A Russian general is working on digital battle plans; hackers are attacking Germany’s federal government; and a man in the Crimea wants to plunge Germany into chaos with fake news. There’s a fierce struggle in progress around the Bundestag election in September.

Information war in Germany’s capital? © Fabrizio Bensch/Reuters

Lesen Sie die deutsche Version dieser Geschichte.

By Von Patrick Beuth, Marc Brost, Peter Dausend, Steffen Dobbert und Götz Hamann, Zeit

The alternative truth about Germany is generated by a man who lives in Crimea. This truth maintains that Germany has weapons of mass destruction, that almost all refugees are criminal, and that Angela Merkel instigates fights. With this truth, this man wants to impact the next Bundestag election from Crimea. His chances for success aren’t that bad.

The man sits in front of a green wall, in a secret location on the peninsula annexed by Russia. He agreed to a conversation via Skype. He said that he would have liked to come to Germany to talk with ZEIT about his goals. But he can’t. He’s been on a list of sanctions since he began working for the Russia-supported rebels in eastern Ukraine. He is thus forbidden to enter Germany. But he can do his job without any problem from Crimea. And he has colleagues in Germany.

Konstantin Knyrik is the man, chief editor of the Russian news agency News Front. He heads up an editorial office with a staff of about one hundred.  Here are some headlines that Knyriks’ staff has produced in German, for Germany:




The headlines are always written in capital letters at News Front. Much of the content appears to be invented. Often, real events are exaggerated in order to create fear. Knyrik and his associates say that truth is being destroyed by the established media. That’s why they call themselves “fighters” in an “information war.”

The agency is still young and small, but it is growing and looking for employees in Berlin for the months leading up to the Bundestag election. The aim is to spread a different truth here and to defend it against the alleged lies and manipulations of the controlled “system media.” By this, Knyrik means all of the major German media channels and newspapers, including ZEIT. According to Knyrik, there’s no free opinion in Europe anymore. He says censorship is “very common” in German media, and that it’s getting worse and worse.

According to News Front, it is financed only by donations and advertising revenues. But a former employee says that a large part of the budget comes from the Russian secret service. Certain topics, says the former staffer, were assigned directly by the presidential administration in Moscow. Knyrik disputes this. But his former subordinate says, “You are a propagandist, and you are not looking for the truth, rather you follow orders.” Defeating Germany in the information war or, at the very least, influencing the Bundestag election in 2017 “is the most important mission of News Front,” says the former staff member. “The news agency was created for such purposes.”

There have long been indications that Russia will try to impact the German election campaign, according to a Federal Intelligence Service (BND) and Federal Office for the Protection of the Constitution report prepared for the chancellery. The goal of the Kremlin is not to help a particular party to victory. Rather, its purpose is to shatter the confidence of German citizens: in the security of the country, the stability of daily life, the integrity of people and institutions. The objective is that an all-encompassing suspicion should spread, democracy thus weakened, and those whose political business is fear will be strengthened. A destabilized Germany in a disputed European Union would thus be all the weaker against Russia.

Are elections in Germany under threat?

This kind of made-up or fake news is only one way of causing confusion in the election year. Through cyber attacks on the electricity or water supply, daily life could be attacked, and only for a matter of hours. Hacker attacks on Bundestag and the federal government computers have already captured large amounts of mails and documents, which – should they be deliberately spread — could damage the reputation of individual politicians. Specially programmed social robots (social bots) could create buzz in the social networks. The director of the federal election fears that on the day of election even false declarations could make the rounds that polling stations are closed. The election results could thus be called into question.

Pro-Russian hacking groups have already launched a serious attack on the German federal government

Germany has already been a training grounds  for such attacks. But the interplay of several seemingly unrelated attacks is the big danger.

To what degree is the Bundestag election open to manipulation?

7 January 2015, around 10 am. The government airplane of the Ukrainian prime minister is approaching Berlin. Arseni Yatsenuk is seeking the help of the Federal Republic. At war with Russia, he wants to ask Angela Merkel for money. The Russians don’t like this at all. At 10:08, one minute before Yatsenuk lands, a cyber attack against the federal government begins. A pro-Russian hacker group with some 35,000 computers at its disposal fires on the government’s Internet sites, bombarding them with inquiries until the German computers are overwhelmed. This is called a Distributed Denial of Service attack, or DDOS for short. Later in the day, Steffen Seibert, spokesman for Angela Merkel, says: “Our service provider’s data center is under heavy attack.” The hacker group, CyberBerkut, calls “all Germans and the German government to end financial aid for the criminal regime in Kiev.” It is a political intervention, a demonstration of strength.

