Germany Braces for Russia’s Shadow War
Chancellor Friedrich Merz says Germany is preparing for severe Russian hybrid attacks involving cyber operations, sabotage, drones and disinformation as tensions deepen.
German Chancellor Friedrich Merz says his country is preparing for major Russian hybrid attacks, warning that cyber operations, sabotage, drones and information warfare could intensify as Europe’s confrontation with Moscow deepens. The threat is serious, but “hybrid” must not become a label applied to every unexplained disruption.
Merz’s warning reflects a documented pattern. European authorities have investigated arson, damaged cables, cyber intrusions, suspicious drones and plots against logistics linked to Ukraine. Intelligence services say Russia uses intermediaries and deniable methods to raise costs without triggering a conventional NATO response. Moscow denies orchestrating such operations and accuses European governments of using Russia as a political explanation for domestic failures.
Hybrid warfare is attractive because ambiguity is part of the weapon. A railway fire may be sabotage or negligence. A drone near a military base may be espionage, activism or a hobbyist. Cyberattacks can be routed through compromised systems across several countries. The target must respond before attribution is perfect, while the attacker benefits from doubt.
Germany is especially exposed. It is a central logistics hub for aid to Ukraine, hosts American and NATO forces, operates dense rail and energy networks and contains industrial firms supporting European defense. Its federal structure divides responsibility among national agencies, states, municipalities and private companies, creating coordination gaps.
Preparation should focus on resilience rather than panic: redundant communications, protected substations, cyber backups, rapid drone identification, security for ports and railways, and clear incident reporting. Hospitals and emergency services need continuity plans, but describing every measure as preparation for World War III can frighten the public without improving capability.
Civil liberties are also at stake. Governments can invoke foreign interference to expand surveillance, restrict speech or stigmatize political dissent. Russian disinformation is real, yet criticism of sanctions, arms deliveries or the government is not automatically Russian-controlled. Democratic resilience requires evidence-based attribution and room for legitimate disagreement.
Germany’s response must balance speed and proof. Waiting months for public certainty can leave infrastructure vulnerable; retaliating on a weak assumption can escalate with a nuclear-armed state. A graded system—technical mitigation first, confidential allied attribution next, public accusation when evidence is strong—offers a more credible approach.
Merz also wants Europe to understand that peace is not the absence of tanks crossing a border. Persistent attacks below that threshold can exhaust security services, undermine trust and make citizens doubt whether institutions can protect everyday life.
Private companies will carry much of the burden because telecommunications, energy, transport and data centers are not all state-owned. Government warnings are useful only if followed by threat-sharing, funding and realistic standards. Small operators cannot absorb unlimited compliance costs, while large firms need consequences when they ignore known vulnerabilities.
This remains a developing story in which official statements, anonymous briefings and political messaging may diverge. Confirmed actions should be separated from announced intentions, and casualty, capability, timing and attribution claims should be revisited when primary documents or independent evidence emerge.
This remains a developing story in which official statements, anonymous briefings and political messaging may diverge. Confirmed actions should be separated from announced intentions, and casualty, capability, timing and attribution claims should be revisited when primary documents or independent evidence emerge.
This remains a developing story in which official statements, anonymous briefings and political messaging may diverge. Confirmed actions should be separated from announced intentions, and casualty, capability, timing and attribution claims should be revisited when primary documents or independent evidence emerge.
This remains a developing story in which official statements, anonymous briefings and political messaging may diverge. Confirmed actions should be separated from announced intentions, and casualty, capability, timing and attribution claims should be revisited when primary documents or independent evidence emerge.
This remains a developing story in which official statements, anonymous briefings and political messaging may diverge. Confirmed actions should be separated from announced intentions, and casualty, capability, timing and attribution claims should be revisited when primary documents or independent evidence emerge.
This remains a developing story in which official statements, anonymous briefings and political messaging may diverge. Confirmed actions should be separated from announced intentions, and casualty, capability, timing and attribution claims should be revisited when primary documents or independent evidence emerge.
What to watch next
Watch German legislation on critical infrastructure, counter-drone deployments, prosecutions and whether Berlin publishes evidence behind future attributions. The question is not whether Russia possesses hybrid capabilities, but whether Germany can defend itself without allowing ambiguity to erode either security or democracy.