Germany: Shadow army or isolated cases? Right-wing structures in the security authorities


The case of Franco A, chat groups, the Uniter association, lists of enemies and threatening letters: how far do the right-wing networks in the Bundeswehr and the police extend?

Support our work: become a Friend of Statewatch from as little as £1/€1 per month.

In April 2017, when it became publicly-known that Franco A, a right-wing Bundeswehr (German army) lieutenant, had built up a false identity as a refugee with the possible aim of committing terrorist attacks and blaming them on refugees, there was significant attention and pressure on the army. It didn’t last long, but it was enough to persuade the Minister of Defense to take some action. "The Bundeswehr has an attitude problem and it obviously has a leadership weakness at various levels and we have to be consistent on this," Ursula von der Leyen – now President of the European Commission – said at the time.[1]

As part of her initiative, barracks were searched and certain Bundeswehr regulations were revised. As of 1 July 2017, the military counter-intelligence service (Militärischer Abschirmdienst, MAD) has routinely checked applicants for, among other things, extreme right-wing views. In addition, the criminologist Christian Pfeiffer was commissioned to conduct an investigation into the internal constitution of the Bundeswehr. In addition to the case of Franco A, revelations about bullying and sexual violence in the military were due to come under scrutiny. However, the study, if it was ever completed, has never been published.

Over two years after the case of Franco A came to light, public attention and official sensitivity to the problem have decreased significantly. Nevertheless, individual revelations about right-wing structures and incidents in the Bundeswehr and the police continue to raise questions. Are they individual cases or is there a network behind the incidents? Is there such a thing as a shadow army in Germany? Is there a deep state? Is the problem taken seriously enough in politics and are security authorities exerting the necessary pressure against such developments? And finally: what do the various scandals in the police and Bundeswehr mean in socio-political terms?

The case of Franco A

It is February 2017. Lieutenant Franco A is arrested at Vienna airport when he tries to remove a weapon from a hiding place in the toilet. The loaded pistol had apparently previously been discovered there by a cleaner; Austrian security forces monitor the toilet and are able to carry out the arrest. The lieutenant claims to have deposited the weapon there after finding it by chance in the bushes during a previous visit to Vienna. It was not until the next day, when approaching the checkpoint at the airport, that it occurred to him that the weapon was in his possession. It was then, he claimed, that he had hidden it. A few days later A flew to Vienna again – on a one-way ticket, with a PDF file of the ‘Mujahedeen Explosives Handbook’ in his luggage. He states that he had returned solely to hand over the weapon to the authorities.[2]

Only two months later, A is arrested in Germany. He is taking part in a training course for lone fighters (Einzelkämpfer, a military term describing soldiers trained to go into combat alone) in Hammelburg. After his arrest, 16 raids take place in Germany, France and Austria. Maximilian T – who is also a soldier and had travelled to Vienna together with A – is listed amongst the accused. During the searches, documents on the handling of explosives, right-wing literature and notes on potential attack victims are found – including Heiko Maas (a high-ranking politician and minister from the Social Democratic Party), Claudia Roth (of the Green Party) and Anetta Kahane (a German-Jewish journalist, author and anti-racist activist). Notes outline further plans, for example the demolition of the memorial stone for the Rothschild family and the liberation of the Holocaust denier Ursula Haverbeck. One idea was to throw a grenade at antifascists whilst ‘disguised as an asylum-seeker’.

For A, this disguise was more than a thought game. In the course of the investigation it became clear that he had built up a false identity as a Syrian refugee, David Benjamin, which would presumably be used for committing attacks. In May 2017, the Office of the Attorney General of the Federal Republic of Germany takes over the investigation because of the preparation of a serious act of violence threatening the state, but the Higher Regional Court of Frankfurt decides in June 2018 not to open proceedings against A because there is no sufficient evidence against him of the crime. In November 2019, however, the Federal Supreme Court rules that legal proceedings should commence.

The case of Nordkreuz

In the course of the investigation into the Franco A case, one informant reported extensively during his interrogation about the Nordkreuz group – a network of soldiers and police officers who exchange civil war scenarios in encrypted chats, organize joint shooting exercises and make plans for the kidnapping and murder of leftists. The informant is Horst S, former lieutenant general of the German Armed Forces and at that time still commander of a regional security and support company, a unit of reservists available for deployment for homeland security tasks.[3]

In June 2017, a few days before the Federal Criminal Police Office (Bundeskriminalamt, BKA) interviewed S as a witness, he was questioned by the domestic intelligence service (Bundesamt für Verfassungsschutz, BfV) and the MAD about mail orders to the extreme right-wing Thule Seminar, amongst other things. How exactly the secret services came to S and whether the conversation also covered Franco A is not known. However, the temporal proximity of both interviews is at least as striking as the fact that S voluntarily offered himself to the BKA as a whistle-blower. During the interrogations he reported that the lawyer Jan-Hendrik H and the policeman Haik J had compiled lists of potential victims. They had also asked him about the planned transport of kidnapped persons.

