Protecting democracy against hybrid attacks

The systematic manipulation of information, largely orchestrated outside Germany, poses a growing risk to democratic societies – especially in the run-up to events such as the Bundestag election on 23 February in Germany. In addition, targeted cyberattacks and sabotage are carried out. Security agencies have warned against such hybrid threats and are taking comprehensive measures to protect democracy. 

Aiming to divide society

The goal of the manipulation is to undermine trust in democratic institutions, deepen social controversies and influence political opinion. Controversial topics such as migration, the Ukraine war, energy policy or the Covid-19 pandemic are targeted specifically to spread uncertainty and exacerbate conflicts within society.

One particularly insidious method is known as the “doppelganger” campaign. This involves creating pretend news websites that closely resemble renowned German media such as “Der Spiegel” or “Welt”. Doppelganger websites disseminate fake news to shake confidence in established media and to discredit political actors. Their impact is amplified by falsified user accounts on social media. In early 2024, Germany’s Federal Foreign Office identified around 50,000 such fake accounts on X, which had posted more than a million comments in German. 

Fake news portals

“We have already identified over 100 such pseudo news sites, which are presumably designed as ‘sleepers’,” says Ralf Beste, head of the Federal Foreign Office’s Culture and Society division - responsible for analysing such websites - in an interview with public broadcaster ARD. The sites are activated at a strategic moment - such as just before the Bundestag election - in order to spread disinformation in a targeted manner. 

One of many examples from the recent past is the fake report that Germany was planning to oblige private households to take in Ukrainian refugees. This false claim was circulated via social media and websites. Another manipulative method is known as “overload”, according to Ralf Beste. This involves overwhelming official agencies and organisations that tackle information manipulation by sending them endless enquiries and verification requests. “These are attacks designed to overwhelm conscientious fact checkers so that they are no longer able to do their work,” explains Beste.

Manipulation attempts ahead of elections

Disinformation really peaks in the run-up to elections. Hamburg’s constitutional protection chief Torsten Voß warned against manipulated information and techniques such as deep fakes - i.e. falsified but deceptively realistic videos and audio recordings - ahead of the Hamburg city council election on 2 March: “Such fakes could be used with the specific aim of discrediting candidates and shaking the confidence of voters.” These methods could seriously jeopardise the integrity of democratic elections, says Voß. 

The Federal Intelligence Service, the Federal Office for the Protection of the Constitution and the Military Counterintelligence Service confirm this threat - especially coming from abroad. The security agencies also warn against cyberattacks, online propaganda, acts of sabotage and targeted espionage attempts. According to the Federal Criminal Police Office, the number of acts of cybercrime orchestrated from abroad far exceeded 130,000 in 2023, a year-on-year increase of 28 percent. 

Exhaust pipes clogged with foam

One incident in December 2024 was particularly bizarre: Hundreds of cars in several German states were damaged when their exhaust pipes were clogged with foam. Stickers bearing the message “Be greener!” and depicting Economics Minister Robert Habeck were also left on the cars. The aim was to fuel resentment against the Greens.

Reactions and countermeasures

As the central agency of the German police force, the Federal Criminal Police Office plays a coordinating role in tackling cybercrime, provides information and tools and serves as a hub for international cooperation. The National Cyber Response Centre (Cyber-AZ) also serves as a cross-agency and -institutional platform. In 2023, 32.2 percent of cybercrimecases were solved. As recently as January 2025, German agencies, working together with their international counterparts, succeeded in shutting down the world’s two largest cybercrime forums, “nulled.to” and “cracked.io”. The goal is to strengthen defence capabilities against cyberattacks and step up protection of critical infrastructures. The German government is cooperating closely with international partners to share information and develop joint strategies to repel hybrid threats.

When it comes to addressing the danger posed by disinformation, the German government’s primary strategy is to educate the general public. On its website, the Federal Ministry of the Interior provides concrete examples of disinformation and explains how to identify such fake reports.