The Jerk and the Password

“Education must become the overarching issue of our society.” Roman Herzog spoke these words on April 26, 1997, at the Hotel Adlon. In a speech titled “Embarking on the 21st Century,” the Federal President emphasized the need for educational reform in order to thrive in the coming knowledge-based society. A few paragraphs later came the famous statement: “A jolt must go through Germany. We must bid farewell to cherished traditions. Everyone is called upon; everyone must make sacrifices; everyone must participate.”

Twenty-nine years later, in the same city, a criminal group infiltrated Berlin’s state network undetected for six days. They copy 5.8 terabytes of data from two Senate administrative offices and publish 1.44 million files on the dark web after the state refuses to pay. Among the files are personnel records, pay stubs, photographs of identification documents, emergency plans, and documents related to water treatment plants and substations.

The administration’s official response is dated September 2, 2026. It consists of an instruction to all government agencies: passwords must be at least sixteen characters long, contain no parts of names, and include characters from three of four categories. All employees must change their passwords.

Between the 1997 statement and the 2026 directive lies the question: What needs to change when technology, work, and risks change? And why does the answer so often come down to the individual?

What was in the files before anything happened

The instruction isn’t wrong. Resetting all passwords after a breach is part of damage control. It renders stolen login credentials useless before anyone can use them to navigate further through the network. And sixteen characters are better than eight; according to experts, the rules cited in the directive should have been standard practice long ago. Things get interesting in two areas: when an immediate measure becomes a permanent rule for all employees, and when the organization fails to address issues regarding its current state that were already on record.

In August 2025, one year before the attack, State Representative Stefan Ziller asked the state: How prepared is the Berlin administration for IT emergencies? The State Secretary for Digital Affairs’ response to the first question—regarding the status of IT security training across the administration—begins by referring to the legal framework. According to Section 23(1) of Berlin’s E-Government Act, mandatory training on information security must be provided at least once a year for all employees of every government agency. The responsibility lies with the agencies. And then there is this sentence:

“The Senate assumes that the legal obligation will be fulfilled accordingly.”

No figures. No survey. An assumption. In response to a request for specific events: The Senate had no information available for 2023; for 2024, two live hacking sessions were mentioned—one with 180 participants and one with 100—for an administration with well over 100,000 employees. The statewide awareness-raising plan had been drafted at that time; implementation was “in preparation,” self-study courses were “planned for the future,” and awareness-raising efforts for top management were “announced.”

Five months before the attack, the Senate submitted the seventh implementation report on the same law to the House of Representatives, dated March 27, 2026, with a reference date of December 31, 2025. This report also does not provide any centrally collected participation figures for the workforce as a whole. It merely notes that, in the fourth quarter of 2025, the State Commissioner conducted the training for management personnel required under NIS-2. On page 94, regarding IT emergency management, it also states: “In 2025, there were personnel resource shortages in implementing the necessary [sic] activities for ICT BCM, as the roles specified in the ICT role concept were largely unfilled in government agencies and institutions.” The relevant guideline had been drafted, but it had not yet been finalized by the State Secretary for ICT; the appointment of the responsible official was planned for 2026.

And regarding the network itself, which was attacked in August, the section on the IT security program states: “Nevertheless, the results achieved did not fully meet the necessary requirements derived from NIS-2, the Federal Office for Information Security (BSI), and national architectural guidelines. No implementation plans for the program-wide measures are available at this time.”

The requirement for individual training had thus been in place for years, enshrined in law, and no one had ever checked whether it was being met. The level at which the problem lay had been documented. And the response to the damage is yet another requirement at precisely that level—one whose compliance had never been verified.

Anyone hoping for a federal mandate here is looking in the wrong place. The NIS2 Implementation Act has been in effect since December 2025 and governs the federal administration. It has no direct effect on state administrations; jurisdiction lies with the states. Berlin is responsible for this matter on its own.

What the regulatory agency recommends

On September 4, 2026, the Federal Office for Information Security issued a warning. It stated that “the network of a government institution” had been compromised in August; the agency did not specify which one. The sequence of events corresponds to a wave of attacks that Microsoft had described a week earlier under the name TerminalFix. The BSI attributes the malware used to the group behind the Rhysida ransomware, which also attacked the Berlin state network in August.

The attack vector is noteworthy. A user visits a compromised website. A fake CAPTCHA prompt appears, instructing the user to run a command in Windows Terminal or PowerShell to confirm. The command is already in the clipboard. The user pastes it and presses Enter. After that, everything continues without their knowledge: a disguised program library, malicious code hidden in image files, the spying on permission assignments and directory services, data exfiltration to cloud storage, and an encrypted backchannel whose commands may not appear in any logs.

