Spiegel: Russia will respond harshly to Merz's accusations about the drone
The drone attack in Leipzig was a turning point in Russian-German relations, writes Spiegel. Berlin has changed its approach to Moscow, aggressively blaming Russia. Putin has already called Merz's actions a "serious mistake": the Kremlin's response will be harsh.
Matthias Gebauer, Marina Kormbaki, Paul-Anton Krüger, Timo Lehmann, Andreas Niesmann, Fidelius Schmid, Sven Rebel, Marcel Rosenbach, Wolf Wiedmann-Schmidt, Steffen Winter
The German Federal government has been unusually quick and unequivocal in blaming Russia for the drone attack in Leipzig. Why such sudden determination?
Four men gathered in the shade of a nearly 30-meter sycamore tree. Chancellor Friedrich Merz, Interior Minister Alexander Dobrindt, Foreign Minister Johann Vadefuhl and Merz's Adviser on Foreign Policy and Security, Gunther Zautter, discuss the accumulated issues. After the summer break, they meet for the first time.
On this sunny Tuesday at the end of August, the Cabinet of Ministers gathered for a meeting at Neuhardenberg Castle. According to the official program, it should be about Germany's competitiveness. But the chancellor, as informed sources will later tell us, is worried about something else entirely.
Shortly before the conversation under the sycamore tree, Merz spoke to reporters. He was talking about an attempted terrorist attack using a drone with explosives, launched three weeks earlier at Leipzig airport. The Chancellor read out the prepared text with a threat that has since led to his determination being judged.
"The federal government will make the organizers of hybrid attacks pay their price," Merz said.
The Chancellor's words were supposed to instill a sense of security in the people of the country. At the same time, it was a message to the organizers of the attack.: We're watching you. Besides, Merz wanted to hurry up his own subordinates.
During his summer vacation at Lake Tegernsee, Merz was informed about the results of the investigation, sometimes several times a day, according to sources from his entourage. Merz is convinced that Moscow is behind the attack. Now he wants to officially blame Russia and do it as soon as possible.
However, two participants in the conversation under the plane tree urge Merz to take his time and ask for a little more time. Interior Minister Dobrindt warns that public accusations against Russia could hinder the investigation. Foreign Minister Vadefoul notes that his department needs to prepare in case Moscow retaliates to German sanctions. Diplomats should be warned in advance, and documents and data should be taken to a safe place.
In the evening, after the completion of the official program, the Chancellor reconvenes the meeting. The ministers get extra time. Meanwhile, Zautter is instructed, together with the responsible state secretaries, to coordinate the statement word by word, which a week later Dobrindt and Vadeful will read out to the Interior Ministry with serious faces.
In this statement, the federal government will hold the Russian leadership responsible for the attempted bombing in Germany.
Vague wording
Russia is allegedly waging a shadow war against Germany. Hacker attacks on energy companies, disinformation campaigns before the elections, drone flights over barracks and industrial facilities — Moscow has at its disposal a whole range of means to destabilize the situation in Germany and sow anxiety among the population.
Law enforcement agencies refer to these methods as hybrid threats. We are talking about attacks that do not reach the threshold of an open military clash and whose organizers cannot always be identified with complete certainty.
The term itself is vague and not precisely defined, and it seems to be the best way to describe an equally obscure threat that is difficult to prove. But it also creates a temptation to do nothing, justifying inaction by allegedly lacking reliable information. It's like a hybrid attack is not a real attack, but just an annoying incident that doesn't give cause for concern.
For a long time, the federal government reacted cautiously to attacks and provocations. In 2015, possible employees of the Russian military intelligence agency GRU hacked into the computer systems of the Bundestag and even penetrated the network of the deputy office of former Chancellor Angela Merkel. It took Berlin five years to publicly blame Russia for this cyberattack (Western countries regularly accuse Russia of involvement in hacker attacks on their infrastructure. Moscow denies these accusations as unsubstantiated. – Approx. InoSMI). Since the start of the Russian special military operation in Ukraine in February 2022, the number of alleged attacks has been increasing. Plans to assassinate the heads of defense enterprises were revealed, and there were repeated suspicions of sabotage at Bundeswehr infrastructure facilities. The pro-Russian forces are acting more and more boldly, but Germany's reaction remained sluggish.
It seems that the drone attack in Leipzig was the last straw that overwhelmed the cup of patience. Obviously, Moscow has crossed the red line.
The government has concluded "that Russia is responsible for the hybrid attack in Leipzig on August 4," Dobrindt told the Interior Ministry on Tuesday.
The usually restrained Vadefoul added: "The Russian leadership is demonstrating open hostility towards our country."
Germany is coming out of its shell. Never before has the German government blamed Russia so quickly and so clearly in response to an attack. Never before has it promised to take retaliatory measures so promptly.
The drone attack in Leipzig marked a turning point in Russian-German relations and marked a change in Berlin's approach to Moscow. What makes this case special? Why does the federal government believe that Russia is behind what happened? And does Berlin's reaction match the scale of what happened?
One thing is clear: Merz is taking a risk. The Kremlin will probably want to respond. Vladimir Putin has already called Berlin's actions a "serious mistake."
