DefenseHub · Friday · Intelligence · October 23, 2026
Germany wants its intelligence services to do more to stop attacks linked to Russia. At an October 5 parliamentary hearing, BND chief Martin Jäger warned that Moscow's campaign against Germany was growing more dangerous. Berlin has backed a bill to expand intelligence powers, including limited action to stop an imminent cyberattack. The government describes these powers in a draft bill. A separate espionage investigation involving former BND chief August Hanning shows why the debate also needs to address the protection of secrets inside the service.
What We Know
Jäger told the Bundestag's intelligence oversight committee that Russia posed Germany's most serious security threat. The parliament's account of the October 5 hearing records his warning that Russian intelligence activity was becoming more aggressive. Sinan Selen, head of the domestic intelligence service, the BfV, also described threats to transport, defense companies and military infrastructure. These public assessments explain why Berlin is arguing for stronger services.
The government's FAQ, published September 16, describes a bill that would allow tightly limited intervention when other agencies could not counter a threat as effectively. Its example is shutting down a foreign server from which a cyberattack is imminent. It also proposes changes to data retention, AI use and oversight. The Independent Control Council would approve especially intrusive measures in advance, while parliamentary oversight would remain. Parliament must still settle the final legal framework.
Federal prosecutors announced Hanning's arrest on October 6. He led the BND from 1998 to 2005. Manfred D., Hanning's former office manager, held that role for successive BND presidents from March 2012 to March 2026. Prosecutors allege he supplied Hanning with nearly 2,000 internal documents for private consulting work. Investigators trace the alleged arrangement to spring 2010 and the documents identified so far to June 2022. The case therefore concerns access by someone working inside the agency as well as the conduct of a former chief.
Prosecutors say Hanning used classified material to prepare an analysis for an officer of a foreign intelligence service; whether it reached that recipient remains unestablished. They also allege that he supplied political information to a contact in another service. The October 6 statement names neither country. Hanning denies the allegations, according to L'Express reporting excerpted by Ifri. Those allegations remain subject to investigation and court proceedings. The cited sources do not link the alleged recipients to Russia's campaign.
Operational Context
The public debate brings together two tasks that require different work. Preventing a hostile cyberattack requires finding its source, deciding who is responsible and choosing a lawful way to stop it. Protecting internal reports requires controlling access, checking how documents are used and investigating suspected misuse. A service can improve at one task while remaining weak at the other. Giving it a wider remit creates no automatic guarantee that its internal controls will improve. Each part needs its own evidence and its own review.
The government's server example gives the reform debate a concrete starting point. I would expect a workable approval process to establish why intervention is necessary and which agency should carry it out. Parliamentary scrutiny should examine those conditions alongside the proposed approval process. A power written broadly enough to cover many situations can also leave difficult decisions to the officials using it. The useful questions concern who makes those decisions, what records they keep and how a disputed operation can be reviewed.
The Hanning allegations raise a different set of questions about access and trust. According to prosecutors, Manfred D. held a job that gave him access to sensitive information for senior decision-makers. Reviewing a former chief's consulting work would address only part of the alleged route by which documents left the agency. An examination would also need to establish how the alleged supplier used his access and which controls applied. The published accusations describe that route, but they do not identify which specific safeguard failed.
L'Express describes the case as a weakness at the top of the BND. That assessment rests on allegations still to be tested in court. It puts attention on the handling of sensitive reports by trusted officials. The investigation should establish how documents were handled. The reform debate should examine the proposed powers and their safeguards.
My Read
A useful reform should give officials a clear way to respond to a specific threat. The government's example of an imminent cyberattack is specific enough to support a useful debate: when can intervention prevent harm, and which authority is best placed to act? Describing the reform simply as permission for more aggressive spying leaves those questions unanswered. The final legal text needs to define the trigger, the permitted response and the route for approval. Those details will determine what the services can actually do.
I would put equal weight on the ability to handle information safely. If investigators establish that a serving official supplied internal reports to a former chief, the review must follow that route through the agency. It should ask who could access the material, how access was checked and what prompted investigation. The fact that a recipient had left the BND years earlier would offer little reassurance about the handling of documents still inside it. The alleged supplier's position makes this a question about the service's own controls.
My concern is that expanding powers can be easier to announce than improving the daily work needed to use them well. Officials using a new power still need reliable intelligence and a secure way to handle it. An internal review should test how security rules work in daily practice. That gives parliament a practical reason to examine both the case for intervention and the safeguards around sensitive work.
For the reform, I would look for clear conditions on intervention and an approval system that officials can use in a crisis. For the Hanning case, I would look for findings about the alleged document transfers and any resulting changes to access controls. Some operational details will remain secret. Public scrutiny can still test whether the legal responsibilities are clear and whether identified failures lead to changes. Parliament should be able to check whether officials followed the approval rules, even when the operational record stays confidential.
What to Watch
The bill's progress through parliament, its final wording and its entry-into-force provisions.
The conditions for active intervention, including who authorizes an operation and who reviews it afterward.
Court decisions and verified findings about the alleged document transfers involving Hanning and Manfred D.
Any changes to BND access controls announced in response to the investigation.
Recommended Sources
German Bundestag, October 5: public hearing of the intelligence oversight committee
German government, September 16: explanation of the intelligence reform bill
Federal Public Prosecutor, October 6: allegations against Hanning and Manfred D.
L'Express, excerpted by Ifri: reporting and analysis of the Hanning investigation
Sources & Methodology
This briefing is based on open-source reporting, official releases, procurement documents, defense-industry disclosures, and specialist analysis available at publication time. Claims involving battlefield effects, classified programs, or active operations are treated cautiously unless corroborated by multiple independent sources.
DefenseHub prioritizes primary sources where available, including official releases, budget and procurement records, legislative documents, technical disclosures, institutional research, and reputable reporting.
Corrections or source clarifications can be sent through the DefenseHub contact page.
R. Planche · DefenseHub
What I find interesting here is the tension between giving intelligence agencies more room to respond to threats and ensuring that their expanded powers remain accountable. If the threat environment includes sabotage, cyberattacks and covert operations, a purely reactive intelligence service may struggle to keep up. But the ability to act more proactively makes oversight even more important, not less. Germany's challenge seems to be finding a framework that allows effective action without weakening the safeguards that distinguish democratic intelligence services from the systems they are trying to counter.