The AfD leak: Russia, the United States and the party's own line — edition 2

Edition 2 · 3 November 2026 · Preliminary — research in progress. This edition replaces none of the first: edition 1 stays online unchanged. Edition 2 carries its Russia findings forward and adds five new questions: classified material and leak allegations, the party’s line on Russia in recent years, its views of NATO, the EU, the USA and the economy, American involvement, and public figures as customers of the party’s merchandise shop.

In short#

• Restricted Bundestag papers reached a mailbox labelled with Manuel Ochsenreiter’s name. In November 2018, Markus Frohnmaier’s Bundestag office forwarded federal government reports on EU Foreign Affairs Council meetings, marked VS – Nur für den Dienstgebrauch (restricted), to his private AOL address, a staff member and an office mailbox that at the time appears — and sends mail — under the name Manuel Ochsenreiter. While it carried his name, the mailbox received three non-public parliamentary papers. Ochsenreiter, a pro-Kremlin journalist, worked for Frohnmaier from autumn 2018 to January 2019. In January 2019 a Polish defendant testified that Ochsenreiter had given instructions and money for the 2018 firebombing of a Hungarian cultural centre in Uzhhorod, Ukraine; Ochsenreiter denied it. He died in Moscow in 2021. ZDF has reported the forwarding to the private address; the Ochsenreiter mailbox among the recipients is, as far as we can find, not reported. The label rests on unsigned email headers, and the files do not show that he read the papers or that anything went to Russia.
• No evidence that classified material went to Russia, in any of 16 press allegations we compared with the archive. For most allegations the archive holds only the party’s press digests about them. Where it shows more, it shows that MPs and their offices received restricted papers — not that anything was passed on.
• The pro-Russian line did not end in 2022; it changed its subject. After the invasion the federal board condemned Russia’s attack and blamed NATO, rejected economic sanctions, arms deliveries and Ukraine’s NATO and EU membership. From 2023 to 2026 the recurring demands in the files are about energy: end the gas sanctions, repair and restart Nord Stream 1 and 2, and in August 2025 “marked territorial concessions to Russia” as the price of peace.
• Split on NATO, hostile to the EU. Some leading figures defended NATO membership (with a stronger “European pillar”); others attacked NATO; all rejected NATO’s eastward expansion and, after 2022, Ukraine’s accession. On the EU and the euro the line is consistently hostile — a euro exit and a “Dexit” campaign were pushed by Alice Weidel in 2016–2018.
• Market-liberal on taxes, selective on trade. Musk is half right. On taxes and red tape the AfD sounds market-liberal: “not more state, but less state”. On trade it is selective. It opposes Western agreements (TTIP, Mercosur) and wants free trade with the Russian-led Eurasian bloc and Russian raw materials back. It pairs this with a welfare state meant first for Germans. That is not socialism, but it is not libertarian free trade either.
• America: mostly favourable to Trump, distrustful of the USA. The leadership congratulated Trump by telegram in 2016 — hoping he would “end the wars in Syria and Ukraine by mutual agreement with Russia” — and again at his inauguration in 2017, asking for his help to remove the UN Charter’s “enemy-state clause”. The USA as a power is mostly criticised, above all over Nord Stream. The files show no direct contact with Elon Musk, JD Vance, Marco Rubio or the second Trump administration — but the mailboxes that reach 2025–26 are regional ones.
• Fanshop: no public figure outside the AfD is confirmed among the shop’s customers. All 450 name matches with prominent people have now been checked; most are namesakes, often AfD members, and a few remain open for review by hand.

What we examined#

The archive was published by the hacker group “Hexane” in October 2026: 421,180 emails and 48,572 attached documents from 11 AfD mailboxes, 2013–2026. The AfD has confirmed the attack but not the authenticity of individual emails, and forged “AfD leak” emails are reported to circulate — so every claim cites the original file and its hash.

