Freddie Ponton
21st Century Wire
On New Year’s Eve 2023, Christina Block’s two youngest children, aged ten and thirteen, stood with their father near the harbour in Gråsten, a Danish town close to the German border. Masked men attacked their father, forced the children into a vehicle and took them into Germany. Five days later, a Hamburg court ordered their return to Denmark.
The abduction was the violent end of a custody battle that had already crossed two legal systems. The children’s father, Stephan Hensel, had kept them in Denmark after a visit in August 2021. German and Danish courts considered that retention unlawful. Still, Danish judges refused to order their return, citing hardship grounds under the Hague Convention, the treaty that normally requires the prompt return of children wrongfully retained abroad. By the end of 2023, the children had lived in Denmark for more than two years, and German courts were losing jurisdiction over their future.
IMAGE: The waterfront at Gråsten Maskinservice in the Danish town where the children were abducted (Source: Marinas.com)
Block, an heiress to the Block House restaurant fortune and one of Hamburg’s best-known business figures, is accused of commissioning the operation. She denies the accusation, saying employees of a security company acted without her knowledge. Her trial began in Hamburg in July 2025.
IMAGE: Christina Block, the Block House heiress accused of commissioning her children’s abduction (Source: Legal Tribune Online)
The fight to recover the children drew in Israeli intelligence veterans, an intermediary associated in court reporting with Black Cube, a former Hamburg police officer and serving security contacts. Among them was August Hanning, former president of the Bundesnachrichtendienst, Germany’s foreign intelligence service. As investigators followed the trail to Hanning, what looked like an extraordinarily well-financed family operation opened onto a private intelligence market built by people whose authority, skills and relationships had been acquired inside the state.
IMAGE: August Hanning, former president of Germany’s foreign intelligence service, the BND (Source: Ynetnews, photo AFP)
Investigators searched Hanning’s premises in September 2025 and found an electronic archive containing approximately 2,000 BND documents. The discovery launched a federal investigation that led to the arrests of Hanning and his former chief of staff, Manfred D., on 6 October 2026. Hanning was suspected of treasonous espionage, spying out state secrets, attempted treason and espionage. Manfred D. was suspected of aiding and abetting attempted treason and treasonous espionage. The following day, a Federal Court of Justice judge ordered both men into pretrial detention.
Federal prosecutors allege that Manfred D. supplied Hanning with BND intelligence in exchange for payment over twelve years. Hanning then used the material in his private consulting work and in his relationships with representatives of foreign intelligence services. The archive reportedly contained assessments of Iran’s nuclear programme and Russia’s armed forces, material prepared for senior security meetings at the Chancellery and intelligence supplied to Germany by foreign partner agencies. The material surfaced not through an internal BND review but because Hamburg investigators were still reconstructing how two children had been taken from a Danish harbour.
The First Attempt
In 2022, Block had already paid more than €100,000 to System 360 to attempt to recover the children. The German security company was led by Hanning and Thorsten Mehles, a former senior officer in Hamburg’s criminal police. It was Andreas Costard, the family’s longtime lawyer and an important figure in its legal strategy, who made the connection.
IMAGE: Andreas Costard, the Block family’s longtime lawyer (Source: beck-aktuell)
Prosecutors say System 360 developed a plan to intercept the children in Denmark, distract the person accompanying them and put them in a waiting vehicle with their mother. The participants allegedly accepted in advance that force might be required. The plan collapsed after Hensel noticed suspicious men near his home and contacted Danish police. According to investigative material reported by Der Spiegel, Hanning pressed for a rapid operation and told Mehles he could recruit two serving police officers willing to take part. Hanning and Mehles denied involvement.
IMAGE: Thorsten Mehles, Hanning’s partner at System 360 and a former Hamburg police officer (Source: WirtschaftsWoche)
The Israeli Route
System 360 had assembled a former BND president, a police veteran and personnel able to operate in Denmark. After that attempt failed, the same lawyer opened the route to another team capable of completing what the German company had not.
