Articles of Germany’s Basic Law are printed on a glass partition as a German flag flies on the Reichstag building in Berlin on May 22, 2024.
JOHN MACDOUGALL/AFP via Getty Images
Germany’s criminal code makes it a prosecutable offense to possess the software that security researchers use to find and report vulnerabilities — and a new white paper published today by the country’s top computer science body warns that artificial intelligence is turning that 19-year-old legal failure into a national security liability.
The Gesellschaft für Informatik (GI), Germany’s principal professional organization for computer scientists, today released a white paper calling for reform of the statutes that have exposed good-faith security researchers to criminal prosecution since 2007. The document was developed in collaboration with industry partners, cybersecurity researchers, and digital-policy nongovernmental organizations — and it arrives as independent threat data confirms that the window from disclosure to exploitation has collapsed to five days at the median.
Why Germany’s Defenders Are Structurally Outgunned
The legal problem begins in the German Criminal Code (Strafgesetzbuch, or StGB). Sections 202a through 202c — collectively nicknamed the “hacker paragraphs” since their enactment in 2007 — define a range of computer-related offenses. Section 202c is the most consequential: it criminalizes the production, distribution, and possession of so-called hacker tools, carrying a penalty of up to one year in prison and a fine.
The structural problem is not with the law’s goal but with its targeting mechanism. Tools such as the network scanner nmap, the vulnerability scanner Nessus, decompilers, and radio signal analyzers are indispensable to anyone doing legitimate security testing — and they are precisely what §202c classifies as criminal contraband. Attackers who use those tools to find vulnerabilities face no such legal constraint; they operate in jurisdictions beyond Germany’s reach, or they simply ignore the law. Germany’s defenders, operating inside the country’s legal system, face criminal liability for possessing the same software.
This is not a theoretical risk. Sections 202a and 202b require prosecutors to demonstrate unauthorized access or data interception — at least a threshold of wrongful action. Section 202c requires no such showing. Possession alone is the offense.
What Prosecution Looks Like in Practice
The landmark case is Modern Solution. In June 2021, a freelance programmer — identified in German legal proceedings as Hendrik H. — was troubleshooting software for a client of IT services firm Modern Solution GmbH when he discovered that the company’s application stored its database access password in plain text inside the program file. Using that trivially accessible credential, he found that he could view the personal data of nearly 700,000 German online shoppers — customers of retail platforms including Kaufland, Otto, and Check24 — that Modern Solution had failed to protect. He reported the vulnerability through proper responsible disclosure channels.
Modern Solution’s response was to file a criminal complaint. German police raided Hendrik H.’s home and office in September 2021, confiscating five laptops, a personal computer, and a mobile phone — the entirety of his professional equipment. The Jülich District Court initially sided with him, then reversed that decision in January 2024 and fined him €3,000 (approximately $3,501 USD; conversions are approximate). The Aachen Regional Court dismissed his appeal in November 2024. The Cologne Higher Regional Court confirmed that ruling in July 2025. His lawyers then filed a constitutional complaint with Germany’s Federal Constitutional Court (Bundesverfassungsgericht), which rejected the complaint on September 15, 2025, without giving reasons. The decision is final; all legal avenues are exhausted.
GI president Martin Wolf — a professor of IT management at the Aachen University of Applied Sciences and the first university of applied sciences professor to lead the organization — framed the stakes in the white paper’s accompanying statement: “Vulnerabilities in IT systems offer significant attack opportunities for criminals and state actors alike. The enormous potential for misuse of AI systems makes the early detection and disclosure of vulnerabilities more important than ever. Volunteer hackers must no longer be rewarded with criminal charges instead of recognition.”
The GI has criticized §202c since the day it was enacted. Security researcher Lilith Wittmann’s experience in 2021 illustrated how the same legal exposure reaches beyond corporate litigation. After she voluntarily disclosed a major security vulnerability in the CDU Connect election campaign app — exposing data on 18,500 campaign workers and the political opinions of some 500,000 canvassed citizens — the CDU filed a criminal complaint, and the Berlin state criminal police office opened a formal investigation, formally listing Wittmann as a suspect. The complaint was eventually withdrawn and the CDU apologized, but Wittmann’s account of her interaction with law enforcement made clear how seriously the legal machinery can engage even when the underlying disclosure is unambiguously in the public interest.
