A blazing fire this summer at a large shopping mall on the outskirts of Warsaw would normally spark little comment outside of Poland.
But then the country’s prime minister Donald Tusk suggested it could have been work of a foreign saboteur.
As fumes of thick black smoke bellowed into the sky, intelligence sources began linking it to other fires across Europe. First, a blaze at an Ikea in Vilnius in Lithuania; then another on a container due to be loaded on to a DHL cargo plane in Leipzig, Germany.
The investigation even led to the UK: a fire at a DHL warehouse in Minworth near Birmingham.
Polish special forces arrested four individuals connected to the arson attack close to Warsaw who they believed were linked to the Kremlin.
Investigators now believe some of the fires were caused by electric massage devices that had been tampered with to contain a flammable magnesium substance, before being detonated remotely.
Those fires, Polish authorities claimed, were a dress rehearsal for a devastating plot to bring down transatlantic airplanes and the latest in a new string of sabotage attacks directed by Vladimir Putin.
The incidents confirmed one thing once and for all: Russia’s hybrid warfare is no longer a risk, it has arrived and its here to stay, whatever events unfold on the battlefields of Ukraine.
Over the past 12 months, agents working for the Russian state have been accused of cutting vital communication lines, spreading disinformation through sophisticated campaigns, and launching devastating hacks to critical infrastructure. The impact has caused mass unrest, disrupted supply chains and sparked international outcry.
Last month, the director of MI5, Ken McCallum, stood in front of a room of journalists and announced that Russia is on a “sustained mission” to create “mayhem” across Britain and Europe.
The spy chief said Russian intelligence agents had carried out “arson, sabotage and more. Dangerous actions conducted with increasing recklessness” in Britain after the UK backed Ukraine in its war with Russia.
From under our seas to inside our hospitals
The front line of the war is no longer confined to the Ukrainian battlefield. It can also be found in Europe’s factories, under its seas, in its hospitals, government offices, police stations – and even in the information sent through our devices.
In response to the West’s support for Ukraine, Putin has shown he can attack his enemies in their home without launching a single ballistic device in their direction.
Last weekend, it emerged that a Russian spy ship had been escorted out of the Irish Sea after it was found patrolling an area containing critical energy and internet submarine pipelines and cables.
Its presence raised fears about the security of undersea cables carrying internet traffic from Ireland-based datacentres to the UK.
This week, tensions escalated further when two undersea cables in the Baltic Sea were cut in quick succession. The incident prompted swift investigation by European intelligence agencies and forced world leaders to finally address what intelligence officials had been warning for months.
Fingers were quickly pointed again towards Moscow after a cable linking Finland and Germany’s internet services and communications was severed although China is also now under suspicion after one of its ships was known to be in the area.
Helsinki and Berlin’s foreign ministers said in a joint statement on Monday that they were “deeply concerned” by the incident while Germany’s defence minister, Boris Pistorius, said on Tuesday that the damage was presumed to be the result of sabotage.
“No one believes that the cables were accidentally damaged” he said. “I also don’t want to believe that the ships’ anchors caused the damage by accident.”
Putin’s use of proxies
Russia’s use of international proxies to take swipes at vital infrastructure is not a new phenomenon. It has long been touted by European intelligence agencies as a tactic of Putin’s we should expect to see more of.
Earlier this year three UK sources told The i Paper that “hybrid” warfare stemming from Russia will increase over the next six months. The sources warned of “further chaos, further disruption, and further harm” if the UK does not build its resilience to attacks.
The Kremlin has repeatedly denied involvement in alleged so-called hybrid attacks, often referring to claims as “vague conspiracy theories”.
But this summer’s arson attacks were seen as a provocation of tensions between Russia and European powers.
Keir Giles, a senior Russia researcher at think-tank Chatham House, told The i Paper that the fire at a DHL warehouse near Birmingham in July may have revealed how Moscow is readying for any direct conflict with Nato.
A UK intelligence source said the GRU, the Russian military intelligence agency, considered cargo flights from Poland and Germany to be a key resource for Ukrainian military support and “financially motivated” low-level criminals to attack the targets. The source said the Russian intelligence agency had significantly “upped their game” when it came to hybrid tactics.
A second UK intelligence source said the attacks were Russia’s response to Nato’s support of Ukraine.
“Putin is saying ‘we don’t need missiles, we can hurt you in other ways’”, they told The i Paper. “On the back of US elections, ahead of the winter, this is Putin’s last big military push against the West.”
Sabotage attacks are just one of many different methods utilised by the Kremlin to inflict disruption on its enemies in the West. In similar incidences, Russian intelligence have relied on low-level criminals to carry out arson attacks aimed at Ukrainian supply chains.
“We are telling our allies that it’s not random, it’s part of military operations,” Kestutis Budrys, an adviser to Gitanas Nauseda, the Lithuanian president said. “We need to neutralise and stop it at the source, and the source is Russia’s military intelligence.”
In April, a British man was accused of orchestrating an arson attack on two units linked to a Ukrainian businessman in an industrial estate in Leyton, east London, after allegedly being recruited by Russian intelligence.
The Crown Prosecution Service claimed he was “engaged in conduct targeting businesses which were linked to Ukraine in order to benefit the Russian state”.
Stephan Blancke, associate fellow and and expert in foreign espionage at the Royal United Services Institute (Rusi), said Russia is “orientating their intelligence operations more and more towards the times of the Cold War”, enlisting third parties to carry out covert attacks.
