Zwei verdeckte Männer vis-à-vis zur Illustration des Arbeitsfelds „Spionage- und Proliferationsabwehr“, Keyvisual Spionageabwehr

How do foreign intelligence services operate?

Collecting information through legal residencies

Many countries have diplomatic and consular representations in Germany, some of which house so-called legal residencies. The term refers to bases used by foreign intelligence services in their host countries under the cover of one of their own countries' official (e.g. embassy, consulate general) or semi-official (e.g. press agency, airline) missions. Pretending to work as diplomats or journalists, the intelligence officers there engage in overt or covert information collection or support intelligence operations conducted by the service's headquarters in their home countries.

Intelligence services obtain a large part of their information from open sources. They carry out specific analyses of media and specialised publications in their target countries. Intelligence officers establish contacts with interesting people both in the real world and in cyber space, using clever communication skills to obtain the desired information.

If a person has access to interesting or sensitive information, the intelligence officers will strive to intensify their contact. They will also introduce conspiratorial elements into the relation, e.g. by holding meetings at neutral places such as restaurants while asking their contacts to keep their conversations confidential. In addition to the previous overt harvesting of information from conversations, they will start to give their contacts specific tasks to procure information. The intelligence officers will give their targets the impression of being particularly important while also offering them material advantages such as presents or invitations to restaurants.

Some of the particularly useful contacts will be converted into classic agent relations. If this is the case, the agent handler will once again strengthen the security arrangements for personal meetings, giving the agent specific instructions for obtaining highly sensitive information. At that point, even the most carefree contacts will become aware of the true nature of the relationship.

Centrally controlled information collection

Many intelligence services supervise such information collection operations directly from their headquarters in their respective countries. Their agent handlers make short trips abroad to meet their agents there, or the latter meet the agent handlers in their home countries.

The Russian intelligence services also make use of so-called "illegals". These often are full-time staff members infiltrated into a target country using a fictitious identity to conduct long-term espionage missions there. It is particularly difficult for the counter-intelligence authorities to expose intelligence officers operating under such a cover. Despite high costs and an enormous operational effort involved, the Russian services keep following that programme. The exposure, since 2006, of more than 15 "illegals" in NATO countries — including Germany — are proof of this.

The German judicial authorities initiate a large number of investigation proceedings in the field of espionage every year. Most arrests and criminal proceedings are the result of the successful work of BfV's Counter-Intelligence Department. It was based on intelligence measures taken by BfV, for example, that the police carried out executive measures against ten suspected agents of the Iranian Quds Force in seven federal states on 16 January 2018. The measures were based on several investigations by the Federal Public Prosecutor General (GBA) against these persons on suspicion of acting as agents for an intelligence service. The suspects are thought to have investigated (pro-)Israeli and (pro-)Jewish targets in Germany. The investigations are ongoing.

State terrorism

In addition to classic espionage and intelligence operations, some countries use their intelligence services to threaten the lives and well-being of their targeted persons. Such cases of suspected state-sponsored terrorism, in which foreign intelligence services play a central role, constitute an additional threat that must be taken very seriously. On 1 July 2018, for example, police in Germany arrested a diplomat accredited with the Iranian Embassy in Vienna on a European arrest warrant issued by the Belgian law enforcement authorities. The diplomat, a suspected agent of the Iranian intelligence service MOIS, is accused of masterminding a planned bombing of an annual gathering in France of an organisation opposed to the Iranian regime. The Iranian diplomat is thought to have recruited a Belgian husband and wife of Iranian origin as agents to carry out the bombing. The German judicial authorities extradited the suspect to Belgium in early October 2018.

Cyber espionage

Human sources continue to be a major part of espionage activities undertaken against Germany by foreign intelligence services. Besides, technical intelligence collection methods have been gaining in importance. Foreign intelligence services use cyber attacks to spy on government agencies, business enterprises or research institutes. BfV defines the term "cyber attacks" as targeted measures carried out using IT infrastructures and directed against such infrastructures. Cyber attacks staged by an intelligence service not only serve to gather information. The term also refers to activities aimed at damaging or sabotaging these systems.

