When does war begin? When does it actually begin? Especially today, in the digital age of cyberattacks? “If a Russian submarine attacked and sank a German corvette, you would call it war,” says Senke Mararens, a Bundeswehr colonel and military strategist. “But what if metal shavings were thrown into the gears on that ship, and the ship was no longer operational: is that war?”
Mararens is an expert on hybrid threats. At the autumn conference of the Federal Criminal Police (BKA) in Wiesbaden, he will discuss the challenges of the future with German and international security experts. His scenario of sabotage of the operational capabilities of a German warship is realistic: the incident took place in January 2025 on the corvette "Emden", shortly before it was commissioned into the German Navy.
Europe is experiencing a steady increase in hybrid attacks. The military, police, politicians and scientists warn at a security conference: the situation is serious.
The chorus of warnings is unanimous. “We are seeing an intense escalation of the situation,” summarizes Zilke Willems, vice president of Germany’s domestic intelligence service. “Germany is the target of hybrid attacks every day,” emphasizes German Interior Minister Alexander Dobrint from the Christian Social Union (CSU). “Democracy is under pressure – from within and from without,” warns Holger Minh, director of the Federal Criminal Police.
"Stress test for democracy"
Minister Dobrint calls the intensity of the attacks on open society a “stress test for democracy.” Vladimir Putin’s regime appears to be under attack on a broad front. “We have cyberattacks, circumvention of sanctions, arson – we are experiencing all this on a scale we have never seen before,” emphasizes Zylke Willems of the Federal Office for the Protection of the Constitutional Order.
A particular challenge: It is often difficult to prove legally who is behind individual attacks. It is often unclear to police and intelligence services whether it is a Russian attack, poor infrastructure or a criminal act. Only a comparison with similar incidents usually provides a clear picture. Russia is deliberately operating in a gray area, which makes it difficult for the attacked countries to respond.
Minister Dobrint: "We too can disrupt and destroy"
According to the security services, Russia is increasingly using low-cost operations. "This is now being carried out through so-called 'low-level agents'," explains Holger Minh, head of the Federal Criminal Police, in an interview with DW. "Through hired people who often don't even know who they are working for - and who do it for little money."
The perpetrators are mainly young men in difficult circumstances, with criminal pasts, who have immigrated to Germany from the countries of the former Soviet Union. They are hired for a small fee, for example, via the Russian social network Telegram.
Minister Dobrint announces that Germany will step up its response to attacks: "Whoever attacks us in cyberspace must be aware: we will defend ourselves in the future! We can both disrupt and destroy."
What does that mean specifically? BKA chief Minh tells DW: "We've been doing this since 2021. It attracted a lot of attention then when we, together with international partners, disabled the most aggressive malware, 'Emotet.'" Cybercriminals had been sending it to institutions and companies - with the aim of taking down their IT systems or extorting ransom.
In the meantime, the Federal Criminal Police has significantly expanded its capabilities to combat cyberattacks so that it can respond in a targeted manner, says Minh. "We don't do it with an axe - we do it with a scalpel. We know which servers the perpetrators' data is on and we can delete or change that data." Even if criminal masterminds around the world rent hundreds or thousands of servers - the BKA can disable them.
In the fight against hybrid threats, the German government decided this week: in future, the Bundeswehr will be allowed to shoot down drones on German territory. This was previously the exclusive responsibility of the police. The police, in turn, are planning to form additional “drone units.”
The danger from within: democracy in retreat
But it's not just Russian drones, incendiary devices and disinformation that worry politicians and security experts. Another major challenge is that German society is increasingly distrusting its own democratic institutions.
This loss of trust is amplified by the digital reality: fake news, disinformation, lies about institutions and mandate holders – all fueled by complex, broad Russian disinformation campaigns. Their goal, according to security services, is to destabilize Germany and the West – through hybrid warfare.
In this context, attention is often focused on the Alternative for Germany (AfD). When several AfD MPs announced a trip to a Russian propaganda conference in Sochi, Christian Democratic Union (CDU) politician Roderich Kiesewetter accused them of turning into an instrument of Russia's hybrid war against Germany and Europe. The AfD constantly attracts attention for its closeness to Putin.
“The AfD openly shows its closeness to Putin and behaves like Germany’s Putin party,” Interior Minister Dobrint said in an interview with Handelsblatt. Thuringia’s Interior Minister went even further – expressing suspicion that the AfD may be spying for Russia.
Defense of Germany
What connects many AfD members to Putin is their rejection of a modern, diverse immigrant society. The head of the BKA is also concerned, warning that the AfD could come to power in some federal states in 2026 – which would also give it access to the security services. In order for Germany to remain resistant to attacks, military strategist and Bundeswehr Colonel Zenke Mararens says: hybrid warfare must be seen as a general social challenge.
Mararens countered the worrying trends at the security conference with an appeal: "There has never been a better Germany. Let's continue to defend it together!"
Bonus video:
