With Zero-Days: BND and BfV to Become "Super Intelligence Agencies"

Contents

The Federal Ministry of the Interior (BMI) is planning a turning point in Germany's security architecture. A 648-page draft bill to reform intelligence service law provides for a fundamental reordering of the previous legal powers of the Federal Office for the Protection of the Constitution (BfV) and the Federal Intelligence Service (BND). It also addresses the interconnections between the two institutions.

Behind this lies a comprehensive digital upgrade: domestic and foreign intelligence services are to become independent actors in the cyber-operational field with expanded hacking powers. At the same time, the Federal Office for Information Security (BSI) threatens to become a digital supplier for the spies.

The Ministry of the Interior justifies its reform plans with a sharpened threat situation. The operational capabilities of the services must be adapted to the digital world. A new early warning system and the expansion of covert online surveillance are intended to close “security gaps”.

Critics see this as the familiar pattern of security policy legislation: far-reaching surveillance powers are presented as the only possible answer to a permanent threat, while digital civil liberties come under further pressure.

Basis for Hackbacks and Zero-Day Exploits

The change in course is evident, for example, in the “active” protective measures. In the future, agents will be allowed to intervene in ongoing cyberattacks under certain conditions if other authorities, such as the police, cannot act in time.

The BMI cites the case where a service has already infiltrated an attacker's infrastructure and discovered malware there. Then it should be allowed to initiate countermeasures immediately instead of letting the attack continue. Opponents speak of a legal basis for state-sponsored hackbacks, blurring the line between defensive reconnaissance and offensive countermeasures.

The new regulation of the relationship between the BSI and the BND is of particular importance. The planned Paragraph 10, Section 2 of the BND Act is intended to re-regulate the transmission obligations of public bodies. The BMI considers the hurdle set in the BSI Act for transmission to the BND only in cases of “significant importance for the Federal Republic” to be too high.

In the future, the BSI is to transmit security-relevant findings to the BND at an early stage of an attack and sometimes automatically. This is justified by the fact that the foreign intelligence service, thanks to its controversial strategic signals intelligence, can place individual incidents in a global context and thus recognize dangers earlier.

Vulnerability Management for Spies

The handling of IT vulnerabilities is particularly sensitive here. According to the draft, the BSI is to pass on findings about the technical functioning of discovered security vulnerabilities to the BND immediately and as automatically as possible. The BMI states that this would create a significant operational advantage, especially with zero-days – security vulnerabilities without an available manufacturer patch.

The justification for the law states that the period until a vulnerability is closed can be used for “important work” by the BND. Time-consuming processes would significantly reduce its applicability.

This would put the BSI in a target conflict that is difficult to resolve. Instead of closing security vulnerabilities as quickly as possible, as the traffic light coalition planned, the time until an update is provided is deliberately factored in for intelligence purposes.

Limited Oversight

As compensation for the expanded powers, Alexander Dobrindt's (CSU) ministry points to stronger rule-of-law control. The responsibilities are to be consolidated within the Independent Control Council (UKRat), which could in the future exercise court-like prior oversight. However, its possibilities would remain limited.

Financially, the initiative also marks a significant expansion of cyber capabilities. For the BND, one-time costs of at least 40 million euros and annual costs of 35 million euros are planned. For the Office for the Protection of the Constitution, around 94 million euros are allocated for the IT structure conversion and operating expenses of approximately 269 million euros.

Parallel to the rearmament, the original protective function of the BSI towards the state, economy, and citizens would recede into the background. The draft law is intended to pave the way for two significantly more powerful cyber intelligence services, whose far-reaching interventions would be only limitedly verifiable. The draft must next go through the Federal Cabinet. The Chancellery already has similar considerations.

(nen)