Low-Cost Sabotage, High-Cost Defense: Germany’s Infrastructure Is Europe’s New Hybrid Front

Between January and August, German authorities recorded more than 165 suspicious incidents potentially connected to sabotage. They also registered roughly 750 suspicious drone incidents involving 1,068 flights over critical infrastructure, military facilities and defence sites.

The figures point to a security problem that is difficult to contain precisely because it does not resemble conventional warfare.

A cheap way to impose an expensive burden

The latest attacks on Germany’s electricity network illustrate the imbalance particularly clearly.

Between September 4 and September 8, police and bomb-disposal specialists found and neutralised 21 improvised explosive and incendiary devices near the Graustein substation in Saxony, close to the Polish border. The devices were positioned along high-voltage transmission lines and designed to create severe short circuits.

Elsewhere, attackers used an even simpler method. At Bergheim, west of Cologne, and at the Jänschwalde power plant in Brandenburg, improvised rockets were used to fire thin wires across overhead electricity lines. The resulting short circuits knocked generating capacity offline in one case and succeeded in disrupting operations in the other.

At the Weisweiler lignite power station near Aachen, police responding to a suspicious person discovered further launching equipment close to high-voltage lines. A bomb-disposal operation followed.

None of these incidents produced a nationwide blackout. That is precisely why the economic and security problem is easy to underestimate.

An attack requiring relatively primitive equipment can force police deployments, bomb-disposal operations, motorway closures, searches, and prolonged protection of infrastructure extending across thousands of kilometres. The cost is not determined by the sophistication of the weapon. It is determined by the response it forces.

Germany’s power system was built around the assumption that its major vulnerabilities would be protected against conventional physical threats. Low-tech sabotage turns that assumption upside down. Transmission lines cross rural areas, industrial sites occupy civilian environments and thousands of pieces of infrastructure cannot simply be placed behind military-grade perimeter security.

That creates an uncomfortable asymmetry: the attacker needs only to find a vulnerable point, while the defender has to protect the entire network.

The problem of attribution

The German authorities are also dealing with a second difficulty: not every saboteur has the same motive or sponsor.

The power-grid attacks have been linked by federal investigators to Daniel V., a 48-year-old climate activist from Gevelsberg. Signed letters opposing fossil fuels were sent to media organisations, while explosives were seized at his apartment. A converted lorry in Niederzier and the Hambach Forest were subsequently searched, but the suspect remains the subject of a national manhunt.

The Munich case has a different profile. On September 3, incendiary devices were thrown at a construction site beside the headquarters of defence technology company Rohde & Schwarz and near Helsing, a developer of AI-based military drone technology used by Ukraine. Two Bulgarian nationals were arrested at a nearby petrol station. Authorities established a political motive aimed at intimidation, but direct involvement by a foreign intelligence service has not been confirmed.

These cases matter because they show why the security response cannot simply treat every suspicious incident as part of a single centrally directed campaign.

A domestic extremist can attack critical infrastructure for ideological reasons. A foreign intelligence service can use criminals or politically motivated individuals as disposable intermediaries. The physical methods may look similar, while the strategic purpose is entirely different.

For European security agencies, the distinction is becoming harder to make - and more consequential.

Leipzig crosses a different line

The explosive drone recovered at Leipzig/Halle Airport represents the sharper geopolitical development.

German Interior Minister Alexander Dobrindt publicly accused the Russian state of organising the operation through what he described as low-level recruited proxies. That attribution followed a forensic investigation rather than simply the political assessment that Russia would benefit from such an attack.

Investigators recovered DNA and other forensic evidence from the drone, its internal explosives container and a signal-boosting antenna attached to a nearby tree. The evidence connected the operation to two principal suspects: a Russian national with a Latvian passport and a Belarusian national with a Russian passport. Investigators are also following leads extending into Poland and Serbia.

That evidence gave Berlin a basis for moving from the language of suspected hybrid activity to a direct accusation against the Russian state.

The distinction is important. Hybrid operations have often remained deliberately below the threshold at which governments feel compelled to respond as though they were confronting an act of open aggression. Attribution changes the political equation because it assigns responsibility not merely to an unknown saboteur, but to a state.

