Acts of sabotage on power plants in Brandenburg and North Rhine-Westphalia, an attempted drone attack at Leipzig Airport and an arson attack on the premises of a defense company in Bavaria. This year there have already been more than 160 suspected cases of sabotage on so-called critical infrastructure nationwide. This emerges from an internal BKA situation report that is available to NDR, WDR and SZ.
Critical infrastructure includes, for example, electricity and water supplies. But also areas such as traffic, health or IT, whose impairment or failure can lead to supply bottlenecks, disruptions to public safety and other dramatic consequences.
At the beginning of the year, the federal government reacted: it passed a law that is intended to increase the protection of critical infrastructure in Germany. The KRITIS umbrella law has been in force since March. Federal Interior Minister Alexander Dobrindt (CSU) previously warned: "Germany is the target of sabotage, espionage, disinformation and, yes, also terror. And it is of course part of the task of politics to arm ourselves against this, to make ourselves more resilient and, yes, to fight back." But experts criticize the implementation of the law.
Responsibilities not clarified
The KRITIS umbrella law obliges operators of important systems to provide greater protection against sabotage and other dangers. However, there is currently no regulation that clarifies responsibilities. According to Johannes Rundfeldt from the Critical Infrastructures Working Group (AG KRITIS), the law is therefore toothless so far: "Neither the operator of such critical infrastructures nor the state is currently obliged to take any measures."
A spokesman for the Federal Ministry of the Interior emphasized today: "We are working hard on the KRITIS regulation so that it comes into force as quickly as possible. However, I would like to emphasize that the measures can in principle be implemented now. The operators are responsible for protecting their infrastructure and should take measures."
The Parliamentary Managing Director of the Green Party parliamentary group Irene Mihalic accused Dobrindt of failings: "Our country is very inadequately prepared for attacks on critical infrastructure," she told the Handelsblatt.
Stefan Erdweg is a consultant for the protection of critical infrastructure. He thinks there needs to be clearer guidelines from politics: "The KRITIS umbrella law, for example, states that a risk analysis must be carried out. But how? We actually need a uniform risk analysis with always the same parameters."
Water supply poorly protected
It is not possible to protect the entire electricity, water or rail network in Germany 100 percent. Experts agree on this. However, particularly in the energy sector, awareness needs to grow among politicians and the population, says Erdweg. "The electricity comes from the socket and the water from the tap. But behind it there is a huge infrastructure that no one sees." The water supply in particular is inadequately protected against attacks. Erdweg is also calling for more legal requirements and uniform emergency plans here.
However, there is greater awareness of protecting airports. There are international guidelines, laws and clear responsibilities. The federal police are responsible for their protection. However, the attempted drone attack at Leipzig Airport at the beginning of August showed that there are security gaps here too. Not all German airports currently have technology that can detect and fend off drones. Federal Interior Minister Dobrindt announced that drone defense would be expanded. Responsibility remains unclear. The Bundeswehr has had its own powers to defend against drones since this year. The Federal Police is responsible for this at airports. In many other cases it is the federal state police.
Operators of critical infrastructure are currently not allowed to fend off drones themselves. However, at the beginning of the year, the Bundestag decided to examine “the responsibility of operators in protecting their critical infrastructure from drones”. “From my point of view, it is conceivable that power plant operators, substations, pumping stations or pipeline operators will start now and procure drone cages,” explains Rundfeldt from AG KRITIS.
More video surveillance?
A short-term measure that has been brought into play by politicians themselves is the expansion of video surveillance. So far, this has only been allowed for companies on their own premises. After the alleged attack on a substation in Bergheim, North Rhine-Westphalia on Tuesday, the Energy and Economics Minister in North Rhine-Westphalia, Mona Neubaur, from the Greens, said: "Where necessary and proportionate, surveillance should also be able to cover the public space around the facility."
According to the hybrid security expert Erdweg, this cannot be implemented in the short term. Legal regulations are needed here too: "That's easy to say, but there is also data protection. Simply placing a camera somewhere in the forest is not possible."
Some areas well protected
Even if the security standards in many areas of the critical infrastructure are too low, others are already in good shape. "In terms of IT security and security of technical systems, protection is relatively far ahead and we are relatively well positioned," says Rundfeldt.
According to consultant Erdweg, defense companies are also comparatively well protected. On the night of Wednesday to Thursday there was an arson attack on a construction site belonging to the defense company Rohde & Schwarz in Munich. The LKA suspects an attempted attack. Erdweg says that the arms industry does have a lot of security requirements, but: "It is of course very, very interesting for third countries. That means the quality of perpetrators is much higher." Defense companies or airports would have to prepare for much greater threat scenarios than other areas.
Even if security is high in some areas according to experts, the critical infrastructure in Germany needs to be better protected. Above all, this requires clear legal requirements, clarified responsibilities and a focus on particularly vulnerable areas.
