Yeah, that's pretty much a "Karteileiche" though, nobody takes that law seriously. This has less to do with germany being overly restrictive in that domain and more with incompetence: The law says something like "possessing hardware/software suitable for hacking is illegal" those who have written this law probably barely knew what software even is. They wanted to make sure they can get those evil "hackers" convicted but misunderstood the nature of what they are dealing with.

The law not being enforced makes this worse, not better as that means there is no motivation to remove it and it remains available to use to coerce/punish in the future.

good point

Which part of that long list of things specifically rules out possession of nmap, a tool used by sysadmins all over the world to help ensure that their own systems are more secure, by ensuring that only specific ports are open for communication?

Mapping a network is not an activity exclusive to criminals.

Dual use tools are not exempt. If it can be used for nefarious haxxoring then you’re out of luck. Let alone having something like msf on your box…

Everything can be dual use for "haxxoring".

Cyber laws are not known for being reasonable.

Though, this particular interpretation does make Google Chrome illegal; it has dev tools that can be used for manually sending HTTPS POST requests with forged headers. (It also has XMLHttpRequest, which can be instructed to do what nmap does with relative ease.)

It's a dumb law but not how it works.

How does it work then? I was stonewalled by various banks investors and insurers over this in berlin…

That shouldn't have happened. The law is super problematic and they can, for example (try to) hit you for finding (or even stumbling over) and responsibly disclosing security vulns, if you were not hired to do so.

But the part about hacker-tools applys only for tools that cannot be used legally (basically none) or are explicitly and knowingly made or acquired to be used illegally (as in you explicitly stated you are downloading this tool in order to get into a computer you do not have permission to get into). They have to prove you are not intending to use it legally (like checking your own network or one you were hired to check).

How did that happen, did they ask you for a complete list of all software that you run?