Bundesamt für Verfassungsschutz (Germany)

https://www.verfassungsschutz.de/DE/themen/cyberabwehr/cyberabwehr_node.html

Added 2026-09-19 as this run's ONE new candidate source (S2). Germany's domestic security service (BfV) co-issues joint international cybersecurity advisories with its own authoritative German-language notice and technical detail (e.g. the 2026-09-18 DPRK WaterPlum/Contagious Interview advisory jointly issued with FBI/NPA-Japan/NCO-Japan/DC3/ASD-ACSC/BND) not otherwise available from Swiss-facing sources -- DACH-region relevance for the home-region/sector-lens mission. FETCH -> python3 tools/fetch_source.py extract <kurzmeldung-URL> (trafilatura-direct, confirmed clean 2026-09-19). Candidate -> promote to active after 3 contributing runs. | 2026-09-29: working recipe is the RSS feed https://www.verfassungsschutz.de/SiteGlobals/Functions/RSSNewsFeed/AlleMeldungen.xml (30 items direct, newest same week); drill each item with `extract <link>`. The feed is BfV-wide (extremism, reports, press), so filter to /praevention_wirtschafts-und_wissenschaftsschutz/, /spionage-und-proliferationsabwehr/, /cyberabwehr/ paths and titles containing Cyber / Sicherheitshinweis / Joint Cybersecurity Advisory; cyber-relevant cadence is roughly one item per 4-8 weeks (18 Sep, 23 Jul, 24 Jun, 9 Jun 2026). The year-bound /SharedDocs/kurzmeldungen/DE/2026/ URL serves the homepage, not a listing. (2026-09-29T2134Z-audit) | 2026-10-28: the health probe of the landing page answered HTTP 400 although `extract` of it and the `feed` command of the RSS URL both read cleanly (newest item 2026-10-19), so the check now runs the feed recipe through health_cmd. | 2026-10-29 (health sweep): the feed recipe fails intermittently with an SSL EOF on the direct transport (the first call of a pair worked, the retry failed) and the landing page answers HTTP 400; transport flakiness, not content death. Retry the `feed` call once before treating it as down. | 2026-10-31 (2026-10-31T0256Z-intel health sweep): the landing page answers 400 or fails with an SSL EOF while the feed reads cleanly (newest item dated 2026-10-2x); probe_url now points at the feed so the reachability probe tests the transport the source is read through. | 2026-10-31 (re-probe): the probe answers HTTP 400 for the feed URL as it did for the landing page while `fetch_source.py feed` reads the feed cleanly, so fetch_method is bridge (the health_cmd feed recipe is the check) and probe_url is removed. | 2026-10-31 (re-probe): the direct `feed` read fails with an SSL EOF on 3 of 4 tries (the host drops the in-container TLS client) while `fetch_source.py extract <feed URL>` reads the feed reliably through the reader (dated items, newest 2026-10-19); health_cmd now runs that extract, which spends one reader call per sweep, and agents read the source with `extract` on the feed URL, not `feed`. | 2026-11-02 intel run (health sweep): the probe, `extract` of the feed (timed out at 120 s) and WebFetch (HTTP 503) all failed; the host dropped the in-container TLS client the same way on 2026-10-31 and the feed read through the reader then. A 503 is transport blocking, so the record stays a candidate; mark fetch_method blocked only if every transport still fails on a later sweep.