The Price Berlin Never Charges

Friedrich Merz says the people behind Leipzig will pay. A Serbian court has already convicted Serbian nationals for an operation in Berlin directed by Russian intelligence. Germany’s most indulged Balkan partner remains the exception.

By Drizan Shala (Security Desk)

On 31 August the Higher Public Prosecutor’s Office in Subotica, near the Hungarian border, issued a statement that almost nobody outside Vojvodina read. Seven people were under investigation, it said, after Serbian security agencies uncovered an organised group that had procured and stored explosives, explosive devices and drones on Serbian territory and prepared them for transfer to “pre-planned and agreed locations” in countries of the European Union. The investigation had begun after 5 April, when explosives were found near the pipeline carrying Russian gas from Serbia into Hungary. The Security Information Agency and the Military Security Agency, Serbia’s civilian and military intelligence services, together with the criminal police directorate and the military police, had all worked the case. The suspects’ individual roles and the ultimate purpose of the seized material would be established later, in cooperation with European investigative organs.

Agreed with whom was not said.

The pipeline is Balkan Stream, the extension of TurkStream that carries Russian gas across Serbia into Hungary. What was found beside it in April, and what Belgrade said about it at the time, is the reason the Subotica file matters now.

Three days after that statement, Der Spiegel supplied the part of the file Belgrade has not published. Two of the seven, Danilo B., who holds Serbian and Russian citizenship, and Slobodan D., a Serbian citizen, were stopped on 11 June near the Hungarian border in two cars moving toward the Union. One carried components of a modified drone and its control units. The other held two tin cans of explosive in a concealed compartment, along with cash and transmitters for flying drones. German investigators describe a similar modus operandi to the attempted attack at Leipzig on 4 August, where the explosive was likewise packed into a tin can fixed to a drone that came to rest beside a fuelled Ukrainian Antonov. They are examining whether the two men in Vojvodina knew a person who also appears in the Leipzig file. A separate Leipzig suspect, according to the same reconstruction, flew from Istanbul into Germany before the operation and afterwards travelled on to Serbia, which Western intelligence services describe as a hotspot for Russian sabotage operations in Europe, a place where Russian services recruit and train the personnel who carry them out.

Put the two documents side by side and the asymmetry is obvious, but it is not the asymmetry an angry reader reaches for first. The documents perform different functions. A prosecutor is not an intelligence service, and a criminal investigation is not a foreign policy statement. Berlin understood that distinction perfectly well. Its own criminal investigation remains open. The decision to name Russia was taken by the government, not by the courts.

April

The Subotica case did not begin in June. It began on the morning of 5 April, when Serbia’s president announced that two rucksacks holding explosives and detonators had been found a few hundred metres from the Balkan Stream pipeline near Kanjiža, and that he had warned Viktor Orbán at once. Hungary’s election was a week away.

The space did not stay empty. Belgrade filled it, and everything Belgrade put there pointed away from Moscow. Đuro Jovanić, who heads Serbia’s military intelligence service, said his agency had earlier warned the government that a person from a group of migrants, with military training, was preparing to sabotage the pipeline, while cautioning that the origin of an explosive does not identify who ordered its use. Pro-government dailies reported that the markings showed American manufacture. Hungary’s foreign minister called the incident an attack on Hungarian sovereignty and placed it in a series of cases in which Ukraine, he said, obstructs Russian energy flows to Europe. Serbia’s president told a press conference that during the preparation of the sabotage calls had been made from certain regional telephone numbers to some embassies in Serbia, and that conclusions would wait until the Hungarian vote was over. Kyiv answered within hours. “We categorically reject attempts to falsely link Ukraine to the incident with explosives found near the Turkstream pipeline in Serbia,” the Ukrainian foreign ministry spokesman wrote, calling it most probably a Russian false flag operation timed to Moscow’s interference in the Hungarian elections.

Nobody in Belgrade retracted the April frame. Nobody in Belgrade confirmed it either.

Five months on, the same file has become an organised group moving drones and explosives to pre-planned and agreed addresses inside the Union, with one Russian passport among the accused and equipment whose configuration German investigators now compare with the Leipzig attempt. The migrant has vanished from the account. The American markings have vanished. Nobody mentions the embassies now. What has not appeared in their place is any statement by any Serbian minister about who arranged the destinations.