Is This More Dangerous Than It Was Five Years Ago?
The answer from current threat intelligence is unambiguous: yes.
Rapid7’s Q2 2026 Quarterly Threat Landscape Report, published one week before the GI white paper, found that high- and critical-severity vulnerability disclosures doubled year-over-year to 8,539 in the second quarter alone. Newly exploited vulnerabilities surged by up to 40% quarter-over-quarter. Perhaps most striking: 62% of newly exploited vulnerabilities required no user interaction to initiate — so-called zero-click attacks that can compromise systems before any human can respond.
Germany sits squarely in the crosshairs of these trends. The Rapid7 report ranked Germany second globally for listed ransomware victims in Q2 2026, with 99 recorded incidents — roughly one-ninth the number of U.S. victims (881) but still the second-highest count in the world.
The GI’s argument connects these data points directly to the legal gap: if researchers cannot probe systems, build expertise with real-world tools, and disclose findings without risking prosecution, Germany’s defenders will remain structurally disadvantaged against adversaries who face no equivalent constraint. The Chaos Computer Club (CCC), Germany’s most prominent hacker organization, has made the same argument for nearly two decades.
What Germany’s Law Looked Like After the Last Reform Attempt
In October 2024, then-Federal Minister of Justice Marco Buschmann circulated a draft reform of the hacker paragraphs. The proposal addressed §202a (unauthorized data access) and §202b (interception of data), creating a good-faith intent defense for researchers who access systems to identify vulnerabilities and report them to appropriate authorities. It left §202c entirely unchanged. The CCC responded that the reform was “blunt” and left researchers operating in “a dangerous grey area.”
Even if §202a’s intent defense protected a researcher from prosecution for accessing a system, that researcher could still face prosecution under the unreformed §202c for possessing the penetration-testing tools used during the assessment. Prof. Dennis-Kenji Kipker, professor of IT security law at the Bremen University of Applied Sciences, described the retained provision as leaving research in legal limbo even after §202a reform.
That draft law — which was not enacted before the government changed — is the immediate backdrop for the GI’s current demand for comprehensive reform.
Is European Law Catching Up Faster Than Germany?
Belgium moved to resolve exactly this problem in February 2023, when it established a formal legal safe harbor through its Centre for Cybersecurity Belgium (CCB). Under the framework — enacted as part of the Belgian Act on the Protection of Whistleblowers of November 28, 2022 — any individual or organization can report vulnerabilities affecting any Belgian system to the national cybersecurity response team without fear of prosecution, provided they file a written report with the CCB and the affected system owner, do not publicly disclose the information without CCB approval, and limit their actions to what is necessary to identify the vulnerability. Crucially, the protection applies even to organizations that have no formal vulnerability disclosure program of their own — covering the vast majority of potential targets.
Portugal legislated parallel protections in Decreto-Lei 125/2025, published December 4, 2025 and effective April 3, 2026, as part of its EU NIS2 Directive transposition. An academic analysis published in the Journal of Cybersecurity (Oxford Academic) in January 2026 surveyed legal frameworks across the EU and found the overall picture “fragmented and insufficient”, calling for a coherent EU-wide framework built on two pillars: mandatory coordinated vulnerability disclosure procedures and explicit legal exemptions for ethical security research. The EU’s January 2026 NIS2 amendment package, while simplifying compliance for entities, did not resolve the core researcher-protection gap.
In the United Kingdom, Security Minister Dan Jarvis committed in December 2025 to amend the 35-year-old Computer Misuse Act to include a statutory defense for security researchers — but as of this writing, that protection remains absent from the Cyber Security and Resilience Act as introduced.
What Comprehensive Reform Would Require
The GI’s preferred model draws explicitly on the Belgian approach: a legal safe harbor that does not require researchers to obtain advance authorization from system owners, provided they disclose findings through an official national channel, limit their actions to what is strictly necessary to identify a vulnerability, and avoid causing harm.
