This story starts on 12 May 2026, in the run up to the AFCEA trade show in Bonn, when Deutsche Telekom and Rheinmetall announced a joint drone shield for German critical infrastructure. Their release said they had split a detection problem into parts.

The first part was ISM bands at 2.4 or 5.8 GHz, and passive RF scanners on cell towers to identify those by protocol signature. That was depicted as the shield.

The remaining part said flights were on mobile networks with a SIM inside. The release called it a research area, basically admitting a hole in the shield, pointing to the Helmut-Schmidt-Universität in Hamburg for current state.

Twelve weeks later, on the evening of 4 August, a drone carrying Semtex and PETN in a sealed food can came to rest against a Ukrainian An-124 at Standplatz 213 of Leipzig/Halle airport. According to ZDF frontal and a joint WDR/NDR/SZ report cited by the NZZ, the drone carried two SIM cards and a 5G router, exactly as Telekom had described as the hole.

WWI isn’t forgotten

Recently I pointed out how modern OPSEC descends from the Russian Second Army broadcasting its marching orders in the clear before Tannenberg in 1914. The May release press by Telekom is not some obscure brief. It was the largest German carrier and the largest German arms maker describing their slow moving front line, and weakness in their flanks.

Reading it reminded me of how the Russian General shot himself to death after making a similar mistake. The RF part is the known position: Telekom says it has located illegal drone flights for police since 2017, including during the 2024 European Championship. Because the mobile space was described as research only, anyone planning anything was handed a map. The proposed technique is to setup passive radar, reading timing changes in reflected cellular signals across at least four masts to build a movement picture. Using detection in physics instead of a link makes sense and is the right direction. However, it telegraphs to attackers that the physics techniques are not yet deployed anywhere, and certainly were not on 4 August.

Every post-incident statement I have found from the vendors has been talking about the wrong part of this story. Rheinmetall’s Armin Papperger told dpa the company is working with Telekom to use cell towers for early drone detection nationwide. Cell towers with RF sensors detect the 90 percent. The Leipzig drone was in the other ten. As a ZDF drone expert put it, the drone was indistinguishable from a mobile phone to a frequency scanner at the airport.

That method is very, very well known and studied in cyber security, because attacks are stuffed into data channels to make them difficult to block. It’s a matter of getting the detection systems pointed into the right channels at the right time.

Detection by declaration

The May release had another note about detecting cellular drones: 5G network slicing, meaning they would shift to a dedicated data lane for drone control. A slice identifies the drones that register in it. An attacker would use their regular consumer SIM, on the general slice, and the special drone channel would see exactly nothing. This is the counter-UAS equivalent of asking passengers to declare intent not to bomb a plane and calling the declaration a control. Cooperative identification has value for airspace management without attackers. It has none when the attackers appear as everyone else does.

The same logic applies to the detection systems installed at Leipzig. Security sources told ZDF that whether and why triggers failed remains under investigation. Airport counter-UAS is built on signatures of a point-to-point link between a controller and an aircraft. It is behavior prediction: an object that behaves like a drone on the spectrum is flagged. This attack device behaved in a way that fooled the detection. So a loaded high-risk cargo aircraft was proven to be exposed to public airspace for four hours, until a bus driver kicked the attack drone over at 23:42.

Carrier records were recording

Investigators did not find the operator through the airport, because instead they found a direction. ZDF frontal reported on 18 August that analysis of 5G radio data and the seized SIM cards pointed to a cell sector in Sachsen-Anhalt near Merseburg, roughly ten kilometres from the scene, the direction from which a second drone allegedly flew. Bild had earlier reported a third SIM located in the same area. A special police unit searched there without result.

That is a Funkzellenabfrage on traffic data, which the Bundesverfassungsgericht knows well because they have two decades experience fencing it in. It worked here for two simple, yet volatile, reasons: the drone was recovered intact including SIMs, and the carrier stored those recent records. Neither is something security can bank on, usually. The German state had no targeted detection setup for cellular-controlled drones, so attribution flipped to bog-standard telecom metadata after the fact. Leipzig will most likely be cited in the next round of the Vorratsdatenspeicherung debates. Cell metadata retention became the attribution method for a critical sensor design failure at an airport perimeter.

