Permission to Break In
Allies are legalizing their reach into foreign machines faster than they can coordinate it.
On the morning of June 25, the German Bundestag read a bill aloud for the first time in the flat procedural voice a legislature uses for a first reading. The bill it read would let the federal police reach into a computer and retrieve, delete, or modify whatever data they found on it. Not necessarily a German computer by the way. The draft boldly includes “systems located outside Germany.”
So we have a domestic police force, asking its own parliament for standing permission to break into machines in other countries and change what is on them. Germany is not the first democracy to reach for this. I call it the Disrupt Doctrine: the licensed authority to operate on a machine you do not own, in a jurisdiction you do not control, and break it.
Thirteen months earlier, on May 16, 2025, Japan had already authorized its own version and started the clock ticking toward the day it’s fully operational. And across the Pacific, the United States has held this power for years, quietly, without ever passing a law that says so out loud.
For most of the last seventy years, that power stayed locked in a small, guarded box. A rare sovereign act, expensive, deniable, reached for a handful of times a decade and never advertised. What changed in the last thirteen months is that allied democracies started writing it into ordinary law, in daylight, and handing the keys to their police. Most notably, it seems, without defined coordination mechanisms between the allied nations that want to wield it.
We’ll start with the two that wrote it down, and then explore the US version and deeper implications next week.
Japan: the cabinet that made a constitution look away
Japan moved first, and it had to walk past its own constitution to do it.
Japan’s parliament, the Diet, enacted the Active Cyberdefense Act on May 16, 2025. The core provisions activate on October 1, 2026, about three months from now, with the sharper powers phasing in over the next two years. Underneath the legal machinery, the law does four things. It pulls private operators into a reporting relationship with the state. It lets the government watch communications data to catch a threat while it’s still forming. It authorizes counter-access against whoever is doing the attacking. And it lets national authorities reach out and disable hostile infrastructure before the attack lands. The National Police Agency and the Self-Defense Forces hold that particular key.
The power came at a price, and Japan paid it against its own founding document. Article 21 of Japan’s constitution says, without qualification, that the “secrecy of any means of communication” shall not be violated, period, no exceptions. And the new law has the government reading communications data anyway. Metadata only, by its own terms: the addresses and timestamps and command strings, not the contents of what people say to each other. To keep that contradiction from collapsing, Tokyo stood up a new oversight committee whose entire raison d’être is to sit on the seam between the law and the constitution and certify, in public, that the two can share a country.
The committee has real teeth and real purpose. Instead of wishing the tension away, Japan built something to sit on the seam and live there. It paid for the power in the open, which is more than most governments manage.
Germany: the cabinet saying it out loud
Germany is a year behind and a good deal blunter about what it wants.
One honest caveat up front: this is a first reading, not a law. The cabinet approved the draft on May 27. The Bundestag gave it that first reading on June 25 and shipped it off to committee, with a motion from Die Linke, the German left party, to ban “hack back” (AKA when the victim of an attack reaches back through the network to disrupt the attacker, instead of just defending) riding along in the same envelope.
Germany’s draft “Strengthening Cybersecurity” bill was approved by the federal cabinet on 27 May 2026 and given its first reading in the Bundestag on 25 June. The competing motion from Die Linke, calling on the government not to legally establish “hackbacks or comparable measures of offensive cyber defense,” is Bundestag Drucksache 21/6653.
The German system is, right now, arguing with itself in public, on the record, exactly the way it is supposed to. Democracy in action. Beautiful thing.
The draft would let the Federal Criminal Police Office and the Federal Police order a system to stop operating, redirect its traffic, and “retrieve, delete or modify data in IT systems” that pose a concrete threat, explicitly including systems sitting outside Germany. It also leans on the BSI, the federal cyber agency, and its authority to issue binding orders to DNS providers (DNS being the address book of the internet, which makes the providers something like the post office that keeps it).
This is a domestic police force writing itself permission to alter data on computers in other people’s countries.
And, through those binding DNS orders, a chokepoint on who can reach whom online.
And Berlin has noticed the problems it is creating, which is more than a reckless government would bother to do. Threat prevention in Germany is mostly the job of the Länder, the states, not the federal government, so a genuine “hack back” may need a constitutional amendment to survive contact with a court. The wall between police and intelligence, the Trennungsgebot, splits up who is even allowed to hold the key. And reaching into a foreign system may breach another country’s sovereignty under international law, which Berlin knows and has not solved.
So: two cabinets, thirteen months apart, reaching for the same power. Tokyo enacted it and is phasing it in behind an oversight committee. Berlin is still mid-argument, and unusually blunt about everything it has not yet solved.
The cabinet that never needed a vote
A third government sits in this story, and it never had to pass anything.
That government is ours (or, mine, for those of you who didn’t spend last weekend decked out in red, white, and blue while grilling hot dogs and lighting off small explosives in the backyard). We have held it for years, partly through military and intelligence authority and partly through a warrant rule our own courts quietly stretched until it fit. Washington has run this doctrine longer than anyone and written almost none of it into law. That is exactly why it belongs in Part 5, next week, with the operators instead of here with the drafters. The cabinets are the tidy version of this story. The operators are not.
My vantage point
I coordinate security partnerships at NTT, a Japanese carrier whose traffic crosses Japanese, German, and American ground before most of our customers have finished breakfast, along with the ground (and legal jurisdictions) of seventy-odd other countries. So none of this reads as abstract to me. It reads as Tuesday.
One incident, on one strand of fiber, a single packet transiting Frankfurt and Tokyo on its way to somewhere else, now lands inside two distinct legal versions of the Disrupt Doctrine at once. Under the German law, a federal authority in Berlin may have standing to reach into that traffic and modify data. Under the Japanese law, an authority in Tokyo, operating under its oversight committee, may have standing too. Neither statute mentions the other. Neither builds a way for one to phone the other and ask the only question that matters: “Are you already inside this box?” The carrier is the seam where the two authorities meet, and the carrier was handed no rule for what happens when both of them turn a key at the same time.
That is the whole worry, and it is a practical question about allies. Two friendly governments granted themselves the same power to reach into machines they do not own, and neither of them wrote a rule for what happens when the two reach into the same machine at once.
Two keys, cut a year apart in two different shops, both fitting the same lock. Nobody has compared them. Nobody is keeping the ring they hang on.
And the thread Part 5 picks up next week is the one that should keep a compliance officer awake. These governments are not even the busiest hand on this. The busiest one never needed a parliament, never filed for a constitutional amendment, never stood up a committee to make peace with its own founding documents. It has been cutting copies of this key for fifteen years, quietly letting itself into criminal networks and switching them off. Last month it switched off more than two hundred before lunch. They are heroes for doing so, but that doesn’t mean we should forget to solve the coordination problem. I’ll give you a hint: it’s not a democracy, it’s not even a country, and home is a cute little municipality in Washington state called Redmond.
Part 5 next week.
If you enjoy A Discipline of Seeing, it would mean the world to me if you shared it with others. Please use the button below to send my Substack to someone who might find my work interesting. Thanks!
— Brandon