The attack begins with an action taken by a single person. It couldn’t be any clearer.

And then you read the list of measures. Six recommendations: up-to-date security software on the network and on devices, a browser with phishing detection, cloud-based detection, logging of PowerShell commands, running PowerShell in restricted mode, and the directive to treat compromised computers as entry points into the network rather than as isolated incidents. There’s no mention of training, awareness campaigns, or skill levels.

The strictest of these recommendations—restricted mode—ensures that the dangerous command cannot be executed in the first place. The regulatory agency removes the person’s opportunity to make the mistake, rather than training their judgment. This is not a sign of disrespect toward employees, but a sober assessment: when a mistake has such consequences, one cannot rely on mere attention.

One more detail. The word “password” does not appear anywhere in the warning. In this attack chain, no login credentials are stolen at the point of entry; the person enters the code themselves. If this pattern also applies to Berlin, the directive issued on September 2 not only targets the wrong level, but also addresses a different mechanism than the one that caused the damage.

How the Competency Framework Interprets This

The fifth edition of the European Reference Framework for Digital Competence, DigComp 3.0, has been in effect since November 2025. It comprises five competency areas, 21 competencies, four proficiency levels, and 523 learning outcomes, with AI integrated across all competencies rather than listed as a separate area. This is the reference framework upon which funding programs, curricula, and corporate frameworks are based.

In the “Safety, Well-Being, and Responsible Use” section, the “Protect Devices” competency at the lowest level explicitly provides guidance, if necessary: Identify and apply basic security measures such as antivirus protection, screen lock, strong passwords, and multi-factor authentication. Further up, at the Advanced level, the same list appears again, this time as the ability to help others implement these measures.

There is no mention of a password manager anywhere in the document. I searched the full text for it, and found not a single instance among the 523 learning outcomes and an extensive glossary. The discussion focuses on behavior, not on the tool needed to actually maintain that behavior in everyday work.

To the framework’s credit, it does not ignore its context. At the very bottom level, it states that individual actions and security tools work together, and that there is legislation governing the cybersecurity of products and services. Both of these aspects depend on individuals recognizing them. DigComp does not stipulate an obligation on the part of organizations to provide the tools, and this is consistent: The framework describes civic competence, not security requirements for institutions. Those are set forth in the BSI’s Basic Protection Guidelines and in state law.

The misstep begins one level higher. A human resources department aligns its competency program with DigComp; management then considers the workforce’s contribution to safety to have been fulfilled, and the institutional aspect is left unaddressed because, formally speaking, someone has done something. A framework for what an individual should be able to do is no substitute for a standard specifying what an organization must provide. DigComp does not claim this either; it is merely what is expected of it.

Something else is even more noteworthy. The 2025 version includes a new section that outlines the requirements for the Basic Level. For anyone to be able to access it at all, they need sufficient reading skills, a sufficiently fast and stable internet connection, appropriate devices with the necessary applications, technical support, and assistance in adapting devices to physical, cognitive, or mental health needs. It is explicitly noted that programs that disregard these conditions are more likely to exacerbate digital exclusion.

So the framework itself makes it clear: without infrastructure, there can be no expertise. His list stops at access alone.

Three answers, each on a different level

At this point, it helps to use a framework that I employ in debates, because otherwise the answer to any question about AI and work inevitably comes down to the individual—a conclusion that itself requires further explanation. Competency development occurs on three levels simultaneously.

The individual level is the only one you can create for yourself. It involves setting a weekly goal for yourself—one that’s slightly beyond your current abilities—as part of a real task: trying out a new way of working, evaluating a result, or acknowledging your own uncertainty. No organization can do that for you.

The cultural level determines whether learning is encouraged in everyday life, regardless of one’s position. Is an objection treated as a contribution to quality or as resistance? Is someone allowed to try something without first guaranteeing that it will succeed? Learning always reveals that something is still missing, and the higher up someone is, the less they can afford to have anything missing. Visible learning is therefore most costly precisely where the most decisions are made.

The infrastructural level provides what individuals cannot obtain on their own: time, money, tools, clear lines of responsibility, and the technical safeguards that catch an error before it takes effect.

None of these elements is sufficient on its own. You can provide the best facilities without anyone using them, and foster an open learning culture without the time needed for it to take root.

If you apply this framework to the past few weeks, the result is a pattern I haven’t seen before. The BSI responds purely from an infrastructural perspective, with six technical measures and not a word about people who need to learn something. The Senate responds purely on an individual level, with a code of conduct for all employees, while the state of the organization remains unchanged. DigComp fully addresses the individual level, touches on the infrastructural level only at its periphery, and leaves out the cultural level entirely.