What is actually being charged

Set guilt aside. Serbian police stopped the two cars. Serbian prosecutors hold the men. Nothing published connects Serbia’s government to Leipzig, and the intelligence characterisation of Serbia as a hotspot describes territory, not a cabinet. If the argument were that Belgrade ordered the operation, Belgrade would answer it in a sentence: we made the arrests, and Germany made none.

The measurable thing is cost. And no European government has done more than Germany to keep that cost near zero.

The Serbian exception

Germany’s response to Leipzig rests on a proposition its ministers stated plainly on 1 September: states and structures that supply Russia’s hybrid war with people, equipment or operating space cannot be treated as though nothing has occurred. Alexander Dobrindt said the government had concluded that Russia bears responsibility for the hybrid attack at Leipzig on 4 August. Johann Wadephul, the most cautious voice in that room, said Russia’s leadership confronts Germany with open hostility. The Russian House in Berlin is being closed. The last Russian consulate general on German soil, in Bonn, is to cease operating this month.

Serbia is where that proposition stops.

Berlin’s own foreign ministry calls Germany a key partner for Serbia within the European Union. Bilateral trade came to roughly 10.1 billion euro in 2025. More than nine hundred companies with German capital employ around eighty thousand people there, on cumulative investment of some five billion euro since 2000. Over the same period Germany has provided more than 2.5 billion euro in development cooperation. On 28 May this year, with the Kanjiža explosives investigation already running, the two governments agreed a further 67.9 million euro across climate and energy, inclusive societies and economic development.

None of those numbers is an accusation. Together they establish something more useful than an accusation. On its own ministry’s figures, Germany is the largest trading partner Serbia has and its largest bilateral donor. Whatever leverage Europe holds over Belgrade, Berlin holds the largest share of it. The question worth putting to the Federal Chancellery is why it is almost never applied to Serbian conduct.

The wager behind the policy was serious and deserves to be stated properly before it is taken apart. Keep Serbia bound to German industry, inside the accession process and within reach of Brussels, and Russian influence there becomes something to be managed rather than confronted. Push too hard and Moscow inherits what Europe pushes away. That reasoning held for as long as the consequences of Serbian ambiguity were paid somewhere else, in Bosnia, in Moldova, in Kosovo, by governments with no seat at the table where the policy was made.

Leipzig moves the invoice. The airport is one of Europe’s largest cargo hubs and a node through which the Bundeswehr and NATO allies move ammunition, infantry fighting vehicles and helicopters east; in NATO’s operational plan for Germany it is marked in red under the code LEJ as a high value target. The last Bundeswehr transport went out on 29 July, six days before a drone carrying roughly 600 grams of Semtex came down beside a fuelled Antonov. A defaced embassy wall can be filed under hybrid nuisance. This was an attempt inside the logistical architecture by which Germany supplies a war, and one of the trails out of it runs into a state Berlin still treats as a privileged partner.

Berlin, December 2025

There is an earlier German exhibit, and it has already been through a court.

On 6 March this year Radio Free Europe obtained and reported the verdicts of the Higher Court in Smederevo, southeast of Belgrade, handed down in late December on plea agreements and kept out of public view until then. Three Serbian citizens were convicted of espionage and of inciting racial discrimination for a series of operations in Paris and Berlin during the spring and summer of 2025. According to the verdicts, the group received orders, instructions and money from “structures of the intelligence service of the Russian Federation.” Its members were paid travel costs and five hundred, one thousand or fifteen hundred euro per job. Its work included green paint thrown on the Holocaust Museum and three synagogues in Paris, pig heads left outside nine mosques in the Paris region, and plastic skeletons placed in central Berlin beside the memorial to the murdered Jews of Europe. The court records the purpose as the inflaming of religious and national intolerance, particularly between Jewish and Muslim communities, and the destabilisation of conditions in Germany and France.

Eleven members of the group were arrested in Serbia in September 2025 and remanded on 1 October. Eight remain under investigation. The organiser identified in the verdicts, Momčilo Gajić, described by one of the convicted as closely connected to the Russian service, was not among them. He appears to be in Moscow, where he has been photographed at a liturgy.

The convictions came through plea agreements, were handed down in closed session, and stayed unpublished for ten weeks. Serbia prosecuted the men it could reach and said nothing about the service that sent them.