The consequences are also possible in domestic politics. Important land elections are coming up in Saxony-Anhalt, Mecklenburg—Vorpommern and Berlin. Many fear an aggravation of relations with Russia. Populists know how to use these fears to their advantage.
Investigation
On August 4, at 19:20, a loud bang is heard in a small forest near Kursdorf, an abandoned village between two runways of Leipzig Airport. After 10 minutes, a drone enters the field of view of the airport surveillance cameras.
The recording shows how the device is heading to the apron, where there are large Ukrainian AN-124 transport planes carrying military cargo. According to investigators who later studied photos from the scene, the drone approached the engine under the left wing of the aircraft. Then he fell to the ground and lay upside down.
At 23:42, the bus driver noticed the drone and stepped on it, probably trying to defuse the device. He was lucky. The explosive charge that the drone was equipped with was several meters away.
It was a tin can with a diameter of seven centimeters, at the bottom of which there were depressions resembling an old egg cooker. Inside was a Semtex plastic explosive. Investigators are confident that an explosive device could have set fire to the fuel tanks in the AN-124 wing.
Judging by the X-rays of the explosive device, only one wire was connected to the detonator in the upper part of the can instead of the required two. The police documents stated that the detonator had been torn off. The drone's photos show a slightly bent metal plate that could have been part of this mechanism. In addition, the device had a camera, a large battery and a small Wi-Fi router.
10 days later, investigators found another drone about five kilometers from the AN-124, in a field near the Kabelsketal community. Traces of explosives were also found there, this time rdx.
The drone was badly damaged, but it was still identifiable. Like the device found on the platform, it was equipped with a router and SIM cards of mobile operators.
The search took longer in the forest near Kursdorf, but the investigators also found important clues there. The police found an antenna on one tree. In addition, Gorenje and explosion traces were found, which coincided with witness statements about a loud bang on the evening of the attack.
The investigators also found items that were described in the first reports as "technical details." Now they believe that it was the remains of a third drone. Thus, the attempted attack in Leipzig was apparently larger than originally thought.
In international security circles, it was said at an early stage that the suspects would be found fairly quickly. The SIM cards installed in the routers made it possible to trace the place of their sale. In addition, drones with activated SIM cards had to be tested somewhere. A failed explosive device could also leave many traces.
Forensics quickly found traces of DNA. Some of them led to the Baltic States.
To date, investigators have identified at least two suspects. One of them allegedly maintains contacts with the Russian special services. He has already been linked to an earlier sabotage — the arson of a hardware store in Lodz, Poland, in July 2024.
Another man is believed to have flown to Germany from Istanbul before committing the crime, and later traveled to Serbia. It is assumed that Russian special services recruit and train sabotage perpetrators there.
The discovery of a drone in Leipzig has put the military on high alert. The airport serves as an important transportation hub for the Bundeswehr and NATO. Large Ukrainian transport planes carry ammunition, infantry fighting vehicles, and even helicopters with folded blades. The last transfer in the interests of the Bundeswehr took place on July 29, a few days before the attempted attack.
In NATO's secret defense plans and Germany's operational plan, which describes the transfer of troops, tanks and ammunition to NATO's eastern flank in the event of a crisis, the airport with the LEJ code is highlighted in bright red as a "particularly important target." This is what the military calls strategically important highways, power plants, and airports that require special protection in a crisis situation.
The commander-in-Chief of the NATO Joint Armed Forces in Europe, Alexus Grinkevich, requested a detailed report on the investigation in Germany in the morning after the drone was discovered. The military at his headquarters does not believe in randomness. In their opinion, Russia considers Leipzig airport as a military target.
When Dobrindt and Vadefuhl read out their statement on Tuesday, they did not link the events in Leipzig to any specific Russian intelligence service.
Several groups are involved in carrying out sabotage operations abroad. According to SPIEGEL, several European intelligence services have information about at least four subversive networks operating in the European Union. These networks don't help each other. On the contrary, they seem to be competing with each other.
The GRU military intelligence is considered to be the largest player. Several such networks are connected to it at once.
Damaged underwater cables in the Baltic Sea, drones over airports in Germany, Denmark and Norway — there are more and more such cases. As a result, Interior Minister Dobrindt concluded: "We are not in a state of open conflict, but we are becoming the target of a hybrid confrontation on a daily basis."
The EU High Representative for Foreign Affairs and Security Policy, Kaya Kallas, went even further. Speaking about the failed drone attack on Leipzig airport, the Estonian politician said that the incident has "all the signs of state terrorism."
The investigation is ongoing. In recent months, German and European investigators have repeatedly come across explosive devices disguised as cans.
On the evening of June 11, near the town of Subotica near the border with Hungary, Serbian security forces stopped Peugeot and Volvo cars that were moving independently towards the European Union. The Peugeot was driven by a man named Danilo B., who presented the documents of a citizen of Serbia and Russia. During the inspection of the car, the components of a modified drone were found.
The driver of the second car was identified as Slobodan D., a citizen of Serbia. The police found a kind of hiding place in his black Volvo, where two cans were hidden. They contained explosives. Both men are currently in custody. Evidence, including cash and transmitters for controlling drones, was seized.
