EMET NEWS PRESS

Situation

Germany’s domestic-security environment is shaped by the interaction of ideological radicalisation, digitally mediated mobilisation and regional organisational capability. Right-wing extremist actors use migration, crime, public-security incidents, economic pressure, energy policy, the war in Ukraine, institutional distrust and municipal disputes as recurring mobilisation triggers.

The threat picture is driven by the repeated interaction of political resonance, extremist actor networks, platform-based dissemination and local activation. These interaction patterns create conditions in which online agitation can develop into intimidation, protest escalation, disruption of public processes, targeted harassment or violence.

The AfD holds a significant position in the national political environment due to its nationwide presence, parliamentary representation, regional organisation, staff infrastructure and digital communication capacity. Its intelligence relevance arises from organisation-related communication patterns, personnel continuities, documented linkage environments and the repeated circulation of narratives that may acquire wider operational utility in right-wing extremist actor spaces.

The primary security concern is concentrated in regional convergence zones. These are local environments where political actors, extremist activists, digital multipliers and conflict-capable networks operate within the same geographic and communicative space. Priority assessment is required where public target-marking, coordinated mobilisation, escalating rhetoric, violence indicators or organisational preparation are present.

High-confidence assessment: 

The highest short-term escalation risk arises in local conflict settings preceded by digital mobilisation. Relevant triggers include accommodation decisions, municipal migration disputes, election appearances, court rulings, public-security incidents, mosque construction projects, Pride events and conflicts involving state authorities.

Moderate-confidence assessment: 

Right-wing extremist mobilisation gains operational effect when parliamentary communication, extra-parliamentary extremist actors and digital multipliers circulate aligned narratives within a narrow time window. Risk increases where this communication is linked to identifiable local networks, target-marking or coordinated calls for action.

Constitutional and Intelligence Framework

The AfD is subject to nationwide intelligence handling as a suspected right-wing extremist case. The Higher Administrative Court of North Rhine-Westphalia confirmed the legality of this classification on 13 May 2024. The Federal Administrative Court rejected the AfD’s complaint against the refusal to permit revision on 20 May 2025. The nationwide suspected-case classification therefore rests on a final judicial basis.

According to the findings of the Higher Administrative Court of North Rhine-Westphalia and the reasoning applied by the Federal Office for the Protection of the Constitution, relevant indicators include an ethnically and ancestry-based understanding of political belonging, possible restrictions on equal civic participation, migration-related and anti-Muslim devaluation patterns, institution-hostile narratives, organisational reinforcement of extremist messaging and personnel or communication links to right-wing extremist actor environments.

On 2 May 2025, the Federal Office for the Protection of the Constitution publicly announced a higher classification of the AfD. On 26 February 2026, the Administrative Court of Cologne issued an interim order pending the first-instance decision in the main proceedings. The order prohibits the Federal Office from classifying, observing, treating, examining or managing the AfD at the higher classification level. It also prohibits public communication of that classification.

The interim proceedings do not alter the nationwide suspected-case classification. Operational assessment therefore requires strict separation between the judicially confirmed suspected-case level and the higher classification restricted by the interim judicial order.

The evidentiary framework combines publicly available material, organisation-related communication patterns and intelligence-assessed information. Open-source evidence provides a transparent and independently reviewable basis for documenting public statements, speaker functions, personnel linkages, event activity and organisational reach. Covert collection retains priority relevance for non-public mobilisation, operational coordination, violence-related activity, clandestine networks and concealed financial or logistical structures.

For elected representatives, proportionality, purpose limitation and evidentiary documentation require heightened attention. Operational relevance arises from activities outside protected parliamentary core functions, organisational roles within extremist networks, substantiated threat or violence indicators and direct contributions to mobilisation structures.

The former youth organisation Junge Alternative and the former internal grouping Der Flügel remain relevant reference environments for personnel and communication continuity. Assessment priorities include staff relationships, regional contact circles, recurring event formats, digital channels, financing links and sustained mobilisation patterns.

Regional Convergence Zones

The first priority convergence zone lies between regional AfD structures, staff environments and right-wing extremist actor networks. Individual contacts provide limited analytical value. Operational relevance develops through repeated personnel overlap, shared event formats, coordinated digital amplification, mutual legitimisation and sustained use of identical ideological terminology.

Assessment requires differentiation between political cooperation, ideological proximity, organisational penetration and security-relevant mobilisation. The decisive factors are frequency, depth of personnel involvement, geographic spread, organisational durability and measurable effect within the regional environment.

The second priority convergence zone lies between digital agitation and local activation. Digital reach alone has limited intelligence value. Operational relevance emerges where online communication identifies specific places, individuals or institutions, mobilises local groups, concentrates protest activity geographically or contributes to threats, disruption, property damage or violence.