The investigators also learn that there were several encrypted Telegram groups related to north-eastern Germany: ‘Nord’, ‘Nord Com’, ‘Vier gewinnt’ and ‘Nordkreuz’. The members of the groups were so-called ‘preppers’ – that is, people who draw up scenarios for the collapse of the state and social order. In the prepper mind-set, this collapse could equally be a consequence of natural disasters, terrorist attacks, or migration – the spectrum ranges from fears of the future to apocalyptic ideas and right-wing fantasies of civil war. Many preppers stockpile equipment and most members of the Nordkreuz group were also in possession of weapons.

Six of them are the focus of investigations by the Federal Prosecutor's Office. Jan-Hendrik H and Haik J are accused of "preparing for a serious criminal offence threatening the state" (§ 89a StGB – Strafgesetzbuches, the penal code). The far right Alternative für Deutschland (AfD) politician Holger Arppe wrote about H in a chat group: "He hates the leftists, has a well-filled gun cabinet in the garage and lives under the motto: ‘If the leftists go completely crazy at some point, I'm prepared’.”[4] Haik J is said to have researched the personal data of potential victims via his office computer, among other things.

In June 2019, there were also searches against one active and several former officers of the special operations command (SEK) of the Mecklenburg-Vorpommern police force. Three of them are accused of having stolen ammunition for years and supplied it to Marko G. He was, in turn, a part of the Nordkreuz chats and was one of those raided in 2017.

It is still unclear which lists with which personal information were found during the raids. The information provided by the federal government and various state governments is contradictory. In response to parliamentary inquiries from the Left Party (Linke), the federal government announced that the defendants had listed 24,521 persons and that this information had been obtained via the hacking of an online mailing list in 2015.[5] When asked whether the persons concerned had been informed, the federal government stated that this was the responsibility of the Länder (federal states) and that the BKA had sent a corresponding risk assessment together with the list to regional police forces

Further inquiries from Linke in several state parliaments, however, brought other information to light. In Berlin, the Senate replied that the BKA had sent about 1,000 sets of data to the Landeskriminalamt (LKA, the regional criminal police force), two of them with references to Berlin.[6] In Saxony, the LKA received a list of 5,500 names, including 10 related to Saxony.[7] For Thuringia, on the other hand, it is said that the lists (plural!) of names found had been transmitted, but that there had been no references to Thuringia.[8] There are obvious differences in respect to the extent of the list, as well as with regard to the question of how many addresses in the respective federal states were on it.

The hack mentioned in the federal government’s reply is probably the data obtained from Impact-Mailorder, which was published on the internet in 2015 and, a few months later, appeared in slightly-modified form on an extreme-right homepage as an ‘Antifa list’. However, these records contain significantly more references to the respective federal states than is apparent from the responses from the state parliaments. Either the information given by the federal government does not correspond to the truth or the answers given by the state governments are incorrect. Furthermore, the federal government announced that the data found during the searches were neither changed nor supplemented. Why, however, is Haik J accused of having misused his office computer to research personal data when the data was allegedly only copied from the Internet? Finally, in the summer of 2019, people on the Nordkreuz list of ‘enemies’ were invited by the police to give statements as witnesses for the first time. Unsurprisingly, these people are not on the so-called ‘Antifa list’.

These contradictions are supplemented by a politically outrageous assessment of the BKA, according to which "so far there are no indications that these are 'enemy lists' or even 'death lists'." In addition, the BKA pointed out that “the collection of information about alleged political opponents is not a new phenomenon and is not only pursued by the right-wing spectrum.”[9] In this view, then, if armed right-wing extremists with access to the police and the Bundeswehr keep lists of potential victims, they should not be considered as lists of enemies and, in any case, left-wing extremists also keep lists of their enemies.

Uniter - connected in one

The informant Horst S is not the only link between the cases of Franco A and Nordkreuz. André S and the association Uniter also play an important role in both. André S was a trainer in the clandestine Special Forces Command (Kommando Spezialkräfte, KSK) of the Bundeswehr. Under the pseudonym ‘Hannibal’ he administered at least one of the chats that Horst S spoke of in his interrogation with the BKA. Franco A and Maximilian T were also members of these chat groups. When A was arrested, André S had the chats deleted.

