Russian campaign of sabotage and assassination targets private sector

Private companies with a role, however indirect, in the defence sector and the Ukraine conflict should take the threat seriously. The campaign’s targets go way beyond states’ critical infrastructure and have already included private sector sites and personnel.

Western governments made Moscow’s increasingly blatant and reckless clandestine activities a priority topic at the NATO 75th anniversary summit in Washington in early July. They recognised the need for NATO to develop an effective, calibrated response to deter expansion and escalation of this campaign. But corporates (and their insurers) also need to take urgent heed. They are used to carrying an intensifying cyber risk associated with Russian hybrid warfare against the West, but this physical risk is new. It is not one that they can hand off to governments to counter. The more precautions states take to protect vital infrastructure, the more the threat will be deflected onto more vulnerable private sector targets. The more the big defence players beef up their security, the greater the threat to smaller companies.

UK prosecutors have accused a British man of masterminding a Russian-backed arson attack on a Ukrainian-linked warehouse in Leyton in March.

Russian activities to date

Compelling evidence of Russian targeting of European defence industry executives involved in supporting the Ukrainian war came with the public disclosure on 11 July of a Russian assassination plot earlier this year against Rheinmetall CEO Armin Papperger. He was fortunate US agencies were reportedly astride the planning and notified the German security service (BfV). Putin’s spokesman Dmitry Peskov typically dismissed the CNN report as a fake story. Rheinmetall plans shortly to open a Panther tank factory in Ukraine and a facility for manufacturing the 155mm artillery shell in high demand with the Ukrainians.

Autocrats, accustomed to treating political opponents at home with casual brutality, often come to assume they can kill critics and opponents abroad with similar impunity. In the last two decades, many exiled Russians or their associates have died in suspicious circumstances, including at least fourteen in the UK, among them Boris Berezovsky in 2013. Alexander Litvinenko was murdered in London by the Russian intelligence services on Putin’s orders in 2007. Putin critics have even fallen to their deaths in Washington DC. Now western executives are at risk, although the Russians may no longer be concerned to have deaths ascribed to natural causes or suicide.

The Russians have long run a hybrid campaign against western countries, including cyber-attacks, disinformation campaigns, incursions into other states’ waters and airspace, smuggling migrants into Poland from Belarus, and other activities designed to test, undermine, and sap the will of western governments. They have also engaged in political destabilisation and sought to interfere with western elections to change the political landscape to their own advantage. In October 2023, Russian proxies were arrested for a disinformation campaign in Paris. Operation Star of David, presumed to be antisemitic, was used to sow confusion, anxiety and exacerbate domestic tensions.

That the Russians have added physical sabotage operations in Europe to their repertoire became apparent in late March, when an arson attack on a warehouse in Leyton that stored aid for Ukraine led to two British nationals being charged in late April with assisting Russian intelligence service and aggravated arson. Three others were detained.

A succession of incidents on the continent followed:

• GPS navigation systems for civil aviation in Baltics were jammed in late April;
• Two men were arrested in early May accused of plotting to attack military and logistic sites in Germany, including US military facilities;
• Nine were arrested for arson and attempted arson in Poland in late May, accused of planning attacks for the Russians in the Baltics;
• On 3 June, a Russian Ukrainian was detained in Paris after preparing explosives for use against a commercial zone near Charles de Gaulle airport;
• A sabotage plot against US bases in Germany led to them being placed on heightened alert in early July.

The list goes on…

Other unexplained incidents may yet prove to be the work of the Russians, including an explosion on 17 April at a BAE munitions factory in Wales supplying shells for Ukraine, and the fireball that destroyed Warsaw’s largest shopping mall, Marywilska 44, in mid-May. The French security authorities will be working overtime to identify those who attacked the TGV network and, later, fibre optic cables that were part of the telecoms system.

Poland’s Marywilska 44 shopping mall was subject to a sabotage attack in mid-May.

GRU in the frame

The campaign appears to have been undertaken by the Service for Special Activities within the GRU (Russian military intelligence), whose operations are reported as drawing on support from other agencies, coordinated through country-specific ‘Committees of Special Influence’ in Moscow. Previously, the GRU acted through its own officers, two of whom botched the notorious attempt to assassinate the Skripals in Salisbury in March 2018. Today, the Russian intelligence presence in missions across Europe has been heavily depleted by official expulsions since 2018. As a result, they have engaged proxies for their latest operations, including members of the Russian-speaking diaspora, organised criminals and mercenary elements. Amateur proxies offer greater deniability, but also enhanced risk of collateral damage.