The interval between a digital trigger and real-world action is a central early-warning indicator. Short mobilisation cycles increase the value of pre-defined reporting channels between intelligence services, police, municipalities, electoral authorities, schools and exposed institutions.

The third convergence zone lies between right-wing extremist agitation and violence orientation. Elevated threat levels develop where enemy-image communication is combined with specific target identification, doxxing, weapons references, closed chat groups, travel activity, procurement behaviour, enemy lists or locally capable action structures.

These indicators require joint threat assessment. Operational relevance derives from the convergence of multiple indicators within a defined time and geographic space.

Institution-Focused Delegitimisation

Right-wing extremist and institution-hostile communication increasingly targets courts, parliaments, electoral authorities, security agencies, public administration, media organisations, schools, academic institutions and local elected representatives.

The operational concern arises where state institutions are repeatedly portrayed as inherently illegitimate, externally controlled, corrupt or hostile. Such narratives can weaken acceptance of elections, court decisions, investigations and administrative measures. They also increase exposure for personnel responsible for implementing or publicly defending state action.

High-exposure groups include local elected representatives, public-administration employees, election workers, judges, journalists, teachers, researchers, religious-community representatives, operators of refugee accommodation facilities and civil-society organisations.

Threat levels rise sharply where public target-marking, local conflict dynamics and digitally coordinated mobilisation occur simultaneously. These combinations require immediate assessment of exposure, offender capability, network support, escalation potential and available protective measures.

Digital Mobilisation

Digital platforms reduce the time between an incident, its emotional framing and local mobilisation. They expand reach, networking and recruitment opportunities for extremist actors. Their operational effect lies in the ability to generalise individual incidents, stabilise enemy images, identify minorities or political opponents and amplify local conflict at national scale.

Operational assessment must distinguish between lawful political communication, extremism-relevant agitation, coordinated manipulation and criminal target-marking. Each category requires separate legal thresholds, responsible authorities and response mechanisms.

Relevant indicators include synchronised publication, identical visual and textual components, coordinated hashtag use, concealed source channels, artificial engagement spikes, automated accounts, AI-generated manipulation content and recurring transitions from online communication to local calls for action.

The principal operational gap concerns response time. Municipalities, schools, electoral authorities and affected institutions frequently receive warning indicators after digital dynamics have already transitioned into real-world mobilisation. Early identification of regional target-marking and immediate transmission of reliable warnings therefore require priority capability.

Foreign Information Manipulation and Interference

Foreign information operations exploit existing social conflict, trust deficits and political polarisation. Their operational effect derives from multi-channel dissemination, technical concealment, repetition and deliberate occupation of interpretive space during the first phase of a developing incident.

For Germany, migration, crime, the war in Ukraine, sanctions, energy prices, NATO, the European Union, election procedures and public security remain particularly relevant themes. These issues connect external strategic objectives with domestic mobilisation potential.

Operational assessment must integrate technical origin, funding, coordinated dissemination, actor connections and strategic intent. Narrative overlap provides an initial analytical indicator. Reliable assessment requires additional technical, personnel, financial or operational evidence.

Protective measures and internal warnings require activation before public attribution is complete. The response chain should combine technical preservation, interagency assessment, platform reporting, protection of exposed institutions, criminal-law review and evidence-based public communication.

High-confidence assessment: 

Foreign information manipulation gains effect through repetition, multi-channel distribution and rapid occupation of public interpretation spaces. A prepared interagency response architecture provides greater operational value than isolated reactive communication.

Counter-Strategy

Intelligence-Led Situational Awareness

Germany requires a shared, federally sustainable situational-awareness format capable of integrating regional indicators while preserving the statutory separation of intelligence, police and prosecutorial powers.

The format should connect constitutional protection authorities, police services, state-security units, municipal security structures, electoral authorities and specialised investigative bodies during concrete high-risk situations. Its function is coordinated assessment, regional prioritisation and early identification of escalation patterns.

Monthly regional risk dossiers should identify local convergence zones. Short-notice case conferences should activate where digital target-marking, personnel overlap, mobilisation capacity and violence indicators occur simultaneously.

The assessment process should focus on a limited set of operational questions:

Who is mobilising?

Which person, group or institution is being marked?

Which local infrastructure is available?

Which intimidation or violence indicators are present?

Which protective measures require activation, and within what timeframe?

Implementation within six months: 

Establish standardised regional risk dossiers, common threat-assessment procedures and fixed escalation channels between intelligence services, police and municipal authorities.

