Time for retaliation: How to respond to Russian sabotage and subversion?

Sabotage’s greatest advantage is asymmetry. A state defending its own infrastructure must protect thousands of potential targets: ports, airports, power stations, railways, warehouses, factories, logistics hubs, energy and telecommunications networks, and undersea cables. The attacker, by contrast, needs to find only one weak point. That imbalance is further amplified by Russia’s model of using intermediaries, locally recruited operatives and individuals hired for one-off tasks.

In his analysis, Russia’s Shadow War Against the West, Seth G. Jones of the Center for Strategic and International Studies (CSIS) describes an expanding Russian campaign of sabotage and subversion against the West and argues that protecting infrastructure alone will not be enough to stop it.

Arresting the person who set fire to a warehouse, photographed a military shipment or prepared one component of an operation matters. But it does not necessarily deter the intelligence service that used that person. If the operative is easily replaced and knows only an intermediary, losing him may simply be treated as an operational expense. Genuine deterrence begins only when the consequences reach higher: the organisers, financing mechanisms, communications infrastructure, front companies, assets and networks of intermediaries that make future operations possible.

Resilience is not enough if the adversary pays no price

This is the distinction between deterrence by denial and deterrence by punishment. In the first case, the adversary calculates whether it can overcome the defences. In the second, it must answer a harder question: what will it lose even if the operation succeeds?

CSIS therefore advocates a calibrated offensive campaign. Jones lists several possible instruments, including stronger sanctions pressure, information operations, offensive cyber operations and tougher action against Russian assets used to circumvent Western pressure, including the so-called shadow fleet. More important still is his diagnosis of “self-deterrence”. Fear of escalation may lead the West to rule out some of the instruments available to it before Moscow has been forced to pay a meaningful price.

The paradox is that a policy intended to reduce the risk of escalation may simultaneously expand the space available for operations below the threshold of war. If Russian planners assume that another arson attack, operation against transport infrastructure or other disruptive incident will result primarily in an investigation, the arrest of a local operative and another package of protective measures, the risk may remain acceptable to them. Caution intended to prevent escalation can then become part of the adversary’s calculations.

Henrik Praks of the International Centre for Defence and Security (ICDS) frames the problem similarly in his analysis, “Russian Hybrid Attacks in Europe: From Deterrence by Attribution to Response”. He argues that hybrid operations are attractive to authoritarian states in part because democracies find it difficult to respond rapidly, directly and proportionately. Such operations are designed to complicate detection and attribution while increasing the political cost of a forceful response. Praks calls for stronger attribution capabilities, counter-intelligence, sanctions, information-sharing and cooperation among states willing to act together. His conclusion is clear: Russia must see that its hybrid activities will carry consequences. 

Importantly, the debate has moved beyond think tanks. Admiral Giuseppe Cavo Dragone, chairman of NATO’s Military Committee, told the Financial Times that the alliance could consider moving away from a purely reactive posture towards a more aggressive or proactive approach, particularly in cyberspace. The discussion also raised the question of whether, under certain circumstances, pre-emptive action could be considered a form of defence. Dragone also pointed to legal, jurisdictional and ethical constraints. This is not an adopted NATO doctrine, but the fact that such questions are being discussed at all shows how the boundaries of the debate are shifting.

A state governed by the rule of law cannot simply copy Russia

The authors of a European Council on Foreign Relations (ECFR) policy brief (Willa Brown, Jana Kobzova, Nicu Popescu and José Ignacio Torreblanca) go considerably further. They argue that Europe’s response to date has been primarily defensive and reactive, while European states should develop the capacity to act offensively in the information, cyber, financial and kinetic domains. This is not the official position of the ECFR or of the European Union, but rather a proposal advanced by the authors.

Its significance lies in a different understanding of retaliation. An arson attack does not have to be answered with another arson attack. Damage to infrastructure does not have to be met by destroying the same type of infrastructure. The response can come in an entirely different domain: dismantling financing systems, exposing intelligence infrastructure, identifying intelligence officers, freezing assets, disrupting logistical support networks or conducting information operations against assets important to those organising the operation. At times, one of the most damaging measures may simply be to strip the adversary of secrecy. Publicly exposing intelligence officers, front companies, assets, intermediaries, financial channels or recruitment mechanisms can destroy investments that took years to build.

Retaliation should therefore be predictable as a principle, but unpredictable in method. Russia should know that its actions will have consequences. It should not, however, be able to calculate in advance exactly where and how the cost will be imposed.

Strike where the loss actually matters

Assessing the effectiveness of potential retaliation requires looking not only at the scale of physical destruction but also at societies’ ability to become accustomed to repeated threats. Habituation is not unique to Russia. Research conducted after successive terrorist attacks in France in 2015 and 2016 suggested that their negative impact on mental health gradually diminished. A similar mechanism was observed after the July 2005 London bombings. Initially, a significant proportion of residents reported severe stress and reduced their use of public transport. Within several months, however, daily behaviour had largely returned to normal, despite a persistent belief that another attack remained likely. This does not mean complete social desensitisation. A major, deadly incident that dominates the media can still affect perceptions of security and political attitudes for many weeks. Habituation primarily concerns the routinisation of the threat, not the disappearance of society’s capacity to react to events that exceed the established threshold of shock.

Russia, however, operates in a far more intense threat environment. Since February 2022, it has been waging a full-scale war against Ukraine, while reports of drone attacks, explosions, fires and damaged infrastructure have become part of wartime life. Field research by the Public Sociology Laboratory, reported among others by Meduza.io, found that in Russia’s Kursk region, ignoring air-raid alerts had begun to become a local social norm after only a few weeks of regular warnings. Residents continued with their daily activities, did not always seek shelter and increasingly ceased to treat alerts as events that automatically interrupted normal life. That does not mean fear disappeared. A nationwide survey by the Levada Centre found that, as drone attacks intensified, concern about explosions and attacks near respondents’ homes rose to 27%, eight percentage points higher than in November 2025. Russians have therefore not become indifferent to the threat, but some wartime incidents have been absorbed into everyday reality.