Germany responded by closing the Russian Consulate-General in Bonn, accusing it of operating as an espionage and hybrid-warfare hub. Moscow rejected the accusation, accused Germany of seeking war and ordered the closure of German Goethe-Institut cultural centres in Russia.

The diplomatic escalation therefore followed the forensic one.

Defence companies are becoming infrastructure targets

The geography of the attacks is as important as their methods.

Rohde & Schwarz produces radar and drone-jamming systems. Helsing develops AI systems for autonomous military drones supplied to Ukraine. In Estonia, an August fire affected a facility used by Milrem Robotics, a defence manufacturer specialising in unmanned ground vehicles.

The pattern places Europe’s defence industrial base alongside energy infrastructure as a target category.

That matters because Europe’s ability to support Ukraine depends not only on governments delivering weapons, but on a network of companies producing sensors, electronic systems, drones, robotics and other technologies. Many of these companies are commercial enterprises operating from sites that were not designed to function as military installations.

A factory or research facility located inside a European city cannot easily be defended in the same way as a military base. Yet once such sites become targets, the distinction between civilian industrial security and national defence begins to disappear.

Companies face pressure to increase surveillance, perimeter protection and counter-drone capabilities. Governments, meanwhile, must decide how much of that burden should be transferred from private industry to the state.

The economic consequences extend beyond the immediate cost of repairs. Higher insurance premiums, additional security personnel, delays and capital expenditure all raise the cost of producing the equipment Europe increasingly wants in greater quantities.

NATO’s deterrence problem is changing

The most difficult challenge may be that conventional deterrence is poorly suited to this form of warfare.

A military alliance can deter a state by making the consequences of a direct attack clear. It is harder to deter an intelligence service from recruiting an individual online, paying a criminal to carry out an arson attack or using a commercially available drone for a limited operation.

The deniability is part of the method.

NATO has increasingly recognised that cumulative hybrid and cyber attacks can raise questions about collective defence, including Article 5. But the threshold remains deliberately ambiguous. That ambiguity becomes harder to manage when individual operations are small, dispersed and carried out by people who may have no formal connection to the state directing them.

Germany is now responding on two levels. The government has announced a national protection shield for airports and transport hubs and established a dedicated Cyberdome. European governments are also tightening diplomatic and intelligence co-operation. Poland and the UK summoned Russian ambassadors after the Leipzig attribution, while German, Polish and French foreign ministers met in Weimar.

Denmark’s intelligence service has separately warned that Russian agents are recruiting citizens through social media and gaming platforms to photograph defence sites for potential future sabotage.

The emerging model is therefore less about a spectacular attack than persistence: many small operations, conducted cheaply, forcing governments to spend continuously to prevent the next one.

The price of defending an open Europe

The European Union is preparing a sanctions expansion involving roughly 1,600 new listings aimed at Russia’s defence-industrial complex, dark-fleet oil tankers and visa restrictions affecting Russian military personnel and tourists. EU foreign policy chief Kaja Kallas has described the Leipzig operation as state terrorism.

Sanctions can raise the cost for the networks behind these operations. They cannot, however, physically protect a power line running through a forest or a defence contractor operating from a civilian industrial district.

That is where Europe faces a deeper policy problem.

The continent's infrastructure was designed for openness, connectivity and economic efficiency. Its energy networks, transport hubs and industrial supply chains depend on physical systems that stretch across borders and cannot all be guarded continuously. Turning those networks into permanently hardened assets would be extraordinarily expensive.

Yet leaving them exposed creates another cost: every improvised device, drone or arson attack forces the state to mobilise resources vastly disproportionate to the attack itself.

Germany is therefore being pushed towards a security architecture in which police, intelligence agencies, infrastructure operators and defence authorities increasingly perform overlapping functions. The old boundary between domestic crime and national security becomes less useful when the same electricity pylon can be targeted by an ideological extremist or as part of a foreign intelligence operation.

The strategic advantage of proxy sabotage lies precisely in that uncertainty. It makes the defender spend as though the threat were everywhere, while the attacker needs to succeed only occasionally.