André S also appears as Hannibal at Uniter – he is a co-founder of this association. Members of the KSK, former soldiers, reservists and men with a penchant for the army come together there. Officially it is about job placement, mutual support after missions, joint training or the establishment of a medical emergency unit. Journalistic research by taz paints a different picture. According to the newspaper, there is also a combat unit being set up under the umbrella of the association.[10]

According to Südwestrundfunk, the association has carried out activities similar to those of the right-wing preppers. Südwestrundfunk cites a former KSK soldier, reporting about 80 to 100 individuals, who are said to have hosted weapons depots for Uniter, in order to become active in case of a ‘day X’.[11]  At least 12 of the former chat participants are or were Uniter members. The fact that Uniter has a strong connection to weapons was revealed by several pictures on the club's Instagram account, prior to their deletion. They showed various weapons, German army and police uniforms and a weapons depot.

The association is divided into districts. In Germany these are North, South, East and West. The chat groups were also named after the four cardinal points. Uniter denies any connection with the chats. André S has not been accused in any of the known proceedings so far and in the case of Franco A he is regarded as a witness. Nevertheless, the Federal Prosecutor’s office is currently pre-investigating the Uniter association. Apart from that, S also played an important role in another trial in Cologne. A lieutenant-colonel in the MAD, who met several times with S as a MAD informant, was accused of having warned S about raids against members of the chat groups. This could not be proven before the Cologne District Court.[12] However, it became clear that André S had foreknowledge of the raids and, amongst other things, removed a laptop before they took place. S is no longer on the board of Uniter. Instead, the board is made up of names of people resident in Switzerland.[13]

Right-wing networks in the blue light milieu

Right-wing networks also exist within the police apparatus. An example of this is the series of threatening racist letters that were allegedly sent by a group of Hessian police officers to the lawyer Seda Başay-Yıldız. Amongst other things, Başay-Yıldız represented surviving dependents of victims of the right-wing terrorist NSU (National Socialist Underground) network[14] and has been receiving threatening letters since August 2018. These are signed ‘NSU 2.0’ and contain racist insults and threats as well as publicly-inaccessible information such as the names and addresses of her child and parents. Investigations revealed that this information was retrieved from a police computer and that officials who had access to this information regularly exchanged neo-Nazi content in a chat. Five police officers are currently under investigation for threats and incitement to hatred.[15]

However, this is not the only current case from Hessen. The police are investigating five policemen from the Vogelsberg district for violation of the Weapons Act, the use of symbols of unconstitutional organisations and incitement to hatred. Among other things, they are said to have attracted attention at a fair by shouting neo-Nazi slogans and collected Nazi devotional objects.[16] Another official from southern Hessen is accused of having passed on information to the neo-Nazi activist Martina H.[17]

The Berlin LKA is currently involved in several scandals. Rundfunk Berlin Brandenburg reported on a meeting of a Berlin LKA official with neo-Nazis.[18] The policeman works for a unit responsible for surveillance, but was not on duty when he met the neo-Nazis. At the meeting in a Berlin pub he was observed by a surveillance team that was actually intended for his interlocutor – the NPD (National Democratic Party) official and neo-Nazi Sebastian Thom. The subject of the meeting is as unclear as the identity of the other neo-Nazis involved.

Thom ran for the NPD in the 2009 Bundestag elections. Together with the former Neukölln AfD district chairman Tilo Paulenz, he is considered a suspect in a series of right-wing arson attacks. One of the attacks was against a Linke politician, Ferat Kocak. Thom and Paulenz had been spying on him since 2017. This did not escape the authorities either – the two neo-Nazis were monitored by the Berlin intelligence service (Landesamt für Verfassungsschutz, LfV). In this context, the secret service also recorded the neo-Nazis’ conversations about the surveillance of Kocak. Two days before the attack on Kocak, the intelligence service informed the LKA, but not Kocak himself. In the end, it was only through his own swift reactions that he was able to prevent the flames that were engulfing his car from reaching the gas pipeline of the house where both he and his parents were residing on the night of 1 February 2018, in an attack that was judged a terrorist incident by Andreas Geisel, the Senator of the Interior for Berlin. Nevertheless, the Berlin authorities are still unable to show any success in their investigations. The Berlin branch of Linke is therefore calling for the establishment of a parliamentary committee of inquiry.

