Russia’s hybrid warfare puts Europe to the test
Officials suspect a campaign of sabotage that once looked opportunistic may be a strategic escalation
Sam Jones in Berlin
In July 2024, DHL parcels exploded in logistics centres in the UK, Poland and Germany.
Each of them was powerful enough to have brought down a cargo plane had they detonated onboard.
Security services would eventually trace the plot back to a group of Russian-directed saboteurs who had a further 6kg of explosive material in their possession.
That was enough to give them the capability for what security officials told the Financial Times was the next stage of the plan: to attack flights to the US, and cause more disruption to the airline industry than any act of terror since the World Trade Center attacks.
It was just one near-miss incident in a co-ordinated and covert campaign of sabotage led by Moscow, officials believe, that has sown bewilderment across the continent and is steadily posing more of a risk to human lives.
Intelligence chiefs and police forces have foiled plots to derail crowded trains, burn down shopping centres, discharge a dam and poison water supplies.
And these are just the ones we know about.
“The first important thing to consider is that we still don’t really appreciate everything which is going on,” says Keir Giles, Russia expert at Chatham House.
“What is publicly understood about this is just the tip [of an iceberg] . . . there’s still a lot that governments have chosen not to talk about.”
What was, as recently as a year ago, still being characterised as a nuisance of “pin prick”, low-level attacks against soft European targets is now being interpreted as a far more serious threat.
To frontline states such as Poland, for example, it is already a matter of fact that Russia now poses as great a threat to civilian life in Europe as does Islamist terrorism, the main preoccupation of domestic intelligence agencies on the continent over the past two decades.
Hawks in intelligence circles across the continent are now wondering, as the scale of Russia’s aggression in Europe has become clearer, whether there is a strategic escalation taking place, and not just tactical opportunism.
The sites Russia is targeting, the risks it is willing to take, and its apparent goals reflect more than just a response to the dynamics of its conflict with Ukraine, many in the intelligence community now believe.
Some intelligence points to longer-term planning.
Although large numbers of Russian spies have been kicked out of Europe in recent years, the Kremlin’s agencies have tried to reinfiltrate European states with trained professionals, even as they bombard the continent with scattergun attacks by proxies and criminals.
The head of one major European intelligence agency says his officers were now observing Russian agents surveying road bridges, he presumes with the intention to mine them.
Railways all over the continent, he notes, are similarly being aggressively mapped for weak spots.
His agency and others are also tracking the attempts of Russia to insert highly trained sleeper-saboteurs into European states.
More detailed, recent assessments of Russian sabotage actions in Europe, another official says, are increasingly being considered in the light of a Nato 2023 Joint Threat Assessment — a classified report shared among the alliances’ defence chiefs — that Russia was gearing its military and economy for a possible hot war with Europe by 2029.
But it is a thorny topic.
By its nature, Russia’s sabotage campaign in Europe is diffuse and hard to read.
Aggressive but ultimately clumsy attempts to sow chaos might yet be reflective of the dynamics inherent in a sprawling, authoritarian state, in which every officer is desperately trying to show initiative and accomplishment to superiors, rather than revealing any doctrine or plan.
Officials and lawmakers are also wary of doing Russia’s job for it: public fear, policy paralysis and the tying up of valuable investigative resources are, all agree, one of the campaign’s main objectives.
But some are beginning to speak up.
Last week, the chair of Nato’s military committee, Admiral Giuseppe Cavo Dragone, told the FT that the alliance was looking at far more muscular responses to Russian covert violence, including pre-emptive strikes as a deterrent.
It amounts to a test of Europe’s mettle, says Chatham House’s Giles.
“The capacity of victim states to deal with these attacks, identify the perpetrators and politically respond . . . is very valuable intelligence” for Russia, he says.
“And if the answer is that they don’t . . . if a country just writes this off as ‘hybrid warfare’ with stern words, then Russia will just continue to do more of the same.”
He adds: “It’s nonsensical to call this anything other than what it is — warfare against Europe.”
A wake-up call came last month.
A bomb placed on the Warsaw-Lublin railway line in Poland was, in the words of the country’s prime minister, Donald Tusk, “an unprecedented act of sabotage” designed to cause a train derailment and mass casualties.
Disaster was averted at the last minute, when a train conductor managed to make an emergency stop.
But the incident made many policymakers realise both that they are unsure what they would have done had the train crashed and caused a huge loss of life, and also what they can do to stop Russia from attempting such reckless actions again.
Indeed, the incident is proving a textbook example of how Russia’s campaign operates, and the challenges it presents to policymakers.