Over the last years, there has been a considerable improvement in the quality of cyber attacks carried out by intelligence services. The services of Russia, China and Iran, in particular, have made extensive use of this means for attacking targets in Germany. Still, they are not the only intelligence services to have recognised the opportunities arising from cyber attacks. Detecting, attributing and preventing such attacks thus is at the heart of BfV's counter-intelligence and cyber defence activity. Further information on this topic can be found here (http://www.verfassungsschutz.de/de/arbeitsfelder/af-cyberangriffe).

Making contact via social networks

Intelligence services also take advantage of the opportunities offered by social networks. They contain a wealth of personal information on a potential target's biography, education, work, friends, colleagues, and superiors.

After choosing the persons they consider interesting, intelligence services will contact them in the guise of headhunters or scientists, offering jobs or other opportunities for earning money. Subsequently, they will invite their targets to the service's home country, for example to China, where they will try to increase their involvement in intelligence activities. The individuals concerned may for instance be asked to write reports or analyses in exchange for money.

Influencing / disinformation activities

A task "traditionally" fulfilled by foreign intelligence services is disinformation (deliberate dissemination of false or misleading information) and propaganda (systematic and targeted manipulation of the public opinion in line with a country's objectives). That way, the services support their countries in increasing their power, in building up their international reputation, or in putting forward their world view. Various state institutions, intelligence services and government-controlled entities co-operate in achieving these aims. Russian influencing operations, for instance, use TV channels, online portals and various social networks to spread the Russian government's narratives in Germany.

China's state and party leadership has announced the start of a "new era" in which China would move closer to centre stage and become a global leader. This will allegedly be achieved with the help of strategic master plans such as "Made in China 2025" and the "Belt and Road Initiative" project. For these strategies to succeed, it will be essential to create a favourable political environment. To this end, Beijing is trying to extend its influence on politics, economy and society worldwide — including in Germany.

Foreign direct investments (FDI) and mergers and acquisitions (M&A) are another means China uses to get access to high technology and future technology, which is to make the country a globally leading "high-tech nation" until 2025. This also increases the economic dependence of investees, providing China with the levers to influence political decisions according to its own interests. China's global investments thus are not motivated by economic considerations alone, but are part of a global geopolitical strategy.

Turkey also uses levers in other countries to advance its political interests. In particular, people of Turkish ethnicity are instrumentalised for exerting influence in Germany.

Print view

Gebäude 1

Anti-terrorist Hotline: +49(0)221/ 792-3366

Anti-terrorist Hotline: +49(0)221/ 792-3366

Publications

2018 Annual Report on the Protection of the Constitution (Facts and Trends)

2018 Annual Report on the Protection of the Constitution (Facts and Trends)

DOI: June 2019
Further information Download PDF File
Cyber attacks controlled by intelligence services

Cyber attacks controlled by intelligence services

DOI: May 2018
Further information Download PDF File
2017 Annual Report on the Protection of the Constitution (Facts and Trends)

2017 Annual Report on the Protection of the Constitution (Facts and Trends)

DOI: July 2018
Further information Download PDF File
How can I identify extremists and members of foreign secret services within my environment? - Important information for refugees in Germany

How can I identify extremists and members of foreign secret services within my environment? - Important information for refugees in Germany

DOI: March 2018
Further information Download PDF File
Right-wing extremism - Signs, symbols and banned organisations

Right-wing extremism - Signs, symbols and banned organisations

DOI: October 2018
Further information Download PDF File
2016 Annual Report on the Protection of the Constitution (Facts and Trends)

2016 Annual Report on the Protection of the Constitution (Facts and Trends)

DOI: July 2017
Further information Download PDF File