Low-level agents in Germany: Russia's covert shadow force

Moscow is ramping up hybrid attacks on Germany, from espionage and disinformation to drone incursions.

German Chancellor Friedrich Merz said that although the country may not be at war, it's no longer entirely at peace either.

In recent weeks, a string of drone incursions has unsettled the country, targeting military, critical and even civilian facilities – including Munich Airport. Both the Chancellor and Defence Minister Boris Pistorius have held Russia responsible for at least some of the incidents.

It's still unclear who exactly was behind the drone flights, as investigators would first need to identify its operators. So far, however, not even a single drone has reportedly been recovered.

What is clear, though, is that there appear to be two types of drone flights: professional operations using larger drones, and amateur flights carried out with off-the-shelf consumer models.

Authorities suspect that some of the latter may have been conducted by so-called "low-level agents" working on the margins of Russian intelligence networks.

Short assignments, high risk

Recently, Germany's domestic intelligence service (BfV), the Federal Intelligence Service (BND), the Federal Criminal Police Office (BKA), and the Military Counterintelligence Service (MAD) issued a warning urging people not to allow themselves to be recruited as "low-level agents" by foreign actors.

These individuals, often approached via social media, are paid relatively small sums to carry out "minor" and low-risk tasks, such as vandalism, surveillance, or arson.

"Low-level agents are typically deployed for tangible actions," explained Dr Christopher Nehring, expert in disinformation and director of the Cyber Intelligence Institute, in an interview with Euronews.

He cautioned, however, that while these agents do perform intelligence-related work, they should not be classified as spies, as espionage involves the covert collection of information. "They're generally not tasked with gathering intelligence," Nehring added.

Instead, their work may involve setting fires, sticking propaganda stickers on walls, spraying graffiti, or causing other kinds of damage.

Is ideology all it needs to become a low-level agent?

Dr Hans Jakob Schindler, terrorism expert and head of the Counter Extremism Project, told Euronews that these "agents" are hired for a single purpose, which means they have little understanding of the structures of Russian intelligence in Germany or across Europe. They operate not only in Germany but throughout the continent.

For foreign actors, including Russia, their main advantage is anonymity. Most are identified via Russia-friendly Telegram channels, where they have expressed pro-Russian views. According to Schindler, these agents – typically male and with lower levels of formal education – are then contacted and recruited.

"It's really just about finding someone who is either ideologically motivated to help or financially incentivised – ideally both," Schindler said. Purely ideological motives, he added, are rare, as money usually plays a part. "Precarious economic circumstances plus ideological alignment is basically the ideal package," the terrorism expert explained.

Schindler described the concept as fairly straightforward: the goal is to carry out as many small-scale actions as possible. Low-cost operations that may be effective in aggregate, while keeping the risk for the Russian side extremely low.

Nehring agreed, noting that the agents' tasks are usually "not particularly complicated". When it comes to sabotage, he said, these are often minor actions that cause limited damage but, taken together, create a sense of insecurity. "Hybrid warfare isn't about defeating Germany or NATO outright," Nehring explained. "It's about politically weakening the will to defend by creating a pervasive feeling of uncertainty."

While many of their actions may seem harmless at first glance, they are regarded as precursors to further escalation.

What do 'low-level agent' operations look like?

Earlier this year, during Germany's election campaign, over 270 cars across several German states were sabotaged with expanding foam and adorned with stickers featuring the face of Green Party chancellor candidate Robert Habeck and the slogan "Be Greener".

Initially, suspicion fell on climate activists. However, a Spiegel investigation suggested it may have been a Russian sabotage operation, intended to stir public sentiment against the Greens and their candidate.

Germany's military support for Ukraine is another focal point: recent reports indicate that Russian spy drones have been monitoring weapons deliveries to Kyiv. Low-level agents could also be employed in operations like these, including Dieter S. and Alexander J., who are currently facing trial at Munich's Higher Regional Court.

Dieter S. is accused of promising a contact that he would carry out explosive and incendiary attacks on military infrastructure and industrial sites in Germany. According to investigators, Alexander J. had been assisting him since at least March 2024. He's said to have scouted potential targets and transmitted photos and videos – of military transports, for example – to his contact.

According to the indictment, the plans were intended to disrupt Germany's support for Ukraine. One possible target cited was a railway line used for arms shipments.

The anonymity of the internet allows foreign actors to cover their tracks in such operations and remain "untraceable". If a recruited agent is caught carrying out a sabotage or espionage task, as in the case of Dieter S., they alone are held responsible for the act.

How are 'low-level agents' treated by their handlers?

According to intelligence services, Russia is increasingly relying on inexperienced operatives. The reason: since the start of the invasion of Ukraine, it has become much harder for Russian intelligence to deploy its own agents in Germany.

While exact numbers are unknown, various reports indicate that at least 60 Russian diplomats have been expelled from Germany since the start of the full-scale invasion. Not every Russian diplomat is automatically a spy, but many Western intelligence agencies assume that some are engaged in espionage, as diplomats enjoy immunity and are officially accredited for political, economic, or cultural duties.

Because of these limitations, the use of "low-level agents" is referred to in security circles as an "act of desperation".

"Low-level agents are 'discarded' in every sense," explained Schindler, adding that the Russian side takes no responsibility for the short-term operatives. "Their only aim is to create uncertainty and gather information."

Penalties for such actions range from "anti-constitutional sabotage", which carries up to five years in prison, to "espionage-related activities" in particularly severe cases, which can lead to sentences of up to ten years.

So far, investigators have generally only been able to apprehend the alleged low-level agents themselves – not the people who recruited them.

According to a ZDF Frontal investigation, this remains a constant dilemma for Germany's domestic intelligence service: as even after thorough investigation, the responsible parties often cannot be conclusively identified.

How are low-level agents recruited? Find out tomorrow on euronews.com