This is not the end of Russian sabotage [Opinion]

Further reports of foiled or halted sabotage and diversion operations on NATO’s eastern flank, including in Poland, prompt a reminder of several critical conclusions about our security. First and foremost, Russia and its decision-makers have accepted, and now accept to an even greater degree than in the past, the risks associated with conducting covert operations against NATO states. We are therefore dealing with a high risk not only of arson or other attacks on infrastructure and transport using explosives (ranging from professional devices to improvised explosive devices, IEDs), but with actions that can take two principal forms.

The end of "Security" as Russia's overarching goal

First, such actions significantly lower the sense of security within a state: struck targets may be incidental, but they create a „critical mass” in propaganda narratives and in public perception. These operations are amplified by propaganda and social-media activity, including efforts to steer narratives toward a more conciliatory course vis-à-vis Russia. Second, there are attempts to strike at infrastructure responsible for supporting Ukraine. These are operational, even tactical, targets: lines of communication across the full spectrum of transport modes (road, rail, maritime and air), transhipment and storage infrastructure, and logistics more broadly. Add to that any infrastructure used to train and support Ukrainian military training. In this respect we are not only talking about strictly military facilities (training grounds, etc.) but also critical civilian infrastructure such as water supplies, power grids and information-communications networks. 

The number of facilities, the quantity of potential targets and the feasibility of striking them require us to recognise that the situation is serious for national counterintelligence protection as well as for regional and European cooperation in this area. The recent high-profile case involving the arrest of a network of Russian human assets dedicated to sabotage included our strategic ally on NATO’s eastern flank, Romania. Earlier widely discussed cases concerned events in the Baltic states and in Poland. The brutal reality suggests that Russia could, at some point, secure a temporary or localized advantage and execute an effective operation, analogous to how terrorist organizations can surprise even the most capable counter-terrorism systems.  n particular, bombings, arson and other destructive acts can be low-cost operations modelled on the modus operandi of Islamist organisations. The Russians are seeking to limit exposure of their intelligence services that would come from classic recruitment using on-the-ground operational officers in NATO states and are shifting to mass recruitment via the cyber domain (social media, end-to-end encrypted messengers). This yields many successes, often defined by a material factor, transfers of funds, to varying degrees of obfuscation, including via more covertly camouflaged cryptocurrency transactions or deliberately plausibly deniable international transfers.

Recruitment can also be assisted by AI-supported solutions that facilitate online targeting, especially with respect to susceptibility to financial incentives. The Russians can also more easily comb pro-Russian milieus to exploit ideological factors. Economically, however, it is often more efficient to keep such milieus in the role of influence agent networks rather than directly linking them to diversion and sabotage on a mass scale, which would lead Western counterintelligence to focus on them. Moreover, individuals who are ideologically involved, openly or less so, may already be known to domestic counterintelligence, increasing the risk for operations dedicated to diversion and sabotage. Russia may also freely use its wartime „recruitment” techniques in the West, visible particularly in Ukrainian (notably SBU) information about tracking Russian diversion and sabotage since the start of the full-scale war in 2022, targeting primarily Ukrainian citizens susceptible to espionage, diversion or sabotage in states other than Ukraine itself.

A time of easier recruitment and beyond

It is also worth noting that Russian services may cooperate with Belarusian counterparts (pooling resources, sharing information and experience) across a number of dimensions, such as targeting, recruitment processes, tasking and maintaining contact/communications. The difficulty of countering such recruitment is growing. Consider Israel, where Shin Bet’s counterintelligence protection was relatively effective, yet cases still emerged of Israelis recruited by Iran/Hezbollah to act within their own country (for example, photographing sensitive sites).  Low-cost actions do not necessarily require delivering traditionally military materiel, such as explosives or detonators. Today it is sufficient to distribute brochures online (e.g., PDFs similar to Islamist sources such as „Dabiq” or „Inspire”), or videos (specially produced or merely redistributed) showing how to construct an improvised explosive device.

Unfortunately, one must also consider assassinations and attempts at physical intimidation: beatings, threats against an individual or their relatives. All of this falls within the acceptance of increased risk noted above, even in cases where a plot is uncovered and thwarted at any stage. Let us note that the Russian side has already physically eliminated perceived enemies of the Kremlin (most often among Russian opposition figures or people with knowledge of the financial spheres of Russia’s elite) and has sought to intimidate those involved in assisting Ukraine (from the Emiliano Gebrev case to the incident involving Armin Papperger, Rheinmetall’s CEO). That risk may now be even greater, particularly as Russia clearly observes quantitative and qualitative changes in Europe’s defence sector. Attempts to paralyse that sector can of course employ soft tools, especially in the information domain, but kinetic sabotage and diversionary strikes and intimidation of personal targets (high-value targets, HVTs) are equally plausible. Especially as Russia, itself effectively struck by Ukraine, may be preparing to deliver similar blows to Western states. Russia, regardless of its military engagement in Ukraine, continues to officially point to „threats from the West.”

