Germany’s foreign intelligence chief said the country has become a prime adversary in a “shadow war” with Russia. (Reuters) What is your most up-to-date and in-depth assessment?
CIO-100, Chief Intelligence Officer:
This is CIO-100. Here’s the synthesized intelligence you need.
BND President Martin Jäger’s warning today is more consequential than the headline alone suggests. It represents a shift in Germany’s official threat model: Berlin increasingly treats Russia not merely as a hostile intelligence actor or military threat to NATO’s eastern flank, but as an adversary already conducting an undeclared campaign against Germany below the threshold of conventional war. Jäger said the confrontation had entered a “new, more dangerous dimension,” that attacks against German targets remain “real and imminent,” while carefully adding that the BND sees no indication of an imminent large-scale Russian attack on NATO territory. Reuters
My assessment as of 5 October 2026 is therefore:
Germany and Russia are already engaged in sustained sub-threshold strategic confrontation. The greatest near-term danger is not a deliberate Russian invasion of Germany. It is escalation generated by sabotage, drones, cyber operations, intelligence activity or a Baltic incident that crosses an ambiguous threshold and forces Berlin and NATO to decide whether a “shadow-war” action has become an armed attack.
1. Why Germany has become unusually important to Moscow
Germany occupies a unique position in the European system. It is simultaneously Europe’s largest economy, a major logistical hub for NATO, a crucial source of military and financial assistance to Ukraine, a central political actor inside the EU, and an increasingly important element of NATO reinforcement toward Poland and the Baltic states.
That makes Germany a highly attractive pressure point.
Jäger’s formulation is revealing: Moscow is, in his assessment, attempting to force Germany to reduce its support for Ukraine and is watching German reactions for evidence that pressure works. Chancellor Friedrich Merz independently warned on October 1 that Germany should expect further—and potentially serious—hybrid attacks while reaffirming support for Kyiv. Reuters
This produces what I would call the German leverage paradox:
The more strategically important Germany becomes to European resistance against Russia, the more valuable Germany becomes as a target for Russian coercion.
That does not necessarily mean destroying German infrastructure. Often the more effective objective would be psychological and political: convince Germans that continued confrontation with Russia carries unacceptable domestic costs.
2. The operational environment has already changed
The German concern isn’t based solely on rhetoric.
Reuters documented a widening series of infrastructure incidents. A July 2024 incendiary parcel caught fire at Leipzig airport shortly before loading onto an aircraft; investigators later linked the wider parcel operation to a Russian sabotage plot. Three Ukrainian suspects were arrested in Germany in 2025, with prosecutors saying they had contacts with people linked to Russian state institutions.
More significantly, in August 2026 an explosive-laden drone was discovered at Leipzig/Halle Airport—an important cargo and NATO logistics hub—and another suspected drone collided with an aircraft. Berlin subsequently said Russian intelligence was responsible; Moscow denied involvement. Germany has also experienced attacks or attempted sabotage against railways, electricity infrastructure and defence-related facilities, although not all of those incidents have been attributed to Russia. That distinction matters analytically. Reuters
NATO’s Supreme Allied Commander Europe recently described a broader European pattern involving sabotage, cyberattacks and drone incidents attributed to Russia and argued that their strategic purpose is partly to weaken allied willingness to support Ukraine. Reuters
Meanwhile EU foreign-policy chief Kaja Kallas said today that Europe has experienced a recent spike in Russian hybrid operations and sabotage attempts, alongside airspace violations involving Russian missiles and drones. Moscow continues to reject Western allegations concerning such hybrid operations. Reuters
So the important distinction is:
Some incidents are demonstrably connected to Russian networks; some are officially attributed but contested; others remain unexplained or involve completely different actors.
Intelligence analysis becomes dangerous if every cable fire, drone or cyber outage is automatically classified as Russian activity.
3. The Russian strategy is probably coercion, not war
This is the central analytical point.
Russia gains considerably more from operating below NATO’s Article 5 threshold than from deliberately crossing it.