Coverage matters for every “recent” statement below. The federal leadership mailboxes (the federal office, Alexander Gauland) end earlier. Of the ~41,000 emails from 2025–26, almost all come from the NRW state party, the Mecklenburg-Western Pomerania office of Leif-Erik Holm, the arbitration courts and the merchandise shop.

How the research works: automated steps run on open-weight models. Keyword rules select candidate messages; a model classifies and extracts; a second model checks extracted ties against the original text; every quote must occur verbatim in the source. A person — or Claude as editor — reads only the extracted findings, not the mail bodies. All claims in this report were checked by hand against press reporting. New in this edition:

• Positions: a sample of 1,994 messages, up to 40 per topic and year, selected by keyword and rated −2…+2 per topic for the author’s own words (forwards and press clippings excluded); 1,288 contained AfD positions with a verbatim quote. “Leadership” means federal and state leaders and MPs; “base” means local officials, members and staff.
• Classified material: 5,645 messages with classification or confidentiality markings were rated for the kind of material and its likely value to Russian intelligence.
• Leak allegations: 16 claims from press and officials were compared with the archive documents matching them in time and content.
• Fanshop: 17,073 public figures from Wikidata (German politicians of all parties and other well-known Germans) were matched by full name against 56,000 shop emails; for each of the 450 people matched, up to six shop emails were checked.

1. Classified papers and the Ochsenreiter mailbox (2018)#

Frohnmaier’s Bundestag office routinely forwarded incoming mail, including papers marked VS – Nur für den Dienstgebrauch (VS-NfD, the lowest German classification, equivalent to EU RESTRICTED), to his private AOL address. Examples in the files: an EU foresight paper for the development committee (February 2018), conference papers of the OSCE Parliamentary Assembly (July 2018) and federal government reports on EU Foreign Affairs Council meetings (November 2018). 1 2 3 Between February 2018 and April 2019 we count 27 messages with non-public parliamentary or state material sent on to the private address, four of them marked VS-NfD. ZDF reported the practice on 29 October 2026; through his lawyer, Frohnmaier said unauthorised persons had no access and the practice has since stopped. Bundestag rules allow VS-NfD material only on approved official IT.

What the files add: from 4 October to 5 November 2018 a Bundestag office staff mailbox sends mail under the display name “Manuel Ochsenreiter | Markus Frohnmaier, MdB”. 4 5 In that period it received three non-public parliamentary papers: a committee’s forward schedule with notes from the Obleute (the parliamentary groups' committee spokespeople) on 19 October, internal coordination of a cross-committee motion on the UN migration compact on 6 November, and the restricted Council reports on 12 November. 6 7 3 Earlier restricted mailings (February–July 2018) also reached this staff mailbox, before Ochsenreiter’s name appears on it, so they cannot be tied to him. The display name comes from unsigned headers; it shows whose name the mailbox carried, not who read it. (These office emails survive as copies in the federal arbitration court’s mailbox, one of the 11 leaked mailboxes; the files do not show why.)

• Ochsenreiter, editor of the far-right magazine Zuerst!, worked for Frohnmaier from September 2018 (taz, RFE/RL). On 14 January 2019 a defendant told a Kraków court that Ochsenreiter had given instructions and money for the 4 February 2018 arson attack on the Hungarian cultural centre in Uzhhorod. Ochsenreiter denied it; Berlin prosecutors opened a preliminary investigation, and he left Frohnmaier’s office. He died in Moscow in August 2021.
• What this shows: a staff mailbox carrying the name of a man who was, two months later, publicly accused of organising an attack in Ukraine received restricted EU foreign-policy papers and non-public committee material. What it does not show: that he read them, or that he or anyone passed them on. The papers concerned were not specifically about Russia or Ukraine, according to our model’s summary.
• Press: ZDF (forwarding to the private address); Ochsenreiter as a recipient: no report found.

