• Germany's Interior Ministry is preparing a Cyberdome network of digital sensors as part of a wider anti-sabotage package
  • The government has not yet disclosed how operators would connect to the system, share data or respond to its alerts

The Fact

Germany's Interior Ministry is preparing a national network of digital sensors to detect cyberattacks as part of a wider anti-sabotage package announced on 6 September. Interior Minister Alexander Dobrindt described the planned system as a "Cyberdome", intended to protect public authorities and companies. The government has not published a detailed technical design or said that the system is already operating.

The wider package also includes stronger protection against drones around critical infrastructure, following an attempted drone attack at Leipzig/Halle airport in August. Germany has attributed that incident to Russia, which denies involvement. Reports reviewed do not give Cyberdome's budget, deployment timetable, participating organisations, data-sharing rules or responsibilities for responding to alerts.

The assessment

If Cyberdome flags suspicious activity inside a power or water network, the alert still has to be checked against what the operator can see locally. Someone then has to decide whether to block traffic, isolate a system or leave it running while the incident is investigated. The proposal does not yet say who would make those decisions.

That matters because a false alarm could interrupt a legitimate service, while a slow response could leave an attack running. Germany has not said what data operators would send to Cyberdome, who would receive the alerts or whether the national system would have any authority to intervene. Those details will determine how the network works alongside existing security teams.

For BTW readers, the main issue is responsibility. Before operators connect production systems to Cyberdome, they will need to know who verifies an alert, who contacts the affected organisation and who can authorise action. Without that chain of responsibility, Cyberdome remains a plan for monitoring rather than a defined way to respond.

What to watch

Watch for Germany to name the agency running Cyberdome, the first participating organisations, funding, and deployment dates. The technical framework should also set out what data operators must share, how alerts are verified, and who can authorise action. Those details will show how Cyberdome would fit into existing incident-response procedures.