Ilona W. Case: How Russian Intelligence Mapped Berlin’s Political Networks

According to the 74-page indictment filed on September 7, Ilona W. - identified by independent media as Ilona Kopylova-Wiener - passed sensitive information to Andrei M., a Russian GRU officer operating under diplomatic cover as a deputy military attaché in Berlin. She was arrested by the Federal Criminal Police Office in January and remains in custody.

If the allegations are proved, the operation points to a form of intelligence gathering that is particularly difficult for an open political system to defend against. Conferences, associations, business forums and professional networks are designed to create access. Intelligence services can use the same access to construct a map of who knows whom, who influences whom and who can reach sensitive parts of the state.

That is a very different proposition from stealing state secrets.

The intelligence value of a guest list

According to the indictment, Ilona W. began systematically gathering information at least by October or November 2023. One of the documented episodes involved the NATO Talk event at Berlin’s Adlon Hotel, where prosecutors say she collected participant lists, contact profiles, and information about relationships within the network.

In December 2025, she allegedly gathered information on senior participants at the German-Ukrainian Economic Forum while sitting close to Chancellor Friedrich Merz and Ukrainian President Volodymyr Zelenskyy.

The individual pieces of information may appear innocuous. A name, an employer, a conference appearance or a professional connection is not necessarily classified. Yet intelligence value does not always reside in the individual fact. It can emerge from the combination.

That is the logic behind what the defence describes as a “mosaic theory”: publicly accessible fragments are assembled into an intelligence picture. Defence lawyer Martin Schüßler has argued that prosecutors are applying espionage law too broadly by connecting otherwise legitimate activities into a single intelligence narrative. Ilona W. has not testified on the core allegations.

The prosecution's case therefore raises a difficult question for democratic states. If intelligence gathering can be built from information that is individually public, where should the boundary lie between legitimate political networking and covert intelligence activity?

German law does not require every piece of information passed to a foreign intelligence service to be a state secret. Section 99 of the Criminal Code covers geheimdienstliche Agententätigkeit, or intelligence agent activity, including gathering or transmitting information for a foreign intelligence service. The Federal Prosecutor's Office initially considered the possibility of espionage in a particularly serious case but abandoned that suspicion because it said the evidence was insufficient.

That distinction matters. It means the case is not simply about whether Ilona W. possessed classified material. It is about the alleged purpose and organisation of her activities, and about the relationship between her and a foreign intelligence service.

Access was the asset

Ilona W. was not operating from the margins of Berlin's political establishment. She ran a PR and marketing company alongside a non-profit association devoted to international understanding. The association's board included prominent entrepreneurs and former Bundestag members from both the SPD and CDU.

That social position is central to the case.

A PR professional has an obvious reason to know politicians, business leaders, and diplomats. An international association has an obvious reason to bring together people from different political and institutional backgrounds. Participation in conferences and networking events is not suspicious in itself.

That makes such environments useful to an intelligence service precisely because they are legitimate.

One of the most consequential allegations concerns a Bundeswehr reservists' assembly in February 2024. Prosecutors say Ilona W. facilitated the entry of Andrei M. using a false German identity. The alleged operation therefore went beyond collecting names. It allegedly created an opportunity for a GRU officer to enter a military network that would otherwise have been more difficult to access.

The investigation also led to searches of properties belonging to two former employees of the German Defence Ministry who had been in contact with the suspect. The precise significance of those relationships will form part of the legal process, but their existence illustrates why intelligence services may value people who can provide introductions as much as those who can provide documents.

The target is the network itself.

From espionage to network warfare

The alleged GRU activity fits into a broader security environment in Germany that has become increasingly difficult to separate into neat categories of espionage, sabotage and influence.

Germany has been a central hub for military assistance to Ukraine, logistics and European diplomatic co-ordination since Russia's full-scale invasion in 2022. Russian intelligence activity in the country has consequently extended across surveillance, cyber operations and physical sabotage.

In August 2026, German authorities neutralised an explosive-laden drone targeting an Antonov An-124 cargo aircraft at Leipzig/Halle airport. Investigators identified Russian national Oleg L., linked to the GRU, and Belarusian national Andrei K. as primary suspects. The drone carried about 1.8kg of Semtex and was aimed at an aircraft loaded with 25,000 litres of aviation fuel.

German authorities are also investigating more than 100 cases involving unauthorised drone flights, arson and weapons caches connected to recruited proxy actors. Among them is the July 2024 fire at a DHL facility in Leipzig.

These operations look very different on the surface. A drone carrying explosives is an overt physical threat. Mapping political networks is quieter and potentially much harder to detect. Yet both can serve the same strategic purpose: identifying and exploiting vulnerabilities inside an adversary's infrastructure.

The distinction between intelligence collection and preparation for future operations becomes less clear when the information being gathered concerns people rather than documents.

A database of relationships can reveal who has access to military circles, which political figures interact with particular businesses, who can open doors to defence networks and where influence may be exerted without attracting immediate attention.

For Russia, that can be more useful than a single stolen document.

The security perimeter is moving

The German response shows how counter-intelligence is beginning to move beyond its traditional focus on classified information and conventional defence targets.

After the investigation, Germany expelled Andrei M. Russia responded by expelling a German diplomat. Berlin also summoned the Russian ambassador and closed Russia's Consulate General in Bonn. Moscow ordered the closure of Goethe-Institut facilities in Russia.

The diplomatic retaliation gives the case a second dimension. A covert intelligence operation conducted through social and professional networks has produced consequences normally associated with a more conventional confrontation between states.

For German security agencies, the harder problem is domestic. A system built around defence contractors, classified facilities and formal diplomatic channels cannot easily identify an intelligence operation that uses a legitimate association or a PR company as its access point.

The implication is not that non-profits, political boards or international conferences are inherently security risks. Treating them that way would undermine the openness that makes them useful. The problem is how to distinguish normal networking from deliberate intelligence cultivation without turning ordinary civic life into a security-screening exercise.

That tension is likely to become sharper as Germany expands scrutiny of the people and organisations surrounding politically and militarily sensitive institutions. Vetting that once concentrated on defence contractors may increasingly reach public relations companies, business forums, civic associations and other intermediaries whose formal purpose is entirely legitimate.

Dual-national professionals are likely to encounter particular institutional friction as a result. The challenge for German authorities will be to improve counter-intelligence without allowing nationality, professional networks or political connections to become crude substitutes for evidence.

The courtroom will test the boundary

The case will ultimately turn on more than the existence of contacts between Ilona W. and a Russian intelligence officer.

The prosecution must establish the significance of the alleged information-gathering, its connection to a foreign intelligence service and the legal basis for treating the activity as intelligence agent activity. The defence, meanwhile, can challenge whether prosecutors have transformed a series of lawful public activities into an intelligence operation simply by assembling them into a narrative.

That makes the case unusually important for the future of counter-intelligence in an open society.