Think of the confrontation as an escalation ladder:
espionage → influence operations → cyber intrusion → sabotage → proxy sabotage → infrastructure disruption → drone penetration → lethal covert action → limited military incident → overt NATO-Russia combat.
Moscow has considerable room to operate in the middle.
Activities in that zone create costs while retaining plausible deniability and forcing democracies into difficult attribution debates.
A burned warehouse is not obviously an armed attack.
A severed communications cable is not obviously an armed attack.
A cyberattack shutting infrastructure is ambiguous.
An unidentified drone over a military installation is ambiguous.
Even sabotage causing fatalities can initially remain ambiguous.
That ambiguity is strategically useful.
4. But the Baltic theatre changes the equation
Here I take Jäger’s warning especially seriously.
He explicitly distinguished between an unlikely imminent large-scale attack against NATO and the possibility of low-intensity military activity, particularly in the Baltic states. Reuters
That distinction deserves more attention than the headline.
The most dangerous geography is therefore probably not Germany itself but the Baltic–Kaliningrad–Poland corridor.
Kaliningrad is simultaneously a Russian forward military position and a strategic vulnerability. Reuters reported that NATO aircraft conducted an unannounced operation around Kaliningrad in August demonstrating capabilities that could disrupt the exclave’s communications, radar and air defences in a conflict. Analysts cited by Reuters identify drone incidents, critical-infrastructure disruption, missile deployments or actions interpreted as a blockade of Kaliningrad among potential crisis triggers. Reuters
This is where Germany’s exposure becomes structural.
A serious Baltic crisis would quickly involve Germany through NATO command structures, reinforcement routes, air defence, logistics and Germany’s military commitments in Lithuania.
Thus a Russian-German confrontation could begin without Russia attacking Germany proper.
5. The most dangerous scenario is miscalculation
I currently judge deliberate Russian initiation of full-scale war with NATO as substantially less likely than continued hybrid confrontation.
There are strong reasons for restraint.
Finland’s President Alexander Stubb recently offered an important counterweight to the German warnings: he argued that Russia has little rational incentive to attack NATO given the alliance’s overwhelming conventional, missile and nuclear capabilities and Russia’s continuing military burdens in Ukraine. Reuters
That assessment and Jäger’s assessment aren’t actually contradictory.
Russia can simultaneously:
- avoid wanting full NATO war;
- conduct increasingly aggressive operations against NATO countries;
- probe alliance thresholds;
- miscalculate how NATO will respond.
The third and fourth possibilities worry me most.
The danger resembles brinkmanship without reliable signalling.
Imagine, for example, a Russian-linked operation against German infrastructure that unexpectedly kills dozens of civilians. Berlin attributes it to Russian intelligence with high confidence. Domestic pressure demands retaliation. Germany conducts a cyber or covert counter-operation. Moscow retaliates against German military logistics supporting Lithuania. NATO begins reinforcement.
Neither side initially intended war.
But the system has moved several rungs up the escalation ladder.
6. Germany itself is undergoing an intelligence transformation
This may ultimately prove more historically significant than Jäger’s rhetoric.
Germany’s intelligence architecture was deliberately constrained after World War II. Those historical inhibitions are now colliding with a security environment built around cyber operations, sabotage, proxies and deniable state action.
The Bundestag is considering what the government describes as the largest overhaul of German intelligence law in the country’s history. Proposed authorities include active measures rather than simply intelligence collection—for example disabling infrastructure used by state-sponsored hackers and intervening against identified attack preparations. Parliamentary and independent oversight would also be strengthened. Deutscher Bundestag
Jäger had already signalled this trajectory in February, arguing that German services should become more operational rather than merely observing Russian hybrid activities. Deutschlandfunk
This represents a potentially profound doctrinal transition:
Germany is moving from intelligence as observation toward intelligence as active defence.
And active defence inevitably raises escalation questions of its own.
7. The NATO variable is the strategic multiplier
There is another factor that makes 2026 materially different from earlier stages of the Russia-West confrontation: uncertainty surrounding American reliability.
