The Internet industry calls for rule-of-law safeguards and a focus on resilient cyber defence rather than active interference in communications networks
Ahead of today’s Federal Cabinet meeting on the planned Cybersecurity Act, eco – Association of the Internet Industry warns against a dangerous expansion of state intervention powers in the digital sphere. From the perspective of the Internet industry, the draft marks a profound shift in the understanding of state cyber defence – away from protection and resilience, and towards active intervention in networks, systems and data flows.
State intervention in digital infrastructures would be massively expanded
eco Board Member Klaus Landefeld states: “This act would permit interventions of the kind we have hitherto associated primarily with authoritarian states. The state could deploy malware, manipulate data streams or actively influence communication channels.”
Under certain conditions, the draft act provides for far-reaching technical measures. These include, amongst other things, interventions in IT systems, the alteration or deletion of data, and the rerouting or interruption of data traffic.
A critical precedent with long-term consequences
From eco’s perspective, the draft creates powers that extend far beyond the current security-policy context and would also be available to future governments.
“The legislator is creating instruments here with considerable potential for abuse. No one can guarantee how such powers might be used in the future,” warns Landefeld.
Particularly in democratic constitutional states, it is essential to prevent the establishment of technical intervention measures that make communication infrastructures structurally susceptible to manipulation.
Cybersecurity must not become a justification for active network control
eco is especially critical of the security policy paradigm shift reflected in the draft. Instead of focusing on prevention, cooperation and the resilience of digital infrastructure, the legislation establishes active intervention as a new instrument of state cyber defence.
These measures include, for example, interference with routing and DNS structures or measures to control data traffic. From the perspective of the Internet industry, this creates an infrastructure capable of centrally influencing digital communication.
eco calls for clear rule-of-law limitations
In its statement, eco therefore calls in particular for:
- clear statutory responsibilities and effective oversight mechanisms
- a narrow and proportionate limitation of state powers of intervention
- priority for defensive and resilience-enhancing measures
- closer cooperation between the state and the Internet industry
eco is particularly critical of so-called “hack-backs” and other offensive countermeasures in cyberspace.
“Offensive interventions in cyberspace are technically high-risk, legally problematic and dangerous in terms of foreign policy,” says Landefeld.
eco also takes a critical view of the discussion around state-managed vulnerability management. Given highly dynamic, AI-supported attack and defence scenarios, such approaches are no longer fit for purpose.
Strengthen resilience rather than enabling network manipulation
Furthermore, eco warns of overblocking effects, unclear obligations for providers, and potential market distortions arising from parallel state structures.
From the association’s perspective, effective cybersecurity primarily requires resilient infrastructure, trust-based cooperation and technically robust protective measures – not state intervention in communications networks.
The Federal Cabinet is therefore called upon to substantially revise the draft and to clearly enshrine clear rule-of-law, technical, and proportionate limitations in explicit terms.
For the full eco statement (in German)
