The Bundestag break-in occurred in May 2015, without a window being smashed. The intruders to the German parliament were not looking for anything tangible, nor were they even in Berlin. They wanted data and they got it: an estimated 16 gigabytes worth.
This was no random smash-and-grab: the hackers sorted carefully through hard drives and made copies only of recently-created Microsoft Word documents. So thorough was their penetration of the German parliament’s computer network that, for fear they had left spy software on the network, everything had to be taken apart, software reinstalled and rebooted and, in some cases, hardware replaced.
No one knows for sure what was lifted out of the Bundestag IT network, but technical staff can say one thing: one of 14 computers hacked was in the Bundestag office of German chancellor Angela Merkel.
Using that computer, the hackers sent an email out to members of her Christian Democratic Union (CDU), supposedly about a telephone conference. Anyone who clicked the link in the mail – naive enough to think the CDU leader writes her own messages – infected their computer with a virus. But to what end?
Ahead of the September 24th federal election, German intelligence agencies hope for the best but are planning for the worst.
German domestic intelligence director Hans-Georg Maassen has warned that “disinformation campaigns” from Russia are as likely as Moscow involvement in the 2015 Bundestag attack, and another one that took place a year later. But he concedes it is “almost impossible . . . to find irrefutable evidence”.
During their investigation after the 2015 attack, German IT specialists found computer code with traces of the Russian hacker collective APT28, linked to the US Democratic Party hack.
But, as any tech specialist will tell you, it is almost impossible to pin a hack attack on any group, particularly as many groups now co-opt each others’ signature code to leave false trails.
Cyberttacks are not the only shadow over this month’s election. Everyone in Germany remembers the case of Lisa, a 13-year-old Russian-German girl who disappeared from her home in January 2016. When she reappeared 30 hours later she said she had been abducted and raped by a group of “southern” migrants.
By tracking her mobile phone data it emerged that the girl had spent the night at a friend’s house. As for the rape claims, two men were convicted of sex with a minor but police believe they had contact with the girl over a longer period. Despite this, the rape of “our Lisa” dominated Russian news for days, Russia’s foreign minister got involved and Russian-Germans held protests outside the chancellery.