Performance indicators: Number of prioritised risk regions, time between digital mobilisation and joint assessment, number of interagency high-risk cases, proportion of cases with documented threat assessment, proportion of transparently documented open-source evidence.

Protection of Exposed Persons and Institutions

Protection measures require prioritisation according to exposure and threat level. General advisory services do not provide sufficient protection where public target-marking, digital mobilisation and local conflict capability converge.

A binding response chain is required: threat assessment, digital evidence preservation, police protection measures, criminal-law review, technical security support and communications advice.

Small municipalities, rural districts and volunteer-based local representative structures frequently possess fewer technical and personnel resources than larger cities. These environments can nevertheless generate rapid mobilisation around accommodation decisions, construction projects, public-security incidents or contentious municipal policy.

Every municipality requires a defined reporting path for threats, doxxing, enemy lists, coordinated intimidation and digital target-marking. Police, state-security units, municipal security offices and victim-support structures should complete a joint threat assessment within a defined timeframe.

Implementation within twelve months: 

Establish state-wide protection and advisory structures for threatened local elected representatives, public employees and exposed institutions.

Performance indicators: 

Response time after a threat report, time between digital target-marking and evidence preservation, proportion of completed threat assessments, number of repeated attacks against the same target, time until implementation of protective measures.

Digital Defence

A federal digital situational-awareness network provides operational value where it consolidates technical analysis, metadata assessment, platform forensics, AI-content verification and digital evidence preservation.

Investigative action, intervention measures and protective operations remain with legally competent authorities. The network’s purpose is early identification of coordinated mobilisation, target-marking, manipulation patterns and real-world escalation risk.

The relevant metric is the time required to identify high-risk activity, establish evidentiary value and transmit regionally relevant warnings. Volume of observed content provides limited operational value without contextual assessment, prioritisation and escalation procedures.

Authorities require prepared communications procedures. Interpretive space develops within hours during rapidly evolving incidents. Delayed or contradictory communication increases the impact of manipulative content. Public responses must remain evidence-based, legally secure, regionally relevant and linked to protective measures for exposed groups.

Implementation within twelve months: 

Establish a digital situational-awareness network linking constitutional protection authorities, police services, the Federal Office for Information Security, state criminal police offices and electoral authorities.

Performance indicators: 

Time until detection of coordinated campaigns, time until regional warning transmission, number of preserved digital evidence chains, proportion of identified mobilisation events receiving early protective response, number of interrupted escalation sequences.

Law Enforcement and Threat Prevention

Criminal-law and police action should concentrate on threats, incitement to hatred, coercion, doxxing, surveillance of political opponents, violence propaganda, enemy lists, offences against public officials and preparation activity with violence relevance.

Digital evidence preservation requires direct integration into threat prevention. Content, communications, metadata, payment channels, chat groups, travel activity and device links should be secured before platform migration, deletion or anonymisation undermine evidentiary value.

State-security units and prosecutors require specialised competence for digitally mediated threat environments. Their work must connect individual reports with repeated attacks, coordinated user groups, regional target patterns and supporting actor networks.

Implementation within twelve to eighteen months: 

Expand specialised state-security and cyber-investigation capacity at federal and state level. Introduce binding digital evidence-preservation standards for threat and target-marking cases.

Performance indicators: 

Time until preservation of digital evidence, clearance rate for digitally mediated threat offences, number of identified repeat offenders and offender groups, time between first indication and prosecutorial assessment.

Federal Implementation Logic

Implementation is shaped by different jurisdictions, legal bases, budgets and operational rhythms. Constitutional protection authorities, police, prosecutors, municipalities, school administrations, electoral authorities and civil-society protection structures require clear interfaces.

The first phase should focus on regional risk dossiers, joint threat assessments and reliable reporting channels. Priority areas are digital target-marking, threats, doxxing, enemy lists, election-related risk and conflict situations capable of rapid mobilisation.

The second phase expands digital analysis, protective structures and specialised investigative capacity. It includes state-wide protection structures, improved access to digital forensics and compatible interfaces between security authorities and municipalities.

The third phase concerns legislative adaptation. It should proceed where concrete implementation deficits have been documented. Relevant review areas include data-transfer provisions, digital evidence preservation, protection of personal data of threatened persons, platform cooperation and resilience of critical electoral and administrative processes.

Phase I: six months. 

Prioritisation of high-risk regions, binding threat assessments, fixed reporting channels and standardised case conferences.

Phase II: twelve to eighteen months.

 Digital situational-awareness network, specialised state-security and cyber-investigation capacity, state-wide protection structures for local elected representatives and exposed institutions.

Phase III: twenty-four to thirty-six months. Legislative adjustment based on documented implementation gaps and tested effectiveness of the first two phases.

