Édition originale en anglais. La traduction de cette nouvelle analyse est en préparation.
Historical case · 2015
The Bundestag Intrusion: Protecting an Institution’s Working Memory
Parliamentary communications combine confidentiality, continuity and public trust.
In this analysis
What happened and what is established
The EU Council’s 2020 decision concerns the April–May 2015 attack on the German Federal Parliament. Its statement describes an impact on the parliamentary information system, theft of data and affected email accounts, and identifies the persons and body sanctioned. [1] This case reports the Council’s attribution and sanctions decision as such; it does not claim an independent forensic determination.
Why the case changed the discussion
An elected institution’s communications are both working infrastructure and a record of sensitive relationships. A breach can affect correspondence, confidence and institutional independence even when the building remains open. The security officer must support diverse users and rapid collaboration without allowing every relationship to inherit the same level of trust.
What could reduce exposure today
Separate ordinary and privileged identities, strengthen authentication and recovery, restrict unnecessary mailbox access and monitor high-impact administrative changes. Protect collaboration tools as core institutional infrastructure. Access reviews should cover assistants, temporary staff, contractors and role changes, with clear ownership rather than an assumption that every account remains needed indefinitely.
How the response could be stronger
Maintain a trustworthy communications channel for the response team and the leadership affected. Preserve mailbox and identity evidence while deciding what must be rebuilt or re-established. Avoid reducing the response to replacing devices if account access and trust relationships remain uncertain. Communicate confirmed effects without publishing sensitive correspondence or inviting speculation about individuals.
Policy decision and exercise
Who can authorise a disruptive reset of institutional communications, and what minimum service must remain available? Exercise a suspected privileged compromise during a time-sensitive public process. Test the transition to trusted communications, independent verification of account recovery and the allocation of support staff. The lesson is to protect the institution’s ability to work and decide, alongside its technical perimeter.
References
Original editorial analysis and paraphrases. Recommendations are distinguished from documented facts; references do not imply institutional endorsement.