Each of these answers makes sense on its own, and each comes from knowledgeable people. But because none of them addresses the bigger picture, the end result is a scenario we’re familiar with in organizations: a lot of visible measures, but nothing changes where it really hurts.

Two sets from the same manufacturer

The cultural level is the most difficult because it cannot be quantified. Nevertheless, it can be observed, and in this case, it has come to light twice within two weeks.

The first remark was made on August 24 during the Internal Affairs Committee meeting. Florian Hauer, State Secretary for Digital Affairs (CDO), said of the network operated by his department: “The state network is large; we’re surprised at just how large it is.” This remark has been the subject of much ridicule, and it certainly invites it.

I would defend him. Here is someone in a position where you’re not allowed to be unaware of anything, publicly admitting that he didn’t know something. That’s exactly what the cultural norm demands, and it’s what happens least often there. Anyone who mocks this statement will reliably ensure that no one says it next time, and then the state of the internet will be settled not in a committee, but on the dark web. That statement is the only part of the entire process where someone has created the conditions for learning.

The second statement was issued on September 5, one day after the data was first published. The Senate Chancellery had commissioned a U.S. security firm to scan the state’s systems for traces of the attackers; the software was to be installed across the board on the districts’ computers. The Lichtenberg District Office refused access and explained its reasoning in an internal memo: The software could gain “virtually unlimited access” to all data and would likely “never be able to be removed”; it was capable of monitoring all work devices, including those of employees, and, to quote the letter: “According to feedback from other districts, it also causes disruptions—some of them severe—in the operation of specialized procedures, services, and programs, and poses a significant risk to the district office’s ability to function.” The district pointed out that it had already checked its systems itself and found nothing, and made granting access contingent on the Senate assuming full responsibility.

The Senate Chancellery’s response: There is “no alternative” to the software.

It may be that the decision was the right one. In an ongoing attack of this magnitude, centralized endpoint monitoring is often essential for forensic analysis. The district’s objection, however, was not a matter of defiance, but rather a balancing act between investigation, operational capability, and data sovereignty; the concern about proprietary software has a name: in the summer of 2024, a faulty update from that very same manufacturer crippled computers worldwide. The phrase “no alternative” does not deny that there is something to weigh. It refuses to weigh the options.

Two statements, the same company, two weeks apart. One opens the door; the other closes it. “We’re surprised” is the beginning of a learning process. “No alternative” is the phrase that signals that knowledge from within the organization no longer influences the decision.

This means that the cultural level does not depend on the willingness of individuals to learn. In Lichtenberg, there were people who knew their systems, had tested them, and were able to articulate objections. The expertise was there. It simply did not influence the decision.

The objection to one’s own conclusion

There should be a call to action here. This needs to send a shockwave through everyone.

That’s exactly what doesn’t work. A text that breaks down appeals to individuals cannot end with an appeal to everyone just because it sounds grander. Herzog is proof of that. The strongest conceivable call to action was made—from the highest office, in Berlin—with education as the overarching theme. It changed the language but not the structure. Incidentally, in that same speech, the Federal President noted a lack among the elites of “the ability and the will to see through what is recognized as right,” a sentiment that has aged better twenty-nine years later than the “Ruck.”

And yet it’s true that it has to go through everyone. It just doesn’t mean that everyone does the same thing.

The individual level belongs to everyone because it is the only one you can grant yourself. The cultural level also belongs to everyone, but for a different reason: it is created every day by anyone who, in a group setting, fails to admit that they haven’t understood something. Whoever makes the decisions has the greater influence here, because they determine what is permitted in this household.

The infrastructure level has few direct stakeholders. Households, procurement, learning time, tools: these decisions are made by people who can be identified by name. Their mandate, however, comes from a majority, and that majority’s priorities are well documented. Economic historian Hartmut Berghoff cites a figure that rarely comes up in the debate: 27 percent of the population and about 38 percent of those eligible to vote in federal elections are retirees. Anyone who cuts benefits here is targeting a group that votes at a proportionally higher-than-average rate. Political energy is therefore directed toward maintaining pensions rather than toward infrastructure for skills development, even though the funds would, in principle, be available.

Through this chain, the third level also belongs to everyone. It just reaches them more slowly—through a ballot rather than a decision on Monday morning. Anyone who laments the lack of time for learning and considers the question of what a budget is sufficient for to be a political issue with which they have nothing to do has not yet considered the second part of their own complaint.