He told The i Paper: “A worrying trend can be observed: Individual intelligence services are increasingly engaging external parties.
“This is not typical outsourcing to private companies. Rather, it is criminals and mercenaries, sometimes overlapping with ideologically blinded individuals. These people are recruited and rewarded with money.”
He added: “The problem here is that, on the one hand, this group of people can consist of unpredictable, unscrupulous daredevils who are prepared to do anything. On the other hand, they are recruited via channels that are not subject to the usual monitoring of the intelligence services.”
Cyber attacks
Earlier this year, a catastrophic cyber attack on the National Health Service (NHS) caused thousands of appointments and operations to be cancelled. The i Paper revealed the attack was the work of a Kremlin-protected group of cyber hackers in what has been seen as a “major escalation” of cyber warfare tactics by the Kremlin.
A UK intelligence source said that cyber attacks on the UK are expected to “hit new levels”. Another warned of “further chaos, further disruption, and further harm” if the UK does not work swiftly to become more resilient against cyber warfare.
Months after the warning, the UK ambulance service was then targeted by Russian hackers, risking disruption to their communication systems, with the potential to severely hamper Britain’s emergency services.
Intelligence material seen by The i Paper revealed that over the past year, a Kremlin-linked hacking network has targeted key suppliers to the UK ambulance services and Ministry of Defence.
A third UK intelligence source said that Europe had “let its guard down” to hybrid attacks and allowed a swathe of Russian intelligence agents to cause chaos, attacking international supply chains, communication systems, and critical national infrastructure as part of a successful campaign to fight back against international support for Ukraine.
Sowing disinformation
After three young girls were killed in Southport this summer, a fake news article, shared widely by politicians and influencers, claimed that a Syrian refugee on a UK intelligence watch-list was responsible for the murder. Many believe this was a major contributing factor to the events that unfolded which saw violent riots break out across the country.
It is still unclear who was responsible for the fake articles, but mass hysteria and distrust is a useful tool for the Kremlin. Moscow denied any involvement.
The i Paper has seen a dossier produced by the US Federal Bureau of Investigation that includes memos and minutes from at least 20 Russian presidential administration strategy meetings.
Read Next
News
Birmingham parcel fire just start of wider Russian terror attacks, warns expertRead More
These reveal a Moscow-directed influence campaign to manipulate politicians, journalists, businesspeople and the public in the US, the UK and Europe over the last two years.
Documents disclose Kremlin plans to use fake newspaper domains and lookalike Facebook accounts of media outlets including the Daily Mail and the BBC to spread Russian propaganda. Anybody clicking on those accounts would then be unknowingly directed to Russian-produced fake articles that would support pro-Russian policies and interests.
Last month, the UK Government sanctioned six Russian agencies and individuals accused of being part of a disinformation network which spread false rumours about the Princess of Wales.
The so-called Doppleganger group was labelled as a “vast malign online network” who intended to cause disruption, chaos and confusion by the Foreign Office. This group has been accused of spreading false articles with the intention of amplifying rumours and fake claims about the Princess when she was out of public view with health problems.
Foreign Secretary David Lammy said Putin was “desperate to undermine European support for Ukraine” and was resorting to “clumsy, ineffective efforts to try and stoke unrest”.
While attempts to spread false rumours about Britain’s Royal Family may not endanger Britain’s national security, Putin’s ambitions to escalate his hybrid war on the West could have far more serious consequences.
From a new spate of arson attacks on logistical hubs to the disruption of health services, emboldened by Donald Trump’s victory, the Russian leader’s desire to cause mayhem on the streets of Europe is unlikely to end any time soon.
10 examples of alleged Russia’s ‘hybrid’ attacks on Europe
20 March – Two facilities of a Ukrainian businessman in east London were set on fire. The police arrested five people and have charged two of them – British citizens – with collaborating with Russian intelligence services.
30 March – Arson attack at an industrial building linked to the same Ukrainian national in Madrid.
17 April – German authorities arrest two dual German-Russian citizens for preparing to bomb industrial and military sites in the country. The federal prosecutor’s office said the men had been in contact with Russia’s military intelligence agency (GRU).
20 May – Polish security services arrested nine individuals of Belarusian, Ukrainian and Polish nationality, accusing them of arson and sabotage in the country, including Warsaw’s largest shopping centre and an IKEA warehouse in Vilnius, Lithuania.
3 June – UK’s National Health Service supplier Synnovis was successfully hacked by a Russian ransomware group halting vital services, causing delays and cancellations to thousands of blood tests and operations.
8 June – Czech police arrested a foreign national in connection with a failed arson attack in Prague. The Czech prime minister said the attempt was “very likely” organised and financed by Russia.
19-22 July – Fires broke out in a container due to be loaded on to a DHL cargo plane in the German city of Leipzig, at a transport company near Warsaw, and near Birmingham, UK, involving a package described as an incendiary device.
July – US intelligence alerted German security services to aRussian plot to assassinate Armin Papperger, the CEO of defence company Rheinmetall, which plays a major role in military supplies to Ukraine.
4 September – The Federal Bureau of Investigation filed a 277-page dossier exposing Kremlin plans to use fake newspaper domains and lookalike Facebook accounts of media outlets including the Daily Mail and the BBC to spread Russian propaganda.
28 October – The UK Fovernment sanctioned six Russian agencies and individuals accused of spreading false rumours about the Princess of Wales. The Foreign Office warned of a “vast malign online network” intended to cause disruption and confusion.
