Under-Equipped and Over-Targeted: Germany's Intelligence Services Face a Threat They Were Never Built For

Two people sit in pretrial detention. One, a Romanian woman, was arrested in Nordrhein-Westfalen. The other, a Ukrainian man, was detained in Spain on a German warrant. The Bundesanwaltschaft accuses both of Geheimdienstliche Agententätigkeit for Russia under §99 StGB. Their alleged assignment: surveilling a German entrepreneur who supplies drones and components to Ukraine.

For readers of the Verfassungsschutzbericht, the case is not surprising. The BfV has classified Russian intelligence activity in Germany as a top-tier threat since 2022, ranking it alongside Chinese economic espionage and Islamist terrorism. Yet the institutions responsible for detecting and prosecuting such activity remain caught between a federal structure designed for a different century and a political class that has not prioritized intelligence reform with the same urgency it brought to military procurement after the Zeitenwende.

The Arrest and the Charges

The Bundesanwaltschaft confirmed the arrests in March 2026. §99 StGB, the relevant statute, criminalizes intelligence gathering for a foreign power on German territory. It is the Federal Prosecutor's exclusive domain; no Staatsanwaltschaft at the state level can bring this charge. The maximum sentence is five years, rising to ten in severe cases.

Prosecution statistics under §99 StGB tell a story of restraint. The Bundesanwaltschaft has historically brought only a limited number of cases per year. This is not because espionage has been rare, but because the evidentiary hurdles are substantial. Intelligence agencies must weigh whether exposing surveillance methods in court is worth the conviction. In many cases, the calculus favors continued observation or quiet expulsion over prosecution.

The cross-border dimension of this case, arrests in both NRW and Spain, points to a European Arrest Warrant and probable coordination through Eurojust. That German prosecutors were able to secure a simultaneous arrest in another EU member state reflects genuine improvement in European judicial cooperation. Spanish authorities cooperated. The mechanism worked.

The BfV: Growing, but Not Fast Enough

The Bundesamt für Verfassungsschutz employs roughly 4,500 people. Under former President Thomas Haldenwang, the service expanded, and its budget rose from approximately 470 million euros in 2021 to nearly 580 million euros by 2025. These are meaningful increases by the standards of German bureaucratic spending.

They are not meaningful by the standards of the threat. Consider the comparison: MI5 in the United Kingdom employs more than 5,000 staff for 67 million residents. France's DGSI has approximately 5,000 personnel for 68 million. Germany has 84 million residents, the largest economy in Europe, and a geographic position that makes it the central transit and operating environment for foreign intelligence services on the continent. The BfV covers more ground with fewer people per capita than either MI5 or DGSI.

Haldenwang acknowledged this publicly in 2023, noting that scaling up, especially in technical roles such as cyber intelligence and signals analysis, requires years of recruitment and training. The service cannot simply hire 500 analysts and deploy them immediately. Security clearances alone take months.

The Verfassungsschutzbericht paints an increasingly alarming picture. Russian intelligence operations in Germany have not decreased since the 2022 diplomatic expulsions. They have adapted, shifting from embassy-based officers with diplomatic cover to recruited civilians, including EU nationals and diaspora members. The BfV documents this shift. Whether it has the operational capacity to keep pace with it is a separate question.

Sixteen LfVs and the Coordination Problem

Germany's counterintelligence is not centralized. It is federal. The BfV handles national security threats. Sixteen Landesämter für Verfassungsschutz handle state-level intelligence tasks, each under its own interior ministry, each with its own legal framework and political oversight.

The result is predictable to anyone familiar with German federalism: information flows imperfectly. The Parlamentarisches Kontrollgremium has flagged this repeatedly. The NSU debacle, in which a right-wing terrorist cell murdered ten people over a decade while being partially monitored by multiple state LfV offices that did not share their intelligence effectively, forced reforms in the 2010s. The Gemeinsames Terrorismusabwehrzentrum and the NADIS database improved information sharing for terrorism cases.

Espionage, however, does not fit neatly into the post-NSU framework. A Russian intelligence network operating in NRW may have connections to targets in Bayern, Sachsen, or Hamburg. The LfV in NRW has no automatic obligation to share raw intelligence with the BfV unless the case meets specific legal thresholds. In practice, cooperation works when personal relationships between agency heads are good. When they are not, cases fall through.

The Tiergarten murder in 2019 underscored the problem from a different angle. A Russian state-sponsored assassin entered Germany, killed a Georgian national in broad daylight in a Berlin park, and was apprehended only because a passerby noticed him disposing of evidence. The failure was not in prosecution, where German courts ultimately convicted the killer and identified Russian state involvement. The failure was in prevention: no agency flagged the entry, monitored the suspect, or connected the operational indicators in time.

