German Interior Ministry Draft Law Expands BND and BfV Cyber Operations, Reduces BSI Role (heise.de)

• 648-page Interior Ministry draft reform of intelligence law
• BND and BfV authorized for hackbacks and zero-day exploitation
• BSI must automatically share vulnerabilities, even unpatched
• Costs: BND €40M one-time, BfV €94M for IT restructuring
• Oversight via UKRat but with limited effectiveness

"Germany's Interior Ministry has drafted a 648-page law reform that would grant the BND and BfV extensive hacking powers, including the use of zero-day exploits and active hackbacks. The BSI would be required to automatically share vulnerability information with intelligence agencies, even before patches are available. Critics warn of a paradigm shift toward offensive cyber capabilities and a degradation of the BSI to a supplier. Costs are estimated at €40 million one-time for BND and €94 million for BfV."