Russia’s suspected sabotage campaign steps up in Europe

On July 10, an individual identifying themselves as a 26-year-old Russian-speaking Estonian named Valeri Ivanov messaged a Telegram account promoted on several pro-Kremlin social media feeds that was looking for European nationals to conduct sabotage within their countries.”You’ve probably already seen what happened in Romania,” read one advert posted a week earlier that included clips of several industrial fires. “They are afraid that there will be more of you … And there are more of you. Just say privet (hello) to us.”Within minutes, “Ivanov” – actually part of a reporting team from NGO the Organised Crime and Corruption Reporting Project – was chatting online in Russian to an anonymous recruiter who promised payments of up to $10,000 worth of cryptocurrency for a range of acts including spying on military bases, setting fire to vehicles and even murder.Western officials say such incidents have skyrocketed in Europe since the start of this year, with suspected Russian-paid operatives thought to be behind a range of crimes. Russia has regularly denied any involvement.Crimes include break-ins and arson at factories and critical national infrastructure, physical attacks and even a reported assassination plot against the CEO of Germany’s largest arms company.It is a trend that is causing increasing alarm, but which Western nations are still working on a coherent strategy to address.The next step, the recruiter said, was for “Ivanov” to film himself in a remote area of forest testing a Molotov cocktail and send the footage to his handlers. For that, he would receive his first payment and additional instructions.While “Ivanov” wasn’t real, European intelligence services believe many such individuals – perhaps dozens or even more – have responded to such offers since last year, often petty crooks with prior convictions.When NATO foreign ministers met in Vienna this April, U.S. Secretary of State Antony Blinken said almost every member nation had reported incidents of sabotage or disruption, a campaign that has intensified sharply since Russia’s 2022 full-scale invasion of Ukraine.Russia’s aims, officials and analysts say, likely include undermining European trust in governments, deterring further European military support for Ukraine and demonstrating Kremlin reach and ruthlessness in ways the West will not wish to match directly. All of that, some suggest, may also be intended to undermine Western cohesion in advance of any future wider conflict.“The aim is clearly to make populations feel vulnerable and unsafe,” said Elisabeth Braw, a Swedish hybrid warfare expert and senior fellow at the Atlantic Council think tank.The head of Germany’s BND foreign intelligence service, Bruno Kahl, warned on Monday last week that Russia’s willingness to use hybrid and covert measures was now at a “level unseen”, while “direct military confrontation with NATO has become an option for Moscow”. Putin would continue to escalate the confrontation, he predicted, with his military likely much more prepared to attack the rest of Europe later in the decade.Last month, the heads of the U.S. CIA and Britain’s MI6 – Bill Burns and Richard Moore – said Russia was waging a “reckless campaign of sabotage” across the continent.Earlier this month, the chief of Britain’s MI5 Security Service, Ken McCallum, said Russia’s military intelligence agency the GRU had carried out “arson, sabotage and more dangerous actions conducted with increasing recklessness,” often operating through underworld criminal gangs. Kremlin spokesman Dmitry Peskov called his statements “unsubstantiated and unfounded”.Western officials say Russia has been using cyber attacks and information warfare for years to disrupt and intimidate enemies, including networks of bots spreading disinformation. The level of physical actions now taking place on the soil of European NATO members, however, outstrips anything seen in recent history, prompting mounting calls for a stepped-up response.”We should improve our strategic communications to make it clear that there would be serious repercussions for these actions, particularly if they lead to loss of life,” said Eero Kytomaa, a senior adviser on national security and hybrid threats to the Finnish government in Helsinki.European nations should consider declassifying more information on such attacks, he said, ensuring populations are better aware of Russian tactics and techniques.GROWING TARGET LISTAccording to European officials, the most recent incidents include a string of break-ins at water treatment plants in Finland that now appears to have spread to Sweden. After an intruder gained access to part of a reservoir and pumping station on the night of Sunday Oct. 13, Swedish media reported residents in the western