Germany is facing an escalation in foreign espionage risks, with growing suspicions that defense industries, military installations, and supply networks are being targeted as the country strengthens its military presence on NATO’s eastern flank. Espionage activities have gone beyond gathering secret information, raising concerns that collected data could be used to exert strategic pressure or prepare potential subversive activities.
On October 22, 2026, German authorities announced the arrest of a 53-year-old Ukrainian citizen in the state of Brandenburg on suspicion of conducting intelligence activities for Russia. According to allegations reported by the Federal Public Prosecutor’s Office, the suspect is believed to have collected information of military significance through contacts with a Russian intelligence agency via an intermediary. These allegations remain subject to investigation and legal proceedings.
According to published information, suspicions centered on the collection of data related to the production of armored vehicles, ammunition, and explosives, as well as information about individuals and military installations associated with NATO. German media reports indicated that the suspect had shown interest in the 45th Armored Brigade, known as the “Lithuania Brigade,” which Germany plans to fully deploy in Lithuania and bring to a higher level of operational readiness in 2027.
This deployment marks a significant shift in German defense policy, reflecting Berlin’s commitment to strengthening the defense of the Baltic states against Russian threats. It also increases the sensitivity of information concerning troop movements, readiness, and logistical requirements, as its disclosure could provide a hostile party with valuable indicators for assessing military capabilities and vulnerabilities.
The risks are not limited to electronic intrusions or the acquisition of classified documents. They can also involve targeting personnel in defense industries, building relationships with individuals who possess sensitive information, and monitoring installations or military movements. However, the available information does not establish that all these activities are part of a single, coordinated operational plan.
German Chancellor Friedrich Merz has warned of the continued increase in Russian intelligence activities in Germany, stating that uncovering the case represents a security success but does not mean the threat has ended. These warnings come amid a series of investigations and arrests linked to suspicions of Russian espionage during 2026.
Federal Prosecutor Rommel previously pointed out, according to the report, that intelligence gathering could pave the way for further activities, including sabotage, targeting individuals, and attempts to undermine German support for Ukraine. The nature and objectives of each case, however, remain dependent on the evidence uncovered through investigations.
Germany is not facing an exclusively Russian threat. Authorities have also announced investigations into suspected espionage activities linked to China and Iran. This reflects the broader security challenge confronting German institutions, from universities and research centers to defense industries and communities targeted by intimidation or surveillance.
Germany’s dilemma lies in the possibility that espionage could serve as a preliminary stage in broader hybrid activities. However, establishing a transition from information gathering to sabotage requires independent evidence in each case. Berlin’s ability to protect its own security and that of NATO’s eastern flank will depend on how quickly it detects infiltrations, strengthens the resilience of its defense industries, and improves information-sharing with its allies.
Researcher in international security and terrorism and head of the European Center for Counterintelligence and Human Security (ECCI)
Disclaimer: The opinions expressed by the writers are their own and do not necessarily represent the views of Annahar.
