It sounds like a contradiction — and it is one. One government agency, the BSI, is supposed to make sure that security holes in software get closed. Other government bodies have a tangible interest in keeping exactly those same holes open — to use them for surveillance. Welcome to German cybersecurity policy.
The BSI: actually on your side
The Federal Office for Information Security (BSI) is the defensive agency. Its job: detect vulnerabilities, report them, close them. The BSI's leadership regularly stresses that holes that come to light are closed as quickly as possible. So far, so good.
The conflict of interest
The problem lies in the structure: the BSI answers to the Federal Ministry of the Interior — the same ministry that also oversees the security and intelligence services (the Verfassungsschutz and the BKA). And they have the opposite interest: they benefit from insecure IT, because they need vulnerabilities for their investigations and surveillance. Critics — among them netzpolitik.org, the Gesellschaft für Informatik and the Stiftung Neue Verantwortung — have for that reason been calling for a genuinely independent BSI for years. So far only a "more autonomous" agency is planned; real independence is nowhere in sight.
ZITiS and the government trojans
The offensive side has a name: ZITiS, the "Central Office for Information Technology in the Security Sphere." It develops and procures tools for state hacking — think government trojans (source telecommunications interception and remote device searches). Whether the state deliberately buys up zero-day vulnerabilities for this has been disputed for years; reports suggest that authorities stockpile such exploits. One thing is clear: anyone who wants to get a trojan onto a device needs an open door — that is, an unpatched hole.
Why this is a problem for everyone
The crucial point: there is no security hole that only "the good guys" can use. If the state deliberately keeps a hole open, the very same hole can be found and exploited by criminals, foreign intelligence services or blackmailers. Every withheld vulnerability is a risk to hospitals, companies, journalists and ordinary users alike. That is precisely what undermines the BSI's actual mission.
The never-ending dispute
To be fair: investigators and intelligence services argue that they need these capabilities against serious crime and terrorism. That is why policymakers have been wrestling for years over transparent vulnerability management that weighs the benefit to the authorities against the risk to the public. Several coalition agreements in a row promised exactly such a process, an independent BSI and a renunciation of "hackbacks." To date, none of it has been cast into binding law.
What this means for you
As long as the state leaves holes open, you can't rely on every door being closed in time. The best answer is to shrink your own attack surface:
- A de-Googled smartphone with GrapheneOS gets fast security updates and is hardened — our SaferPhone models.
- A messenger that is end-to-end encrypted and leaves no metadata behind — VOID.
- Giving away less data means less that can be siphoned off. More on this in our Chat Control overview.
Conclusion
The debate is legitimate and far from settled. But as long as there is no binding, transparent vulnerability management and no independent BSI, one thing holds: don't rely on the state alone — protect yourself.
Sources (selection)
- netzpolitik.org — Vulnerabilities: A Breach of the Coalition Agreement
- heise online — BSI to Become "Independent," Vulnerability Management in Doubt
- SWP — Governance of 0-Day Vulnerabilities
- Verfassungsblog — Schrödinger's BSI President
- Tagesspiegel Background — Is the BSI Central Office Coming?