Blind Spots: Why Germany's Security Apparatus Struggles With the New Espionage

The Bundesanwaltschaft has arrested two suspected Russian agents. One, a Romanian national, was detained in Nordrhein-Westfalen. The other, a Ukrainian citizen, was picked up in Spain. Both face charges under §99 of the German criminal code: intelligence activity on behalf of a foreign service. Their alleged target was a German entrepreneur who supplies drones and drone components to Ukraine. The cross-border operation, coordinated between German and Spanish authorities, represents the kind of prosecutorial action that security officials have been demanding for years. It also exposes, once again, the structural weaknesses that make Germany one of Europe's most permissive environments for foreign intelligence operations.

What We Know

The Bundesanwaltschaft confirmed the arrests in March 2026. The suspects are accused of surveilling a drone entrepreneur based in Germany whose business supplies unmanned aerial systems and components to the Ukrainian armed forces. The Romanian woman was arrested in NRW; the Ukrainian man in Spain, suggesting an internationally coordinated operation likely involving a European Arrest Warrant.

The charge, Geheimdienstliche Agententätigkeit under §99 StGB, is Germany's primary espionage statute. It criminalizes intelligence gathering on behalf of a foreign power. The Bundesanwaltschaft has exclusive jurisdiction over such cases due to their national security classification.

What the press release does not specify: which Russian intelligence service ran the operation, how long the suspects had been active, and whether they are connected to a broader network. These questions remain open.

The BfV's Capacity Gap

Germany's domestic intelligence service, the Bundesamt für Verfassungsschutz, employs roughly 4,500 staff. That number has grown since 2022, and the budget has risen from approximately 470 million euros in 2021 to nearly 580 million euros by 2025. These are real increases, but the comparison to peer services is instructive.

The United Kingdom's MI5 maintains a workforce of more than 5,000 for a population of 67 million and a significantly smaller geographic footprint. France's DGSI operates with approximately 5,000 personnel. Germany, with 84 million residents and a geography that stretches from the Danish border to the Alps, tasks its counterintelligence service with covering more ground using fewer people per capita than either of its closest European counterparts.

Former BfV President Thomas Haldenwang acknowledged the gap publicly in 2023, noting that the service was scaling up but that recruitment of qualified personnel takes time, especially in technical fields such as cyber intelligence and signals analysis. The Verfassungsschutzbericht has flagged Russian espionage as a top-tier threat every year since 2022. The disconnect between threat assessment and operational capacity persists.

Sixteen Agencies, One Problem

The German federal system splits counterintelligence between the BfV at the national level and sixteen Landesämter für Verfassungsschutz at the state level. Each state office operates under its own legal authority. The result is an intelligence architecture in which information sharing depends on cooperation rather than command.

This fragmentation has been criticized repeatedly. The Parlamentarisches Kontrollgremium, the Bundestag's intelligence oversight body, has flagged coordination failures between federal and state agencies for years. The shortcomings are not theoretical. The NSU scandal, in which a neo-Nazi terror cell operated undetected for over a decade, led to reforms in information sharing. The 2019 Tiergarten murder, when a Russian state-sponsored assassin killed a Georgian national in a Berlin park, exposed gaps in real-time coordination between agencies tracking known threats.

Proposed reforms to centralize counterintelligence authority, or at minimum to create binding information-sharing protocols, have circulated for years without result. None have been enacted into law. The federal structure remains intact because it reflects Germany's constitutional architecture, and constitutional architecture does not bend easily to intelligence requirements.

The Legal Framework

Espionage prosecution in Germany relies primarily on §99 StGB. The statute carries a maximum sentence of five years, or ten in particularly severe cases. By European standards, this is moderate. Prosecutions have historically been rare, with the Bundesanwaltschaft bringing only a limited number of cases per year.

The low prosecution rate reflects structural difficulty, not lack of activity. Intelligence agencies are reluctant to expose sources, methods, and surveillance capabilities in open court. Evidence that would establish guilt beyond reasonable doubt often cannot be presented without compromising ongoing operations. This creates a persistent tension between the intelligence function, which prioritizes continued monitoring, and the prosecutorial function, which demands disclosure.