district of Bollnas were asked to boil drinking water as a precaution.A similar event took place in Germany in August near Cologne when a hole was found cut in a security fence around a reservoir. Again, locals were encouraged to boil drinking water while tests were conducted for chemical or biological contamination.German spy chiefs testifying to their parliament last week cited booby-trapped parcels designed to catch fire, one of which ignited at a DHL logistics centre – and would have caused disaster on a commercial aircraft. “We are observing aggressive behaviour by the Russian intelligence services,” said Thomas Haldenberg, head of domestic German intelligence, warning such actions were putting lives at risk.According to the Guardian newspaper last week, a similar device appears to have caused a fire at a UK DHL logistics facility in Birmingham in July, and officials are investigating possible Russian links.The most potentially serious, according to reports from CNN and others in July, was an alleged plot to assassinate German defence executive Armin Papperger, CEO of arms firm Rheinmettal, which has been delivering shells, vehicles and other military items to Ukraine.Targets for arson or defacement include an IKEA store in Lithuania and Latvia’s Occupation Museum chronicling its decades under Soviet control, while unidentified drones have overflown a German nuclear power plant and briefly forced the closure of the main airport in Stockholm.Multiple countries including Estonia, Poland, Latvia, Lithuania and Britain have arrested suspected Russian-sponsored actors for sabotage and other offences, many not disclosed in detail. Poland said it arrested nine suspects in May for “beatings, arson and attempted arson” while Estonia said 10 people arrested there were part of a wider campaign to spread “fear, discontent and confusion”.Potential responses to further Russian actions could include greater Western support for Ukraine, the official suggested, as well as more targeted sanctions. But officials acknowledge attribution can be hard. Many analysts were quick to blame the Kremlin after the 2022 destruction of Nordstream 2 Russia-Germany gas pipeline, but more recent reports suggest Ukrainian elements may have been responsible.”COGNITIVE WARFARE”Still, officials say the overall trend of rising Russian activity in 2024 versus 2023 remains very clear.Writing in the London Times newspaper last week, former UK Foreign Secretary William Hague described Russia’s sabotage efforts as part of a much broader “cognitive warfare” campaign waged by an increasingly coordinated block of authoritarian nations led by Russia and China determined to undermine the confidence and cohesion of Western states and allies.More conventional cyber attacks have also continued, with both Russia and China accused of penetrating systems. Last week, the i newspaper in Britain reported that Russian hackers using ransomware have been able to penetrate the communication systems used by the UK ambulance service, while private companies delivering defence and other services have also been targeted.On NATO’s eastern flank, Poland and Lithuania have also reported a steady increase in the number of migrants attempting to cross the border from nearby Belarus, more than 26,000 this year with 2,500 last month alone. Last week, Polish Prime Minister Donald Tusk said he would lobby the European Union directly to release Poland from its obligations to offer asylum to certain migrant groups, accusing Belarus and Russia of exploiting vulnerable individuals by pushing them across the frontier.New barriers and tighter surveillance along the Finland-Russian border appear to have halted the significant flow of migrants that were coming from Russia earlier in the year. Western officials say they have also been getting better at identifying Russian spies, including those under diplomatic cover.Social media platforms have been able to take at least some action, including Telegram after its founder Pavel Durov was arrested in France in August charged with enabling illegal activities on the platform. After the Telegram feed recruiting European saboteurs was exposed by the Organised Crime and Reporting Project, it was shut down on that social media platform within days.Most officials and analysts, however, expect much more to come. “They have no shame, and are clearly not concerned about being called out and found out,” said Braw of the Atlantic Council. As long as the narrative of rising escalation fits the interests of the Kremlin and its allies, expect more of this disruption – and with it, the risk of people, businesses and nations getting badly hurt.(The opinions expressed here are those of the author, a columnist for Reuters.) Sign up here.Our Standards: The Thomson Reuters Trust Principles., opens new tab