Germany is experiencing growing pressure on the front of espionage, intelligence activities and sabotage attributable to foreign powers.

According to an official response from the federal government to the Bundestag, between July 10, 2021 and July 10, 2026 the German Federal Prosecutor opened 58 investigative proceedings related to intelligence activities, sabotage, sabotage preparation and related offenses.

The judicial balance sheet includes 30 arrests, 19 indictments and 13 convictions.

A picture that shows how German territory has become one of the main European fronts in the confrontation between foreign intelligence services, critical infrastructure, defense industry and state apparatus.

Fifty-three cases linked to foreign intelligence activities

The most significant data concerns the nature of the proceedings.

According to information communicated by the German government, 53 of the 58 proceedings opened by the Federal Prosecutor involved intelligence activities attributable to foreign states.

This does not mean that all cases are attributable to the same country.

Germany is indeed at the center of a much broader confrontation involving various international actors interested in gathering information on German politics, economy, research, infrastructure and military capabilities.

Federal authorities consider particularly sensitive activities directed against state institutions, Armed Forces, critical infrastructure and security and defense industry.

The defense industry among the main targets

The response to the Bundestag highlights how the German security and defense sector represents one of the objectives of greatest interest for foreign intelligence services.

The reason is obvious.

Since the beginning of the war in Ukraine, Berlin has accelerated rearmament programs, ammunition production, air defense systems, drones, armored vehicles and industrial cooperation with Kyiv and other NATO partners.

Information on production capacity, technologies, supplies, military programs and specialized personnel have therefore assumed growing strategic value.

In this context, industrial and military espionage no longer represents a phenomenon separate from geopolitical confrontation, but a direct component of competition between states.

Russia among the main threats identified by Berlin

The German government has repeatedly identified Russia among the actors most active in the field of espionage and sabotage on federal territory.

According to authorities, activities attributed or traced back to Russian circles include information gathering, surveillance of sensitive targets, influence operations and possible preparatory activities for sabotage.

Berlin also believes that Russian services have progressively expanded their use of intermediaries and collaborators recruited through social networks and messaging platforms.

The German picture fits into a broader dynamic observed in several European countries following the Russian invasion of Ukraine.

Iran under scrutiny as well

The same documentation also indicates growing attention to activities attributed to Iran.

According to Berlin, Tehran has also resorted to proxies and subjects from the criminal environment for surveillance activities and for the preparation of operations against targets considered sensitive.

The model shows a characteristic increasingly common in contemporary clandestine operations: using intermediaries capable of distancing the material executor as much as possible from the state apparatus that would have ordered the operation.

A strategy that makes it more difficult to directly attribute political responsibility for an action.

Berlin responds: more operational powers for intelligence services

The figures on espionage and sabotage have already produced a political response. In August 2026, the German government approved a deep reform of the regulations governing the Bundesnachrichtendienst (BND) and the Bundesamt für Verfassungsschutz (BfV), justifying it with the increase in threats posed by espionage, sabotage, cyberattacks and clandestine operations by foreign powers.

The most relevant change concerns the possibility for the services to adopt, within limits established by law and subject to control, actual active protection measures.

The BND could, for example, intervene against a foreign server from which a cyberattack is about to be launched or penetrate computer systems used by hostile entities. The project also mentions interventions against the infrastructure of state hacker groups, disinformation networks and, in the most serious situations, systems linked to chemical weapons laboratories or drone factories.

The reform also expands data collection and analysis capabilities, regulates the use of artificial intelligence and biometric recognition, and facilitates information sharing between BND, other federal authorities and the Bundeswehr.

Germany is therefore modifying not only investigative tools but the very role of its services: from apparatus primarily dedicated to intelligence gathering to structures capable, under certain circumstances, of directly intervening against a threat.

Thirty arrests and thirteen convictions

The figures provided by the German government indicate that investigative activity has not been limited to monitoring.

During the period examined, 30 arrests were made.

In 19 cases the prosecution presented a formal indictment, while 13 proceedings concluded with a conviction.

The gap between investigations, indictments and convictions is not anomalous: intelligence activities are by nature complex to prove in court and often require long investigative periods.

To this is added the difficulty of reconstructing the chain of command between executor, intermediaries and foreign apparatus.

From classical espionage to hybrid warfare

Germany's centrality in the European political, economic and military system makes it a natural target for numerous foreign services.

Berlin hosts NATO structures, important military installations, strategic industries, research centers and one of the largest economies on the continent.

Since 2022, its weight in military support to Ukraine has also grown rapidly.

Germany has become one of Europe's main suppliers of weapons to Kyiv and a crucial logistics hub for the NATO device on the eastern flank.

Gathering information on German capabilities therefore means obtaining information that can concern not only Berlin, but the entire European security system.

The picture presented by the Bundestag finally highlights how the border between espionage, sabotage and hybrid warfare has become increasingly blurred.

An intelligence activity can be used to identify vulnerabilities.

Surveillance of infrastructure can precede sabotage.

Information gathering on a defense company can serve to understand production capacity, supplies or technologies.

This is why the German figures assume a significance that goes beyond simple judicial statistics.

Fifty-eight proceedings in five years, thirty arrests and thirteen convictions indicate that espionage on European territory no longer belongs solely to the hidden dimension of competition between states: it has become one of the concrete tools of the new hybrid warfare.