Germany’s Hybrid War Blind Spot: Attackers Fear No Cost

DGAP’s white paper delivers a sharp warning to Berlin: the wake-up-call phase is over.
Germany is already under hybrid attack, from drones and cyber strikes to sabotage, disinformation and economic espionage.
Russia is treated as the most active aggressor, while China also appears in the espionage picture.
The brutal weakness is this: attackers believe Germany is too slow, too legalistic and too badly organised to make them pay.
Resilience alone will not save the country. Deterrence has to enter the grey zone.

The attacks are already here

The paper rejects the comforting idea that hybrid war is a future risk.

Germany is seeing near-daily incidents below the threshold of open war: suspicious drone flights over military sites and critical infrastructure, severed sea cables, incendiary devices in parcel networks, naval sabotage and cyberattacks on research and aviation systems.

In 2025 alone, German authorities registered more than 1,000 suspicious drone flights over military facilities and critical infrastructure. That is not background noise. It is probing.

Russia tests the seams

DGAP frames Russia as the central hybrid attacker.

Moscow’s aim is not necessarily one dramatic victory. It is corrosion: unsettle society, feed populism, weaken institutions, blur truth, tie up resources and test what Germany will tolerate.

The calculation is cold. Small strikes, deniable tools and cheap agents can do big damage if Berlin responds to each incident as an isolated nuisance rather than part of a campaign.

Germany looks too easy to hit

The paper’s harshest charge is that attackers expect too few consequences.

Germany’s rule-of-law system is not built for enemies who ignore the rules, operate through cut-outs and hide inside ambiguity. That does not mean Berlin should copy illegal methods. It means it needs lawful tools that can still hurt.

The current posture invites pressure: protect everything, react slowly, investigate carefully, then struggle to impose costs.

Resilience is not enough

DGAP is clear that hardening infrastructure matters, but cannot be the whole answer.

Germany cannot protect every cable, every hospital, every railway line, every data system and every citizen all the time. A purely defensive model leaves the attacker free to choose the next weak point.

That is why the paper calls for restrictive deterrence: not perfect prevention, but reducing the frequency and severity of attacks through targeted, credible, scalable countermeasures.

Hit back differently

The white paper’s key idea is “not-in-kind” defence.

Germany should not answer hybrid attacks by copying terrorism, sabotage or attacks on civilians. Instead, it should respond asymmetrically and legally. If hackers hit a hospital, Germany could disable crypto wallets. If Russian drones probe critical sites, Berlin could answer with sanctions or increased military support for Ukraine.

The point is simple: the response does not have to mirror the attack. It has to impose a cost.

The state needs a sharper machine

DGAP wants Germany to build a real hybrid-defence system around three pillars: information control, deterrence and resilience.

That means better strategic intelligence, a central situation centre with clear political responsibility, stronger financial forensics, more crypto-tracing capacity, faster strategic communication and wider intelligence-service powers under democratic oversight.

The paper also calls for resilience by design: sensors, monitoring and security built into critical infrastructure from the start, not bolted on after the next attack.

Bureaucracy is part of the weakness

The problem is not only hostile action. It is German fragmentation.

Responsibilities are spread across ministries, federal states, agencies, police, intelligence services, private operators and allies. Unclear authority slows reaction and weakens deterrence.

DGAP even raises the question of whether Germany needs a new legal status between peace and defence emergency – a “hybrid tension case” – to match the reality that enemies are already operating between those categories.

The stark truth: Germany must make sabotage cost something

DGAP’s warning is severe: Germany cannot analyse its way out of hybrid war. It needs political will, legal tools and a state machine able to react before attackers learn that every strike is low-risk.

Berlin does not need to abandon the rule of law. It needs to stop letting the rule of law become an excuse for paralysis.

The grey zone is not empty. Germany’s enemies are already inside it.