A German government reading its own file would find the following sequence. In summer 2025 a group recruited in Serbia and directed by Russian intelligence staged an operation at the Berlin Holocaust memorial. In December a Serbian court convicted three of its members and put the Russian intelligence connection in writing. In March the judgments became public and Le Monde ran the conclusion that Serbia has become the principal hub of Russian destabilisation operations in Europe. On 28 May the German and Serbian governments met in Berlin and agreed another 67.9 million euro. On 4 August a drone with a Semtex charge came down at Leipzig.

Merz’s own doctrine

The German government settled the relevant principle this week, and it settled it against itself.

Officials in the Chancellery, according to the Spiegel reconstruction, put the question directly: should the government wait to name Russia until the criminal investigation was legally watertight, which could take months or years, or does the gravity of the attack require a fast response once the chain of evidence points to state structures in Russia? A foreign intelligence service delivered the tip in the first half of August that several people involved could be assigned to Russian services. Insiders call that information the gamechanger. The government chose speed. Four weeks from the tarmac to the attribution.

Apply that doctrine to the country the couriers were driving out of.

Nobody is asking Berlin to declare Aleksandar Vučić an accomplice at Leipzig, and the evidence does not support it. The question is narrower and harder. Germany has accepted that a government may revise its posture toward a state on an intelligence assessment while the courts are still working. Its allies have delivered an assessment about Serbian territory, and a Serbian court has delivered a judgment about an operation in Berlin. What in German policy has changed?

Petrit Selimi, Kosovo’s former foreign minister, asked on the day the Spiegel reconstruction appeared: Serbian nationals sent to attack synagogues and mosques in Europe for Russian intelligence, training camps organised in Serbia to create chaos in Moldova, now drone operators attacking Germany ending up in Serbia. When is it enough?

Strip out the single element the public record does not establish, which is the naming of the FSB rather than Russian intelligence generally, and the sequence holds. The Smederevo verdicts establish the first. Moldova’s intelligence service says Russian special services, the GRU among them, ran camps on Serbian territory where Moldovan citizens were trained in confronting police and creating disorder before the 2024 vote, with seventy four people detained on their return. Neither case demonstrates direction by the Serbian government. Both demonstrate the thing that matters to this argument, which is that Serbian territory keeps appearing as the operating environment for Russian intelligence work against European states.

Addressed to Belgrade, the question invites a denial. Addressed to Berlin, it has no comfortable answer. How many times does Serbian territory have to appear in a European security file before German policy toward Serbia acquires a condition?

What Berlin has priced, and what it has not

Germany’s ministers have named Russia, closed its cultural house, ordered its consulate shut, announced tighter entry controls for Russian citizens and pressed for movement on the shadow fleet. An intelligence bill due before the Bundestag in the autumn would permit German services to take active measures: entering the computers and servers of attackers to delete stolen data, interfering in supply chains by inserting manipulated components into deliveries to hostile powers, and in acute threat situations hacking the systems of drone factories or chemical weapons laboratories to sabotage production. Spiegel calls the immediate response clear but measured, and notes that at Union level the twenty second sanctions package extends deadlines and adds ships because there is no majority for anything that would hurt more.

Against Belgrade, no measure tied to this security assessment has been announced, and none is publicly under discussion.

There is an old diplomatic word for buying short term convenience by declining to price conduct that grows more dangerous each time it repeats. Berlin does not have to use the word. It does have to explain the policy, because the policy now has a security externality and the externality has arrived at a German airport.

A difficult partner can be tolerated. Territory from which an adversary works against you is a different category of problem, and the difference is not one the accession process was built to notice.

Belgrade’s own prosecutor says the investigation has found that explosives, drones and supporting equipment were prepared in Serbia for transfer to locations inside the European Union that had been planned and agreed in advance. Serbia has named the couriers, the hardware, the route and the fact of the arrangement. It has not named the other party to it. Germany does not need that name in order to act, any more than it needed a verdict before naming Moscow.

Merz says the people behind Leipzig will pay.

Berlin should now explain why the country its own allies describe as a recruitment and training hub for Russian sabotage operations in Europe never does.

Drizan Shala is a security researcher and doctoral candidate at the University of Sarajevo. He writes on defense, private security, and the security architecture of the Western Balkans.