00:00Is Germany facing a cyber war?
00:03The country is already under attack.
00:06Every day, thousands of strikes are registered,
00:09mostly invisible, silent,
00:10and many people don't know the security threat they pose to their daily life.
00:15Cyber attacks are deliberate and malicious attempts to harm technology.
00:19And increasingly, they're becoming a political tool.
00:23Even if we say we're not at war,
00:25it's no longer a peaceful environment that we see.
00:29Cyber attacks target German businesses, hospitals, power plants, politicians, every day.
00:36They paralyze public transport, access sensitive data, and compromise computer systems.
00:43The country is a popular target for these acts of sabotage.
00:46And the fear is, they could spill over into an actual conflict.
00:50We're on an all-time high when it comes to cyber attacks.
00:53We joined the German military for a cyber defense exercise,
00:56met with the head of Germany's intelligence services,
00:59and spoke to industry professionals and cyber security experts.
01:03Is Germany ready to face a cyber war?
01:06How is it defending itself and fighting back?
01:14Germany is one of the top targets worldwide for cyber attacks.
01:18In 2025, a quarter of all known state-sponsored hacker groups had Germany actively in their sights,
01:25surpassed only by the United States, India, and Japan.
01:28The latest attack has hit Germany's political center right here in Berlin.
01:33From leading politicians, members of the government to the former deputy head of domestic intelligence services.
01:40As German media reported, allegedly, almost 300 individuals were successfully targeted in a phishing attack.
01:48Even the greatest sensitivity does not protect against the possibility of something happening.
01:54Then it's important to react, and that's what we did.
01:58Reportedly, victims disclosed their login data to a fake account on the messenger app's signal.
02:03Now Germany's federal prosecutor general has started investigations on the suspicion of espionage.
02:09Sources close to the government here in Berlin say they believe the phishing campaign may have been steered from Russia.
02:16This was actually not a very sophisticated hack.
02:19It is rather a question of a lack of cyber security awareness.
02:25Cyber crime is no longer a fringe risk in Germany.
02:28In 2025 alone, cyber sabotage data breaches caused 289 billion euros in damage to the German economy.
02:38A significant part of these costs would not have to occur,
02:41because the knowledge is in principle there to detect these attacks and to deflect them so that the damage doesn't
02:48happen.
02:51Markus Schneider runs the cyber training at ATINE, a national cyber security institute in Darmstadt,
02:58just 30 kilometers south of Germany's business and transport hub Frankfurt.
03:01His mission? To make Germany's industries fit to counter cyber attacks.
03:06German companies send their IT professionals to Schneider and his team to train how to detect cyber attacks and defend
03:13themselves.
03:28The training is confidential and happens in the cyber range.
03:32A virtual space in which trainer Thomas Dexheimer recreates attacks that have already happened.
03:37The biggest challenge for the students here? Knowing how to keep their cool.
03:43They don't necessarily react very competently, which is why they are coming to our training.
03:47To have the opportunity to experience it live and test their knowledge in a simulated emergency.
03:58If you look at other sectors such as aviation, then you have pilots regularly practicing a crisis in their flight
04:07simulator.
04:10So, Germany is ramping up efforts to make its industry fit to protect themselves against cyber attacks.
04:17But the problem goes way further.
04:23Increasingly, cyber attacks are getting more political and can be linked to state-sponsored actors.
04:28As German industries start to feel the heat, they are willing to close ranks with Germany's armed forces to protect
04:34each other.
04:35We see a growing trend for nation-state driven attacks, especially coming from Russia and also from North Korea supporting
04:42them.
04:43It's a bit quiet these days on the Iranians for understandable reasons, but we're on an all-time high when
04:51it comes to cyber attacks.
04:52The German army itself has long been a target.
04:55We see that 24-7 attacks against our systems.
04:59And that is very clear that from low-level DDoS attacks up to sophisticated attacks, people are trying to invade
05:08our system, to penetrate our system, not potentially to cause an immediate action and damage, but to get into the
05:15system.
05:15In 2024, Germany's military upgraded its cyber defense to be a fully operating troop in the armed forces next to
05:23the Navy, Army and Air Force.
05:25Yet Germany can't do it alone. That's why they joined forces with their neighboring countries for NATO's annual cyber exercise.
05:33It's in an inactive nuclear power plant near the Dutch-German border.
05:37The computer screen is their battlefield. In this big conference hall, almost 200 military and civilian IT experts are preparing
05:45for a potential cyber attack.
