Russian hostile activity costs the UK at least £2 billion annually, according to a recent report by Scottish MP Graeme Downie. But this figure is just the baseline. In reality, a profound shift in Moscow’s approach to sabotage means the true cost is set to climb higher.
[The author of this piece is Elena Grossfeld, a researcher at the King's Centre for the Study of Intelligence, King's College London, and the Swedish Defence University.]
...
Within months [after Russia’s full-scale invasion of Ukraine in 2022], over 400 Russian intelligence officers operating under diplomatic cover were expelled across Europe. This number has since climbed to more than 700.
The mass purge was expected to cripple Russia’s spy networks. But it instead accelerated Moscow’s pivot towards what research I carried out with colleagues in 2024 defined as “gig-economy” operatives.
In place of declared “diplomats” well known to local counterintelligence officers, operations have been outsourced to disposable proxies recruited for a pittance. These people are often unaware of who their handlers are or their mission’s real goals.
...
While many of these plots have been amateurish, the intent behind them and their potential damage is real. Blurring the lines between theatrics and physical damage, the campaigns have included mock coffins placed beneath the Eiffel Tower and graffiti designed to stoke antisemitic tensions across Paris.
Arson targets have ranged from a warehouse in London storing aid for Ukraine to an Ikea store in Lithuania and a paint factory in Poland. Western intelligence also narrowly averted catastrophe in 2025 when incendiary devices planted on DHL cargo planes caught fire in freight depots on the ground rather than mid-flight.
Beyond commercial property, Moscow’s campaign has targeted critical infrastructure. At sea, the playbook has escalated from plausible deniability to overt military posturing. Since 2023, Russian-linked commercial vessels flagged from China to the Cook Islands have repeatedly severed power and data cables by dragging their anchors across the seabed.
...
A parallel escalation has unfolded in the air. Operations began with electronic interference and drone surveillance disrupting commercial aviation, as well as probing European military bases and transport hubs to test air defences and map blind spots and vulnerabilities.
They have since graduated to overt airspace violations by Russian military aircraft and missiles, while armed drones have repeatedly crashed or detonated in Polish, Latvian and Moldovan territory.
...
This pattern crossed from deniable sabotage into a direct physical attack in August 2026 when an explosives-laden drone crashed into the wing of a parked Ukrainian cargo plane at Leipzig/Halle Airport in Germany. The device failed to detonate, averting a major explosion on an aircraft that had previously transported military ammunition.
...
The same logic underpins the Kremlin’s cyber campaigns, where merely threatening critical infrastructure is often enough to achieve intimidation. Cyberattacks on a Norwegian dam and a Swedish heating plant, both in 2025, caused negligible physical damage. But they generated alarming headlines and have had psychological effects.
...
Across domains, Russia has turned unpredictability and disruption into its strategic weapon of choice. Using expendable, poorly trained proxies directed remotely by state handlers consistently achieves psychological disruption while narrowly averting casualties through operational failure.
However, relying on Russian incompetence to protect European lives cannot hold. As the old maxim goes: hope is not a strategy.
...
Archived