Pilotless Schengen

In March, I wrote about the FOI taxonomy of convicted spies in Europe: the Observer, the Disposable, the Mobile Spy exploiting open borders. The model assumed the disposable one is who carries out the act. Leipzig separates the roles. Someone in Germany placed a small antenna in a tree at Kursdorf, north of the airport, which investigators believe served as a signal amplifier, and someone delivered the explosives. The reporting tells us a pilot needed internet. As the ZDF expert said, a café in Leipzig or a chair abroad would do equally well.

Every counter-sabotage approach that rests on catching the person who flies is going to run into the cybersecurity problem of the last 20 years at least. You get the mule, the person who installs, and that’s it. The skill and the risk are decoupled by design. German intelligence has already said as much. The joint BKA, BND, BfV and BAMAD warning I covered on the Leverkusen rail sabotage describes Russian services recruiting locals through social media and messenger apps, directly or via intermediaries.

Sequencing

The attribution path in the press doesn’t have much to it. On 7 August, two days after the discovery, the Wall Street Journal reported that US officials assessed the drone as likely linked to the Russian government. On 25 August, flight-tracking data showed a US government transport from Joint Base Andrews landing in Moscow; the Washington Post and CNN identified the passenger as CIA Director John Ratcliffe, carrying a message about attacks on NATO territory, with preceding intelligence flagging sabotage, cyber and drone operations.

On 27 August, ABC News quoted a US official calling the explosives and device structure typical of the GRU. On 1 September the Interior Minister Dobrindt stated that police investigations, the pattern of the act and intelligence findings together established Russian responsibility. The government closed the Russian consulate in Bonn.

No source connects the Ratcliffe trip to Leipzig. I am placing them in one timeline because they occurred in one. The evidentiary basis for German attribution has not been published. I’m simply pointing out a sequence where Washington held an assessment within 48 hours, delivered a warning in person three weeks later, and then Berlin’s uncharacteristically formal attribution to Russia followed the warning by a week. Whether that reflects coordination, German realization they can’t trust America, or a new pace of Bundesanwaltschaft work, is all unknown. It remains the same minister who, after the Berlin blackout, ruled Russia out on ZDF before the investigation was finished.

Target exposure

The Antonov, according to SZ citing police reports, had flown ammunition from France and it was still on board. Leipzig has a public role in the Ukrainian airlift and every charter announces itself on ADS-B. Russia is of course watching it all with minimal cost, just like the rail line north of Leverkusen that burned in July.

The question the vendors have been answering is how they can recognise a drone. But the actual question from this incident veers more towards why a loaded aircraft sat reachable from public airspace for four hours by any object that did not match a signature. Allow list, not a deny list. Recognition is a prediction that leaves open the historic failures of systems that rely on consistency in attacks to get a “feeling” of safety. Reachability is reality, and it says German site risk isn’t being managed properly. The Telekom release told us in May that Germany not only was expecting attackers to self-identify, but that the flanks were sitting open on a slow-moving frontal defense shield.

Source caveats

The SIM, router, antenna and relay details come from security sources via ZDF frontal, WDR/NDR/SZ, Zeit and Bild, consistent across five outlets and confirmed by none officially. The Merseburg cell sector is single-source to ZDF frontal. The France ammunition detail is single-source to SZ. The Bundesanwaltschaft’s own 6 August release confirms only professional explosives, a detonator, and a probable second drone. The Telekom/Rheinmetall release is primary and public.

Russians are having a laugh about Ahab on the East Sea 1-2-3. And then there’s Sunshine 13. These were passwords disclosed in the Berlin Senate breach. The “Ahabostsee123”, is in fact a yacht for vacations in the Baltic.

Much of the press seems to be wagging a finger about BSI recommendations, calling the passwords weak. The actual story is that 8,110 critical infrastructure risk analyses and emergency plans walked out the door as if nobody is paying attention.

The password story is a form of institutional misdirection. The laughs obscure the real story, the structural one.

