vulnerabilities might then go unreported instead of being brought to the responsible authorities for remediation. That could weaken IT security overall. In 2024, the traffic-light coalition had agreed to require federal agencies to report known security vulnerabilities to the BSI. But the initiative did not make it through the Bundestag.

Germany’s Federal Ministry of the Interior recently wanted to require the BSI to send the BND security-related findings, including vulnerabilities not yet widely known, during the early stages of an attack. Bitkom and GFF argue that regulated vulnerability management is necessary not only for resilient digital infrastructure but also as a matter of constitutional law. Germany’s Federal Constitutional Court has emphasized the state’s duty to protect fundamental rights.

(vbr)