When Investigations Investigate Themselves
Why Hungary’s Brussels spy story by Direkt36 reads more political than investigative
Direkt36 ’s Brussels spy story piece is vivid—park-bench coffees, a recruitment push, whispers about pressure on Commission texts—but it leans on anonymous voices and loaded phrasing, not published artefacts or a clear benchmark for what’s over the line in a city where allies routinely collect on allies. Published on 9 Oct 2025 as a cross-border exposé, it brands Hungary’s tradecraft as uniquely malign without showing receipts or a comparative baseline. This isn’t “kill the story”—it’s invert the workflow: do the hard analytical and investigative work before the prose. Otherwise it’s the same old “their spying is malign, our liaison benign” trope in a new wrapper.
The story painted a vivid picture: Hungarian diplomats under intelligence cover roaming the EU quarter’s parks, inviting Hungarian Commission staff for coffee, fishing for gossip, and—in at least one dramatic encounter—sliding across the table a recruitment declaration to sign.
The lead figure—known only as “V.”—was said to have headed Hungary’s clandestine network in Brussels until his recklessness brought the operation down in 2017.
Other vignettes fleshed out the network: another officer, “E.,” who after his Brussels stint reportedly reappeared inside an EU security directorate as a national expert; Hungarian officials allegedly pressured by intelligence handlers to tweak Commission reports; and a permanent representation led by future Commissioner Olivér Várhelyi, accused of turning a blind eye. The through-line was stark: Hungary’s Információs Hivatal (IH), the civilian foreign-intelligence service, was not serving national interest but the narrow political power of Viktor Orbán’s government.
Presented in the polished tones of international investigative journalism, the article promised to expose a hidden scandal. Yet beneath the drama, the evidence rests almost entirely on anonymous recollections, “according to sources” attributions, and rhetorical flourishes. No expulsion orders, no leaked tasking memos, no administrative footprints. In other words: it lands more like a morality play—or a political play—than a dossier.
The Blind Spots of “Objective” Investigations
Brussels is arguably the world’s busiest square mile for political intelligence. It packs the European Commission, Council, Parliament, and NATO headquarters into one neighborhood—plus a sprawl of permanent representations, think tanks, lobbyists, consultancies and security services that quietly trade information every day. In that ecosystem, the line between diplomacy, liaison, open-source intelligence (OSINT)1, human intelligence (HUMINT)2, signals intelligence (SIGINT)3, and outright espionage is thin, negotiable and often judged in hindsight. Precisely because of that ambiguity, any investigation that seeks to recast routine collection as scandal owes readers the highest standards of evidence. Otherwise, it’s political prose.
The article at issue—the multi-outlet collaboration asserting that, in the mid-2010s, IH ran clumsy recruitment operations in Brussels, was exposed, and saw its local network “collapse”—invites a contrarian reading.
Not because allies never overstep (they do), nor because consortia can’t add value (they can), but because the piece leans so heavily on anonymous recollection, interpretive framing, and rhetorical escalation that its own claim to objectivity becomes a live question.
This essay stress-tests the article’s evidentiary standards, framing choices, and proportionality. It also asks what “public interest” looks like when reporting on historical tradecraft in a city where everyone spies on everyone else—yes, allies too.
Take 1. What the Article Claims—And What It Actually Proves
At core, the article claims that (a) IH officers under diplomatic cover attempted to recruit EU-employed Hungarian nationals (!!!); (b) one officer (“V.”) pushed so aggressively that he drew institutional attention; (c) by 2017 the “network” effectively collapsed; and (d) the purpose was partisan power rather than statecraft.
Some of this is inherently plausible. Allies do cultivate compatriots; services do overreach; specific officers get burned by sloppy tradecraft. None of that is extraordinary. But extraordinary claims—collapse of a rezidentúra years later, or tasking to serve a single political clique—require documentary artefacts, administrative footprints (persona non grata actions, accreditation refusals), declassified tasking, disciplinary records, or court-verified facts.
What we actually get is a chain of anonymized recollections, a handful of vivid vignettes, and a cascade of evaluative language (“obviously and clumsily / nyilvánvalóan és ügyetlenül,” “irresponsibly / felelőtlenül,” “like a domino, it dragged the whole system down / dominóként rántotta magával az egész rendszert”). Institutions are quoted with “no comment”—standard in this domain—while the narrative treats that silence as corroborative shadow.
The result is a story that asks readers to substitute trust in unnamed sources for the evidentiary anchors that make strong claims falsifiable.
If “V.” truly tried to have a target sign a source cooperation agreement (beszervezési nyilatkozat), where is a redacted image? If a rezidentúra “collapsed,” where are expulsion notes, accreditation withdrawals, or oversight references? If EU security flagged actors, where are document numbers, case IDs, or dates? Absence doesn’t prove events didn’t occur—intelligence is messy and rarely leaves tidy public trails—but without artefacts, dramatic assertions remain interpretive rather than demonstrative.