Over the next 36 hours, a battle unfolds — typical of modern information wars. A good dozen IT experts from the company Babiel, which has long been working for the federal government, take on the pro-Russian hackers. Babiel has computer centers, which are used, among other things, to run the government’s Internet pages.

The owner of the company, Rainer Babiel, remembers well this battle in January 2015. “The attackers worked in groups and had been launching attacks simultaneously against different parts of our systems.” The attacks lasted two full days without interruption. “This means there were several teams on the other side that spelled one another. It must have been a large, tightly organized group.”

On January 8, the Ukrainian prime minister left Berlin. Shortly after the plane started, CyberBerkut stopped its onslaught.

An investigation revealed that computers from 137 countries were used for the attack, says Babiel. Possibly, the hackers had rented a so-called “bot network.” Bot networks are usually built up by organized gangs and used for blackmail or leased to others. The business starts with hackers looking for vulnerable points in the software of popular computer systems, in order to penetrate them unnoticed. They send huge numbers of e-mails with a destructive software in the attachment, hoping that thousands of people open the attachment. If this happens, the gangs take control of the computers, which are from then on remotely controlled. That‘s why “bots” is the short form of “robots.”

Two years have passed since CyberBerkut’s attack, and the threat of DDOS attacks has grown dramatically – because the bot networks have grown as well. It was only last autumn that a criminal network was discovered, which had captured more than 1,000,000 devices, 30 times more than the hackers of CyberBerkut used. You can even rent the largest bot networks for a few thousand euros an hour, says Rainer Babiel.

The biggest DDOS attack so far hit the U.S. last autumn, when intruders attacked with about one million web devices. They blocked computers, which are as important for the distribution of the Internet traffic as highway crossroads for the car traffic. After it, companies, authorities and private individuals could no longer access their data.

In Germany, 900,000 Telekom customers lost their Internet connection in November. Invaders had tried to build a new bot network. But then the attacked WLAN routers of the customers switched off automatically, before they could be captured – a kind of self-protection of the technology. Hundreds of thousands of Telecom customers were cut off from the Internet for hours.

The Invisible Power

It is not always possible to trace the tracks to Russia as clearly as with the DDOS attack by CyberBerkut. “What makes cyber attacks so attractive to foreign powers is that you will never actually find a smoking gun, one can always deceptive tracks and operate under a decoy flag,” says Hans-Georg Maaßen, the director of Germany’s Federal Office for the Protection of the Constitution. But now the traces back to Russia are so numerous that a large-scale strategy is becoming apparent.

It starts with a network of fake news sites, including News Front. It includes hacker attacks on the Democratic Party in the US, the German Bundestag, and the chancellery of the Netherlands. The details of this strategy were described by the Russian chief of staff himself in February 2013, in an essay for the weekly Woenno-Promyschlennyi Kur’er (Military-Industrial Courier). “Wars are no longer declared, and once they have begun, they run according to an atypical pattern,” writes Waleri Vasilyevitch Gerasimov. Non-military means are more important than ever, in some cases even more important than weapons. Gerasimov explicitly mentions communications as a non-military means. Wars are not necessarily won by those with more weapons. But rather wars are won by those who control the information.

When the Gerasimov text appeared, nobody in the West noticed it. But how the strategy works could be seen a year later: when Russia annexed Crimea and destabilized southeastern Ukraine. Without the knowledge of NATO or the Ukrainian military, Russia is able to bring a part of Ukraine under its control. On the peninsula, Russia used false information as a weapon: on television, on the Internet, in newspapers. There were no causalities in this intervention, which is why the military operation is a prime example of the Gerassimov doctrine: a mixture of political illusions, secret military operations, cyber attacks, and disinformation campaigns.

In the chancellery, Merkel’s staff fear attacks on Germany, especially on the chancellor and her closest confidants. The cyber attacks in the U.S. election campaign — when hackers penetrated the Democratic Party’s computers and captured internal e-mails from Hillary Clinton and her staff chief John Podesta and passed them onto the WikiLeaks platform — were only a prelude. “The real test of Russia’s strategy is the Bundestag election,” they believe in the chancellor’s office.

Hackers captured 16 gigabytes of data in a cyber attack on the German Bundestag in May 2015. Affected were computers of 14 deputies, and also a computer in Merkel’s office. Behind the attack was the same group as the attack on the U.S. Democrats: Fancy Bear, also known as Sofacy Group, Operation Pawn Storm, or APT 28 (advanced persistent threat).

