Long handcuffed by court rulings, complex oversight arrangements, and stringent data-protection rules, the Bundesnachrichtendienst (BND) has tended to operate as a simple, if reasonably effective, intelligence-gathering and analysis outfit. In a country where the Gestapo and Stasi cast long shadows, strict limits have been placed on the operations of the secret services. The original BND Act, written in 1990, was in essence a data-protection rule book. “It’s very slow, and very bureaucratic,” says a European former security official of the BND.
The BND must cease monitoring once a target once enters Germany. Foreigners abroad enjoy the same privacy protections as someone in Germany, curtailing the BND’s ability to tap phones or monitor data flows. Personal data must be redacted if the BND is to pass information to other German agencies. These “totally absurd” restrictions do not apply in other countries, says Wolfgang Krieger, a historian who has written extensively on the BND. They limit the trust placed in the BND by partner agencies—and create vulnerabilities foes can exploit. “Putin has no rules, and we respond with our Rechtsstaat [constitutional state],” sighs Marc Henrichmann, an mp on the Bundestag’s intelligence-oversight panel.