An attack on the German railway communication system led to a disruption of the complete railway traffic in Northern Germany on 8 October 2022.
The GSM-R outage at Deutsche Bahn on 8 October 2022 was a large-scale failure of the GSM-R railway communication network in northern Germany. The disruption was caused by cuts to two fibre-optic cables, which were designed to be redundant, near Herne and Berlin-Karow. As a result, rail services in Lower Saxony, Bremen, Hamburg, and Schleswig-Holstein were interrupted for approximately three hours. [1] [2]
The Berlin–Amsterdam route was also suspended, and thousands of travellers were stranded at stations across the affected regions. The Landespolizei of Berlin and North Rhine-Westphalia took over the crime investigation. On 13 October, the German general public persecutor and the German federal Criminal Police Office took over the investigations. [3] [4] [5] [2]
According to Transport Minister Volker Wissing, the incident was treated as an attack, although the background of the act was initially unknown. It remained unclear whether the same individuals were responsible in both locations and whether the actions had been coordinated. Investigators pursued all possible directions, including suspected anti-constitutional sabotage under Section 88 of the German Criminal Code. Authorities assumed that the perpetrator or perpetrators had significant technical knowledge of data cables and railway radio communication, and the cables were considered very likely to have been cut in a coordinated manner. [6]
After the Federal Police initially led the investigation, responsibility was transferred to the state security divisions of the Berlin and North Rhine–Westphalia State Criminal Police Offices. On 13 October, the Federal Prosecutor General took over the case due to the suspected anti-constitutional nature of the act and its broader significance. On 21 October 2022, the investigation was assigned to the Federal Criminal Police Office (BKA). [7]
ARD terrorism expert Holger Schmidt suggested that the incident may have involved a new group of perpetrators, assessed as more professional and better equipped than those responsible for earlier attacks on railway infrastructure. Manuel Atug, an IT security consultant and co-founder as well as spokesperson of the Critical Infrastructures Working Group (AG KRITIS), pointed to similar risk situations affecting telecommunications, shipping, banking, and insurance systems, while noting that a comprehensive understanding of security requirements across all levels was still lacking. State-directed sabotage was not ruled out. Information about the GSM-R network and Deutsche Bahn’s fibre-optic infrastructure was publicly accessible online. [8] [9]
At the same time, Carsten Breuer, then commander of the Bundeswehr’s Territorial Command, warned of a growing number of attacks on infrastructure aimed at unsettling the population. He stated that Germany must prepare for hybrid threats and foreign influence, describing the situation as one “no longer fully peace, but not yet outright war,” and stressed the need for heightened vigilance by security authorities. [10]
Five months after the incident, the Federal Prosecutor General reported that no investigative findings pointed to foreign groups or intelligence services. According to unconfirmed reports by ARD’s Berlin studio and Südwestrundfunk in July 2023, the cable cuts at the two locations were believed to have been attempted cable thefts, which only coincidentally affected the same technical system on the same night. On this basis, and given the classification of the acts as theft and dangerous interference with rail traffic without a political motive, the Federal Prosecutor General reportedly prepared to return the cases to local prosecutors. [11]
In June 2024, after the case had been transferred, the Bochum public prosecutor’s office identified two suspects. Investigators stated that the individuals had acted independently of each other and that the timing of the damage was coincidental. The suspects were believed not to have recognized the fibre-optic cables as such, as they were searching for copper cables. One of the two individuals was identified but was not initially placed in pre-trial detention. [12]
The attack raised concerns about the vulnerability of German infrastructure, especially taken into account the 2022 sabotage of Nord Stream gas pipelines and the German support for Ukraine in the Russian-Ukrainian War. The German main police union stated that it expected that further sabotage at Deutsche Bahn might be attempted and called for surveillance systems to be strengthened. Green politician Anton Hofreiter told FUNKE media group that the sabotage reminded him of the disruption of the Nord Stream pipelines where the "trail leads to the Kremlin". "Maybe both were warning shots because we support Ukraine", Hofreiter added. [5] German police stated that there was no sign of any involvement by a foreign state or terrorism and that it had not excluded political motives in general. [4]