The Bundestag passed a law to strengthen cybersecurity on 12 November 2026. It provides additional powers for the Federal Office for Information Security, the Bundeskriminalamt and the Federal Police The governing coalition parties, the CDU/CSU and SPD, voted in favour of the federal government’s bill; the AfD, Greens and Left Party voted against it. of the Federal Government, published on the same day. They show both increased participation in the The governing coalition parties, the CDU/CSU and SPD, voted in favour of the federal government’s bill; the AfD, Greens and Left Party voted against it.
With the decision, the debate shifted from whether cyber defence should be strengthened to the scope of the state’s powers to intervene. Under the government’s bill, the federal police forces would be able, among other things, to redirect, restrict or block data traffic. It also provides powers to read, delete or alter data associated with a threat on information technology systems. Such measures are intended to help defend against cyberattacks.
The Federal Office for Information Security is to be better able to protect the federal administration’s information technology in particular, and to improve its intelligence picture. According to the federal government, preventive measures in its own systems alone are not enough to deal with large-scale attacks. It argues that additional powers to intervene could avert or limit serious consequential damage.
The federal government had already approved the bill in cabinet on 27 May 2026. The Bundestag held its first reading on 25 June; on 5 October, the Committee on Internal Affairs heard evidence from experts. According to the Bundestag, the need for stronger cyber defence was not disputed. At the same time, the proposal attracted criticism.
Interventions in other people’s information technology systems are particularly contentious. The Left Party opposed so-called hackbacks and offensive cyber defence in a motion of its own. It called for plans that could allow the Federal Criminal Police Office and Federal Police to intervene without the knowledge of those affected to be dropped. The party raised constitutional concerns and criticised what it considered inadequate judicial and parliamentary oversight. The Bundestag rejected the motion.
The vote does not mean that the new powers are already in force. The Bundestag adopted the bill in the version recommended by the Committee on Internal Affairs; the The positions now put forward are initially demands or proposals from individual states, not measures that have already been approved. must also be considered as part of the further legislative process. Whether and when individual provisions come into force will only become clear once the process is complete and the law has been promulgated.
The parliament also adopted a companion resolution. It calls on the federal government to continue developing its cybersecurity strategy and to expand the National Cyber Defence Centre as a platform for cooperation between government agencies. Unlike the law, the resolution is a political request to the government. The practical impact of the new rules will depend on how the relevant authorities exercise their powers and what safeguards are in place.
Editor: Phillipe Schmidt-Araguin (Article created with AI assistance).