Berlin's recovery from one of the most consequential cyberattacks on German public administration is turning into an open power struggle between the city-state's government and its own districts. The district of Lichtenberg is refusing to let CrowdStrike, the US security company commissioned by the Senate Chancellery, onto its servers.

The refusal is documented in an internal letter obtained by broadcaster rbb. CrowdStrike's job is to comb the state's IT for damage, traces and leftovers left behind by the Rhysida ransomware group, which breached Berlin's administrative network in mid-August — the attack was discovered on 14 August — and to help make the systems usable again.

The dispute is only the latest chapter of an affair that has dominated Berlin politics for weeks. The hackers exfiltrated data from the state network, and Governing Mayor Kai Wegner confirmed that the city was being extorted. The ransom demand was 30 bitcoin, around two million euros. Berlin repeatedly said it would not pay. After an ultimatum expired, Rhysida announced on Friday that it had published stolen data on its darknet site.

Lichtenberg's letter raises both data-protection and operational objections to CrowdStrike's Falcon agent. The district warns that the software would gain 'near-unlimited access' to all data, including personal data, and would probably 'never be removable again'. It adds that the agent is capable of monitoring all work devices — and therefore the district's own staff — and that feedback from other districts points to 'sometimes severe disruptions' in the operation of specialised procedures, services and programs, posing a significant risk to the district office's ability to work.

The district also says it has already audited its own systems and found no evidence that the attackers were active there; it relies on a competitor's product for protection. CrowdStrike would only be granted access to Lichtenberg's IT if the Senate took over the entire responsibility, including all costs.

According to rbb, the Senate Chancellery responded on Saturday evening: the software was 'indispensable' (alternativlos), and it would assume responsibility for its deployment.

The showdown revives memories of July 2024, when a faulty update to CrowdStrike's Falcon product triggered worldwide IT outages that also hit Berlin's BER airport — a reason, critics say, why an always-on US agent with sweeping access rights meets particular resistance in German public administration. For the moment, the Senate and the district of Lichtenberg remain at odds, with the darknet publication of the stolen data adding urgency to the question of how Berlin's fragmented state IT is secured.

Sources