German MPs examining the surveillance activities the US National Security Agency have found a legal loophole that allows the Berlin’s foreign intelligence agency to spy on its own citizens.

The agency, known by its German acronym BND, is not usually allowed to intercept communications made by Germans or German companies, but a former BND lawyer told parliament this week that citizens working abroad for foreign companies were not protected.

The German government confirmed on Saturday that work-related calls or emails were attributed to the employer. As a result, if the employer is foreign, the BND could legally intercept them.

Opposition politicians have accused Angela Merkel’s government of pretending to be outraged about alleged spying by the NSA while condoning illegal surveillance itself.

The revelation comes after a BND employee was arrested in July on suspicion of selling secret documents to a CIA contact. Rather than report the contact to their allied German counterparts, the US spy agency was reported to have paid the agent €25,000 (£20,000) for 218 documents classified as confidential or top secret.

The incident prompted Germany to consider stepping up its counter-espionage efforts. Possible measures include monitoring the intelligence activities of nominal Nato allies such as the US, Britain and France, and expelling US agents from Germany.

In June the BND officially revealed some of its worst-kept secrets by acknowledging that half a dozen facilities are in fact spy stations.

The agency had for decades maintained that it had nothing to do with sites bearing cryptic names such as the Ionosphere Institute, but amateur sleuths long suspected their true identities and posted them online.

At a ceremony in the Bavarian town of Bad Aibling, the agency’s chief, Gerhard Schindler, officially attached the BND’s logo to the entrance of a site previously called the Telecommunications Traffic Office of the German Armed Force.

The facility features several giant golf ball-shaped radio domes commonly used for eavesdropping on radio, data and phone traffic.