For more than a decade, APT 28 has been blamed by Western security agencies for hacker attacks on military and political institutions, including NATO, OSCE, the White House, and the World Anti-Doping Agency. U.S. and German security agencies believe that APT 28 is controlled or supported by Russian intelligence agencies.

Nobody should be surprised if the data from the Bundestag hack is published in the coming months on WikiLeaks or elsewhere. In the end, the perpetrators used the same tools and methods as the hack on the computers of the U.S. Democrats. Security authorities are silent about which documents or mails were captured – and the Bundestag MPs, too. You can imagine why.

Of course, the Bundestag’s computers today are better protected than two years ago. The Federal Office for Information Security has also been massively expanded: into to a “GSG 9 for cyber security,” according to Arne Schönbohm. In addition, his agency is now working closely with industry in order to learn from hacker attacks on private companies.

But has the risk of possible interventions now less in this election year? Not really. If three days before the election an old document emerges, which sullies Merkel or one of her ministers, the best cyber defense does not help. If the next DDOS attack is routed over a 30 times larger bot network than the previous attacks, no one will be able to defend them. This is the perfidy of the information war: Whether you are well prepared or not, you know only when it happens. Previously, security policy makers counted the atomic warheads of the other side, they added up divisions and studied navies. The strength of an army could be observed from space, photographed and entered on maps. But the fighting in the information war? It is invisible.

American cyber security adviser Lydia Kostopoulos says there is a need for a different language to describe “state actors in cyberspace” and their approach. She rejects a word like “army.” For years, Kostopoulos has been advising Western institutions and states on cyber security policy, working for the U.S. State Department and NATO. “State actors in the information war have long-term intentions, but they must be agile and opportunistic,” says Kostopoulos. “They act on opportunities. They have an organizational center and large financial resources, but they often work in a loose group, with subcontractors, freelancers and hacking groups.”  The information war is a” battle of creativity,” a debate in which imagination is crucial. Often you have to react quickly to situations.

Why fake news are dangerous

In our old world, the defense minister moved a division to a border or sent out a naval fleet. Deterrence in the information war is much more difficult. Even more difficult is to be prepared for attacks. This is especially true of a lie attack: to deliberately spread false notifications that will manipulate people.

There have always been newspaper gaffes, and journalists have never been error-free. But fake news is something else — and much more dangerous: it is fictitious messages, which exploit the functional logic of social networks.  Users can get upset at any time. Certain hot topics can be effortlessly instrumentalized: the fear of alienation, the abuse of power, questions of war and peace.

In the German chancellery and in the parties’ headquarters, fake news is among the biggest concerns. If something could negatively influence the election campaign, then most likely deliberately spread false notifications. For a society in which people are informed mainly through the media — and form their political opinions through it – this process is threatened when lies spread through the media. When it is no longer clear what is false and what is correct, people lose their confidence in the state. Is it true, what they tell me on TV? What I read in the newspaper? What I’ve heard on the net? Mistrust is the poison that destroys every society. Using fake news, this poison is injected in small doses.

Konstantin Knyrik, who manages the News Front agency’s false news from Crimea, says 20,000 people a day in Germany read the news on his website. Added to this are various partner websites and the many readers who see the content of News Front on Facebook or YouTube. Alone on the video platform YouTube, News Front web pages, many of them for an audience in Crimea and in eastern Ukraine, are clicked about 600,000 times per day.

News Front belongs to a network of Pro-Russian sites, similar to RT (formerly Russia Today) and Sputnik, which are financed and managed directly by the Kremlin. News Front, RT and Sputnik cooperate and exchange content. For example, News Front publishes articles that appear on Sputnik. RT refers to experts interviewed by News Front. The cooperation is strategic. This way, one has several sources, even for fictitious material. And several sources makes the report seem more credible.

As of last week, the Bundeswehr has had to deal with the absurd claim that German soldiers raped a young girl during a NATO operation in Lithuania. Allegedly, NATO has also put 3,600 tanks into position against Russia.

In January, it was reported that 700,000 Germans had left their homes in Germany because of Merkel’s refugee policy. After New Year’s Eve, a false report claimed that 1,000 immigrants had lit on fire a church in Dortmund. None of this is true. And for more than a year, the selfie of a Syrian refugee with Angela Merkel has been coursing through the social networks, combined with the lie that said refugee is an IS assassin. The refugee has sued Facebook, and the original photomontages are now also deleted. Yet, not a few people will be stuck with the image of Angela Merkel posing with a terrorist.

