COLOGNE — On the morning of September 2, a line of German police officers moved slowly through a flat green field outside Preilack in eastern Brandenburg, spread beneath a web of high-voltage transmission lines and steel towers. The day before, someone had left improvised explosive devices at the site — beside the infrastructure that keeps the lights on in one of Germany’s most energy-dense industrial regions. Across the country, a second team was examining damaged cables at a substation in Bergheim, a suburb of Cologne, where a separate attack had severed power connections the same night.
Germany’s interior minister named it quickly. The incidents fit “the known pattern of Russian hybrid operations,” Alexander Dobrindt told reporters Tuesday, opening a terror investigation at Preilack. By Tuesday morning, two parallel probes were running, as first confirmed from the investigation sites, no suspects had been identified, and Moscow had denied any involvement.
The twin attacks landed at a specific moment — not simply because they hit German infrastructure, but because they arrived on the same night that European foreign ministers had convened in Ireland to discuss exactly this kind of threat. Whatever the intended audience, the political calendar and the bombing calendar aligned.
Neither substation was destroyed. Authorities said service at Preilack was briefly interrupted before all lines were restored; the Bergheim damage knocked out some cables without triggering a wider blackout. No injuries were reported. But the method — IEDs at a high-voltage site, deliberate cable severing at another — represented a step in the category of targets struck on German soil, moving from airport drone interceptions to attacks on the national grid itself.
Dobrindt’s attribution language was almost identical to what Foreign Minister Johann Wadephul used in August, when Berlin formally blamed Russia for a drone carrying military-grade explosives intercepted at Leipzig/Halle Airport on August 4. Berlin said the “drone configuration, components, explosives and detonation systems” were “known to us from other hybrid operations by Russia.” The same phrase — “known pattern” — returned Tuesday. The same absence of a named suspect accompanied it. Germany’s expanding surveillance of Russia’s drone operations over European territory has not yet produced a named defendant in any of these cases.
The Gymnich meeting in Wicklow, Ireland — an informal gathering of EU foreign ministers, joined by counterparts from Ukraine, Canada, Switzerland, and the United Kingdom — was already in session when news of the substation attacks broke. In dispatches from the Wicklow meeting, the attacks immediately reshaped the discussion. British Foreign Secretary Ed Miliband said the incidents demonstrate “Russia’s attempt to divide us.” Lithuanian Foreign Minister Kestutis Budrys was precise about the trend: attacks against European infrastructure have “quadrupled against us in the last year.”
Russia denied involvement. Its denials, consistent since the Leipzig airport incident, have done nothing to slow Germany’s attribution — but they have shaped the evidentiary gap at the center of every investigation. Berlin has not identified a suspect in the Leipzig case or in either September 1 attack. The “pattern” that officials cite as the basis for attribution has not produced a criminal charge in any open court proceeding.
That gap defines Europe’s posture on hybrid warfare. Governments attribute publicly, investigate privately, and have not demonstrated the evidentiary chain that moves from “this looks like Russia” to “this is Russia.” For publics conditioned to the rhythm of Russian attribution after each incident, the framing is familiar. For prosecutors, it represents an accusation that will eventually need to go somewhere beyond a press conference.
The terrorism designation matters under German law. A “terrorist” offence requires proving intent to coerce the government or intimidate the population — a higher bar than criminal sabotage. Federal prosecutors have not disclosed whether they hold surveillance footage, physical evidence linking the two September 1 attacks to each other, or materials consistent with the Leipzig airport drone case. What they have confirmed is that the investigation is open and the designation preliminary.
At Gymnich, the ministers also revived discussion of unfreezing Russian sovereign assets to fund Ukraine’s defense — a proposal circling without resolution since it was first introduced. The substation attacks, arriving as that debate resumed in Wicklow, add fresh urgency to a conversation European governments have struggled to convert into action. Dobrindt’s investigation and Gymnich’s financial deliberations both respond to what Moscow has framed as a long-term structural confrontation with the West, not a tactical exchange subject to negotiation.
Finnish Foreign Minister Elina Valtonen put the seasonal dimension plainly: “Europe needs to support Ukraine ahead of the winter.” That line linked the attacks on Germany’s grid to the energy leverage Russia has deployed against Ukraine and, intermittently, against European consumers. Whether the September 1 timing was intentional is among the things investigators have not yet said — along with who precisely was responsible, whether the two attacks were coordinated by the same actors, and whether the physical evidence connects either incident to the Leipzig drone case in a technically meaningful way.
Those questions remain open. Germany has a designation, an investigation, and an attribution without a name. Europe has solidarity statements and an asset-freeze proposal that has been in discussion for over a year. Neither timeline has converged on an answer.
Related Posts