The fact that a police officer allegedly meets criminal neo-Nazis in the pub raises questions, but is not the only such scandal of the Berlin LKA. Last year, the LKA investigated one of its officers because he had used data from the police's internal information system to write threatening letters to left-wing activists. The officer admitted the crimes and was ordered to pay a fine of €3,500, not for sending the letters but for violation of the Berlin Data Protection Act. He does not, therefore, have a criminal record. Doubts about his sole responsibility came to light through media reports. Amongst other things, the official only had access to the data in question until 2015, but some information in the letters could only have found its way into the information system in subsequent years.[19] The civil servant's life partner is also a police officer and has been responsible for monitoring the left-wing scene at the police state security department. She is said to have had access to the relevant data while the letters were being sent.

Shadow army, militias or concerned citizens in uniform?

The closer one looks at the individual cases, the more comes to light. These are not individual cases that are exceptions to the structure. The perpetrators have networks. These networks do not have to be strictly-organised secret societies. They can also be chat groups or informal cliques. However, it is imperative to overcome the standard presumption of individual perpetrators. It harms investigations and political inquiry because it does not focus on the social, logistical and political conditions of far-right actions and instead focuses only on individual motives. It also serves to release the respective apparatuses and their leadership from responsibility.

At the same time, the cases also show that the problem is not a ‘deep state’, a shadow government that systematically pulls the strings in the background. The problem lies in a social shift to the right that affects not only parliaments, football stadiums and schools, but also the authorities. The problem is exacerbated by the fact that democratic culture is insufficiently anchored in the security apparatuses. Signs of this inadequate anchoring are, for example, racist attitudes as well as institutional racism, which is reflected in erroneous investigations and illegal racial profiling. Signs also include a widespread, violent and harmful idea of masculinity, a tendency to authoritarianism and a traditional and deeply rooted hostility to leftist and humanist ideas.

Structures in which such deficits prevail are dangerous. They produce networks such as those described above and develop men who are capable of severe violence if circumstances permit or even if their personal situation changes drastically, for example through the loss of family or a job. What distinguishes these men and their networks as right-wing is not primarily (potential) identification with historical national socialism. Rather, the right-wing hostility towards democracy consists of the tendency to take the law into one's own hands in order to allegedly save the German people, in disregard of the Basic Law (the German constitution, Grundgesetz) and democratic state structures. Preparation for the collapse of the state order and the bringing about of that collapse thus merge smoothly into one another.

Such structures are protected by esprit de corps and a lack of political will to inquire. This esprit prevents apparatuses from democratically regulating themselves or from being effectively regulated from outside. Political leaders are often unwilling enough to push ahead with the inquiries because the political costs would fall back on their own ministries or parties. The CDU is trying to protect its former defence minister from further political damage and the SPD is unwilling to risk another coalition crisis because of these cases.

For clarification to take place, federal and state governments must come under pressure. In order to build up this pressure, parliamentary and extra-parliamentary opposition are just as important as critical, investigative and anti-fascist research. Only then will there be committees of inquiry with more powers; only then will politicians within the governing coalition pass the pressure on to the security apparatuses. Then the leaders under whose responsibility such developments have taken place can be replaced, then independent investigations can be carried out on recruitment in the police and the Bundeswehr, then independent complaints offices can be created to which those affected could turn as well as democratic police officers or soldiers. Then the apparatuses can be audited and measures can be implemented to democratise these dangerous structures in the long term.

Sebastian Wehrhahn and Martina Renner

Originally published by CILIP: ‘Schattenarmee oder Einzelfälle? – Rechte Strukturen in den Sicherheitsbehörden’, November 2019. Translation by Statewatch.


[1], 27 March 2019

[2] Terrorermittlungen gegen Bundeswehrsoldaten 2017,; C. Balikci, ‘Rechter Soldat mit Terrorplänen’, Der Rechte Rand, no. 173, July/August 2018

[3] ‘Hannibals Schattennetzwerk’,,!t5549502/

[4], 31 August 2017

[5] Bundestag-Drucksache 19/4369, 17 September 2018

[6] Abgeordnetenhaus Berlin Drucksache. 18/16844, 12 November 2018

[7] Sächsischer Landtag Drucksache 6/14336, 7 September 2018

[8] Thüringer Landtag Drucksache 6/6390, 6 November 2018

[9] Niedersächsischer Landtag Drucksache 18/1516, 3 September 2018

[10], 21 December 2018

[11] SWR–aktuell, 7 February 2019

[12], 20 March 2019

[13] Wochenzeitung (WOZ), 14 March 2019

[14] ‘National Socialist Underground’, (editor’s footnote)

[15], 8 July 2019

[16], 3 February 2019

[17], 11 January 2019

[18], 17 April 2019

[19], 21 February 2019

Our work is only possible with your support.
Become a Friend of Statewatch from as little as £1/€1 per month.


Spotted an error? If you've spotted a problem with this page, just click once to let us know.

Report error