eco – Association of the Internet Industry: Cybersecurity Act Threatens to Normalise State Intervention in Network Infrastructures

Berlin, 2 March 2026 - The draft bill for an Act to Strengthen cybersecurity intervenes deeply in the architecture and control logic of digital infrastructures and fundamentally shifts the understanding of cybersecurity. eco - Association of the Internet Industry strongly criticises this paradigm shift.

"Under the proposed legislation, cybersecurity is no longer understood primarily as an issue of protection, prevention and resilience, but as a justification for state intervention in networks and systems. This shift is highly problematic from a regulatory policy perspective," explains Klaus Landefeld, Board Member of eco - Association of the Internet Industry.

Far-reaching expansion of powers for security authorities

The draft provides that three federal actors - the German Federal Criminal Police Office (BKA), the Federal Police and the German Federal Office for Information Security (BSI) - are to be granted, in part, new and significantly expanded powers to issue orders and intervene. This entails a substantial shift in competences and power. If several security authorities are granted extensive parallel intervention rights in digital infrastructures, questions arise regarding clear delineations of responsibilities and effective rule-of-law oversight mechanisms.

eco takes a particularly critical view of the fact that the proposed measures go far beyond the previous practice of shutting down clearly malicious infrastructure. The draft not only permits blocking, but explicitly also the redirection or prevention of data traffic. In addition, the German Federal Criminal Police Office (BKA) and the Federal Police are to be authorised in future to collect, delete or even alter data in IT systems.

"This represents a qualitatively new intervention in the integrity of information technology systems. A threshold is being crossed here: it is no longer merely about averting danger at the periphery, but about active intervention in ongoing communication and data processing operations," warns Landefeld.

Embedding of far-reaching network control instruments

The explanatory memorandum to the draft bill explicitly describes that data traffic may be redirected to police-controlled systems - so-called sinkholes. State-ordered traffic redirection thus creates a technical infrastructure that is structurally capable of centrally influencing communication flows. Instruments such as DNS and routing interventions as well as state-ordered traffic redirection are building blocks that have so far been discussed primarily in the context of censorship and control regimes.

"If we normalise such mechanisms in legislation, we establish instruments that could structurally be misused for content control and at the same time lose credibility in the international debate on digital freedom rights," says Landefeld. "To put it plainly: we have so far strongly criticised precisely the same mechanisms and powers to issue orders, with identical, low thresholds for justification, as legislation in Russia or Turkey at all levels. Is this now to become the new normal here in Germany as well?"

In conclusion, eco - Association of the Internet Industry makes clear that cybersecurity must not become a gateway for state network control and system manipulation. The objective must be to strengthen the resilience of digital infrastructures - not to establish far-reaching state control and intervention powers on the Internet. The legislator is now called upon to fundamentally revise the draft and to introduce clear guardrails that are sustainable under the rule of law.