Costard’s request for outside security assistance reached Jens Meier, chief executive of the Hamburg Port Authority. Meier had led the authority since 2008, holding one of the most connected public positions in Germany’s largest port city. That position made him a plausible bridge between a Hamburg family lawyer and an international security contact.
IMAGE: Jens Meier, Hamburg Port Authority chief, who connected Costard with an Israeli security consultant (Source: NDR)
He turned to Alon Katzir-Shimoni, an Israeli security consultant and longtime resident of Germany. Testifying in Hamburg, Katzir-Shimoni acknowledged passing on a contact but denied knowing the introduction would lead to an abduction. Parts of his examination took place behind closed doors because the court accepted that public testimony could create security risks. Court reporting described him as having worked with Black Cube, the Israeli private-intelligence company founded by veterans of the country’s intelligence services. He presented himself as having senior contacts in German and Israeli security circles.
Katzir-Shimoni told the court that the route to Cyber Cupula involved a colleague connected to Unit 8200, Israel’s signals-intelligence and cyber branch. Asked to identify that person, he refused to do so publicly. Even after the court closed the hearing to the public, the colleague’s identity remained protected. By the time the introduction reached the Block family, it had crossed three strands of Israel’s intelligence world. David Ram Barkay, the man at the end of the chain, came from Unit 504. Katzir-Shimoni brought the methods and contacts of the private-intelligence sector, while the unnamed colleague connected the introduction to Unit 8200.
IMAGE: David Ram Barkay, Cyber Cupula’s founder and Unit 504 veteran, at Hamburg Airport (Source: Stern, photo Jan-Henrik Dobers / BILD)
Barkay, Cyber Cupula’s founder and sole director of Cyber Cupula Operations GmbH, was also listed as a director of the Israeli company Cyber Cupula (U.D.) Ltd., incorporated in Israel on January 3, 2019. He was the Israeli operative at the centre of the Block investigation. His team’s cross-border capabilities emerged in the proceedings. According to Barkay’s account reported by Legal Tribune Online, Cyber Cupula employees installed cameras in Denmark and transmitted live images of the children to their Hamburg headquarters at the Grand Elysée. Israeli reporting identifies him as a veteran of Unit 504, the human-intelligence arm of Israeli military (IDF) intelligence. The unit recruits and handles human sources, conducts interrogations and operates beyond Israel’s borders. Barkay later confirmed in the Hamburg courtroom that he had served in Israeli intelligence, although he said he could not discuss the details.
IMAGE: Hamburg’s Grand Elysée, where Barkay said his team received live surveillance images from Denmark (Source: Tripadvisor)
Cyber Cupula marketed expertise in cyber intelligence, human-threat intelligence, infiltration, deception and what it called cyber HUMINT warfare. Its corporate description said its handlers used human-intelligence methods and deception to make undercover contact with cybercriminals, hacktivists and other targets. Beyond the camera operation, court reporting described social-media research, surveillance of the family’s movements and preparations for the physical recovery of the children. Cyber Cupula’s personnel could move from collecting information to acting on it.
IMAGE: Cyber Cupula’s archived homepage advertising active cyber HUMINT services (Source: Cyber Cupula via Internet Archive)
The Woman Called Olga
Keren Tenenbaum Alagem, a member of Barkay’s Israeli Cyber Cupula team, brought the operation inside the family when she entered the Grand Elysée, the Block family’s luxury hotel in Hamburg, under the name Doris White. Christina Block knew her as Olga.
Rather than remain an outside consultant, she lived within the family’s environment, listened to Block describe the custody conflict, researched the children’s lives and received information about efforts to bring them back from Denmark. Block later captured their relationship in six words.
“For me, Olga was Cyber Cupula.”
IMAGE: Keren Tenenbaum Alagem, the Cyber Cupula team member Christina Block knew as Olga (Source: Facebook)
Tenenbaum became the link between the client and Barkay’s operation. Her proximity to Block allowed her to absorb her wishes, observe the family from inside its own hotel and carry information back to the Israeli team. Tenenbaum testified under safe conduct, an arrangement also granted to Barkay that allowed them to appear as witnesses in Block’s trial and leave Germany without being arrested over the alleged operation. In court, she said she and other Cyber Cupula personnel had stayed at the Grand Elysée on Costard’s recommendation. She also described a meeting in Tel Aviv attended by Barkay and said Block repeatedly encouraged the effort to regain contact with the children.