Take 2. Brussels Is Not a Church: Parity of Practice Matters
One framing pillar claims that “network-building and information-gathering (hálózatépítés és információgyűjtés)” of this type belongs mostly to non-EU powers (Russia, China, Iran), not EU member states. That’s a political framing, not reality. Network building and information gathering based on this is one way to gather intelligence. In Brussels, capable EU and NATO members run some mix of intelligence tradecraft and liaison-based collection against one another’s policies, intentions, and negotiating positions.
The Merkel–NSA–Denmark episode did not happen on Mars: a Danish review showed the NSA4, with Copenhagen’s help, tapping Danish internet cables to monitor senior EU leaders, including Angela Merkel. Leaks later showed U.S. surveillance of French presidents Chirac, Sarkozy, and Hollande, serious enough for the Élysée to convene an emergency meeting. Germany’s BND5 curtailed elements of its NSA cooperation - hardly limited to ‘war on terror’ —after disclosures that U.S. “selectors” had hit European officials and firms. And the UK’s GCHQ6 ran the sweeping Tempora program, tapping hundreds of fibre-optic cables and sharing the take with Washington, effectively vacuuming up European traffic transiting the UK.
These cases show allied-on-allied intelligence in Europe is structural, not aberrant—so it’s misleading to treat Hungary’s alleged operations as unprecedented. The Szájer-scandal7 did not arise from a concerned citizen’s police report; it bore the hallmarks of a European peer-service operation, underscoring how politics, leverage, and intelligence narratives constantly collide in the heart of the EU quarter.
If the article claims Hungary went beyond accepted allied norms, it owes a comparative baseline: how, concretely, did Hungarian methods deviate from what France, Germany, Italy, or others have historically considered “within bounds” in Brussels? Without that, readers are nudged toward a moralized asymmetry: when “they” do HUMINT, it’s malign; when “we” do liaison and networking, it’s benign. Emotionally satisfying, analytically thin.
Take 3. From Networking to Espionage: Where Is the Line?
The piece is strongest where it describes conduct that—if documented—would cross the line: payments for sensitive information, an attempt to get a target to sign a cooperation document, or requests for non-public internal texts. But most vignettes orbit the liaison/intelligence gray zone common in Brussels: coffees with compatriots in parks, spot-and-assess mapping (“tippkutatás”)8, gauging attitudes, trading gossips. None of this is a smoking gun.
The legal/diplomatic threshold is not whether a diplomat asks questions, but whether they induce transfer of protected information by means that breach the Vienna Convention and host/organization rules: payment, improper inducement, or coercive leverage. Even then, practice tends to be handled administratively (silent withdrawals, cooling-off) rather than via scandal. If the article claims a breach, it should show precisely where the conduct crossed codified lines—not rely on the reader’s moral intuition that “this felt wrong.”
Take 4. Motive Imputation Is Not Evidence
The sweepiest claim is that IH’s Brussels activity served partisan power rather than the state. That may be true—but without access to tasking orders, budget lines, and distribution lists, it’s inference, not proof. Governments routinely redefine “national interest” around their agenda. To show partisanship, you would need documents linking collection directly to political rather than policy objectives. The article doesn’t provide that.
Raising the Bar: Beyond Narrative
Cross-border formats (Der Spiegel, Der Standard, De Tijd) lower risk and broaden reach, but they can create echo effects—shared sources and frames can mimic independent corroboration. That’s why method transparency isn’t optional: how many sources, how many first-hand, what corroboration steps, and which claims rest on a single voice. The same goes for funding or institutional briefings—if an NGO, OSINT lab, or peer agency shaped the story, readers deserve to know.
Proportionality matters too. Most alleged events predate 2018 and have long circulated in Brussels corridors. Publishing names, roles, and methods without artefacts risks more heat than light—especially when the payoff is moral clarity rather than hard proof.
Language also betrays bias: “obviously and clumsily,” “like a domino,” “the domain of Russia/China but not EU states.” These aren’t neutral descriptors; they nudge toward condemnation. A rigorous approach anchors claims in artefacts, numbers, and dates—and tests benign explanations rather than waving them away: routine compatriot liaison, spot-and-assess mapping, organizational churn mistaken for collapse. None of these disprove misconduct, but they prevent narrative inevitability.
What Stronger Journalism Would Show
Receipts: redacted recruitment forms, accreditation notes, expense records.
Methods: source counts; first-hand vs. hearsay; single- vs. multi-source claims.
Comparative baseline: how other EU services draw the line in Brussels.
Chronology: verifiable timestamps anchoring vignettes in time.
Provenance notes: who supplied which document and how it was corroborated.
Why It Matters
In Brussels, everyone collects—even allies. Journalism that brands one state’s HUMINT as uniquely malign while others’ liaison is treated as benign must meet higher evidentiary standards. Otherwise, it teaches the wrong lessons: that coffee equals espionage, that “no comment” equals guilt, and that allied collection is an aberration.
Skepticism here isn’t cynicism. It’s civic hygiene. If we’re going to name and shame, we must also show and prove.
Conclusion: Evidence First, Narrative Second
A stronger version of this investigation would lead with documents, dates, and administrative footprints—not recollections and rhetoric. If specific officers crossed bright lines, show the artefacts; if consequences followed, cite expulsion notes, accreditation withdrawals, case numbers, ethics files. Otherwise, we’re connecting dots with the ink of suspicion.