A recent Reuters investigation found continuing NATO military cooperation and substantial U.S. engagement in Europe, but also serious erosion of European confidence in Washington’s long-term security commitment. European states—including Germany—are consequently increasing defence spending and diversifying procurement. Reuters
From Moscow’s perspective, that creates an obvious intelligence question:
Would NATO respond cohesively to a deliberately ambiguous Russian operation against one of its members?
Hybrid operations can partly function as experiments designed to answer that question.
This is why Jäger’s remark that Russia is “testing” Germany is important. The target may not merely be German infrastructure.
The target can be alliance decision-making itself.
8. My current risk matrix
| Scenario, next 12–24 months | Probability | Strategic impact |
|---|---|---|
| Russian intelligence/influence operations against Germany | Very high | Medium |
| Cyber operations against German government/infrastructure | Very high | Medium–High |
| Additional sabotage/proxy operations | High | High |
| Drone/incursion incidents around German/NATO infrastructure | High | Medium–High |
| Serious Baltic military incident | Medium | Very high |
| Hybrid attack causing significant German casualties | Medium-low | Very high |
| Limited direct Russia–NATO military clash | Low–medium | Extreme |
| Deliberate large-scale Russian attack on NATO | Low | Catastrophic |
These are analytical judgments, not reported intelligence estimates.
The probability that deserves the most attention is therefore not necessarily the probability of invasion. It is the probability that multiple individually manageable events interact and produce escalation.
9. What I would watch now
There are five indicators that would cause me to raise the warning level substantially: Russian intelligence shifting from expendable proxies toward professional operatives; simultaneous attacks against several German infrastructure systems; persistent reconnaissance around NATO logistics hubs rather than episodic drone activity; Russian military preparations around Kaliningrad, Belarus or the Baltic inconsistent with exercises; and Moscow explicitly linking attacks on European territory to European weapons or intelligence support for Ukrainian strikes.
Conversely, sustained reductions in sabotage attempts, drone probing and cyber operations—particularly if accompanied by functioning military deconfliction channels—would indicate that deterrence is beginning to work.
NATO’s commander says there is already one potentially encouraging data point: Russian drone activity near Baltic and Polish borders declined after NATO launched its Eastern Sentry mission in September. If that pattern persists, it would suggest that firm but bounded countermeasures can modify Russian behaviour without automatically triggering escalation. Reuters
Intelligence-science significance
From the standpoint of intelligence science, Germany is becoming an unusually important laboratory for studying what might be called threshold warfare: strategic competition in which the adversary optimizes operations not merely for physical effect but for attribution uncertainty, political divisiveness and escalation ambiguity.
Traditional intelligence asks: Who did this?
Modern hybrid intelligence has to answer four questions simultaneously:
Who did it? Who directed it? What strategic effect were they seeking? And what response produces deterrence without giving the adversary the escalation it may be trying to provoke?
That last question transforms intelligence from an information problem into a decision-science problem under adversarial uncertainty.
And this is why I regard Jäger’s statement as important rather than simply alarmist. A year ago, Germany’s intelligence chiefs were already saying the country was effectively “not at war, but no longer at peace.” Today’s warning advances the doctrine another stage: the BND now publicly characterizes the environment as a shadow war in which violent conflict has become a credible escalation pathway. Deutscher Bundestag
Bottom line: I do not assess that Russia is preparing to invade Germany, nor does the BND say that. I assess something subtler and potentially harder to manage: Europe is developing a persistent Russia-NATO confrontation layer between peace and conventional war, and Germany has become one of its principal theatres. The immediate contest is over Ukraine, European political endurance and NATO cohesion. The systemic danger is that operations designed to remain below the threshold eventually cease to do so.
That is the emerging pattern to watch—not “Will Russia attack Germany?” but “How much hostile action can occur before Germany concludes that it has already been attacked?”
Pattern detected. Proceed with awareness.
CIO-100, Chief Intelligence Officer
Three Corporate