Prosecutors place her close to the final operation through accounts presented in the proceedings. She reportedly sought information about the children’s New Year’s Eve movements near Gråsten harbour and, after they had been taken into Germany, accompanied Block to the rural location where they were being held. She later gave Hamburg prosecutors a statement reported to run to more than 170 pages. Living inside Block’s world while remaining part of Barkay’s circle, she had occupied both sides of the relationship investigators needed to reconstruct. Her account revealed a method built on trust, proximity and the ability to move between identities.
Doris White could check into a hotel, Olga could become a confidante, and Keren Tenenbaum could carry what she learned back into an international operation.
Partners in Private Intelligence
Uriel Yosef Broshi, a businessman with a background in corporate management, had worked alongside Barkay at Immersion Corporation years before Cyber Cupula. At the American touch-feedback technology company, Broshi handled European customer support while Barkay led the international medical business, a shared professional history that preceded their move into private intelligence.
IMAGE: Uriel Broshi, whose corporate career included European customer support at Immersion (Source: LinkedIn)
The two later became directors of Cyber Cupula (U.D.) Ltd. in Israel. Broshi was the sole director of its British namesake, which declared its business as private-security activities, and also served as president and registered agent of Cyber Cupula Inc., registered in Florida in June 2022. On 14 December 2023, Cyber Cupula Operations GmbH entered the Hamburg commercial register with Barkay as its sole managing director, authorised to represent the company alone. Its registered purpose covered the sale, distribution and installation of cybersecurity and cyber-intelligence technology, along with related services, including security testing
Seventeen days after the German company entered the commercial register, Cyber Cupula personnel allegedly abducted the children from Denmark. The Hamburg proceedings brought the company’s work into view, tracing digital research, undercover access and physical surveillance through to an operation involving force on Danish territory.
Barkay and Hanning had formalised their commercial partnership before the operation that led to the children’s abduction from Denmark. According to RND’s reporting, reproduced from n-tv, Hanning reportedly signed a two-page memorandum of understanding on 14 October 2023, agreeing to introduce German clients to Barkay’s consulting company in exchange for half the resulting fees. The agreement brought the former BND president and the Unit 504 veteran into the same business model two and a half months before the children were taken. Barkay supplied operational intelligence capabilities while Hanning supplied clients, standing and access in Germany, with the fees from those introductions divided equally. The failed German operation and the later Israeli operation were successive stages in the same pursuit of private power, with Hanning connecting the two.
In 2023, Barkay reportedly emailed Hanning files containing child-sexual-abuse material and asked him to pass them to the Bundeskriminalamt (BKA), Germany’s Federal Criminal Police Office. According to RND’s reporting, reproduced from n-tv, Hanning identified the appropriate BKA contact and forwarded the files. During the subsequent search of his home, he said he had not known what the folder contained.
Hamburg prosecutors were also investigating an alleged attempt to plant similar material. They said an Israeli security company had obtained a hard drive containing well over 500 child-sexual-abuse images and videos and placed it on property connected to Hensel. The alleged aim was to discredit the children’s father and his family-law adviser through false allegations of paedophilia.
Cyber Cupula brought information-gathering, source cultivation, surveillance and the ability to deploy operatives. Hanning brought the institutional reach of a former intelligence chief, including contacts through whom he could pass material to federal law enforcement. The investigation into Hanning’s dealings with Barkay led police to search his private premises, where they discovered confidential BND material and opened a new line of inquiry into the private use of German state secrets.
German authorities had also received allegations about Hanning’s foreign connections before his arrest. Intelligence Online reported on 8 October that veteran German private investigator Werner Mauss had submitted a dossier to German prosecutors in 2025 concerning Hanning’s alleged activities with several foreign states. The publication’s French-language preview said details leaked before Hanning’s arrest resembled material in that dossier. Earlier reporting by German journalist Lars Winkelsdorf had described a 25-page dossier in which Mauss alleged that Hanning used Israeli intelligence contacts in connection with the Block children’s abduction.