The agents Russia uses are typically young men, often recruited online.
They are not spies.
Nor have they typically had any connections to Russia.
They are individuals with Schengen area residency.
They are mobile, often motivated solely by money, and completely disposable.
They are hard to identify in advance, and hard to prosecute under espionage legislation when discovered — particularly when their links to Russian intelligence are often ambiguous.
Many of those caught claim not to have known who they were working for.
In the Polish case, two Ukrainian nationals have been identified by the authorities as the bombers.
They escaped.
Four collaborators were arrested with dozens of false identity papers and passports issued by Moscow found in their possession.
But they were later released by a court owing to a lack of evidence.
Maciej Materka, a retired general and former head of Poland’s military counter-intelligence, says the Polish rail sabotage incident showed a “systemic” problem.
“These people entered Poland without any problems, carried out their operation, and left without incident,” he says.
“And there is a second, equally troubling issue, namely the individuals who collaborated in the sabotage and were released by the court, probably because it did not have sufficient evidence.”
Polish authorities believe the agents were being run by a Russian cut-out, or intermediary, named Mikhail Viktorovich Mirgorodsky, who was in turn working for the FSB, Russia’s domestic and near-abroad intelligence agency.
Mirgorodsky was used to finance the operations, paying individuals recruited via Telegram in cryptocurrencies.
This set-up is typical of what analysts have dubbed the “gig economy” of Russia’s new spycraft.
In part it is a product of necessity.
Russia’s growing belligerence over the past decade has resulted in waves of mass expulsions of Russian intelligence agents posing under diplomatic cover.
Russian military intelligence, the GRU — the agency primarily responsible for coordinating sabotage on foreign soil — has been hit particularly hard.
Proxies have, as a result, become the new foot soldiers of Russian terror.
Russia’s intelligence agencies also seek to obfuscate their involvement by using cut-out agents, like Mirgorodsky.
Jan Marsalek — the former Wirecard boss who is one of the highest profile of such inbetweeners — directed at least one ring to carry out disruptive attacks: a cell of Bulgarians who were imprisoned earlier this year.
Among their targets: US military bases and foreign embassies.
The GRU has even used third parties such as the Russian mercenary group Wagner for recruitment.
A Wagner officer was the handler for six young British men, convicted this October, for setting fire to an east London warehouse on behalf of Russia.
The hunt for proxies also helps explain why the FSB — not traditionally an agency tasked with kinetic attacks in Europe — has played an increasing role, thanks to its primacy in developing networks with criminal and underground groups in Ukraine and other former Soviet states.
This layered and loose operational arrangement has a drawback: it greatly diminishes Moscow’s precision and control, especially when the recruits turn out to be unskilled and fallible.
Dylan Earl, the 21-year-old ringleader of the east London arson attack, was convicted after a video of himself starting the fire was found on his phone.
He had a Russian flag in his apartment, along with cocaine with a street value of £34,000.
To pick up tradecraft tips, his Wagner handler had told him to watch The Americans, a glossy TV drama about two undercover KGB agents carrying out improbable covert operations in the US.
But the gig economy of spycraft offers one very significant advantage: scale.
Through messaging apps like Telegram and Viber, Russian recruiters can reach huge potential pools of willing individuals.
Just like in the legitimate gig economy, Earl was eager to leverage his own network of criminal contacts to help establish his usefulness for his “client” and ensure more work would come his way.
“They have a warehouse in Czech Republic to burn for 35 thousand,” he wrote to a drug dealer contact shortly after setting the blaze in London.
It is the sheer number of such attacks, rather than granular detail about each individual instance, that is now enabling European intelligence agencies to see patterns, drawing connections between events even in cases where no Russian involvement has been proved, disclosed or detected.
For example: three individuals — two Ukrainians and a Romanian — have been charged with setting fires at properties and a car linked to UK Prime Minister Sir Keir Starmer this May.
Prosecutors have not mentioned any connection to Russia.
But from an intelligence perspective, it is notable that elsewhere in Europe politicians’ cars and properties have been targeted in near identical circumstances, particularly in Estonia, which borders Russia and where Britain has its largest contingent of troops deployed on the continent.
“These incidents might look small, like little pin pricks.
But you have to see this in the whole picture.
These are all individual components of a very concerted, hybrid campaign to divide society,” says Konstantin von Notz, a member and former chair of the German parliamentary committee that supervises the country’s intelligence agencies.
“There is always this demand for a smoking gun, which is understandable, and legally of course also correct.
