Looks like the infamous German "Hackerparagraph" §202c StGB. A toothless piece of feel-good legislature since all the tools can also be used for "good" (pen-testing etc.).
What happens is that these charges are used in place of "real" charges when the police want to convict.
For instance, it is in general illegal to possess "burglary tools", with no definition thereof. You might think that that would penalize only people with specialized tools modified for burglary. You would be wrong to think that. An unmodified hammer, screwdriver, wrench, knife or anything like that can be charged as a burglary tool, if the police feel you are a bad person. And yes, people routinely go to prison for possessing a regular unmodified screwdriver. Using it for burglary is not required at all under the law.
It doesn't matter even a tiny bit if the tools can also be used for good.
So when your house gets raided and the police find no actual evidence that you've done anything wrong, but you possess hacking tools, well... if they don't lay any charges that means they were dumb for making the raid in the first place.
Two years in prison (the minimum ceiling for all new offences mentioned by the press release) is a bit much if this section is just for posturing and brownie points.
The actual quote reads: The maximum penalty to be imposed by Member States for these offences would be at least two years' imprisonment, ...
Each EU member will have to make this local legislation, and two years are the minimum time for the maximum sentence. The upper limit can not be lower than 2 years in other words.
I understand the quote, unpacking it doesn't change my point. It's a law that creates new criminal offences and prison sentences, of course it isn't a harmless feel-good law without consequences outside of the political arena.
Those feel-good provisions are the ones that aren't already covered by existing laws punishing actual computer fraud, that makes them the ones we should pay attention to.
https://en.wikipedia.org/wiki/Strafgesetzbuch#.C2.A7_202c:_P...
Like most tools (kitchen knifes are the obvious example), intent and actual use is far more important to the law.
To my knowledge, there has not been a single ruling that declared simple possession of e.g. nmap a punishable offence.
Edit: http://www.gesetze-im-internet.de/englisch_stgb/englisch_stg... §202c in English