This article is authored by Lars Zimmermann, Member of the Board, GovTech Campus Deutschland, and Manuel Kilian, Managing Director, Global Government Technology Centre Berlin.

Germany is finally getting a National Security Council. Long overdue, the new body is meant to centralize security strategy, coordinate across ministries, and provide integrated foresight in an increasingly unstable world. But the Council’s effectiveness will depend on one thing above all: whether it takes technology seriously.

Germany is finally moving towards the creation of a National Security Council (NSC), a step many see as long overdue to strengthen strategic coordination at the highest level of government. According to the coalition agreement between the Christian Democrats and the Social Democrats, published on 9 April 2025, the current Federal Security Council is to be developed into a strategic, Chancellery-led decision-making centre for integrated security policy, strategy development and crisis foresight.

"We will further develop the Federal Security Council, within the framework of the departmental principle, into a National Security Council in the Federal Chancellery. It shall coordinate the key issues of an integrated security policy, engage in strategy development and strategic foresight, conduct joint situation assessments, and thus serve as the forum for unified political decision-making."

- Coalition agreement, 2025, translation by the authors

This moment is pivotal. National security in 2025 is no longer about hard borders alone. It’s about digital infrastructure and its continuity, a sovereign use of key technologies, and the capacity to operate under conditions of cyber disruption, technological volatility, and information warfare.

The NSC must address these threats and risks by considering four interconnected dimensions of technology:

1. As a strategic tool for governing and decision-making,
2. As a threat environment that adversaries exploit,
3. As a geopolitical arena,
4. As a platform for cooperation with private and international partners.

1. Technology as a Strategic Tool

Germany is lagging behind- public services remain fragmented, analogous, and in many cases still reliant on paper. In the event of a major crisis hit such as a cyberattack, natural disaster, or geopolitical shock, would the ministries be able to respond swiftly, share data securely, and coordinate decisions effectively? To answer that question with a clear “yes,” the NSC must treat technology as a strategic tool and actively promote its adoption across all ministries and levels of government.

Governments around the world increasingly rely on technology not just for efficiency, but for strategic capacity. Secure cloud services, digital communications, and automation can dramatically improve a state’s ability to anticipate crises, make decisions, and maintain continuity under stress. In essence, digital infrastructure is critical infrastructure.

The United Kingdom gives an example of what this looks like in practice. Through its G-Cloud framework, government agencies can rapidly procure secure, scalable cloud services. That means critical systems stay online even during physical disruption or sudden spikes in demand. Cloud has become a foundational layer for resilience, enabling governments to stay operational when the unexpected strikes. In wartime, we’ve seen how vital this is – Ukraine’s government, for instance, credited cloud providers with literally saving its digital infrastructure when Russian attacks threatened its data centers.

Technology also helps governments act faster and think ahead. Artificial Intelligence (AI) can detect early warning signs in complex data, flagging risks before they escalate. Machine Learning supports crisis modeling, from pandemics to migration flows. Singapore’s Centre for Strategic Futures builds precisely these capabilities, combining scenario planning with real-time analytics to improve long-term readiness.

This means accelerating efforts in areas like digital identity, secure communications, and cloud-based critical services. It’s about building a government that doesn’t freeze when pressure mounts, but instead remains prepared, connected, and capable.

2. Technology as a Threat Environment

Just as technology empowers governments, it also empowers adversaries. The threats it poses are no less real than traditional military threats, and in many cases they're harder to detect and just as damaging.

Cyberattacks are now an everyday reality. German companies and public institutions face thousands of intrusion attempts every day. In 2023, a ransomware attack on Südwestfalen-IT, a municipal IT service provider, temporarily crippled the digital infrastructure of over 70 cities and local authorities, disrupting services from email to citizen portals and administrative workflows. This incident demonstrated how a single successful breach can cascade across institutions and paralyze essential functions of local government. 

Digital espionage is equally worrying. Multiple breaches targeting the Foreign Office and Berlin-based think tanks have shown how foreign actors aim to infiltrate Germany's political infrastructure and siphon off sensitive intelligence. In 2023 and 2024, Russian-linked hacking groups were publicly blamed for cyber intrusions targeting political parties and government systems and for undermining research institutions.

But hacking is just one dimension. Disinformation and deepfakes are a growing strategic threat. Coordinated propaganda campaigns can inflame social divisions, distort public discourse and undermine German foreign policy, such as its support for Ukraine. To understand the scale of the risk, consider the 2024 presidential elections in Romania. Intelligence services discovered widespread algorithmic manipulation by foreign actors, leading to the annulment of the first round – a dramatic example of democracy destabilised by digital interference.

A 21st-century NSC must be fully connected to this digital battlespace. It should ensure Germany’s intelligence and security agencies have the tools to detect intrusions early, attribute them correctly, and respond decisively, whether through sanctions, legal action, or active defense. And it must serve as a coordinating hub across ministries to manage the full spectrum of hybrid threats, from cyberattacks to information warfare.

3. Technology as a Geopolitical Arena

Technology is a driver of geopolitical and economic power. In the 2020s, this power is increasingly exercised through control over digital infrastructure, global standards, supply chains, and the norms that shape how emerging technologies are built and used. This is fueling a visible convergence of foreign policy and tech policy – a shift that for years now, other major powers have been approaching far more strategically than Germany.

Recognizing technology as a geopolitical arena also makes clear that national security and economic security are inseparable. Control over key technologies, from semiconductors to AI, determines not just who leads economically, but who can remain resilient in the face of coercion, disruption, or dependency. For an export-driven industrial economy like Germany’s, secure digital infrastructure and influence over global tech standards are not niche concerns but matters of economic survival. The NSC must therefore treat tech policy as industrial strategy, and see innovation capacity as a national asset to be protected and advanced.

