Germany classified €1.2bn of unrelated research as federal cyber security

Germany’s federal audit office found that at least €1.2bn assigned to a constitutional debt-brake exception for protecting information systems did not serve that purpose. The spending supported general AI methods, computing capacity, robotics and projects including an app that recognizes bird calls and a system that measures recycling-container levels.

The bird app is a memorable example, but the 31-page audit describes a structural failure. Across the 2025 and 2026 budgets, €4.5bn was placed in the cyber-security exception. Five research-funding lines worth more than €1.2bn did not name protection of IT systems as their primary purpose; five of 68 underlying guidelines explicitly excluded IT security as a research topic. The Bundesrechnungshof says the classification raised the permitted level of net borrowing and violated budget rules. The government argues that technological sovereignty requires mastery of the wider computing stack. The auditors reject that as too broad for an exceptional borrowing category.

The operational side is no better. The Federal Office for Information Security has had authority to inspect agency communications security for four years, but by August had completed baseline checks at only 15 federal bodies. At the current pace, the audit estimates, a single round across government would take more than 20 years. The Digital Ministry plans a functioning information-security dashboard in 2027, largely using agencies’ self-assessments; the auditors want expanded on-site checks, independent evidence and an operational system by the end of 2026.

This is therefore two accountability problems joined together. Officials cannot reliably measure the government’s security posture, and the spending label is broad enough to accommodate projects with no direct security purpose. A larger cyber budget cannot fix either problem by itself. Germany needs a narrow eligibility test for the borrowing exception and evidence gathered by inspectors, not merely reported by the agencies being assessed.