Low-level agents in Germany: Russia’s covert shadow force

Moscow is intensifying its hybrid attacks on Germany, from espionage and disinformation to drone strikes.

German Chancellor Friedrich Merz said that although the country may no longer be at war, it is no longer at complete peace either.

In recent weeks, a series of drone strikes have destabilized the country, targeting military, vital and even civilian installations – including Munich Airport. Both Chancellor and Defense Minister Boris Pistorius held Russia responsible for at least some of the incidents.

It remains unclear who exactly is behind the drone flights, as investigators will first need to identify their operators. But so far, not even a single drone has been found.

But what is clear is that there appear to be two types of drone flights: professional operations using larger drones, and hobbyist flights carried out using off-the-shelf consumer models.

Authorities suspect that some of these recent operations may have been conducted by so-called “low-level agents” operating on the fringes of Russian intelligence networks.

Short assignments, high risk

Recently, the German domestic intelligence service (BfV), the Federal Intelligence Service (BND), the Federal Criminal Police Office (BKA) and the Military Counterintelligence Service (MAD) issued an order warning Urging people not to allow themselves to be recruited as “low-level agents” by foreign parties.

These individuals, often contacted via social media, are paid relatively small sums to carry out “simple” and low-risk tasks, such as sabotage, surveillance or arson.

“Low-level agents are usually deployed to carry out concrete actions,” explained Dr. Christopher Nearing, a disinformation expert and director of the Cyber ​​Intelligence Institute, in an interview with Euronews.

However, he warned that while these agents were carrying out intelligence-related work, they should not be classified as spies, because espionage involves covert gathering of information. “They are generally not tasked with gathering intelligence,” Nearing added.

Instead, their work may include setting fires, pasting propaganda posters on walls, spraying graffiti, or causing other types of damage.

Related to

Is ideology all you need to become a low-level agent?

Dr. Hans-Jakob Schindler, a terrorism expert and head of the Countering Extremism Project, told Euronews that these “agents” are hired for a single purpose, meaning they have little understanding of Russian intelligence structures in Germany or across Europe. They work not only in Germany but all over the continent.

For foreign actors, including Russia, their main advantage is anonymity. Most of them are identified through Russia-friendly Telegram channels, where they have expressed pro-Russian views. According to Schindler, these agents are then contacted and recruited, who are typically male and have low levels of formal education.

“It’s really about finding someone who is either ideologically motivated to help or financially motivated — ideally both,” Schindler said. Purely ideological motives are rare, he added, because money usually plays a role. “Unstable economic conditions plus ideological consensus is basically the ideal package,” the terrorism expert explained.

Schindler described this concept as fairly straightforward: the goal is to perform as many actions as possible on a small scale. Low-cost operations could be effective overall, while keeping the risks to the Russian side very low.

Neering agreed, noting that agents’ tasks are typically “not particularly complex.” He added that when it comes to vandalism, they are often simple acts that cause limited damage, but combined they create a feeling of insecurity. “Hybrid warfare does not aim to defeat Germany or NATO directly,” Neering explained. “It is about weakening the will to defend politically by creating a widespread sense of uncertainty.”

While many of their actions may seem harmless at first glance, they are a precursor to further escalation.

What do Low Level Agent operations look like?

Earlier this year, during the election campaign in Germany, more than 270 cars in several German states were vandalized with expanding foam and decorated with stickers bearing the face of Green Party Chancellor Robert Habeck’s face and the slogan “Be greener“.

At first, climate activists were skeptical. However, an investigation by Spiegel suggested that it may have been a Russian sabotage operation, intended to stir up public sentiment against the Green Party and their candidate.

Germany’s military support for Ukraine is another focal point: recent reports indicate that Russian spy drones have been monitoring arms shipments to Kiev. It is also possible to employ low-level agents in such operations, including Dieter S. and Alexander J., who are currently facing trial in the Higher Regional Court in Munich.

Dieter S. was charged. He promised someone that he would carry out explosive and incendiary attacks on military infrastructure and industrial sites in Germany. According to investigators, Alexander J. He has been helping him since at least March 2024. He is said to have spotted potential targets and sent photos and videos – of military transports, for example – to his contact.

According to the indictment, the plans were aimed at disrupting German support for Ukraine. One possible target that has been mentioned is a railway line used for weapons shipments.

The anonymity of the Internet allows foreign actors to cover their tracks in such operations and remain “untraceable.” If a conscript agent is caught carrying out a sabotage or espionage mission, as in the case of Dieter S., he alone is responsible for the act.

Related to

How are “low-level agents” treated by their handlers?

According to intelligence services, Russia is increasingly relying on inexperienced agents. The reason: Since the beginning of the invasion of Ukraine, it has become very difficult for Russian intelligence to deploy its agents in Germany.

While exact numbers are unknown, various reports indicate that at least 60 Russian diplomats have been expelled from Germany since the beginning of the full-scale invasion. Not every Russian diplomat is automatically a spy, but many Western intelligence agencies assume that some are involved in espionage, as diplomats enjoy immunity and are officially approved for political, economic or cultural missions.

Because of these restrictions, the use of “low-level agents” is referred to in security circles as an “act of desperation.”

“Low-level agents are being ‘weeded out’ in every sense of the word,” Schindler explained, adding that the Russian side bears no responsibility for short-term agents. “Their sole purpose is to create uncertainty and gather information.”

Punishments for such acts range from “unconstitutional sabotage,” punishable by up to five years in prison, to “espionage-related activities” in particularly severe cases, which can result in sentences of up to ten years.

So far, investigators have generally only been able to catch alleged low-level agents themselves, not the people they recruited.

According to an investigation by ZDF Frontal, this remains an ongoing dilemma for the German domestic intelligence service: even after a thorough investigation, the responsible parties often cannot be conclusively identified.

How are low-level agents recruited? Find out tomorrow on euronews.com