Being passive in this space is no longer an option. A failure to engage would leave Germany a bystander – a rule-taker, forced to operate within standards set elsewhere, whether in Washington, Beijing or beyond. The consequences of such strategic complacency are already visible: Germany’s reliance on foreign suppliers for 5G equipment and critical raw materials has become a widely acknowledged security risk. In contrast, an assertive, forward-looking approach would position Germany as a rule-maker, helping shape the global rules of the road on issues such as AI governance, cybersecurity norms, and technology supply chain resilience.

This is also where the much-debated concept of digital sovereignty comes into play, although the term is often used inconsistently and has recently become inflated through overuse. Rather than framing it narrowly as data localization or self-sufficiency for its own sake, the NSC should ground digital sovereignty in the idea of strategic agency: the ability to choose, shape, and defend Germany’s position in the global digital order. True digital sovereignty is not just about minimizing dependencies. It’s about influencing the rule-making around emerging technologies and aligning digital governance with democratic values. The NSC can help shift digital sovereignty from a defensive reflex to a forward-looking framework for strategic leadership.

4. Technology as a Platform for Cooperation

Technology is not only a domain of tools, threats and strategic influence, it is also a strategic connector. Risks increasingly flow through shared digital systems, public-private dependencies, and international alliances. No country can manage this landscape alone, let alone develop all required skills and expertise in-house. That makes well managed cooperation, both with the private sector and with trusted allies, a core requirement of national security.

Building Partnerships Between Government and Technology Actors

Cyberattacks require collective detection efforts. The private sector is often the first to see threats. Social media platforms are at the forefront of influence operations. Cybersecurity firms identify malware infrastructure before it reaches critical systems. Cloud providers manage critical digital infrastructure every day, often with more visibility and agility than state agencies.

Governments are already adapting to this interdependence. In the United States, the Cybersecurity and Infrastructure Security Agency (CISA) was created to formalize public-private coordination. It supports critical infrastructure operators across all sectors through joint alerts, information sharing, and national-scale exercises. CISA’s model is dynamic, collaborative, and designed to respond at speed.

Other countries are building similar approaches. Japan has established an Economic Security Unit within its National Security Secretariat to bring together ministries and industry, safeguarding key technologies through a coordinated national strategy.

Estonia stands out as a leader in digital defense cooperation. After suffering major cyberattacks in 2007, Estonia built a holistic ecosystem connecting government, private firms, and a reserve corps of volunteer tech experts. Critically, Estonia institutionalized public-private cooperation: banks, telecoms, and government agencies share information and train together, creating one of the most robust digital security systems in Europe.

Germany needs to build similar connective tissue. The NSC should act as the central node linking ministries, public agencies, and industry players. Without this, digital threats will be spotted too late and addressed too slowly. With the right partnerships and processes, however, fragmented signals can be turned into a coordinated national response.

International Alliances

Technological cooperation doesn't stop at national borders. Germany's security is closely linked to that of its allies, especially in cyberspace.

NATO already treats cyber as a shared responsibility. Its Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn serves as a key hub for joint training, planning and doctrine development. The European Union has also strengthened its strategic posture. In 2023, it adopted an Economic Security Strategy based on three pillars: Promote, Protect and Partner. The strategy emphasises investment in innovation, protection of key technologies, and close coordination with like-minded partners on digital standards and governance.

These frameworks underscore the growing urgency of technology supply chain security, especially in sensitive sectors such as semiconductors, 5G and AI. As Europe's largest economy, Germany has a responsibility to lead, not just to protect its own digital interests, but also to shape the European and transatlantic approach.

The NSC must ensure that Germany speaks with one voice in EU and NATO discussions – on export controls, technology standards and responsible state behaviour in cyberspace. At the same time, it should actively pursue bilateral technology dialogues with key partners to build common frameworks and reduce dependence on suppliers from authoritarian states.

A Tech-First NSC: What It Takes and Why This Moment Matters

For years, Germany has been slow to respond to fast-moving global threats – from pandemics to war to technological disruption. The creation of a NSC is a rare opportunity to break this pattern. But seizing it will require more than institutional redesign. It will require embedding technology at the heart of how Germany anticipates, decides, and acts.

Building a tech-first NSC means going beyond superficial digitization. It means embedding technology into the mission, mindset, and mechanics of the Council:

• Mandate: Technology, cyber defense, and digital infrastructure must be treated as core strategic issues. They are not peripheral technicalities. They are essential levers of national power, sovereignty, and global influence.
• Staffing: Tech leadership must be reflected through the full range of expertise: The NSC needs more than diplomats and generals – it must include engineers, data analysts, and digital policy experts who understand today’s threats and tomorrow’s systems.
• Foresight: The NSC should establish a dedicated technology foresight unit capable of scanning for emerging risks, running simulations, and modelling long-term trends in security, economic, and technological domains.
• Infrastructure: The NSC must push Germany to work with secure, modern digital systems for information sharing, real-time coordination and crisis response. It should itself be a model for how the government can operate under digital pressure.
• Outreach: An effective strategy requires proactive, constant dialogue with the private sector, start-ups, civil society and research institutions. The NSC should institutionalise these relationships and build structured partnerships.

Without deep technological capability, the NSC will be blind to the very threats it is meant to anticipate – and miss out on tools that already exist in the tech ecosystem. It will coordinate too slowly, think too narrowly, and remain stuck in 20th-century routines. But if it’s designed for the world we actually live in, the NSC can help Germany leap ahead: anticipating risks, defending the digital space, and shaping policy with speed, insight, and confidence.