A rule that extends beyond this specific case

The Berlin case has led to a principle that works in any organization:

There can be no rule of conduct without the tool that makes it possible to follow it.

Sixteen characters, no parts of names, three character categories—a different one for each system—renewed every three months, and no password manager in sight: This is a requirement that people can only meet by circumventing it. They write down their passwords, or they devise a system that formally meets the complexity requirement but effectively nullifies it. The rule doesn’t simply fail. It produces its own workaround, and afterward, the record states that the matter has been settled.

It’s no mystery which tool is missing here. A centrally managed password manager has been the industry standard for years. The fact that many government agencies don’t have one rarely has anything to do with a lack of willingness: Procurement, public procurement law, and a software budget that isn’t allocated in the current fiscal year hold up such purchases, sometimes for years. A policy can be enacted in an afternoon, but a procurement process takes longer than the fiscal year. That’s why people fall back on the rule.

This principle applies almost unchanged to work with AI, and it will be needed in many organizations over the next few months. Anyone who imposes verification requirements on AI results without allocating time for verification will end up with documented non-verification. Anyone who requires citations without organizing access to the sources will end up with fabricated citations. Anyone who introduces an approval requirement without clarifying what constitutes a usable result will end up with approvals that mean nothing. In all three cases, the organization will end up looking like it’s being controlled from the outside.

The Long Bow

The transition that Herzog announced in 1997 is well documented in economic history. In 1926, Nikolai Kondratiev described the long waves of the business cycle—ups and downs lasting about fifty years. Later, Joseph Schumpeter attributed each of these cycles to a fundamental innovation: the steam engine, the railroad and steel, electricity and chemistry, the automobile and petroleum, and most recently, information technology. The first four were based on new energy sources; the fifth was the first not to be.

The fundamental innovation of the current sixth cycle is artificial intelligence. Market forces will drive it into all areas of society, and no one will be able to avoid areas where there are no points of contact. This means that the question of who can work with these systems and who decides on their use is not merely a personnel issue alongside the restructuring. It is the restructuring itself.

In Germany, this picture is shaped by an institutional logic that rewards improvement but has no place for innovation. The focus is on making what already exists slightly better, in areas where responsibilities are clearly defined and procedures are in place.

The password rule is this logic on a small scale. It’s an improvement in one detail, in one area where the organization appears capable of taking action, while the question of architecture remains unasked. In the fifth cycle, this cost an entire generation: In 1997, the “knowledge society” was proclaimed at the Adlon, and education was declared a major issue—yet the structural response never materialized. The sixth cycle isn’t waiting for us to finish dealing with the fifth.

However, anyone who wants to be in a position to help shape the new modern era on the global stage urgently needs to develop comprehensive expertise to lay a solid foundation for the AI age.

Three Steps Toward Greater AI Proficiency

Everyone has to do something, but not the same thing. Each level has its own task, and it can be assigned for the coming week.

Personalized, for everyone. Pick three tasks from the past week that involved AI. For each one, ask yourself: What exactly was the assignment? How would I have known that the result wasn’t viable? Did I check it, or did I just accept it because it sounded convincing? The third question is the uncomfortable one.

Cultural, for everyone, with varying degrees of importance. This week, try saying in a group setting that you didn’t understand something—especially when it feels uncomfortable to do so. If you make that decision, that single sentence will be worth more than any training budget you approve in the same quarter.

Infrastructure-wise, for the few. Take the next rule of conduct you plan to implement in your home and ask yourself whether there is a tool available that will help you enforce it. If not, get the tool before you enact the rule.

The state-wide network was large, and no one knew exactly how large. This sentence describes the situation in more organizations than would care to admit it.

---

Documents

All quotations are taken from the documents listed here and were verified against the respective originals on September 7, 2026.