[But] does the logic of in dubio pro reo [let doubt favour the accused] have to be suspended somehow when we’re dealing with hybrid warfare?
Do we need to have the courage to name what we’re dealing with without being able to prove it down to the very last legal detail?”
In October, a Finnish court dismissed a case against the captain and senior crew of the Eagle S, a Russian-linked tanker that had dragged its anchor for 90km back and forth over the bed of the Baltic Sea, breaking five undersea cables.
The cost of repairing one of them — the Estlink 2, a key electricity link between Finland and Estonia, will run to at least €60mn and take months to complete.
The crew claimed a mechanical failure in the anchor winch was responsible.
The court eventually found it had no jurisdiction, ruling that instead, any prosecution would have to take place in the vessel’s flag state: the Cook Islands.
The Finnish government now faces a €195,000 legal bill.
It is exactly such legal, jurisdictional and political grey areas that Russia is seeking to exploit in its sabotage campaign, and to widen.
The danger, says von Notz, is that European governments become paralysed by their own rules.
Instead, they need to become far more aggressive in tackling the problem head on. And calling it out.
“When it miaows like a cat and looks like a cat, then it probably is a cat.”
One key to understanding Russia’s current objectives in Europe can be found in recent history.
Thanks to intelligence troves such as the vast set of notes on KGB files brought to Britain by Vasily Mitrokhin in 1992, and the archive of the Czechoslovak secret police StB, preserved largely intact in Prague, a remarkable amount is known about Soviet-era sabotage tradecraft and doctrine.
And there are a “number of striking continuities between what Soviet bloc intelligence services were planning for during the cold war and what we appear to see happening now,” says Daniela Richterova, co-director of the King’s Centre for the Study of Intelligence in London.
Take, for example, the operational “families” of targets stipulated by the StB in the 1970s.
“It’s almost like a shopping list,” Richterova says.
Seven groups of targets are identified, ranging from military bases to reservoirs and communications systems.
“We have seen almost all of these same operational targets attacked or attempted in the last two years,” says Richterova.
Further, the files suggest how and why activity is escalated.
“The archival documents explicitly say there is a doctrinal separation for each stage of tension,” Richterova says.
“During peace time, Russian intelligence aims to carry out smaller-scale and more subtle attacks which are supposed to look like accidents.
Random fires and vandalism and so on.
During an actual war they would meanwhile activate a range of agents saboteurs to carry out all kinds of destructive actions.”
Where Europe finds itself now aligns with a middle “prewar” phase stipulated in the StB files, Richterova says.
The same range of low-level deniable and disruptive attacks take place, albeit at greater scale, but these come augmented with a range of attacks designed both to show mettle, and also to cause panic about Russian ability and willingness to cause harm.
That includes a greatly expanded tolerance for civilian casualties.
But a third objective exists alongside these: attacks and operations as reconnaissance.
Russian military intelligence doctrine leans heavily on the idea of razvedka boyem — reconnaissance through battle — in which information is found out about an enemy’s weaknesses by constantly probing and testing for them.
And when you find a weakness, you continue to push.
“Reinforce success” is an idea drummed into students at Russian military intelligence academies.
This helps explain the spate of drone incursions over European soil, which began in September when over a dozen flew into Poland, closing several airports.
Sightings have since been reported in Belgium, Denmark, Germany and others near military bases or airports.
An aggressive tactic revealed — perhaps surprisingly even to Russia — a major vulnerability that can be exploited continent wide with little cost.
Even better for Russia, the incursions seem to have spawned a series of copycat events by drone hobbyists and troublemakers, and even some false sightings.
All are adding to the confusion and cost for European responders.
Discussions around what effective deterrence might look like are in their early stages. European states have just begun to hold regular meetings between senior national security officials to specifically tackle the issue.
“Containment is not enough,” declared Italy’s minister of defence, Guido Crosetto, in the preface to a white paper on the subject last month.
What being proactive looks like, however, is still a sensitive topic. Many responses are on the table, from further sanctions to retaliatory cyber attacks.
Fundamentally, however, many in European Nato still fear any course that they perceive as inflammatory, particularly at a time when Washington is going all out to try and de-escalate — even if that means selling out its allies.
“Europe has tied itself in knots in terms of what it can do to respond,” says Giles.
“The assumption still holds that you will never have escalation dominance with Russia . . . but it’s complete nonsense.
It’s nonsense that Putin never de-escalates.”
Additional reporting by Raphael Minder and Laura Pitel
0 comments:
Publicar un comentario