The Files Behind the Feud
The roughly 2,000 documents led investigators to Manfred D., a recently retired BND official whose career had kept him close to successive intelligence chiefs. He served as Hanning’s chief of staff during his presidency from 1998 to 2005, then followed him to the Interior Ministry as his assistant until 2009. In March 2012, he returned to the BND president’s office, serving as chief of staff to several successive presidents until March 2026. As the service’s leadership changed, Manfred D. retained his position at its centre.
Federal prosecutors say his relationship with Hanning became a paid intelligence pipeline through an agreement reached in spring 2010. Under that arrangement, Manfred D. would continuously supply valuable BND intelligence to his former boss, who would pay him and use the material in his private consulting business.
IMAGE: Federal prosecutors announce the arrests of August Hanning and Manfred D., 6 October 2026. (Source: Federal Public Prosecutor)
Hanning founded HanningConsult with his wife in July 2010, only months after prosecutors say his paid arrangement with Manfred D. began. In October 2019, he transferred almost all his shares to his wife and three daughters, retaining just 0.5 percent, but continued representing the company before federal authorities. Its 2024 accounts recorded equity of just under €3 million.
Prosecutors say the flow continued until June 2022. Some documents were prepared for senior intelligence meetings at the Federal Chancellery, the chancellor’s office, where ministry and security officials exchanged current intelligence. Others concerned Iran’s nuclear programme, Russia’s military and reporting from partner services. Rather than an archive left over from Hanning’s presidency, the alleged pipeline supplied fresh intelligence as he expanded his consulting businesses and built commercial relationships with security figures in Germany, Israel and elsewhere.
Prosecutors say Hanning used classified intelligence supplied by Manfred D. to prepare an analysis for an officer of a foreign intelligence service, although whether it reached the intended recipient remains publicly unconfirmed. They also accuse him of passing political information to a representative of another foreign service over several years, drawing at least partly on the same material. In the arrangement prosecutors describe, Manfred D. supplied the intelligence from inside the BND, while Hanning found outlets for it abroad.
Selling the Old Liaison
In July 2021, Hanning joined the advisory board of World Health Energy Holdings, an Israeli cybersecurity company known as WHEN, whose president, Danny Yatom, had previously led Mossad, Israel’s foreign intelligence service. The company presented the two former intelligence chiefs’ experience as an advantage in expanding its security-monitoring business internationally.
IMAGE: Danny Yatom, former Mossad director and WHEN president, whose company recruited Hanning (Source: Haaretz)
Their partnership grew out of a relationship forged in government. Yatom said they knew each other before either became an intelligence chief, when he advised Israeli prime minister Yitzhak Rabin and Hanning worked close to German chancellor Helmut Kohl, and later cooperated as heads of Mossad and the BND. At WHEN, that old state liaison acquired a commercial purpose. As the company pursued expansion in the United States and other markets, Hanning described their complementary networks, with his contacts in Germany and Europe alongside Yatom’s in Israel and the United States.
WHEN described software that continuously monitored audio, video, written communications, geolocation and metadata from company phones and computers. It established patterns of normal behaviour and flagged departures by employees or devices. Yatom compared its purpose to identifying an insider like Edward Snowden before information could leave an organisation.
Hanning presented his government connections as a commercial asset, saying a cybersecurity company needed contacts with governments, police and intelligence agencies. He described a grey zone in which private hackers, state agencies and intelligence services used one another to pursue their own interests—the overlap between public authority and private capability in which he was building his business.
WHEN brought a former Mossad director and a former BND president into the same company. In the Block custody operation, Cyber Cupula supplied a Unit 504 veteran, Katzir-Shimoni provided the private-intelligence connection, an unnamed Unit 8200 contact helped arrange the introduction, and Tenenbaum embedded herself in the German client’s hotel. These separate organisations drew commercial value from intelligence experience, the prestige of former state positions, trusted introductions and access to people still inside public institutions. Hanning joined WHEN in July 2021, while prosecutors say Manfred D. continued supplying him with BND material until June 2022. His work alongside a former Mossad director therefore overlapped with the final year of the alleged pipeline carrying German state intelligence into his private business.