2. Leak allegations compared with the archive#

We compared 16 published allegations with the matching archive documents. No document shows a transfer:

For the other allegations (Bundestag pass refusals in 2025, the Bavarian intelligence-oversight committee, drone questions classified VS-NfD, BfV warnings) the archive holds no matching document or only general material on the subject. The 11 mailboxes are party offices; the personal mailboxes of the people named in these allegations are not in the archive.

Other restricted state material in the files (described only in general terms): the leaked 2019 Verfassungsschutz assessment of the AfD (marked VS-NfD, published by netzpolitik.org at the time) and the party’s legal response 11; a 2020 Foreign Office paper on 5G security 12; confidential Bundestag material on the Wirecard affair 13; police and BKA security plans for party conferences. Of about 5,600 marked messages, 215 carry state, parliamentary or EU material; most “confidential” markings (about 3,500) concern internal party matters. Among the state material from 2022 to 2026, nothing concerns Russia beyond public parliamentary business.

3. The party’s line on Russia, before and after 2022#

Read with care: the scale also counts calls for peace talks or an end to sanctions as mildly pro-Russian (+1), and our model did not mark even the federal board’s condemnation of the invasion as critical. The one “critical” text after 2022 is itself a rating error: it complains about “self-destructive Russia sanctions”. The content matters more than the count:

• Before: “Russia is a partner, not an opponent in the fight against terror” (Gauland, 2015) 14; “Dialogue and cooperation with Russia instead of confrontation and pointless sanctions” (Meuthen, 2018) 15; Weidel in 2018 welcomed Trump’s step “to normalise relations with Russia” 16; “Russia is one of our most important partners in Europe” (Nikolaus Kramer, AfD group leader in Mecklenburg-Western Pomerania, 2021) 17.
• 2022: the federal board “unreservedly condemned” Russia’s attack on Ukraine’s territorial integrity, but called the escalation also a result of “estrangement between NATO and Russia”, rejected economic sanctions and Ukraine’s NATO and EU membership. 18 19 Tino Chrupalla warned that NATO arms deliveries risked a third world war. 20 In 2023 federal treasurer Carsten Hütter called for tying support for Ukraine to Kyiv’s readiness to negotiate. 21
• 2023–2026 (mostly Mecklenburg-Western Pomerania): end the gas sanctions 22; “repair and reactivation of Nord Stream 1 and 2” (Petra Federau, 2026) 23; “without marked territorial concessions to Russia there will be no end to the dying” (Jan- Phillip Tadsen, August 2025, welcoming Trump’s peace effort). 24 In NRW the party’s line to members in 2025: the criticism is “not directed against the Ukrainian people nor the Russian one” but against the federal government’s foreign policy. 25
• Contacts after 2022 are few and low-level in the available mailboxes: an RT DE interview request to an NRW official (September 2025) 26, an NRW official’s trip to a conference in Sochi (November 2025, organiser not shown) 27, and an internal complaint in Mecklenburg-Western Pomerania about planned contacts with “Putin-near” representatives (October 2025). 28 The September 2022 trip of Saxony-Anhalt state MPs to Russia and the occupied Donbas was reported at the time. 29

4. NATO, the EU and the economy#

Counts are documents in our sample with an AfD position (leadership / base). Rank-and-file texts are fewer, and many come from state party offices answering members. They point the same way as the leadership, except on the economy, where the base leans more towards the state.

The economy counts understate the market-liberal side: the model sometimes rated demands for tax cuts as “state-oriented”. The quotes are more reliable than the counts.

