But surely intel services are smart enough to get people in there illegally.
Hardware security used to be a joke. Now verified boot, encrypted RAM, key storage in hardware security models and hardware and OS attestation are getting somewhere.
But if you're important enough of a target to a state actor they will magically have some workaround. For your average raid on your home they might actually work depending on the specific setup.
For really high threat models you want zero trust models with E2EE as well as staying anonymous so no one knows where the hardware (and the people which might be much more vulnerable) are located. Tor exists for a reason.
Turns out it was a front for Russian intelligence. Even after the German government found out, the guy still somehow escaped to Russia. There’s a solid chance that Russia operatives have infiltrated the German government. They was even a big hack Russia’s state hackers did and a lot of information was leaked.
I bring this up because Hetzner was asking for my passport to buy a $10/m server. Simple opsec says to just pay a bit more and use DigitalOcean or some other VPS.
There are many good non-Hetzner European hosting companies, luckily.
Wirecard were a German fintech, but didn't have big market penetration across Europe. They were a real company with real operations, but a decent part of its balance sheet was fake (supposedly it was in an Asian subsidiary, there was no money there). It wasn't a front for Russian intelligence, it's COO was a Russian operative (and nowadays runs a shadow intelligence agency from Moscow, using incompetent morons to try to kidnap journalists, or scheming to hire ISIS suicide bombers to blow them up); those connections only surfaced after the whole thing imploded. But the whole company was an actual real place with real operations and real non-russian intelligence employees. It's still not certain if the CEO knew about the COO for instance.
Read the FT series on the whole thing, their investigation started the collapse.