The Route to Baku
German media reported that investigators were examining a possible Azerbaijani connection to the foreign intelligence officer for whom Hanning allegedly prepared an analysis. So far, Federal prosecutors have not publicly identified the officer, and Azerbaijan denied any involvement in the case.
Hanning had longstanding public ties to Azerbaijan through his board membership of the German-Azerbaijani Forum, an organisation promoting political, commercial and cultural relations between the two countries. The forum reelected him in August 2025, just one month before investigators searched his premises.
Azerbaijan’s ties to Israel give the possible Baku connection a wider regional significance. Bordering Iran, Azerbaijan supplies Israel with oil and buys advanced Israeli weapons, while the two countries’ security relationship includes intelligence cooperation focused on Tehran.
IMAGE: Israeli Foreign Minister Gideon Saar, left, and Azerbaijani Foreign Minister Jeyhun Bayramov in Baku, 26 January (Source: CNN, photo Resul Rehimov / Anadolu / Getty Images)
During the 2026 war with Iran, CNN reported that Israeli commandos, intelligence personnel and Mossad operatives used sites in southern Azerbaijan to support reconnaissance and drone operations near Iran’s northern border. Azerbaijan rejected the report as baseless and later filed a defamation lawsuit against CNN.
The BND material allegedly supplied to Hanning included reporting on Iran’s nuclear programme. His private business connected him to former Mossad director Danny Yatom, who publicly identified Iran as a major cyber threat, while investigators examined a possible Azerbaijani connection to an analysis Hanning allegedly prepared using classified intelligence. Those relationships placed his private consultancy at the intersection of German intelligence on Iran, Israeli cybersecurity expertise and contacts in Baku, a strategic Israeli partner on Iran’s northern frontier.
The collection also reportedly included intelligence supplied by foreign partner services, bringing information entrusted to Germany through official liaison into Hanning’s private hands. Prosecutors say he used classified material in his consulting work and dealings with foreign intelligence representatives. The custody investigation had uncovered a suspected route through which intelligence gathered or received by the German state could be repurposed for private business and passed into an international network
Prosecutors say Manfred D. supplied Hanning with intelligence until June 2022, keeping the alleged pipeline running through changes in the service’s leadership and the governments it served. More than sixteen years after leaving the BND, Hanning allegedly continued receiving fresh intelligence for his private consulting work, rather than relying on knowledge accumulated in office. Prosecutors say he used classified material to prepare an analysis for an officer of one foreign intelligence service and passed political information to a representative of another over several years. Manfred D. allegedly delivered the information from inside the BND; Hanning turned it into a private product outside the service.
The federal allegations describe a business offering access not just to former officials, but also to Germany’s classified intelligence.
The Market Investigators Found
Hamburg investigators discovered the BND archive while examining the Block custody operation, not through an internal intelligence-service review. Their inquiries into the family, System 360 and Cyber Cupula led them to search Hanning’s premises, where they uncovered classified material. Hamburg authorities passed it to federal investigators, and the Federal Prosecutor’s Office took over the case in May 2026.
What began as a custody investigation had exposed the overlap between private security operations and the alleged trade in German intelligence. Hanning stood at that intersection, bringing his institutional contacts into a commercial partnership with Barkay while, prosecutors allege, receiving classified reporting from inside the BND. The Israeli connection ran through that partnership, linking an Israeli security company to the contacts and access of Germany’s former foreign intelligence chief.
Following the German-Israeli business network, investigators uncovered what prosecutors describe as a flow of classified reporting from inside the BND into private hands. For Germany, the danger extends beyond private profiteering. Such a channel could put German secrets within reach of Israeli intelligence through commercial intermediaries rather than authorised state cooperation. The question is who controls access to Germany’s intelligence—the institutions entrusted to protect it, or private networks built by their former leaders.