This has direct implications for deterrence strategy. European societies, living outside a direct war zone, are likely to treat a serious fire at a strategic facility, an explosion on a railway, a severed cable or the closure of a major airport as an exceptional event that quickly becomes a political and media issue. In Russia, an incident of identical physical scale may not produce a comparable psychological effect because it competes with a daily flow of reports about wartime activity. Symmetry in physical damage does not therefore necessarily produce symmetry of effect.

For this reason, mechanically copying Russian sabotage may be not only legally problematic but strategically ineffective. Retaliation should not be measured by the noise of the explosion or the number of square metres destroyed by fire. Far more important is the value of the asset the adversary loses, and the time and cost required to replace it. Exposing a network that an intelligence service spent years building may be more valuable than destroying a randomly selected facility. The same applies to blocking a critical financial channel, identifying a valuable intelligence officer, depriving the adversary of logistical infrastructure or dismantling a mechanism used to recruit and finance future operatives.

Effective retaliation against Russia does not have to be spectacular. It has to be strategically costly. It should target assets that are difficult to replace and raise the cost of subsequent operations enough to change the calculations of those organising them. In an environment of growing habituation, what matters is not merely the scale of the incident but its ability to exceed the threshold of what society and the state apparatus have already come to regard as an ordinary cost of an ongoing conflict.

The scale of Russia’s intelligence apparatus potentially capable of supporting sabotage operations is illustrated by an assessment cited by the authors of the ECFR policy brief. According to them, Martin Jäger, head of Germany’s BND foreign intelligence service, said during the Munich Security Conference in February 2026 that Russia had around 60,000 intelligence officers worldwide, excluding informants. The figure should not be treated as an independently verified statistic, but as an assessment by the head of German intelligence cited by the ECFR. Its importance lies primarily in illustrating the scale of the problem: behind a single arsonist or saboteur may stand an extensive apparatus of intelligence services, intermediaries and replacement operatives. Arresting the person who carries out a specific task therefore does not necessarily amount to effective deterrence. To change the adversary’s calculations, the consequences must also reach the structures that organise and support such operations.

The state does not have to do everything itself

Every operation requires money, accounts, intermediaries, cryptocurrencies, documents, transport and logistical support. Targeting these elements may not produce dramatic images, but it raises the cost of operating the system as a whole. The more intermediaries that must be used, and the more complicated the methods required to transfer funds, the greater the risk of exposure and disruption to subsequent operations.

Nor does the state need to possess every capability required for such a response within its own institutions. Banks hold data on financial flows. Private satellite operators provide intelligence and imagery. Technology companies possess knowledge of parts of the digital infrastructure, while specialist analytical firms can reconstruct ownership structures and networks of commercial relationships. That does not mean private entities should themselves conduct retaliatory operations. They can provide the state with capabilities, information, analysis and technology while leaving decisions on the use of coercive measures to public authorities.

Outsourcing can expand state capabilities, but it cannot be used to distance the state from responsibility. A cautionary Western example remains the Blackwater case, when the Washington Post reported in 2009 that the CIA had assigned the company some tasks connected with a covert programme targeting al-Qaeda’s leadership. According to former officials, the use of a contractor was intended to give the agency additional distance should the effort fail, although the planned lethal missions under the programme were never carried out.

The case primarily illustrates how quickly the use of a private contractor raises questions of oversight, legality and political accountability. A private entity can provide information, technology, intelligence and specialised expertise. But the closer an operation comes to the use of coercive force, the stronger government oversight must become. The decision to act, the selection of targets, the assessment of legality and responsibility for the consequences must remain with the state.

Self-deterrence may be the greatest danger

The limits of any response must remain clear. Not every fire is sabotage, not every breakdown is an act of subversion and not every incident can be credibly attributed to a foreign state. The more serious the response, the stronger the evidence linking the operation to its sponsor must be. Russia’s system of intermediaries is attractive precisely because it makes such an evidentiary chain difficult to establish.

The objective is therefore not to abandon the law in the name of effectiveness, but to create mechanisms that make faster action possible within the law. Praks points, among other measures, to stronger attribution, intelligence-sharing, counter-intelligence, sanctions, expulsions and cooperation among groups of states prepared to respond more decisively.

The risk of escalation is real. A retaliatory operation may prompt a response that leads to another countermeasure. A conflict being conducted below the threshold of war could gradually move towards a more dangerous boundary — one for which the West may not be psychologically prepared. But there is also an opposite risk: an absence of consequences is itself a strategic message. If successive operations impose little cost on their organisers, Russia may conclude that the threshold of Western tolerance is high. Caution may then cease to serve escalation control and instead encourage further testing of the limits.

Ultimately, the entire strategy comes down to changing the adversary’s calculations. If an operation is cheap, the operative easily replaceable and the most serious consequence of failure is that person’s arrest, the system does not deter the real sponsor. Retaliation should therefore be one avenue for countering sabotage and subversion. Not as revenge, not as a mirror image of Russian methods, and not as permission to wage an uncontrolled covert war. It should form part of a deterrence strategy based on real consequences — one in which Russia knows that every further operation will trigger costs felt by those who organise it as well. It is therefore not enough simply to protect the next warehouse from the next arsonist. The objective must be to create a situation in which, before sending another operative, the potential sponsor has to answer a far more important question: Is this act of sabotage worth the price we will have to pay?