Retaliation for Ukrainian use of western weapons against Russian territory

The Russian goal with the campaign is to intimidate, reduce support for Ukraine, create disunity among Ukraine’s western supporters, and disrupt western supplies to Kyiv. But, in terms of timing and intensity, it is probably linked to the increased willingness of western governments to allow western-supplied weaponry to be used against Russian sovereign territory to offset the asymmetric advantage Moscow previously enjoyed. The Ukrainians need this longer-range capability to relieve attritional pressure on their over-stretched front lines, where they are at risk of being overwhelmed. The more western weapons systems are used by the Ukrainians against Russians military formations, supplies and facilities across the Russian frontier, the more brazen the Russian sabotage and assassination activities in Europe are likely to become by way of retaliation.

A Ukrainian soldier with a Starlink terminal near the frontline in the Luhansk region.

Western private sector involvement in the Ukraine conflict

The western private sector’s role in the Ukraine war has been higher profile than in previous limited conflicts on the continent. This in part reflects the crucial role the provision of western technology has played in defending Ukraine. Musk’s SpaceX Starlink, supplied free, has given the Ukrainians satellite capability critical for their drone warfare. In the cyber domain, the whole battlefield is run by western companies, which have sided with Ukraine and become directly engaged. The potential sensitivity of Starlink’s role is illustrated by Musk’s refusal in 2022 to turn it on near the Crimean coast, despite Ukrainian entreaties. He feared a Ukrainian attack on the Black Sea fleet at anchor would create a ‘Pearl Harbour’ moment and lead the Russians to resort to nuclear weaponry.

Another reason for the perceived prominence of western defence companies in the conflict is that the war has become one of attrition and Ukraine’s shortage of industrial capacity, as well as manpower, is telling on its ability to resist Russian military pressure. This is why it desperately needs western defence companies to establish local manufacturing facilities and produce the volumes of basic weaponry and ammunition that it lacks. Talk in Washington of a ‘bridge to NATO’ seems like a distant prospect to Ukraine in 2024. Without alliance membership, it is crucial for Ukraine that it becomes ever more self-reliant through development of a robust defence industrial complex. The GRU objective is to deter large western defence companies from making these investments, but also to discourage smaller companies from supplying drone or other technology and components sought by the Ukrainians. Those companies too will need to review their security status.

Danger of the West overreacting to incidents

The West must proceed with caution in assuming that new, unexplained incidents are the work of Russia. There are investigative dots to join up, but any connections to Moscow must be made on clear intelligence or – better – evidence. If Moscow is portrayed publicly as responsible for attacks it did not orchestrate, vital western credibility will be damaged and Moscow’s propaganda machine will be boosted.

This campaign on the western private sector is designed to intimidate. Putin wants the West to feel under threat as a consequence of its continued support for Ukraine, with the ultimate goal of pushing the West to encourage the Ukrainians to make a deal before the situation get worse for both parties.

The West’s response must focus on deterrence, and on convincing Putin that these attacks are counterproductive and not worth the effort or resources. Russia’s enforced dependence on proxies can be to the western advantage, giving strategic opportunity for a horizontal response while avoiding direct retaliation. For example, increased support and finance for Russian defectors would hurt the Kremlin, as would counter-attacking hackers.

Putin personally welcomed FSB assassin Vadim Krasikov back to Russia after the prisoner exchange.

Conclusion

We cannot say how much further the Russian campaign of sabotage and assassination will go. In Europe the operations are likely to grow in number and impact, whereas in the US Russia seems to be acting with more caution. The Putin regime will be relying more and more on the security services and proxies, and keeping them on his side is key. The prisoner exchange on 1 August is significant, for it highlights the contract Putin has struck with his operatives: you will not be left in western jails, we will look after you and loyalty will be rewarded. This exchange was an opportunity for Putin to demonstrate his determination to get FSB assassin Vadim Krasikov back and give him a hero’s welcome, with the President personally meeting him off the plane.

At present, the campaign of sabotage and assassination appears in its early stages. If western-supplied artillery or drones start to cause serious damage in Russian sovereign territory, it could escalate quickly with greater loss of life across Europe than we have seen so far, and with more serious international repercussions.