NRW: Industrial Heartland, Intelligence Target

The drone entrepreneur at the center of this case was based in Nordrhein-Westfalen. This is not coincidental. NRW hosts one of Germany's densest concentrations of defense-adjacent industry, dual-use technology firms, and research institutions. The Ruhrgebiet's industrial legacy has evolved into a modern ecosystem of specialized manufacturers, many of them Mittelstand companies with fewer than 500 employees.

The BfV's Wirtschaftsschutz reports have flagged NRW repeatedly as a high-priority target for both Russian and Chinese intelligence services. The logic is straightforward: Germany's industrial strength lies in its Mittelstand, and many of these companies now produce components or systems with military applications. They operate without the security infrastructure of large defense contractors like Rheinmetall or KNDS. No facility clearances. No systematic personnel vetting. No counterintelligence briefings.

The BfV has intensified its Wirtschaftsschutz outreach, holding informational sessions for companies in sensitive sectors. But the initiative started late, reaches a fraction of potentially targeted firms, and competes for attention with more established concerns about cybersecurity. A fast-growing drone startup in NRW is unlikely to have a security officer, let alone a protocol for identifying surveillance by a foreign intelligence service.

The Zeitenwende That Didn't Reach the BfV

Chancellor Scholz declared the Zeitenwende on 27 February 2022. The 100-billion-euro Sondervermögen was established for the Bundeswehr. Germany committed to the two-percent NATO spending target. Forty Russian diplomats were expelled in April 2022.

The intelligence services were not part of this equation. The Sondervermögen is earmarked for military hardware, readiness, and infrastructure. Not a single euro is designated for BfV expansion. BND reform received some legislative attention, partly because of its foreign intelligence mandate and partly because the BND-Gesetz was already under review following a Federal Constitutional Court ruling in 2020. BfV structural reform has not been the subject of any legislative initiative.

Members of the PKGr from the SPD, Grüne, and FDP have called publicly for faster modernization of the intelligence architecture. These statements have not translated into bills. Intelligence reform is politically unrewarding. It involves classified capabilities that cannot be discussed publicly, produces no visible infrastructure, and activates historical sensitivities about domestic surveillance that are deeply rooted in German political culture, from the Gestapo to the Stasi to the BND's own controversies.

The result is an asymmetry. Germany has upgraded its military posture significantly since 2022. Its intelligence posture, the one that is supposed to detect threats before they materialize, has received modest budget increases and rhetorical support but no structural overhaul.

What the PKGr Sees, and What It Cannot Change

The Parlamentarisches Kontrollgremium is the Bundestag's mechanism for oversight of the three federal intelligence services: BND, BfV, and MAD. Its members hold the necessary security clearances and receive classified briefings. Their public statements, necessarily vague, have grown increasingly pointed since 2022.

PKGr members have flagged three recurring issues. First, the BfV's staffing levels are inadequate relative to the documented threat. Second, the federal-state split creates intelligence blind spots that adversaries exploit. Third, the legal framework for espionage prosecution is outdated and discourages aggressive use.

The PKGr can pressure. It can request reports. It can criticize publicly, within the limits of classification. What it cannot do is legislate. Intelligence reform requires executive initiative, coalition agreement, and parliamentary majority. In the current political environment, where coalition management consumes most legislative bandwidth, intelligence reform has not reached the top of the agenda.

What We Do Not Know

The Bundesanwaltschaft has not identified which Russian service directed the operation. The GRU, SVR, and FSB all maintain operations in Germany, with overlapping and sometimes competing mandates. How the suspects were recruited, how long they operated, and what specific intelligence they gathered and transmitted has not been disclosed.

Whether this case connects to other known Russian espionage operations in Germany remains publicly unknown. The BfV's annual reports document a broad pattern of activity, but individual cases are rarely linked publicly to the wider network unless a trial produces such connections.

The information gap is standard at the arrest stage. It is also structural. Germany's intelligence ecosystem generates limited public transparency about espionage threats compared to the United Kingdom, where MI5's Director General delivers periodic public threat briefings, or France, where DGSI's assessments enter public debate more readily. In Germany, the public depends on the Verfassungsschutzbericht, an annual report that documents threats but rarely provides operational detail.

The arrests confirm what the BfV has been saying for years: Germany is a high-priority target for Russian intelligence. The question is no longer whether the threat exists. The question is whether the institutions tasked with countering it are equipped for the task. As of March 2026, the honest assessment is: not yet.