05:47This time the threat is fictional, with a red team from NATO posing as the attackers and a blue team
05:53here behind me preparing how to fend them off.
05:56Some participants have to hide their identity as their daily cyber operations are highly confidential.
06:02Others, such as Army reservists, are keen to bring in their external expertise.
06:06I wouldn't call it patriotism, but I would say it is just a pure reasonableness that we need to, well,
06:14realize and face these threats and challenges we are currently facing and give a strong answer.
06:20And everyone has to do the part he can do to help everyone.
06:28So, Germany's industries and military are teaming up for cyber defense. But is defense enough?
06:35The German government is calling for more effective tools to fight back.
06:40One option? Bringing in Germany's intelligence services.
06:44For the head of the domestic intelligence service, this has been long overdue.
06:48It's not only to detect and understand that we are under attack, especially in hybrid warfare, but to respond.
06:56But how should Germany respond to attacks?
06:59One strategy discussed is known in hacker circles as hackbacks.
07:03Hackback would mean that if you are attacked and you can identify the server from what you are attacked, then
07:11hackback would mean you immediately throw back.
07:14But you need to know who you are hacking back at.
07:17One group linked to multiple attacks on Germany is known as Fancy Bear.
07:21Identifying them wasn't easy.
07:22The Russian hacker group accessed the parliamentary server and the emails of former Chancellor Angela Merkel and other German lawmakers
07:30back in 2015.
07:32It took authorities several years to trace the attack back to Russian military intelligence.
07:38When you want to attribute a cyber operation to its perpetrators, you need to understand who was technically responsible for
07:45the operations.
07:46That is challenging.
07:47What makes cyber attacks so hard to trace?
07:49It's how attackers hide their identity and methods.
07:53They use private computers or unrelated software as a weapon.
07:57If you react to that computer that attacks you, you're not attacking me.
08:02So hackback would potentially aim at a victim, a computer that was just hijacked in the chain of the attack.
08:12And if you would immediately throw back and attack the other computer, that might be a hospital.
08:17And then there are the constitutional constraints.
08:20Right now, federal authorities are not allowed to fight back.
08:25We need instruments to disrupt this ongoing operation of foreign agencies.
08:34It's not to send out messages, but to become operational in this context.
08:41But to give Seelen and German intelligence services that right, the country would have to change the law.
08:46And that could take time.
08:48Time Germany may not have.
08:54In early 2026, Russian hacker group Fancy Bear struck again.
09:00The group infiltrated internet routers to access sensitive data from military, political institutions and infrastructure.
09:07It included 30 devices in Germany.
09:10Some of the infiltrated routers were accessed because they were outdated.
09:13Stilted digitalization and tech modernization are common problems in Germany.
09:19It's very often these same well-known things that are not being done, which then enable these huge and high
09:28-profile cybersecurity attacks,
09:29which is quite frustrating, to be honest.
09:31Here's another common problem.
09:32Germany's bureaucracy.
09:34When an accident or an incident is happening, you have to report to different authorities.
09:41So you're binding really valuable resources you need to combat against the attacker in those notification processes.
09:49To cut through the web of institutions, the German government has set up a national cybersecurity panel.
09:55Yet the round table lacks resolve in emergencies.
09:59If there is a major cyber attack that would happen in Munich, Frankfurt, Berlin, Hamburg,
10:05then you have many local states being involved down to the local mayor of our city.
10:11But then we are going each and every one its way and there is no coordinated response.
10:17So, we've seen. Germany still lacks significant awareness, defense capabilities and political resolution when it comes to cyber attacks.
10:27At the same time, global politics are getting more heated.
10:34Germany, as any other European state, currently finds itself in a much more conflictive international environment.
10:41And this means that adversaries will now, will then use all the means at their disposal and cyber security or,
10:49sorry,
10:50cyber capabilities have certain advantages.
10:55The important of all this is that it always stays below the threshold of a military armed conflict.
11:01No tanks that are crossing a border, no rockets that are landing somewhere in Germany.
11:08Take the cyber attack on the Polish energy grid in 2025.
11:12The goal was a mass blackout for Germany's neighbor.
11:15It has been attributed to Russia.
11:18If that attack had been successful, this would have meant an attack by Russian actors on the critical infrastructure in
11:26a European Union and NATO country.
11:29Cyber attacks are an effective way for one political actor to weaken another without having to declare war or start
11:35an actual conflict.
11:36Hard to detect, defend and designate.
11:39There are serious threats that Germany needs to be ready for.
Comments