Berlin's containment choice: two ministries pulled off the state network, no return date

Berlin has kept two of its state ministries disconnected from the city government's IT network since Friday after authorities found a security breach, the Senate Chancellery said in a statement on Monday [s1c1][s1c2]. The decision is the interesting part: rather than clean up inside a live network, Berlin took the segment out and left it out, and it has not said when the ministries will be reconnected [s1c9].

The two units cut off are the ministry responsible for urban development, construction and housing, and the ministry for mobility, transport, climate protection and the environment [s1c3]. Officials have not said who was behind the intrusion, how access was obtained, whether data was stolen, or when it happened [s1c4]. "The security of the state network is the top priority," the Senate Chancellery said, adding that "for investigative reasons, no further specific information about the scope or background can currently be provided" [s1c5]. The investigation is ongoing [s1c6]. German public broadcaster RBB, citing government sources, reported that attackers allegedly exploited a vulnerability in the IT systems of one of the two ministries [s1c7].

The architecture matters for anyone drawing a containment boundary. According to RBB, Berlin's state-owned IT service provider ITDZ Berlin was not affected, and the two ministries share some IT infrastructure and run their part of the state network independently of ITDZ [s1c8]. A central provider being clean does not make an incident small when the compromised estate hangs off the same state network by its own arrangements. What can be isolated cheaply is decided years before the incident, by whoever signed off on that independence.

The cost of the cut is visible. Both ministries remain operational, but staff have lost their usual IT systems, including email and internet access, and are working by telephone, text message and fax, RBB reported [s1c10]. Downstream, other local media reported that applications for housing benefits and for education and participation assistance cannot currently be processed at some district offices, because those offices depend on systems operated by the affected urban development ministry [s1c11]. That is the part worth copying into your own tabletop notes: the blast radius of the containment action ran past the two ministries and into counter service at district level, and it surfaced through local reporting rather than through the Senate Chancellery's statement, which addressed the network and not the queue [s1c5][s1c11].

By the time officials confirmed the isolation on Monday, the ministries had been off the network for at least three days [s1d1]. Treat that as the planning unit. If the honest answer to a confirmed intrusion is severance, then the segment list, the dependency map for each segment, and the fallback for the services that ride on it need to exist before Friday afternoon, along with an out-of-band communications plan that does not assume email [s1c10].

Watch for the reconnection date, since none has been given [s1c9]. Watch whether Berlin ever states that data was taken, given that it has so far declined to say [s1c4]. And watch whether other parts of the state network that operate independently of ITDZ get reviewed on the strength of this one [s1c8].