In my July analysis of the 691-page Referentenentwurf I called § 10(2) BNDG the wild west’s gun dealer: the BSI, the federal agency whose statutory mission is getting vulnerabilities patched, conscripted by law into a mandatory intake feeding the BND raw and unprocessed vulnerabilities, ohne vorherige Aufarbeitung, including 0-days.
That provision is now being reported as dead.
Florian Flade, who documented the duty on his Verschlusssache blog on July 13, reported this morning from @FlorianFlade on the Nazi Swastika-adorned platform that the intelligence bills go to cabinet this week and that the BND draft got one change shortly beforehand:
Die Verpflichtung des BSI künftig IT-Schwachstellen an den BND melden zu müssen, ist raus.
EN: (The obligation for the BSI to report IT vulnerabilities to the BND in future is out.)
The Kabinettsfassung itself is not yet published. Until the BMI posts it, I’m basically reposting what Flade is reporting. The document itself still has to be the proof.
The Paper Trail
How the provision died was in the brief public record. The BMI published the draft on July 5 and Sven Herpig flagged the transmission duty within days. Flade documented it by July 13. Then the Verbändeanhörung produced its Stellungnahmen, and the duty was their concentrated flashpoint. The AG Kritis warned that the provision would degrade IT security rather than strengthen it, and that operators of critical infrastructure would have to ask “wie vertrauenswürdig das BSI dann noch für sie sein kann” if their most sensitive incident data flowed onward to an intelligence service.
A public question on abgeordnetenwatch records Konstantin von Notz characterizing the duty as careless and incompatible with the Bundesverfassungsgericht’s requirements.
Finally, per Flade, deletion arrived before the draft went to the cabinet.
Deletion is just deletion
Removing the feed is not something bigger, like a full equities process. Herpig’s reporting had the Kanzleramt spending eight years blocking a statutory Schwachstellenmanagement on the BND’s behalf. Deleting the one-way attack feed returns Germany into that stated vacuum. It does not resolve it because no disclosure duty replaced the transmission duty. The BND’s use of vulnerabilities for foreign collection continues on its existing legal basis; what changed, on current reporting, is only that the BSI is no longer statutorily drafted as the supplier. The Begründung’s own logic, that remediation time is the harvest window, was withdrawn and left unanswered.
Moving ahead
Flade’s characterization is that there was a small but relevant change. On current reporting, everything else in my July analysis goes to cabinet as it has been drafted.
The automated countermeasures are still being justified with the claim that human review adds no relevant quality assurance. That’s nonsense.
The § 60 deception charter that writes state Desinformation into statute under the label Schutzmaßnahme. The abolition of the G10-Kommission. The 30:1 ratio of capability spending to control spending. All of it remains concerning for the reasons already stated.
Look at the exact provision that died and why. The transmission duty had a concentrated constituency with something specific to lose: KRITIS operators with incident data, security researchers with disclosure decisions, the BSI’s own intake pipeline. Those parties write Stellungnahmen. The provisions that have survived distribute costs differently, from the economics view of vulnerability research.
The G10-Kommission’s abolition costs the general public an oversight body; the deception charter costs the targets of informant networks; the automation clause costs whoever is standing on shared infrastructure when the machine fires. None of those constituencies files sector comments. This is not a claim about anyone’s intent. It is how comment processes filter: they answer the objections that arrive organized, funded, and on particular letterhead.
The Next Window
The Verbändeanhörung is over. From cabinet the package moves to the Bundestag, where provisions are added and removed by Änderungsantrag in committee, with no second comment round required by procedure. A provision deleted before cabinet is the cheapest kind to restore, and it would return at the stage with the least public exposure.
My July post argued this draft builds instruments that survive handover between governments. We see here the miniature of the same problem: instruments surviving handover between drafting stages, where each stage has less scrutiny than the last. The Kabinettsfassung will confirm or correct all of this; the Ausschussfassung, still months out, will show whether the gun dealer’s office reopens.