The arson attack on the Teltow Canal suddenly showed Berlin how vulnerable central supply structures are. Tens of thousands of households were without power, the Federal Prosecutor General is investigating, and the political debate follows familiar patterns. Higher fences, more cameras and stricter laws are required. But this reflex falls short. Today, physical sabotage almost always begins digitally.

Security starts at the fence

It is a dangerous mistake to believe that concrete, steel and barbed wire alone can protect critical infrastructure. Before a perpetrator reaches a substation, he often already knows its weak points in detail. Site plans, maintenance logs, circuit diagrams and network documentation are the actual target coordinates of modern attacks.

Anyone who stores such information unprotected via clouds based in the United States or sends it via unencrypted electronic mail makes it easy for attackers. The bolt cutter on the fence is then just the last tool in a chain of attacks that began digitally long ago. Secure data exchange is therefore not a convenience feature, but rather the first line of defense of physical protection.

Data is the attackers’ navigation system

Today, attackers no longer have to spend much time spying. In many cases, they find sensitive information where it was placed for convenience or cost reasons. Anyone who can no longer control who has access to construction plans or operating data and when will effectively lose control over their systems. The fence is already ineffective at this moment, even before anyone touches it.

Digital sovereignty determines resilience

The problem becomes particularly clear when it comes to energy supply. The so-called n-minus-one principle, which is intended to compensate for failures through redundancies, has long been fully digitalized. Switchovers are automated, controlled by complex communication processes. However, these processes become an Achilles heel when they run over infrastructures that are not under their own control in the event of a crisis.

True resilience requires digital sovereignty. Critical operators must ensure that central control and communication channels function even if external services fail or are compromised. Anyone who relies on providers outside of European jurisdictions for vital processes is becoming strategically dependent.

Critical infrastructures need integrated protection

Protecting critical infrastructure must no longer be divided into physical security on the one hand and cybersecurity on the other. Both areas are inextricably linked. Cybersecurity is the nervous system of the physical world. If data is manipulated, spied on or blocked, the real damage is only a matter of time.

More than a law on paper

The planned umbrella law for critical infrastructures must therefore not become a bureaucratic fig leaf. A rethink is necessary: ​​Protection begins with control over data flows, access rights and communication channels. Only when these foundations are designed to be confident and resilient do fences, cameras and security guards have their effect.

Those who continue to dismiss digital sovereignty as a side issue may find themselves learning the next lesson in the dark. Then no political debate will help, only the realization that physical security without digital control is an illusion.