Seven Days, Six Terabytes, One Breach

From August 7 to 14 the Russian-speaking ransomware crew Rhysida held access to the networks of two Berlin Senate administrations, transport and building. Seven days of continuous exfiltration before anyone noticed. 5.79 terabytes. Roughly 1.44 million files spanning at least 2014 to 2026, down to Bundesrat correspondence with a federal minister who retired in 2018. That’s a decade of unsegmented material, reachable from a single intrusion, in the largest data theft in the history of the Berlin Landesverwaltung.

It’s floating up now for a 30 bitcoin minimum, roughly two million euros, with bids closing Friday afternoon. The Regierender Bürgermeister says Berlin will refuse to be extorted, no blackmail. Smart. Germans agree on the whole and extortion payments are always advised against, always. The 5.79 terabytes are gone no matter what.

What the Russians Took

Read the ransomlook.io inventory that the Tagesspiegel has documented, once you skip past the giggles and passwords:

• 8,110 documents, risk analyses, and emergency plans for critical infrastructure, with Rhysida specifically showcasing Verwundbarkeitsanalysen of the Berlin water supply
• 11,777 folders and documents marked confidential or classified
• 5,941 files of access credentials, including credentials for the electronic building permit system and for the database of Payone, the payment processor handling transactions for the Land Berlin
• 27,299 personnel files and pay records, including disciplinary proceedings now dangled as individual extortion material

Rhysida sells to whoever pays. That is the thing to watch. Moscow’s sabotage arm, the one Dobrindt keeps calling “left-wing” Vulkangruppe (a name that fails every German left-wing naming test, no less), can arrive any minute. It needs only 30 of Putin’s bitcoin and a Friday afternoon. Expect the map to work its way into another round of Dobrindt waving his favorite false-flags at the next critical infrastructure breach.

The plain-text credentials sat in files with the operationally efficient name “Passwort.docx”. Unencrypted. Working access data for permit and payment infrastructure, typed into a Word document named after exactly what it contained, which an attacker had a week to poke around and read.

Mangelhaft Wasser

The water supply item deserves special attention, because it has German history worth telling. In summer 2020 the consultancy Alpha Strike Labs, commissioned by the Berliner Wasserbetriebe themselves, found more than 30 vulnerabilities and graded the utility’s IT security “mangelhaft“. Is there a better word for failing? The BWB announced a Sofortpaket (immediate) fix-it project. Remediation, however, was only at the level of self-reported. Independent verification of the fixes, six years later, translates into a big fat zero: none that I can find.

So Rhysida is advertising a vulnerability analysis of the city’s water system, which sounds like offering a Weißwurst to Oktoberfest. The map already exists. Alpha Strike drew it in 2020 and handed it to the utility. Whether Rhysida holds that old map or a newer one goes undisclosed, which is how sellers inflate value. Here it makes no difference. Berlin bet that it would never have to show proof the 2020 holes were closed. The auction calls that bet. Every buyer gets to test the Sofortpaket, and the Wasserbetriebe get to find out who was right.

Gears of Fear Turning

The Senate’s access decisions tell you how governance is spelled in German. The breach becomes public in mid August: the home office access is restricted. Then a week later access gets restored. Monday morning, September 1, access is cut again. Ok, but why? This is when Tagesspiegel published two of the stolen passwords.

Ahab on the East See and Sunshine are funny, but really they unlock the bigger story.

All the credentials were exposed the entire two weeks. The intrusion, the plaintext files, the exfiltration were known to the Senate. What actually changed is exposure to the public of what the institution was sitting on, and who was attacking. Berlin incident response wears the suit and tie of press response, which happens to be the same reflex I documented in the recent tragic CSD attack: the state performs a dance around what’s leaking to the public, while the ground level failure analysis goes unowned and unanswered.

Let’s talk about what really is going on, as much as Berlin’s cover-up culture seems to want to do everything except that.

The Cover-Up

Call it what it is. Operators knew, operators played dumb.

They knew in 2020. Their own consultants handed them a failing grade on the water system and a list of more than 30 holes. They interpreted that as a moment of self-certification, in order to produce no written record of whether anything was fixed. They manufactured a silence as their product, instead of a list of failures and fixes.