But the white paper frames the legal change as necessary but insufficient. Alongside statutory reform, the GI calls for changes to adjacent legal regimes that researchers currently navigate with equal uncertainty: copyright law (which can be invoked against decompiling software), the Trade Secrets Protection Act (which can be invoked against reverse engineering), and data protection regulations (which apply to data encountered during security testing). It also calls for the explicit decriminalization of techniques fundamental to security work — including decompiling software code and examining unencrypted radio signals — and for the establishment of national vulnerability reporting infrastructure: standardized disclosure channels, defined timelines for vendor response, and formal recognition of the researchers who contribute to national cybersecurity.
The political opening is real. The current CDU/CSU and SPD coalition government included legal certainty for cybersecurity research among its stated goals in its coalition agreement — a commitment the GI explicitly cites as the mandate its white paper is designed to give concrete form. Previous German reform efforts have stalled at exactly this stage; the GI and its coalition partners are calling for comprehensive reform that includes all affected stakeholder groups, not another revision that addresses §202a and §202b while leaving §202c intact.
Does Germany Have a Timeline for Change?
No specific legislative timeline has been announced. The GI is pushing for the government to “act swiftly” on reform, but the coalition agreement’s stated commitment has yet to produce a draft bill from the current government.
The GI’s full white paper is available at gi.de.
Currency conversions from euros to U.S. dollars are based on the exchange rate as of August 25, 2026, and are approximate.
Frequently Asked QuestionsIs it illegal to own penetration testing tools in Germany?
Under §202c of the German Criminal Code — the provision Germany’s computer science community has called the “hacker paragraph” since 2007 — the production, distribution, and possession of software classified as a “hacker tool” carries a penalty of up to one year in prison and a fine. The practical problem is that widely used, legitimate security tools — network scanners, vulnerability scanners, decompilers — fall within the law’s scope. Unlike §202a (which requires demonstrating unauthorized access) and §202b (which requires data interception), §202c requires no showing of criminal intent: possession alone can constitute the offense. The GI’s white paper specifically demands that §202c be reformed or repealed as part of any credible decriminalization package.
How does Germany’s approach compare to Belgium’s?
Belgium is the most frequently cited counterexample. Since February 15, 2023, Belgium’s Centre for Cybersecurity Belgium has operated a formal legal safe harbor that protects any individual who reports vulnerabilities through official channels — even for systems whose owners have no formal vulnerability disclosure program. Researchers who follow the defined procedure are protected from both criminal and civil prosecution. Germany has no equivalent protection. The GI’s white paper explicitly names Belgium (and Poland) as models the German government should study.
Does the AI threat landscape change the urgency of reform?
According to Rapid7’s Q2 2026 Quarterly Threat Landscape Report, high- and critical-severity vulnerability disclosures doubled year-over-year to 8,539, with newly exploited vulnerabilities surging by up to 40%. The median time between a vulnerability’s public disclosure and its exploitation in the wild has collapsed to five days — a timeline that makes pre-disclosure security research more valuable, not less. AI tools are accelerating attacker capabilities in discovering and weaponizing vulnerabilities at scale. Germany ranked second globally for listed ransomware victims in Q2 2026 with 99 incidents. The GI’s central argument is that a legal framework that discourages volunteer researchers from finding vulnerabilities before attackers is a structural liability in this environment.
What happened to the Modern Solution case?
Hendrik H., the freelance programmer convicted under §202a in January 2024 for responsibly disclosing a vulnerability that exposed the data of nearly 700,000 German consumers, was fined €3,000 (approximately $3,501 USD at August 25, 2026 exchange rates). His appeal was dismissed by the Aachen Regional Court in November 2024; the Cologne Higher Regional Court confirmed that ruling in July 2025. His lawyers then filed a constitutional complaint with Germany’s Federal Constitutional Court, which rejected the complaint on September 15, 2025, without giving reasons. The decision is final. Under the Belgian-style safe harbor model the GI advocates, a researcher who reported the same vulnerability through official channels and met the defined conditions would be legally protected from prosecution.