Admittedly, the Military Counter-Intelligence Service (MAD) is not the focus of the government’s draft bill on the reform of the intelligence services. However, this is less due to its small size – it is the smallest of the three German intelligence services – and more to the fact that a fundamental reform of the Military Counter-Intelligence Service Act (MADG) came into force on 16 January 2026 (see Federal Law Gazette 2026 I No. 7, p. 37).
Nevertheless, the draft also contains substantial amendments to the MADG which, from the perspective of those affected, give cause for criticism.
Admittedly, the Military Counter-Intelligence Service (MAD) is not the focus of the government’s draft bill on the reform of the intelligence services. However, this is due less to its small size – it is the smallest of the three German intelligence services – and more to the fact that a fundamental reform of the Military Counter-Intelligence Service Act (MADG) came into force on 16 January 2026 (see Federal Law Gazette 2026 I No. 7, p. 37).
Nevertheless, the draft also contains substantial amendments to the MADG which, from the perspective of those affected, give cause for criticism.
I. New provisions on the surveillance of correspondence, postal and telecommunications communications in Section 18 of the draft MADG
A key amendment to the MADG concerns the introduction of a separate regulatory framework governing the surveillance of correspondence, postal and telecommunications communications and the processing of personal data obtained therefrom. Until now, the provisions of the G 10 Act (G 10) have applied to this area by virtue of a reference in Section 18 of the MADG. This area is now to be regulated by the completely amended Section 18 of the MADG-E. The newly inserted Section 18a of the MADG-E relates directly and exclusively to the obligations of providers of letter, postal and telecommunications services to cooperate, but not to the conditions for surveillance measures or their intensity.
The fact that Section 18 of the MADG-E is now intended to replace the reference to the G 10 with a separate provision within the MADG is to be welcomed for reasons of legal clarity. However, Section 18 of the MADG-E does not, in its entirety, meet appropriate safeguards. A distinction must be made here between the general surveillance measures under Section 18(1) and (2) of the MADG-E (1.) and the provision on Trojan horses in Section 18(3) of the MADG-E (2.).
1. General surveillance measures under Section 18(1) and (2) of the MADG-E
Pursuant to Section 18(1), first sentence, of the MADG-E, the opening of letters and postal items, as well as the monitoring and recording of telecommunications traffic, is permitted if the conditions set out in Section 8(3) of the MADG are met. Accordingly, on the basis of factual evidence, the use of the intelligence service measure must be necessary to investigate persons who carry out activities – by this, pursuant to Section 2(1), first sentence, No. 2 MADG, this refers to activities that endanger security or constitute espionage on behalf of a foreign power, in particular sabotage or espionage – or who, in pursuit of their objectives, are preparing or committing criminal offences punishable by a maximum term of imprisonment of at least five years. The threshold for intervention here therefore does not lie in the fact that the person is actually suspected of a serious criminal offence, sabotage or espionage, but rather that, from the MAD’s perspective, the intervention is necessary to investigate suspicious persons. However, the surveillance of telecommunications, as a far-reaching measure, will generally be the very means by which information can most easily be obtained. Accordingly, the requirement is likely to be met on a regular basis from the MAD’s perspective, which is granted a margin of discretion in this regard. This therefore does not present a genuine obstacle.
This discretion of the MAD is restricted by Section 18(2) of the MADG-E, according to which measures under paragraph 1 may be directed solely against specific individuals. For this, it is at least necessary that, in accordance with No. 2, they are directed at the target person – who, pursuant to Section 7(1) of the MADG, is defined as a person in respect of whom there are factual indications that they are pursuing endeavours or carrying out activities, or are actively supporting such endeavours or activities – receives or passes on specific communications or those originating from the target person; or, in accordance with No. 3, that the target person uses their connections. However, the very act of receiving and passing on communications may, according to the wording of the provision, fall within the scope of any person who communicates with the target person – even if only for a short period – without precise knowledge of the target person’s actual activities. This results in an extremely broad group of individuals who may be affected by state communications surveillance measures. These extremely low thresholds for intervention are at odds with the considerable weight of such a surveillance intrusion into the secrecy of telecommunications under Article 10(1) of the Basic Law.