An operator who types passwords for their payment backend into “Passwort.docx” knows what all of that means. It’s 2026 in Berlin, not 1936. That file existed because nobody touching it believed in accountability, what an honest audit would bring, let alone the press.

And they knew when they were exposed. Watch the dates. Breach goes public: access restricted. A week later: access quietly restored. Monday, the Tagesspiegel prints the passwords: access cut the same morning. That is a team tracking how they look to someone judging them, lacking internal moral compass, acting on getting exposed instead of getting a clue. Nobody managing legibility that precisely is confused about what they prioritize. They are covering and ducking, pivoting to please whomever they think has immediately authority over them.

A state of improvisation, as political scientists have explained about German institutional habits, instead of rational documented actions.

Throwing blame at “Sonnenschein13” is part of the same operation. Point at the clerk’s password, have a laugh and click on the BSI hygiene lecture. The questions start and stop at that weak endpoint. That’s a shadow of Dobrindt pointing at an attacker’s suspended sentence while perimeters fail to meet baselines, with barrier plans unfunded. The employee is strung up to be visible, far more attention gathering than the operators and the curse of Dobrint.

Berlin collected everything, then they apparently protected nothing, such that when the story broke they spun into managing perceptions of risk instead of the risk. Run the training budget and the apology as routine, then write it off. The questions that actually need to be invested in have names attached: who signed off on skipping independent verification of the Sofortpaket? When? Who owned the directory and the file in it called Passwort.docx? Who ordered home office access restored mid-incident, and who ordered it cut again Monday morning, and what did that person hear over their morning coffee? Put those names in an Untersuchungsausschuss and the whole blowup about a Russian-driven auction gets a lot less interesting. And if they have ties to the AfD, we’ll get closer to the real story here about Russia getting a visit from the CIA about a Winchester America being unable to defend Germany anymore.

Ahab on the East Sea in the Sunshine, is not the story people think it is.

A 2024 NBC survey of 30 San Francisco crossing guards found nearly 25% reported close calls with Waymos while guiding children through crosswalks. They didn’t specify if it has been trending upwards.

Then, after a year and a half of “learning”, in January 2026 a Waymo hit a student near a Santa Monica school. Police blamed the child (“outside the available crosswalk”), running a script the auto industry wrote in the 1920s when it invented the myth of “jaywalking” to shift blame from machines onto the people they crashed into.

California gutted enforcement of that script in 2023 with the Freedom to Walk Act, which was passed with data showing police citations were racist. In Los Angeles, Black residents were being saddled with jaywalking tickets at more than triple their share of the population, according to the campaigns that passed AB 2147. That illustrates how race-based police doctrine gets repealed by legislators, yet still seeps into a Santa Monica report of a Waymo crash.

Side note: the 1860s Kansas term “jayhawkers” included the men recruited into the 1st Kansas Colored Volunteers, who were killing Slaveholder Rebellion Confederates at Island Mound in October 1862 before the federal government formally allowed it.

Who could have seen a child going to school would be crashed into by a Waymo? Not Waymo, apparently. NHTSA has opened an investigation of Waymo, but nobody seems to have addressed police using racist framing to blame a child and protect a car company. Notably, the police also claimed non-injury, while Waymo’s own required report to NHTSA explained the child sustained minor injuries.

And now a 2-year-old fell face down in the crosswalk at Sanchez and Duncan in Noe Valley around 9:30 last Friday morning; as a Waymo drove toward her, her father pushed their stroller into its path and the car stopped just feet from running over the child. Waymo announced its vehicle did nothing wrong, which seems like a PR campaign more than any actual data point.

Waymo keeps the telemetry secret, so that’s a good reason to believe all the people reporting what they saw, versus the corporation spinning a story on something nobody can see. GM’s Cruise ran the same play in 2023, claiming its records showed no driverless car present where a family reported one accelerating at their 7-year-old, before regulators penalized Cruise $112,500 for withholding collision information.

Cruise was then cancelled.

Who will be the next person, and the next, and the next to jump in front of a Waymo to save a child’s life?

Who are the modern day jayhawkers on our streets to stop Google’s robots from making streets unsafe?