Active countermeasures: Germany must deter hybrid attackers

Germany faces a growing threat from hybrid warfare, with attacks ranging from drone incursions over military installations to cyber intrusions targeting research institutions and disinformation campaigns aimed at undermining public trust in government. The German government has acknowledged the need for a new approach to deter such threats, emphasizing the importance of active countermeasures tailored to the evolving nature of modern conflict. The situation escalated significantly in 2025, with the Federal Criminal Police Office (BKA) reporting over 1,000 suspicious drone flights near critical infrastructure and military sites alone. A major cyberattack on Germany’s air traffic control system was traced back to Russia, while a disinformation campaign known as “Storm-1516” during the 2025 federal elections was also attributed to Russian actors. These incidents underscore the increasing sophistication and frequency of hybrid attacks, which are designed not just to cause physical damage but to erode societal cohesion and institutional credibility. According to a study by the Bitkom industry association, the economic loss caused by data theft, industrial espionage, and sabotage amounts to nearly 300 billion euros annually. However, the impact extends beyond financial figures. Hybrid attacks aim to destabilize public confidence in state institutions, fragment social bonds, and hinder governmental effectiveness. This dual threat, both material and ideological, demands a comprehensive response strategy that goes beyond traditional security measures. The strategic calculus of aggressors is simple yet effective: small, repeated strikes to test defenses and divert resources. For nations like Russia, China, and Iran, the distinction between war and peace is blurred, allowing them to operate within the grey zone between conflict and diplomacy. Exploiting the inertia of Germany's legal framework and its reluctance to classify hybrid attacks as direct threats to national sovereignty has become part of their modus operandi. Dr. Thomas Kleine-Brockhoff, director of the Deutsche Gesellschaft für Auswärtige Politik (DGAP), highlights that Germany has long treated these attacks as isolated incidents rather than coordinated efforts against state integrity. He argues that this passive stance invites further aggression. Simply building resilience through increased surveillance and public awareness is insufficient. There is too much to protect, and reactive measures alone will not suffice. To address this, Germany must adopt a proactive deterrent strategy. Rather than stockpiling conventional weapons, the focus should shift toward hybrid deterrence methods that align with the nature of modern attacks. These strategies should be graduated, ambiguous, and unconventional, ensuring that aggressors face unpredictable costs. By demonstrating both defensive capabilities and the ability to respond decisively, Germany can prevent escalation while maintaining stability. Three key instruments have been proposed to enhance Germany’s capacity for counter-hybrid operations. First, rapid intelligence gathering through advanced financial forensic techniques. Modern hybrid attacks often leave digital and financial traces, which can be exploited to trace funding flows and identify perpetrators. In past cases, such as Russian interference in Moldova and a series of sabotage incidents across Europe, financial investigations uncovered payments to agents responsible for vandalism, revealing the extent of organized support networks. Second, strengthening legal and regulatory frameworks to ensure swift and effective sanctions enforcement. This includes integrating artificial intelligence tools into investigative processes to detect patterns and anomalies that might otherwise go unnoticed. Third, fostering closer cooperation with international partners, particularly within organizations like the Financial Action Task Force (FATF), to share intelligence and coordinate responses to transnational threats. These measures represent a crucial step forward in Germany’s defense strategy, though they remain part of a broader effort to reshape how the country responds to hybrid threats. As the landscape of global conflict continues to evolve, so too must the mechanisms used to safeguard national interests.