Hungarian investigative journalism—at its best—can do this. Too often, as here, the craft leans on scenes and adjectives instead of data and verification. The writing is the easy part; the real work is collection, provenance checks, adversarial corroboration, and method transparency. Without that, moral clarity drifts into moral theatre.
What “working harder” looks like in practice:
• Publish the receipts (forms, metadata, travel/expense, internal memos, docket numbers).
• Show your methods (source counts; first-hand vs. hearsay; how each claim was corroborated).
• Add provenance & funding notes (OSINT vs. insider vs. institutional; who funded; conflicts).
• Provide a comparative baseline (where conduct crosses law, Vienna Convention, internal rules).
• Offer replicability (timelines, appendices, a small public data room for audit).
In a city where everyone collects—friends included—the burden on any newsroom claiming objectivity is to raise the bar above narrative. If we invoke the public interest, we should submit our journalism to the same evidentiary rigor we demand of the institutions we scrutinize.
Skepticism toward this piece is not hostility to journalism; it’s a demand that the work be less performative and more probative.
Do the hard part first—the research, analytics and intel—then write.
Disagree? Good. I don’t write to be right—I write to be tested. Bring your “Tenth Man” view, your sharpest counterpoint, or even a quiet doubt. Sometimes the most useful critique is the one that unsettles my own thinking.
Don’t forget to subscribe for more Critical Hungary Insights!
OSINT (Open-Source Intelligence): the targeted, systematic collection and analysis of information from publicly accessible (non-classified) sources for decision-support purposes. This includes traditional and online media, professional publications, corporate and government public records, social media, as well as commercially available data. OSINT differs from HUMINT and SIGINT in terms of source access, relying explicitly on lawful and ethical acquisition.
HUMINT (Human Intelligence): the collection of information through human sources—structured or semi-structured interviews, conversations, elicitation, on-site observation, and network-building. The process involves recruiting and handling sources, evaluating credibility and reliability, controlling for bias, and ensuring legal and ethical compliance. HUMINT differs from OSINT (which relies on publicly available sources) and SIGINT (signals intelligence) in its mode of access.
SIGINT (Signals intelligence) is the collection and analysis of information derived from electronic signals—including communications (COMINT: phone, email, messaging metadata/content) and non-communications emissions (ELINT: radars, telemetry, electronic beacons). Typical methods include wire/cable taps, satellite interception, radio/RF capture, and network exploitation, often at scale via backbone access points. Unlike HUMINT (human sources) or OSINT (public sources), SIGINT hinges on technical access and produces both contentand metadata used for threat warning, attribution, and policy insight; its use is governed by national law, oversight regimes, and international agreements.
NSA (The U.S. National Security Agency) is the United States’ signals-intelligence and cybersecurity agency (founded 1952; HQ Fort Meade), responsible for collecting, processing, and analyzing foreign electronic communications and protecting U.S. government networks; it operates closely with partner services such as the UK’s GCHQ within the “Five Eyes” framework and has been central to multiple transatlantic surveillance disclosures (e.g., the Snowden leaks).
BND (The Bundesnachrichtendienst) is Germany’s foreign intelligence service, reporting to the Federal Chancellery. Its mandate is to collect and analyze intelligence outside Germany (counterparts: BfV for domestic security, MAD for military counterintelligence). The BND historically operated major SIGINT sites (e.g., Bad Aibling), has cooperated with partner services including the NSA, and underwent legal reforms (BND-Gesetz) and oversight tightening in the mid-2010s–2020s following debates over foreign surveillance and selector use. Its main HQ is in Berlin (opened 2019).
GCHQ (The Government Communications Headquarters) is the United Kingdom’s signals intelligence and cybersecurity agency, headquartered in Cheltenham. It is responsible for intercepting, analyzing, and protecting communications to support UK national security, defense, and foreign policy. GCHQ works in close partnership with the U.S. NSA and other “Five Eyes” allies. Its capabilities include large-scale interception programs such as Tempora, which taps international fibre-optic cables. Alongside SIGINT, GCHQ also operates the National Cyber Security Centre (NCSC), established in 2016 to coordinate UK cyber defense.
Szájer-scandal: In November 2020, Hungarian MEP József Szájer—founding Fidesz figure and architect of Hungary’s constitution—was caught at a male-only Brussels party violating Covid rules, attempted to escape down a drainpipe, and resigned amid a global hypocrisy scandal.
Spot-and-Assess (Tippkutatás in Hungarian intel jargon) phase of HUMINT is about the spotting and prospecting for potential sources. Intel officers map and screen candidates who might have access (e.g., EU staff, contractors, lobbyists), then do light-touch checks—public info, social graph, vulnerabilities, access level—to prioritize who to approach. It’s the pre-recruitment phase of HUMINT: identify → assess → shortlist (no tasking yet). As long as it relies on open sources and consensual conversation, it’s typically seen as benign liaison; it turns malign when inducements, pressure, or requests for protected material enter the picture.