Germany isn’t at war—but it’s acting like a target. And that distinction now matters less than ever.
Germany has taken a decisive step toward hardening its critical infrastructure, passing new legislation amid mounting fears that rising tensions with Russia are translating into sabotage, cyberattacks, and hybrid warfare on European soil.
On Thursday, lawmakers approved a sweeping security package requiring power utilities, water suppliers, food distributors, and even some supermarket chains to reduce their vulnerability to terrorism, espionage, industrial accidents, natural disasters, and public health emergencies. The law brings Germany into line with new European Union resilience directives and marks one of Berlin’s most significant domestic security shifts since the Cold War.
“Germany is not at war, but we are the target of hybrid warfare,” Interior Minister Alexander Dobrindt told parliament ahead of the vote. “Sabotage, espionage, aggression by foreign powers, terrorism—we have a responsibility to ensure resilience.”
The legislation applies to roughly 1,700 operators providing essential services to at least 500,000 people, spanning sectors such as energy, water, food, health, transport, telecommunications, financial services, IT, and waste disposal. Companies will be required to upgrade physical security and alarm systems, conduct regular risk assessments, train staff, and report incidents to Germany’s civil protection authorities within 24 hours.
The political urgency was sharpened by a recent incident in Berlin, where a midwinter arson attack on a high-voltage power cable plunged tens of thousands of households into darkness for nearly a week. The blackout disrupted mobile networks, heating systems, and local rail services, highlighting how quickly infrastructure failures can cascade. The attackers, a far-left militant group calling itself the “Vulkangruppe,” claimed responsibility, prompting public outrage and a government offer of a €1 million reward for information leading to arrests.
Dobrindt argued that such attacks demonstrate the need to rethink openness around sensitive systems. “We must shift from transparency toward greater resilience,” he said, signaling plans to limit public access to detailed infrastructure data such as online maps of power grids—information security experts warn could be exploited by hostile actors.
Germany’s move comes as Europe’s largest economy reassesses its domestic defenses after decades of relative stability. As a major supporter of Ukraine and a central logistics hub for NATO, Germany has become increasingly exposed to retaliatory or destabilizing actions linked to Russia.
Defense Minister Boris Pistorius has warned of a surge in hybrid attacks across Europe, citing cyber intrusions, data cable sabotage in the Baltic Sea, drone-based espionage, and coordinated disinformation campaigns. These threats, he said, are already disrupting supply chains, energy security, and private-sector operations.
Not everyone is convinced the new law goes far enough. Konstantin von Notz, a security expert from the Greens, called the package “too little, too late,” arguing Germany remains “miles away” from uniform protection of its critical infrastructure.
Security specialists, however, stress that absolute protection is unrealistic. Daniel Hiller of the Fraunhofer Institute noted that modern infrastructure systems are so interconnected that resilience depends less on impenetrability and more on redundancy and contingency planning. “Anyone claiming 100% protection is possible is misleading the public,” he said.
That view is echoed by Sabrina Schulz of the European Initiative for Energy Security, who argues that building backups and rapid recovery capacity may matter more than fortifying individual assets. As Chancellor Friedrich Merz pledges to expand Germany’s conventional military strength, Schulz cautioned that civilian resilience is “at least as important as tanks and drones.”
The new law reflects a broader recognition in Berlin: in an era of hybrid conflict, the front line no longer lies only at the border. It runs through power cables, data networks, water systems, and supply chains—and defending them has become a core task of national security.