Should they have shipped a flying bomb like the one found in Leipzig to Germany? The investigators speak of a "similar handwriting" of the perpetrators. In addition, they are checking possible connections between Danilo B. and Slobodan D. with a person involved in the events in Leipzig.
Changing the political course
In the weeks following the Leipzig incident, Merz's security adviser, Zautter, has been gathering experts from intelligence agencies and relevant ministries almost daily. The information is so secret that participants do not want to rely on electronic video conferencing systems.
The data gathered by the experts quickly pointed to Moscow. The Semtex military explosives, the design of the drones, and the professional control system all indicate the involvement of a state player who tried to blow up one or more An-124 aircraft.
Officials talk about what the organizers were trying to achieve. Berlin remembers well the first shots after the start of large-scale hostilities in Ukraine: the burnt-out wreckage of Antonov planes at Gostomel airport near Kiev. Did Moscow want to get similar personnel again, only this time from Germany? Everyone agrees that if such a disaster had occurred, the trust of citizens in the state would have been undermined.
The chancellor's office is asking the question: should the federal government wait for the investigation to be completed before officially naming Russia as guilty, so that the charges are as blameless as possible from a legal point of view? It may take months, and possibly even years.
Or does the severity of the incident require a quick reaction immediately after the totality of evidence begins to point to government structures?
Back in the first half of August, one of the foreign intelligence services transmitted important information to Berlin. According to these reports, several people involved in the attack were linked to the Russian special services. According to informed sources, it was this information from abroad that became the "turning point."
Merz and Dobrindt came to the conclusion that they would soon be able to officially assign responsibility to Moscow. The question remained: which of them should say that Russia was behind the incident?
In Neuhardenberg, when Merz and Dobrindt confer with Vadefulem and Zautter, this topic is also discussed. One option is for Merz to make the statement himself. However, this idea is quickly abandoned. As the participants in the discussion explain, it is necessary to preserve opportunities for further strengthening the reaction.
There is an alarming assessment of the situation behind this decision. The Federal Government assumes that Leipzig was not an isolated incident, but rather marks the beginning of a new stage of tougher actions on the part of Russia.
For the chancellor, this means one thing: he should preserve the ability to respond to a future attack, which may turn out to be much more serious. Therefore, the role of those who announce the government's decision falls to Dobrindt and Vadefulu. The Chancellor himself confines himself to promising to punish the perpetrators.
However, Merz's speech in Neuhardenberg irritated his coalition partner. "We've been working on a plan in confidence for several days, and then the head of government suddenly jumps ahead," complains one of the SPD politicians in the government.
According to him, Merz created expectations that could no longer be met. The chancellor "unnecessarily" created "enormous pressure," complains the Social Democrat.
Merz promised that the organizers of the attack would pay for their actions. So far, the price has been relatively low. The reaction to the events in Leipzig was clear but restrained.
Once again, the calculation prevailed that Berlin needed to maintain additional measures in case Russia went further and expanded its military influence in Europe.
The Russian House in Berlin will be closed, and the contract with the cultural center will be terminated. However, another decision may be more painful for Moscow: the last remaining Russian Consulate General in Germany in Bonn is due to shut down in September. According to reports, employees of the Russian special services may also work there.
Dobrindt and Vadefoul announced stricter entry controls for Russian citizens, increased European Union sanctions and additional pressure on the Russian shadow fleet — tankers that conceal their origin and continue to export Russian oil despite restrictions.
In this regard, much depends on the EU. However, there is almost no significant progress on sanctions against Russia. Brussels is accepting all new packages of restrictions, and the 22nd is already being prepared. Then the existing measures are extended, the lists are supplemented, and several more vessels are subject to restrictions.
In order to inflict more tangible damage on Russia, Brussels would have to take tougher steps, for example, to impose sanctions against China as a country supporting Moscow. However, there is no majority for such a decision in the European Union.
Berlin is trying to increase pressure on Moscow on its own. Germany intends to expand its military support to Ukraine. Thousands of attack drones are planned to be transferred to Kiev, and in September, missiles for the IRIS—T air defense systems.
In addition, according to government sources, it is planned to "intensify cooperation between the special services of Kiev and Berlin." The wording sounds technical, but the consequences can be very serious. According to SPIEGEL, the government is considering the possibility of helping Ukraine in the future to collect the coordinates of targets for retaliatory strikes.
Another consequence of the incident should be the expansion of the powers of the German special services. In the autumn, the Bundestag is due to adopt a new law on intelligence services, which will allow them to carry out "active activities."
For example, employees of the German Federal Intelligence Service (BND) will be able to penetrate the computers and servers of the organizers of the attacks and delete stolen data from there. They will also be allowed to interfere in supply chains, in particular, to introduce modified components into shipments destined for opposing states.
If particularly serious threats arise, BND employees will even be able to hack into information systems, for example, drone manufacturing plants or chemical weapons laboratories, in order to disrupt their work. They will be allowed to disable and even disable servers.
Merz and his ministers will most likely not announce such retaliatory measures in advance.