• Herzog 1997. Roman Herzog, “Embarking on the 21st Century,” speech at the Hotel Adlon, Berlin, April 26, 1997. Full text available in the Federal Government Bulletin, as well as in the speech archive at bundespraesident.de. The following are cited: the section “A jolt must go through Germany…,” the sentence “Education must become the overarching issue of our society,” including the following sentence on the “coming knowledge society,” and the sentence about the elites, whom the Federal President denies “the ability and the will to see through what is recognized as right.”
• The Attack and the Password Policy. Coverage from September 2 to 5, 2026: Alexander Fröhlich,“Instructions to All Berlin Government Agencies Following a Hacker Attack,” Tagesspiegel, Sept. 2, 2026; Kai Biermann and Pauline Schinkels, “They’re demanding money. Berlin doesn’t want to pay. So what now? “, DIE ZEIT, Sept. 4, 2026; Marie Gundlach, Meredith Haaf, and Georg Ismar, “This Data Leak Threatens Our National Security,” Süddeutsche Zeitung, Sept. 5, 2026;“What Risks Does the Data Release Pose?”, tagesschau.de, September 5, 2026. The scope of the data leak, the timeline of the access, and the directive dated September 2 are taken from this reporting. The statement regarding the size of the state network was made as early as August 24 in the Committee on Internal Affairs, Security, and Public Order; quoted verbatim in“Hacker Attack: Berlin Senate Departments Back Online,” rbb24, August 24, 2026 (State Secretary for Digital Affairs Florian Hauer, CDO).
• Mandatory Training and Its Monitoring. Berlin House of Representatives, Printed Paper 19/23495: Written inquiry by Representative Stefan Ziller (The Greens) dated August 4, 2025, “How prepared is the Berlin administration for IT emergencies?”, answered on August 19, 2025, by Martina Klement, State Secretary for Digitalization and Administrative Modernization. The response also includes a reference to Section 23(1) of the Berlin E-Government Act and the statement, “The Senate assumes that the legal obligation is being fulfilled in accordance with the law,” as well as details regarding the live hacking events in 2023 and 2024.
• The situation prior to the attack. The Governing Mayor of Berlin, Senate Chancellery,“7th Implementation Report on the Berlin E-Government Act and ICT Future Report,” March 27, 2026, reference number 0400 J, 157 pages, report date December 31, 2025. The section on IT emergency management (ICT-BCM) is on page 94, the section on the IT security program and the Berlin State Network is on page 43, and the NIS 2 training for senior management conducted by the State Commissioner in the fourth quarter of 2025 is on page 98 (Section 2.3.17, ICT Security Awareness).
• Jurisdiction. The NIS2 Implementation Act has been in effect for the federal administration since December 2025. For state administrations, the provisions of the BSI Act have no direct normative effect; legislative authority lies with the states. See the BSI’s overview of NIS 2 for state and local governments.
• The TerminalFix Campaign. Federal Office for Information Security,“German Institutions Compromised by TerminalFix Campaign,” BSI IT Security Bulletin BITS-B No. 2026-287419-1032, Version 1.0 dated September 4, 2026, Criticality 2, TLP:CLEAR. Based on: Microsoft Security Blog,“TerminalFix Campaign Deploys a Reverse Tunnel Through Multistage Intrusion,” August 28, 2026. The BSI does not name a specific institution but refers to “the compromise of a government institution’s network” in August 2026.
• The Competency Framework. Jude Cosgrove and Romina Cachia, “DigComp 3.0: European Digital Competence Framework — Fifth Edition“, Publications Office of the European Union, Luxembourg 2025, published on November 27, 2025, DOI 10.2760/0001149, CC BY 4.0. The cited statements are the Competence Statements CS4.1.04 (Basic Level) and CS4.1.11 (Advanced) in Competence 4.1, as well as CS4.1.02 and CS4.1.03. The prerequisites for the Basic Level are listed in Section 2.4.2. The search for a password manager was conducted using the full text of the report. The assertion that organizations are replacing institutional security standards with the Citizen Framework is the author’s assessment, not a finding of the report.
• The controversy over the cleanup software.“Hacker Attack in Berlin: District Refuses to Use CrowdStrike,” Golem.de, September 6, 2026, based on an investigation by rbb, which has obtained the internal memo from the Lichtenberg District Office. The quotes from that source—“virtually unlimited access,” “can never be removed”—the sentence regarding disruptions to specialized procedures, and the statement from the Senate Chancellery that the software is “without alternative,” issued on September 5, 2026, are all cited here. The global outage caused by a faulty Falcon update in July 2024 is also discussed there. The fact that centralized endpoint monitoring is usually unavoidable during an ongoing incident is standard practice in incident response—it is not a finding of the rbb investigation.
• The Composition of the Electorate. Hartmut Berghoff in an interview with Nils Markwardt,“We’ve Never Had It So Good,” DIE ZEIT, June 9, 2026. The article states that 27 percent of the population and about 38 percent of eligible voters in federal elections are retirees or pensioners, and explains why this blocks structural reforms.
• The long waves. Nikolai Kondratiev, “The Long Waves of the Business Cycle,” 1926; Joseph Schumpeter on creative destruction; Clayton Christensen on the three types of innovation. Discussed in: Anja C. Wagner, “Called Rather Than Certified” (2021).
• For more information, see my blog. A walkthrough of the six levels of AI proficiency can be found in“The Perfect Prompt Is No Longer Enough” (August 24, 2026). The test with the three tasks is from the September issue of The NeWoS.