A new ‘turning point’ for Germany’s cyber posture?

Germany is likely to hold early elections for a new government in February 2025, after the German governing coalition collapsed on November 7. The issue of active cyber defence is likely to emerge in the short period before the elections. The conservative Christian Democratic Union, which has a high chance of leading the next government, has been a supporter of active cyber defence. As a result, active cyber defence in peacetime may make a comeback. 

The 2022 Russian invasion of Ukraine led to the ‘Zeitenwende’ (‘historic turning point’), a paradigm shift in Germany’s relationship towards Russia and towards its own military and security policy. The German government created a one-time €100 billion special fund, to boost defence spending and fill gaps in the underfunded and overstretched armed forces, the Bundeswehr, in pursuit of NATO’s 2% target. A large chunk of the special fund was allocated to the cyber and information domain, resulting in many useful initiatives. 

However, there is still work to be done: Germany must find a way to counter cyber operations in peacetime, come up with more effective strategies to counter influence operations, and update strategic thinking about cyber operations below the threshold of armed attacks.

German cyber defence in peace…

The 2015 Russian government hack of the Bundestag was Germany’s wake-up call to cyber conflict. The following year, Germany drafted a new cybersecurity strategy to beef up defensive measures for critical infrastructure and to adopt a whole-of-government approach to cybersecurity. Politicians fiercely debated ‘hack backs’, offensive cyber operations to counter adversarial cyberattacks. In the following years, the Ministry of Interior developed a four-step approach of active cyber defences to counter cyber operations: first, traffic sink holing; second, domain seizures; third, data manipulation to stop attacks; and, fourth, in the most extreme cases, remote shutdowns of foreign command-and-control servers. The last two elements of offensive cyber in peacetime were to be used if all other options, including diplomacy and sanctions, failed to stop an attacker.

However, constitutional and operational challenges arose over whether the Federal Intelligence Service (BND), Federal Criminal Police Office (BKA), or Federal Office for Information Security (the cyber security agency, BSI) should manage these capabilities. Civil agencies either lacked the authority or technical capability to penetrate foreign networks, while the BND had the skills but no executive mandate. 

Federalism further complicated matters, because civil defence in peace time traditionally falls under individual states’ jurisdiction. So, the debate shifted to the need for a constitutional reform to give federal actors the required authority. However, constitutional changes require a two-thirds majority in the federal parliament, the Bundestag, and the debate stalled. In 2021, the new government wrote in its coalition agreement that ‘we fundamentally reject hack backs as a means of cyber defence.’ Political momentum was lost. 

Following the invasion of Ukraine and a significant uptick in Russian-aligned cyber operations against Germany in 2022, there have been renewed attempts to establish a peacetime cyber operations capability. Notably, Foreign Minister Annalena Baerbock and Minister for the Interior Nancy Faeser argued for bundling peace time offensive capabilities at the federal level, under the BKA or the Federal Police, whose primary job is border protection. The concept was not included in the 2023 German cybersecurity strategy, but was mentioned in somewhat vague terms in Germany’s first National Security Strategy that same year. 

… and war

In 2017, the Bundeswehr set up the Cyber and Information Domain Services (CIR) to conduct military operations in the cyber and information domains. It was tasked with reconnaissance and effects-based operations in the cyber and information domain, operation and protection of Bundeswehr IT systems, and the sharing of threat intelligence and situational awareness data through the National Cyber Defense Centre. It was also designed to drive consolidation and modernisation of the disparate IT infrastructure of the armed forces. CIR has grown to 16,000 employees. Initially designed as a service provider, like the Bundeswehr medical service, for main military branches (the air force, army, and navy), the Cyber and Information Domain Service was elevated to a fully-fledged fourth military branch in April 2024. 

Since 2017, CIR has developed its own offensive cyber-capability, to be activated only for self-defence against armed attacks on German or allied territory or as a force-multiplier in Bundeswehr missions abroad. Its Center for Cyber Operations houses around 100 civilian and military personnel for computer network operations. Standalone offensive cyber missions, however, would likely require a parliamentary mandate, comparable to the legal status of other cyber commands in Europe, including those in the Netherlands, Denmark, and Poland.

