Attacks on substations reveal weaknesses in the protection of critical infrastructure

The recent attacks on substations in Jänschwalde and Bergheim show once again: energy and water supply, telecommunications, or local public transport are increasingly falling into the focus of hybrid threats – from cyberattacks to sabotage. Protecting critical infrastructure (Kritis) has become one of the central security policy tasks of our time.

In recent years, Brussels and Berlin have introduced numerous guidelines to strengthen the security of critical infrastructure. These include the European Cybersecurity Directive and the CER Directive, which was implemented in Germany as the Kritis Framework Act (Kritis-Dachgesetz).

The goal of all these laws is undeniably correct. However, they place too much focus on documentation, verification, and legal safeguards instead of effective security measures – and in practice lead primarily to double and multiple regulation.

The problem is further exacerbated by new laws that impact companies' protective measures while unfortunately creating additional hurdles. Particularly relevant, for example, is the European AI Act. Modern monitoring systems for critical infrastructure sites increasingly contain AI components.