Effectiveness Review

The strategy requires quarterly threat and impact reviews at federal and state level. Absolute offence figures are insufficient as a stand-alone metric. Higher reporting levels can reflect deteriorating conditions, improved recording, increased willingness to report or more effective access to security authorities.

Security trends should be tracked through violence indicators, threats, weapons references, surveillance activity and attack preparation. Mobilisation capability should be measured through regional event density, transition from online communication to real-world action, digital reach and network formation.

Protective capacity should be assessed through response times, quality of digital evidence preservation, duration of threat assessments and repeated attacks. Institutional resilience should be measured through disruption of public processes, pressure on electoral authorities and municipalities, judicial workload and reach of coordinated disinformation campaigns.

Operational steering should focus on a limited number of indicators: time to threat assessment, time to protective action, repeated target-marking incidents, clearance rate for digitally mediated threats, proportion of prevented escalation sequences and duration between campaign detection and local warning.

Overall Assessment

Germany’s right-wing extremist threat environment is shaped by the interaction of an expanding extremist personnel base, sustained violence orientation, digitally accelerated mobilisation, regional organisational structures and political resonance spaces with national reach.

The AfD-related suspected-case classification provides a central intelligence framework for examining organisation-related communication patterns, personnel transitions and extremist linkage environments.

The most effective near-term strategy concentrates on concrete high-risk configurations: digital target-marking, regional mobilisation capability, right-wing extremist actor links and substantiated violence indicators.

The federal security architecture requires shared assessment, separate powers, clear responsibility and measurable protective effect.

Glossary

AfD
Alternative für Deutschland; German political party subject to nationwide intelligence handling as a suspected right-wing extremist case.

Convergence Zone
A regional environment in which political visibility, extremist networks, digital amplification, local mobilisation capability and concrete escalation indicators coincide.

Doxxing
The publication or dissemination of personal data without consent for intimidation, harassment, targeting or coercive purposes.

FIMI
Foreign Information Manipulation and Interference; coordinated and intentional manipulation of information environments by foreign state or proxy actors.

Free Democratic Basic Order
Core constitutional principles of the German Basic Law, including human dignity, democratic legitimacy, rule of law, separation of powers and the right to constitutional opposition.

Open-Source Intelligence
Information derived from publicly available material, including public statements, publications, event documentation, digital communication and official records.

State Security Units
Specialised police structures responsible for politically motivated crime, threats to constitutional order and related extremist offences.

Suspected Right-Wing Extremist Case
German intelligence-service classification based on factual indications of efforts directed against the free democratic basic order.

Target-Marking
Public identification of a person, institution or location in a context that can facilitate intimidation, harassment, mobilisation or violence.

References

Federal Ministry of the Interior / Federal Office for the Protection of the Constitution
Verfassungsschutzbericht 2025. Right-wing extremist personnel potential, violence-oriented actors and right-wing extremist offence data.  www.bmi.bund.de/SharedDocs/downloads/DE/publikationen/themen/sicherheit/BMI26012-vsb2025.pdf?__blob=publicationFile&v=7

Federal Criminal Police Office
Politically Motivated Crime 2025. Federal police reporting and methodological distinction from intelligence-service reporting categories.  www.bka.de/SharedDocs/Downloads/DE/UnsereAufgaben/Deliktsbereiche/PMK/2025PMKFallzahlen.pdf?__blob=publicationFile&v=4

Federal Administrative Court
Press Release No. 54/2025, 22 July 2025. Finality of the decisions concerning Der Flügel, Junge Alternative and the AfD nationwide suspected-case classification.
www.bverwg.de/pm/2025/54 

Federal Administrative Court
Decision of 20 May 2025, Case 6 B 23.24. AfD nationwide suspected-case classification.
www.bverwg.de/200525B6B23.24.0 

Administrative Court of Cologne
Decision of 26 February 2026, Case 13 L 1109/25. Interim order concerning the higher classification of the AfD; main proceedings 13 K 3895/25.
nrwe.justiz.nrw.de/ovgs/vg_koeln/j2026/13_L_1109_25_Beschluss_20260226.html

Federal Constitutional Court
Judgment of 26 April 2022, Case 1 BvR 1619/17. Constitutional standards for intelligence powers, data processing, data transfer and proportionality.  www.bundesverfassungsgericht.de/SharedDocs/Entscheidungen/DE/2022/04/rs20220426_1bvr161917.html

European External Action Service
Fourth EEAS Annual Report on Foreign Information Manipulation and Interference Threats, 12 March 2026.
www.eeas.europa.eu/eeas/4th-eeas-annual-report-foreign-information-manipulation-and-interference-threats_en