Russia’s sabotage campaign against the West

When a DHL cargo plane crashed while approaching Vilnius airport on Monday, killing one of the crew, it looked like technical failure, but given that Russia was believed to be behind a series of incendiary devices which ignited on DHL flights and in warehouses this summer, inevitably many feared Moscow’s hand. The suspicion is likely to be the point. In the past year, the Russians have stepped up their disruptive activities in Europe, from cyber-attacks to assassinations, with the apparent aim of generating chaos and a climate of fear as much as anything else.

Russia has outsourced its activity to a motley array of ‘patriotic hackers’ and outright cyber-criminals

In February, a Russian defector was gunned down in Spain, in what seems to have been a hit commissioned by Moscow but carried out by gangsters. In March, petty criminals hired by the GU, Russia’s military intelligence, torched Ukrainian-owned warehouses in Leyton, east London. Moscow was also blamed for a subsequent series of arson attacks across Europe on everything from Polish shopping malls to a German factory. In July, US and German authorities announced that they had foiled a Russian plot to assassinate Armin Papperger, CEO of the Rheinmetall armaments conglomerate, an outspoken supporter of Ukraine. Although the circumstances are still unclear, two telecommunications cables across the Baltic have just been severed in what could easily be sabotage.

Meanwhile, as the cabinet minister Pat McFadden warned the Nato Cyber Defence Conference in London this week, Russia has expanded its campaign of cyber-attacks. Some are essentially intelligence-gathering operations, but an increasing proportion seek to disrupt, such as the attacks on the Czech railways this year or the regular spates of fake bomb scares generating the kind of hypervigilance behind recent controlled explosions in Glasgow, Euston station and near the US embassy, and a major security alert at Gatwick airport.

How do the Russians manage to maintain such a tempo of attacks? In part, by outsourcing to a motley array of ‘patriotic hackers’ and outright cyber-criminals. This is not just confined to the online realm: as the MI5 director-general Ken McCallum warned last month, this year has seen ‘Russian state actors turning to proxies for their dirty work, including private intelligence operatives and criminals from both the UK and third countries’.

This is especially evident in the online world, with Russian ransomware gangs and other criminal hackers essentially being given a free pass so long as they are targeting the West. Yet it is also clear that criminals are being used more broadly, in everything from carrying out surveillance on behalf of Moscow’s intelligence agencies to covering walls across Europe with divisive and anti-Semitic graffiti, from planting firebombs to smuggling in sanctioned microchips.

It should not be a surprise that the Russians are turning to criminals and private investigators. After Russia’s full-scale invasion of Ukraine, some 750 Russian diplomats were expelled across the West. Since most spies work under diplomatic cover, this delivered a serious blow to Russia’s espionage networks. Yet we could hardly imagine that this would stop the Kremlin from trying to find new ways to operate. Many proxies are hired anonymously online, so that they may not even know they are doing Vladimir Putin’s dirty work. Some have been carrying out surveillance under the belief that their clients are convinced their spouses are cheating on them or their employees are stealing.

The real question is why Moscow has stepped up its campaign this year, and what it could possibly hope to achieve. Does it honestly believe that burning down a shopping centre or daubing some graffiti will really make any kind of meaningful difference?

The answer lies in Putin’s perception of the situation. He appears genuinely to believe that an implacably ‘Russophobic’ West is committed to confining or dismembering Russia, and that Ukraine is essentially little more than a weapon aimed at the Mother-land. Kyiv’s intelligence services have been conducting a series of attacks on Russian military targets, officers and outspoken cheerleaders for the war; this month, for example, a naval officer was killed when a bomb exploded under his car in Crimea. To Putin – a man who believes Ukraine is an artificial construct created by Lenin after the 1917 Bolshevik revolution out of ‘what is historically Russian land’ – these attacks could only be happening at our behest, or at least with our approval.

The question is why Moscow has stepped up its campaign, and what it hopes to achieve

A hawkish Russian thinktanker close to the presidential administration spelled it out to me: ‘You think you can get Ukrainian terrorists to do your dirty work and that we’ll politely pretend you’re not behind it? It’s time you got to know what it feels like to be at war.’ Besides, he added: ‘What else are sanctions but economic and political warfare? You try to crash our economy and then whine if you get hacked?’

It seems that at some point in the middle of last year, a decision was made by the Kremlin to allow its intelligence agencies to go ‘a bit feral’, in the words of the MI6 director Sir Richard Moore. In part, this is simply revenge against Ukraine’s allies; but it is also something more strategic, what one could call the weaponisation of inconvenience. There is a sense in Moscow that the West has become too comfortable with the war, that we regularly write off a certain amount of money and part of our military arsenal to keep the Ukrainians fighting, without really feeling the costs. One could argue against this conclusion – ‘Ukraine fatigue’ is a growing challenge, likely to be magnified if Donald Trump unloads a greater share of the war’s costs on to Europe – but it seems to be a belief held in hawkish circles around Putin.

The campaign of cyber and proxy attacks is intended not only to further Moscow’s usual goals of spreading division and demoralisation, but also to convey to Europeans a sense that their countries’ continued support for Ukraine is affecting their lives negatively.

A massive cyber-attack of the sort that McFadden described, bringing down the national power grid, is unlikely because it falls squarely within the terms of Nato’s Article 5 guarantee of mutual assistance. It also invites retaliation in kind, and it would be naive to presume that the West is not also seeking back doors into Russia’s critical national infrastructure.

But what about a criminal ransomware attack on an NHS pathology provider that forces more than 10,000 acute outpatient appointments to be postponed, as happened in June? Explosive packages on DHL flights that create delays for all deliveries? Cyber-attacks on railway signalling and ticketing systems that could impose commuting misery on hundreds of thousands of people and large business losses? None of these comes anywhere near the threshold for direct retaliation, but they certainly make an impact, especially if we become so frightened of Putin’s shadow that we ascribe every upset and accident to his machinations.

This strategy helps to explain why Americans have so far avoided the worst of the attacks. In the run-up to the presidential elections, Moscow had no desire for the limelight, and now it doesn’t want to risk forcing Trump to take a firmer line. Europe has no such immunity. So how should it respond? This month, my report ‘Gangsters at War: Russia’s use of organised crime as an instrument of statecraft’ was published by the Global Initiative against Transnational Organised Crime, and I embarked on the usual round of briefings. After one, at Nato headquarters, I was approached by two national representatives: one from a southern European country, the other from one of the Baltic states. The former was worried: ‘What can we do against such a campaign? We can hardly fight back in kind.’ His more seasoned Baltic counterpart’s reply was blunt: ‘We know the Russians. They will keep up the pressure so long as they think it’s working. You just have to refuse to let it work, to double down, not give up.’ Keep calm and carry on, in other words.

WRITTEN BY Mark Galeotti