In any event, it would be more appropriate to introduce an additional cognitive or temporal criterion rather than the blanket inclusion of all possible communication partners of target persons. Accordingly, it should be a requirement that the person concerned maintains a long-term communication relationship with the target person or is aware of the target person’s activities or intentions.
2. Provision on Trojan horses in Section 18(3) of the MADG-E
The situation is different with regard to the provision on Trojan horses in Section 18(3) of the MADG-E, which replaces Section 11(1a) of the G 10.
Admittedly, the monitoring and recording of ongoing communications under the first sentence infringes upon the secrecy of telecommunications under Article 10(1) of the Basic Law, and the monitoring of stored communications under the second sentence infringes upon the fundamental right to information technology under Article 2(1) of the Basic Law in conjunction with Article 1(1) of the Basic Law. There are therefore significant infringements of fundamental rights. However, the use of the Trojan must be expressly directed only against ‘an information technology system used by the target person’. The scope is thus strictly limited to those persons suspected of posing an immediate threat. Section 18(3) of the MADG-E thus distinguishes itself, in a positive sense, from Section 37 of the BNDG-E, which permits the use of Trojans against any person within very broad limits. This general scope is not reflected in Section 18(3) of the MADG-E. The clear limitation of this highly intrusive measure is very much to be welcomed.
II. Protection of persons bound by professional secrecy who are entitled to refuse to give evidence under Section 29 MADG
The protection of persons bound by professional secrecy who are entitled to refuse to give evidence under Section 29 of the MADG is not, however, subject to any new provisions as part of the current reform. Nevertheless, it is noteworthy that, in contrast to Section 22 of the BNDG-E and Section 32 of the BVerfSchG-E, Section 29 of the MADG is not undergoing any significant changes. It is true that Section 29 of the MADG was also only recently introduced as part of the reform that came into force on 16 January 2026. However, according to the explanatory memorandum at the time, the exception under Section 29(4) of the MADG, which is decisive for the actual protection afforded, is intended to correspond to the previous ‘entanglement’ provision in Section 3b(4) of G 10 (despite the different wording) (Federal Government’s draft bill, Bundestag printed paper 21/1846 of 29 September 2025, p. 95).
The erosion of the confidential relationships of those bound by professional secrecy, brought about by Section 22 of the BNDG Bill and Section 32 of the BVerfSchG Bill, is thus not continued in the MADG. The justified criticism of Section 22 of the draft BNDG, which stems from the significant broadening of the scope of the exception compared with the preceding provision, Section 3b(4) of G 10 (see the statement by the German Bar Association on the draft law reforming intelligence service legislation – hereinafter ‘DAV-SN’ – B.IV.1., p. 20 ff.), cannot therefore be applied to Section 29(4) of the MADG.
III. Prior review under Section 22 MADG-E
By contrast, the prior review of surveillance measures under Section 18 MADG is subject to a new provision which fails to introduce an effective prior judicial review.
Currently, due to the reference in Section 18 MADG to the G 10 Act, pursuant to Section 15(6) of the G 10 Act, the G 10 Commission is responsible for assessing the lawfulness and necessity of these measures. Section 18 of the MADG, by its wording, excludes a court order under Section 22(1), first sentence, of the MADG – which, pursuant to Section 45(1), first sentence, No. 1, of the MADG, is issued by the Cologne Local Court – ‘without prejudice to Section 22’ – does not, for the time being, preclude such an order. However, Section 18 of the MADG itself does not refer to Section 8(3) of the MADG, which would be necessary to trigger the main scenario for judicial review under Section 22(1), first sentence, No. 1 of the MADG. That aside, a judicial review pursuant to Section 22(1), first sentence, No. 5 is required in the event of an infringement of professional secrecy protected under Section 29(2) of the MADG. Accordingly, there has so far been at least some form of prior judicial review.
The new Section 22(1), first sentence, No. 1 of the MADG-E, which exempts measures under Section 18 of the MADG-E from prior judicial review by reference to Section 8(3) of the MADG, broadly maintains this situation. However, pursuant to Section 22(1a) of the MADG Bill, the prior judicial review of measures under Section 18 of the MADG by the G 10 Commission is replaced by prior review by the quasi-judicial supervisory body of the Independent Supervisory Council (UKRat) pursuant to Section 27(3)(3) of the UKRatG.