CIR faces the same problem as many other cyber commands: as a wartime capability, it cannot be easily used against cyber operations below the threshold of an armed attack and is thus less useful against the majority of cyber operations. Despite these constraints, CIR has been successfully practising its offensive capability through ‘red-teaming’ and NATO exercises like Locked Shields.

Zeitenwende for cyber?

Around 2019, the Bundeswehr began reprioritising national and alliance defence vis-à-vis out of area missions. A structural reform dubbed CIR 2.0 was initiated in 2021, aiming to enhance the command’s efficiency and reduce the complexity of its hierarchy. The commands for strategic reconnaissance and information technology were dissolved and decision-making processes centralised and accelerated. A new joint intelligence centre was created to combine military intelligence from all domains and a new Cyber and Information Domain Component Command was created to oversee all operations from one place. 

In reaction to Russia’s invasion of Ukraine, Olaf Scholz’s coalition government announced the Zeitenwende and the creation of a one-time special fund to update defenses and to bring general defense spending up to NATO’s 2% goal. Germany’s annual defence budget is about half the amount of the special fund – €50.4 billion in 2022. Although most of the fund was spent on modernising the air force and buying new tanks, the second-largest chunk was allocated to the cyber and information domain (about €20.7 billion of the €100 billion). 

However, most of that money is not flowing into cybersecurity or cyber defence directly but toward hardware and software upgrades to digitise the armed forces. This includes the digitisation of land-based operations (€ 8.6 billion), procurement of a new digital battlefield management system, and purchase of encrypted software-defined radios to interconnect thousands of vehicles, soldiers, and digitized command posts. Another goal was the creation of a new German Mission Network to interconnect various aspects of out-of-area missions (€ 2.6 billion), and a field-deployable, tactical wide area network system. Additionally, Germany’s tiny military satellite fleet is to be updated (€4,7 billion). Lastly, new data centres will be created to support various new digital services. 

Tasks for the next government

In 2024, multiple cyber-attacks, of likely Russian origin, targeted German ruling parties, alongside an increase in offline sabotage attempts. The Taurus Affair, which involved a leaked call of high-ranking Bundeswehr officials, raised concerns about cyber awareness and exposed German weaknesses in countering such efforts and coordinating strategic communication with allies (who were not amused). Unfortunately, the Zeitenwende and the special fund have not yet delivered on their promises to significantly enhance German cyber and information security. 

In terms of peace-time cyber operations, Germany is lagging behind, both in legal capability as well as strategic thinking. Many European countries have recognised the strategic dilemma of countering cyber operations below the threshold of armed conflict. They possess military cyber commands but only can legally use them in wartime and therefore lack civil means to respond to adversary cyber operations in peacetime. 

Therefore, countries like Sweden, Finland, and Poland that, before the invasion of Ukraine pursued purely defensive cyber postures, are currently considering including peacetime offensive components in their next cybersecurity strategies. Even Japan, which like Germany has a historic culture of military restraint, is setting up its first military cyber command and developing a cyber strategy including preemptive attacks. Many countries are abandoning purely reactive defence postures in favour of the offensive strategies of ‘constant contact’ or ‘persistent engagement’ pioneered by the US, as Richard Harknett notes. 

Meanwhile, CIR is tasked with and equipped for conflict in the information domain, but is constitutionally restricted to acting only in wartime. Other countries, like France and Sweden, have created psychological defence agencies, drafted counter-information operations doctrines, or updated their strategic communications to better react to Russian influence operations. All of this is currently lacking in Germany.

Given the current political headwinds of a new Donald Trump administration in the US, which might abandon NATO; increased aggressiveness of Russian hybrid warfare; and Chinese ambitions and prepositioning in Western critical infrastructure, the next government needs to update its cyber and information domain strategies as well as operational capabilities to meet the current realities of cyber conflict.