Diversion and sabotage in wartime

Therefore, in addition to the diversion and sabotage described above, we must realistically consider the introduction of professional Russian human assets: intelligence officers, special-operations operators and mercenaries/contractors with military-intelligence experience. Moreover, this links to the highly probable use of unmanned platforms. We noted previously in the piece „Spy, Saboteur, Agent… Drone” (Defence24, 21st June 2025) that any covert operation originating from Ukraine or the Middle East that is innovative, tactically or technologically, will pose a challenge for us. Thus, we must consider not only incursions by Russian drones from outside, but also attempts to replicate the modus operandi of the operation codenamed „Spidersweb” against the armed forces and their resources, as well as strikes against energy systems and key economic sectors. We must therefore say plainly that today internal security services and the military alike must prepare to neutralise threats such as attempts to eliminate important state figures (for example, attempts on the life of the President of Ukraine in the early days of the full-scale war in 2022); coordinated and mass attacks on military facilities and critical infrastructure; and actions by well-trained diversionary-sabotage groups equipped with professional weapons and equipment, even deep inside states far from the borders with Russia and Belarus.

One cannot, particularly in the current international environment, exclude the use of CBRN factors or attempts to cause panic by creating the impression that such agents have been used. Recall the paralysis of an entire town (approximately 40,000 people) in Salisbury, UK, following the use of Novichok (the intended target was Sergei Skripal, but the entire local population was affected). We are already discussing the security of water intakes in cities such as Warsaw or Cracow. It is therefore not excessive to insist that while preparing our armed forces to deal with potential CBRN threats on the battlefield, we must simultaneously strengthen capabilities to protect civilian urban spaces, particularly those that have critical positioning in terms of supporting military assistance to Ukraine, their role in Poland’s defence system, and their importance for allied cooperation within NATO.  

A tank as important as a Counterintelligence Officer

Today it is clear how important counterintelligence capabilities are for Poland, supported by appropriate lessons learned in terrorist-prevention and high-level capabilities to counter terrorist threats. Russia, as the aggressor on NATO’s eastern flank, has not hidden, and does not hide, its intention to test us on a mass scale, using some of the „product” of non-state structures (terrorist actors) in terms of recruitment models, contractor contacts and low-cost methods. Furthermore, as NATO countries« defensive potential grows and their preparedness to repel conventional forms of aggression increases (both symbolic shows of force and real uses of force), Russian authorities will be more convinced of the need to intensify a campaign of terror in the West. This implies actions aimed at achieving concrete physical objectives in tactical and operational terms (paralysing communications, weakening military and training assistance), while also influencing debates about the nature of relations with Russia (creating a perception of omnipotence of Russian intelligence services and, beyond fear and a sense of threat—arguing for a perceived necessity to reduce tensions with Moscow). We must not ignore the more emotional side of such actionsm ideological motives for covert operations against Western states or simple acts of revenge.

Concluding Notes

To conclude, we must reiterate that the comprehensive system of national security and defence should always be treated as an interconnected system. Modernisation plans for the armed forces cannot proceed without increased resources for counterintelligence and intelligence (both human and technical investments). Moreover, the actions of the services and the military cannot be taken without an understanding of the necessity to invest in awareness and resilience of the non-military system, closely correlated with education and prevention in the areas of terrorism and counterintelligence, which should become a priority. We must also explicitly reject claims about the ineffectiveness of allied actions or calls to prioritise autonomy in the sphere of security and defence. One of the best ways to enhance our capabilities against the varied forms of Russian aggression is joint action with allies such as Romania, Lithuania, Latvia and Estonia. This also concerns countering both new and old methods of below-threshold warfare, especially when covert operations are planned or executed across different NATO/EU states. Finally, it should be emphasised that we are continually speaking about diversion in a multi-domain environment. Accordingly, the level of our military and counterintelligence operations becomes not only trans-border but also multi-domain - covering classic domains (naval, air, land) as well as cyber, space and the information-cognitive domain.