• NATO: “remaining in NATO is indispensable”, with a stronger European pillar (Gauland, 2017) 30; “we are already members of a functioning defence alliance, NATO” (Georg Pazderski, 2018) 31; but “the AfD opposes any further eastward expansion of NATO” (Harald Laatsch, 2018). 32 After 2022 the NATO question becomes Ukraine’s accession (rejected) — while state MPs in Mecklenburg-Western Pomerania call Bundeswehr investment “long overdue”. 33
• EU: from the euro to Dexit — “We need a nationwide campaign for Brexit / Dexit!” (Weidel, 2016) 34; “Dexit is the logical consequence” (Weidel, 2018). 35 Hardly any text in the sample is favourable to the EU.
• Economy — Musk’s “free-market” AfD? The market-liberal side is real. It ran from Meuthen and Weidel in 2015–2017 (“economic order policy as the best social policy”) to Frohnmaier against rent control as “planned economy” (2017) 36 37. It is now the everyday line of the Mecklenburg-Western Pomerania group: “We need extensive and targeted tax cuts. Not more state, but less state, not more subsidies, but lower levies” (Martin Schmidt, 2022). 38 In 2025 the same group called for lower non-wage labour costs “instead of the quasi-planned-economy wage targets” (Michael Meister). 39
• But not free trade with the West. The party opposed TTIP (Georg Pazderski, 2016) 40 and in Mecklenburg-Western Pomerania backs the farmers’ “resistance to the Mercosur agreement” (2024). 41 The same group wants to “restore interrupted supply chains for Russian raw materials” (Martin Schmidt, 2023). 42 Bundestag MPs called for “a free-trade zone between the European Union and the Eurasian Economic Community” (Eurasische Wirtschaftsgemeinschaft, as the MPs called the Russian-led bloc; Waldemar Herdt and Anton Friesen, 2017). 43
• A welfare state for Germans first. East German MPs call for state investment programmes 44. The NRW state party office wrote in 2025 that the party stands “for a strong welfare state – but for one that helps its own citizens first”. 45 In 2026 the Mecklenburg-Western Pomerania leader Enrico Schult rejects any later retirement age for people who have worked 45 years. 46 In the base sample, state-oriented texts slightly outnumber market-liberal ones.
• Our assessment: on taxes, regulation and energy the AfD speaks the language Musk likes. On trade it is protectionist towards Western agreements and open towards Russia. It pairs both with a welfare state meant first for Germans. There is no socialist programme in the files, but there is a strong social-protectionist strand, more visible in the East and at the base. This is still a keyword sample, mostly from two state-level mailboxes for recent years.

5. Americans and the AfD#

• Telegrams to Trump. After the 2016 election the federal board voted by circular resolution to congratulate Trump; the telegram, signed by Frauke Petry, expressed confidence that he would “end the wars in Syria and Ukraine by mutual agreement with Russia”. 47 At his inauguration in January 2017 Petry and Jörg Meuthen called the AfD Trump’s “natural allies” and asked: “Please support us in our effort to remove the enemy-state clause from the UN Charter.” 48 Press: the Guardian reported the 2016 telegram from the leak; the inauguration telegram and its request: no report found.
• Steve Bannon. Weidel met Bannon in Zurich on 6 March 2018; the emails show the meeting was arranged through intermediaries including Vincent Harris, whose Texas firm Harris Media worked for the AfD’s 2017 campaign. 49 50 Press: the meeting was reported (dpa, 2018); the Guardian found “no follow-up” in the leak.
• US government. According to an AfD press release, in June 2018 foreign-policy spokesman Armin-Paulus Hampel and defence committee member Jens Kestner held talks at the State Department, on Capitol Hill and at the Pentagon, including with a security adviser to Senator Ron Johnson. 51 Press: announced in an AfD press release; we found no independent coverage.
• Mailing lists are not contacts. Weidel and Gauland received dozens of Trump campaign and Republican National Committee fundraising emails in 2016–2018. That shows a subscription, not money or contact.
• Musk, Vance, Rubio, the second Trump administration: no direct contact in the files. Vance’s February 2025 Munich speech appears only as a reference in AfD press releases. 52 The AfD’s well-reported 2025 contacts with the administration ran through the federal leadership and the Bundestag group, whose mailboxes for that period are not in the archive.