Germany lacks a dedicated security court or tribunal system with the clearance infrastructure to handle classified evidence in camera. The United Kingdom's Special Immigration Appeals Commission offers one model for resolving this tension. Germany has not adopted anything equivalent. The result is that many espionage investigations end in quiet expulsions or surveillance rather than prosecution.

Cross-Border Coordination

The simultaneous arrests in NRW and Spain indicate a level of cross-border prosecutorial coordination that would have been difficult to achieve a decade ago. The European Arrest Warrant, operational since 2004, provides the legal instrument. Eurojust, the EU's judicial cooperation agency, facilitates coordination between national prosecutors.

This suggests that European judicial infrastructure for transnational criminal cases is functional. The caveat: espionage cases have traditionally been handled bilaterally between intelligence services, not through EU mechanisms. Each member state applies its own legal definition of espionage, its own evidentiary standards, and its own classification regime. Spanish authorities cooperated with German prosecutors in this case, but the framework remains ad hoc rather than systematic.

The EU has no unified espionage statute. A Russian agent operating across multiple EU countries can face different charges, different burden-of-proof standards, and different sentencing ranges depending on where the prosecution takes place. This inconsistency benefits intelligence services that deliberately structure their operations across jurisdictions.

The Tech Sector Blind Spot

The targeted entrepreneur represents a category of intelligence target that barely existed fifteen years ago: a civilian running a small or mid-sized company that supplies military-relevant technology to a country at war. Traditional defense contractors operate within established security frameworks, including personnel vetting, facility clearances, and regular counterintelligence briefings. The Mittelstand firms and startups now entering the defense-adjacent space typically have none of these protections.

The BfV has launched its Wirtschaftsschutz initiative to engage the private sector on intelligence threats. The outreach is real but recent, and it competes for attention with the more established focus on cyber threats to large corporations. A drone entrepreneur in NRW, running a fast-growing business supplying a conflict zone, may never have received a counterintelligence briefing or been informed that foreign intelligence services might consider their supply chain a legitimate target.

NRW hosts a high concentration of dual-use technology firms and defense-adjacent industry. The BfV has flagged the region as a priority target for foreign intelligence services, particularly Russian and Chinese. The gap between this assessment and the practical security posture of companies in the region remains wide.

What Has Actually Changed

Chancellor Scholz declared the Zeitenwende in February 2022, three days after Russia's full-scale invasion of Ukraine. Germany expelled 40 Russian diplomats in April 2022. The 100 billion euro Sondervermögen was established for defense spending. The shift was real, visible, and politically significant.

The intelligence sector, however, received far less of this momentum. The Sondervermögen is earmarked for military hardware and readiness, not for intelligence service expansion. BND reform has received some legislative attention. BfV structural reform has not. The Parlamentarisches Kontrollgremium has seen members from multiple parties call for faster modernization of the intelligence architecture. A comprehensive reform bill has not materialized.

This is not unusual. Intelligence reform is politically unrewarding: it involves classified capabilities, no ribbon-cutting ceremonies, and a public that distrusts its own intelligence services for historical reasons that are not entirely unjustified. The political incentive structure favors visible defense procurement over invisible counterintelligence investment.

What Remains Unclear

The Bundesanwaltschaft has not identified the specific Russian intelligence service behind the operation. The GRU, SVR, and FSB all conduct operations in Europe, with different targets and methods. Whether this case falls under military intelligence, foreign intelligence, or domestic security service jurisdiction on the Russian side is publicly unknown.

The duration of the espionage operation has not been disclosed. Nor has the specific intelligence the suspects are alleged to have gathered and transmitted. Whether the drone entrepreneur was the sole target, or one node in a broader surveillance operation, remains open. Whether the suspects are connected to other known Russian intelligence networks operating in Europe has not been addressed publicly.

These gaps are normal at the arrest stage. They also reflect a recurring pattern: German authorities announce espionage arrests with minimal detail, and the subsequent legal proceedings unfold largely outside public view. This protects operational security. It also limits the public's ability to assess the scale of the threat.