Produced for cross-media investigative format Stern Investigativ, Putins Wegwerfagenten – Die billigen Vollstrecker (Putin’s Disposable Agents – The Cheap Enforcers) examines the methods used by suspected Russian actors to carry out espionage, sabotage and other hybrid operations in Germany.

Posing as potential recruits, the undercover reporters received assignments via Telegram from suspected Russian actors, with payment offered in Bitcoin. These ranged from spying on a CDU employee and a human rights organisation to gathering information on German defence companies – information that, of course, the reporters never passed on to those who had commissioned them. The investigation revealed how seemingly harmless paid tasks can form part of wider hybrid operations involving espionage and sabotage. After around a year, one reporter was exposed as a journalist and received threats against herself and RTL Deutschland, culminating in a death threat.

We spoke to Sergej Maier, a researcher in RTL Deutschland’s verification team who worked on the investigation, about going undercover, using Telegram and open-source intelligence (OSINT) to follow the network, and the persistence – and editorial backing – required for a year-long investigation.

1. What first put this network on your radar, and when did you realise going undercover was necessary?

I had been monitoring this hacker group for two or three years, but until then, I hadn’t been aware of them recruiting people for this kind of work. We then came across what appeared to be a job posting for "disposable agents". It became clear that how the system worked could not be understood through conventional reporting alone. At that point we began considering an undercover approach, subject to legal and security assessments.

2. You were mostly in contact with the people giving assignments via encrypted apps. What did the undercover work look like day to day? How did you decide when to simply observe and when to actively carry out an assignment? Before going undercover, had you already decided which type of assignments you were willing to carry out and where you would draw the line?

All communication took place exclusively via Telegram. We already knew that networks like this tend to prefer the app. Alongside communicating with the accounts, I tried to gather as much information as possible about the Telegram accounts themselves — for example, when they had been registered or what other chat groups they were active in. So, a lot of the work involved sitting at a laptop and doing digital research.

We established clear red lines before going undercover. In addition, every individual assignment was assessed by the team and in close coordination with the relevant authorities before we decided whether and how we could respond.

3. How did your position in RTL Deutschland’s verification team help in this investigation?

In our verification team, I specialise in Telegram. I think it helps a lot to understand how the platform works and how to conduct research there effectively. Knowing how different groups use Telegram was an advantage. It allowed us to gain access to some of the hackers’ private chat groups and follow their conversations.

4. How did verification techniques and digital research help you establish who was behind the assignments and distinguish genuine leads from misinformation or attempts to mislead you?

More generally, we were able to uncover quite a lot of information using OSINT (open-source intelligence) techniques alone – in other words, methods for finding, analysing and verifying publicly available information. For example, we identified the social media accounts of the two suspects in the Stefan Thumann case. This enabled us to digitally trace their backgrounds and find some insights. We could then cross-check these findings against the information that was already publicly known.

5. What is the biggest challenge with this type of investigative journalism, and what do you wish people better understood about the work that goes into a year-long undercover investigation?

Undercover and investigative reporting is challenging and requires careful consideration as well as ongoing editorial and legal oversight. Over such a long investigation, you become determined to get as deep into this network of agents as possible and to find out as much as possible about the people behind it.

As a team, we had many consultation rounds about what we could and were allowed to do — and what we absolutely could not do. I think the most important qualities in investigations like this are persistence and perseverance. Even when there are setbacks, you simply cannot lose focus.

Also, a project like this requires time and, above all, a management team that stands behind it. We always knew that we had the full backing of RTL News and RTL Deutschland and the freedom to pursue this investigation thoroughly. Working for a company that supports investigative journalism and stands firmly behind press freedom is something I am very grateful for.

Putins Wegwerfagenten – Die billigen Vollstrecker is available on RTL+ and will be broadcast in an extended version on flagship channel RTL on 2 September at 20:15.