6. Public figures in the merchandise shop#

Buying party merchandise reveals a political opinion, which data-protection law protects specially. We therefore publish only the result. Among the 450 matched public figures, all now checked, apparent customers from outside the AfD — politicians of other parties, athletes, musicians, a bishop — mostly turned out on closer look to be namesakes: in many cases AfD members or local officials with the same name (shown by party addresses or offices in the orders), in the others private customers whose place or details do not fit the public figure. A few matches remain open and are being checked by hand; we will report them only if a public interest justifies it.

Russia findings from edition 1 (unchanged)#

All edition 1 findings stand; see edition 1 for details and press sources. In brief:

• Occupied Crimea: the February 2018 delegation was invited via Yuri Gempel of the Crimean “State Council”, whose side offered to cover accommodation, transfers and interpreters; the federal board discussed MPs’ trip to the April 2018 Yalta forum, and Weidel recommended entering via Odessa. 53 54 55
• The March 2018 “election observers” were, according to the emails, invited by Duma chairman Volodin and foreign-affairs chair Slutsky; the Bundestag group approved its own financial support. 56 57
• The NRW network around Eugen Schmidt arranged and invoiced AfD advertising on Rossiya 1 and Rossiya 24 in 2017 — AfD money to Russian state TV, not the reverse. 58 59
• The Moscow City Government provided a private jet for Petry, Pretzell and Flak in February 2017 (reported); Meuthen met the Ulyanovsk governor and Duma committee chair Gutenev in July 2018; Kalbitz announced an “informal exchange of information” with sanctioned oligarch Konstantin Malofeev in Moscow in February 2019 (first reported by CORRECTIV from this leak). 60 15 61
• The Russian embassy invited Petry and Weidel to a Crimea conference (2017); Robby Schlund invited Duma budget chair Andrei Makarov to the Bundestag (2018). 62 63

What we did not find (so far)#

• No Russian money to the AfD or its officials: no payment, loan or donation. The only benefits remain travel and hospitality.
• No transfer of classified information to Russia, and no contact with Russian intelligence services. The archive shows careless handling of restricted papers and, in one case, a recipient mailbox carrying the name of a man later accused of organising an attack in Ukraine.
• No American money, and no direct contact with Musk or the second Trump administration in the available mailboxes.

How to verify#

Every reference [n] points to a file in the published archive. The afd:// address gives the mailbox and the mbox file (or document); the SHA-256 is the hash of the raw message and identifies it uniquely. Message-IDs are left out because some contain private domains.

• sha256 ok means the file is unchanged since we indexed it — not that the email is genuine.
• DKIM pass means the sender’s server signed the message and the signature still verifies today — strong evidence of authenticity. Most cited emails are internal AfD or Bundestag mail without a signature.

Positions are model ratings of a keyword sample and contain errors; the quotes are verbatim and were checked against the source. “No report found” means only that our searches found none.

Press sources#

• ZDFheute, 29 Oct 2026 — AfD-Leaks: Sammelte Abgeordneter Infos für das Assad-Regime?
• RFE/RL, 2019 — Far-right German journalist implicated in firebombing of Hungarian center in Ukraine
• RFE/RL, 2019 — Berlin prosecutors investigate German journalist named in Ukraine arson attack
• taz — The Firebugs
• Wikipedia — Markus Frohnmaier
• Verwaltungsgericht Berlin, 2025 — press release on the refused Bundestag pass
• ZDFheute — Bundestag: Kein Hausausweis für mehrere Abgeordneten-Mitarbeiter
• Raw Story, on the Guardian’s review of the leak — AfD and Trump
• Quartz, 2018 — Alice Weidel is getting advice from Steve Bannon
• The Local, 2018 — Steve Bannon in Zurich
• Japan Times / Reuters, 31 Oct 2025 — Far-right AfD deepens ties to Trump administration
• CORRECTIV, 21 Oct 2026 — Was im AfD-Leak steckt
• Spiegel, 5 Apr 2019 — Markus Frohnmaier: Russen setzten auf AfD-Abgeordneten

Evidence index#