The draft bill fails here to establish genuine judicial review for the highly intrusive measures under Section 18 of the MADG-E. Contrary to what the designation as a quasi-judicial supervisory body might suggest, the review by the UKRat does not involve a quasi-judicial procedure: Those affected are given no opportunity to represent their interests in these proceedings, not even – should one assume that notification to those affected is excluded on the grounds of special confidentiality interests – through independent representation of their interests before the supervisory body. Reference is made here to the DAV-SN under B.III.1. on p. 16 ff., which discusses this in greater depth.
IV. Notification obligations under Section 23 MADG-E
The points of criticism identified in relation to the prior check under Section 22 MADG-E can be applied to the notification obligations under Section 23 MADG-E. Under the new provisions of paragraphs 3 and 4, the UKRat is responsible for deferring or excluding notification to the data subject. Previously, this fell within the remit of the G 10 Commission under Section 12 G 10.
V. Data protection supervision under Section 46 of the MADG-E
The revised provisions on data protection supervision by the MAD are also met with a lack of understanding.
To date, pursuant to Section 46(1), first sentence, of the MADG, the Federal Commissioner for Data Protection and Freedom of Information (BfDI) has been responsible for monitoring compliance with data protection regulations. Under the second sentence, the G 10 Commission supersedes the BfDI within the scope of its own remit. Under Section 46(1), second and third sentences, of the MADG-E, the UKRatG is now to be responsible, within the framework of administrative supervision under Section 32(1)(1) of the UKRatG-E, for supervising the processing of personal data by the MAD, insofar as such data is collected through measures under Section 18 of the MADG-E. The G 10 Commission is therefore replaced by the UKRat. In this respect, the supervision of the MAD is brought into line with that of the BND and the BfV.
The key change – apart from the replacement of the G 10 Commission by the UKRat – lies in the fact that oversight by the BfDI is completely abolished by Section 46(1), second and third sentences, of the MADG-E in relation to surveillance under Section 18 of the MADG-E. Admittedly, the BfDI had previously had no jurisdiction where the G 10 Commission also had jurisdiction. The latter was, after all, responsible for overseeing measures under the G 10. However, in the case of oversight of measures under Section 18 of the MADG-E, there is now no longer any provision for a possible request for assistance from the UKRat to the BfDI. Previously, such assistance to the G 10 Commission by the BfDI was possible. The BfDI therefore exercises its supervisory function under the MADG solely outside the scope of Section 18 of the MADG-E.
The removal of any competence of the BfDI in the area of the surveillance of letter, postal and telecommunications traffic in favour of the UKRat raises considerable concerns, which relate primarily to the structure of the UKRat. This concerns two circumstances in particular. Firstly, the UKRat lacks, in Sections 33 and 34 of the UKRatG-E, an explicit power to remedy the identified breach. The legislature must therefore face the criticism that it has created a ‘toothless tiger’ in the form of this administrative supervisory body (for a far more in-depth discussion of this, see the comments by the DAV-SN under B.III.2. on p. 17 ff.). Furthermore, the removal of the BfDI means that the legal and technical expertise it had built up remains untapped. This is not compensated for by the UKRat, which appears to have been understaffed and lacking in specialist expertise (for a far more detailed discussion, see the comments by the DAV-SN under B.III.4. on p. 19 ff.).
VI. Conclusion
Overall, the assessment of the new MADG is more lenient than that of the BNDG-E and the BVerfSchG-E. Whilst the Trojan horse provision in Section 18(3) of the MADG-E contains a clear limitation on interference by restricting it to the target person’s information technology systems, the general surveillance measures under Section 18(1) and (2) of the MADG-E raise significant concerns regarding fundamental rights, particularly due to the far-reaching inclusion of communication partners. The transfer of data protection oversight to the UKRat also raises questions about the effectiveness of such oversight, given the UKRat’s lack of powers to remedy breaches and the abandonment of the BfDI’s involvement in the area of telecommunications surveillance. On the other hand, however, the retention of the standard of protection for persons bound by professional secrecy under Section 29 of the MADG is to be welcomed.