The most popular false report was a video that presented Merkel as mentally ill

If something like this is happening so long before the election, what will it be like in the decisive weeks? In the government and in political party headquarters, where the fury of these lies is feared, the electoral campaigners are largely at a loss. How can we defend ourselves against false news, which comes in the guise of scoops? Which spread in the net at maximum speed? All parties have formed so-called rapid response teams: employees in the election campaigns who are constantly monitoring the discussion in the social networks – and if necessary post their own comments or figures. “But we really have little to counter the pace, the force and the criminal energy of the attackers,” says an experienced campaigner. The dynamics of the net against the sluggishness of the apparatus – an unequal struggle with clear advantages for the aggressor.

In the final phase of the American presidential election, the 20 most successful false declarations were more frequently shared, liked, and commentated as the 20 most successful reports of serious media, according to the online portal Buzz Feed. In Germany, it’s not this bad yet. But here, too, there is a devastating response to the deliberately scattered lies. In the publicly accessible Facebook posts “among the ten most popular links to news articles are five sources of fake news and right populist websites,” says Johannes Hillje. He organized the 2014 electoral campaign of the European Greens. Today, he advises politicians and parties on how to handle false news. “Last year’s favorite fake news was a video of the right-wing political broadcaster Rebel News from Canada, in which the German Chancellor is portrayed as a mentally ill,” says Hillje. “On YouTube, this video had nearly 1.3 million clicks.”

The goal of the Gerasimov doctrine

It does not always have to be a lie. More effective is fake news that contains a grain of truth, which relates to an actual event. This is then so distorted that it becomes untrue. Such untruths are the kind most likely to find their way into the mainstream media, such as newspapers or television stations, and broadcast further.

In the final stage of the American election campaign, most U.S. citizens did not even learn through their social networks of fake news. They learned about it through the traditional media. Above all television reported in the weeks before the U.S. election in news and talk shows about the cursing abstruse rumors and lies. They did this with a noble purpose: explanatory and critical. However, the traditional media provided a much larger audience for these false notifications.

And this is the real impact of fake news producers such as News Front, RT or Sputnik in election year 2017: the infiltration of Kremlin-controlled disinformation into the reports of the media used by Germans hundreds of thousands of times and spread many times over. People will not believe every single false message. But if the distortions and forgeries accumulate, the boundaries of what can be said and conceived are shifted. Then the extreme is considered normal. And the incredible as true. This is precisely the goal of the Gerasimov doctrine.

Western societies are not powerless against fake news, but they haven’t yet found the most effective medicine. There’s still no general antibiotic that neutralizes all of the pathogens. Facebook is working on a fact-checking methodology, where journalistic methods are used to check whether suspicious messages are falsified. ZEIT ONLINE is one of the media outlets that is considering whether it will participate in it. But as important as this idea is, it has limitations. And even in the so-called defensive center against disinformation, which the Federal Minister of the Interior wants to build up, the idea may be worse than the effect: the government appears as if it alone determines what is truth.

How rumors spread in an election campaign, from pro-Russian propaganda pages to social media and traditional media, is particularly evident in France. There, a false report ran in the news for days: Presidential candidate Emmanuel Macron was married on paper only (a Scheinehe) and was actually gay. A French parliamentary deputy told this to the Russian website Sputnik.

The article appeared on Sputnik on February 4 at 12:19, and at this moment a storm broke over Macron. Within a few days, more than 17,000 blog entries, Twitter posts, press articles, and radio and television broadcasts picked up the rumor and spread it. For ZEIT and ZEIT ONLINE, the Cologne-based company Unicepta analyzed how the lie spread worldwide. In France, the media outdid itself with reports of Macron’s alleged duplicity.

However, Emmanuel Macron did not fall victim to the fake news. He found hundreds of supporters. They defended him and closed ranks. And the media began to investigate where the rumor had its origin.  That became the focus of the ensuing discussion.

Will it always be possible to overcome such an attempted character assassination? Unlikely. Macron is constantly under fake news bombardment, and it’s uncertain how this will affect the election. Nevertheless, this fake news case also gives us hope for the German election campaign: for even the most evil rumor can create a backlash.

By Von Patrick Beuth, Marc Brost, Peter Dausend, Steffen Dobbert und Götz Hamann, Zeit

Assistance: Kai Biermann und Arndt Ginzel

Translation: Paul Hockenos