Western officials say Russia is behind a campaign of sabotage across Europe

The incidents range from stuffing car tailpipes with expanding foam in Germany to a plot to plant explosives on cargo planes. They include setting fire to stores and a museum, hacking that targeted politicians and critical infrastructure, and spying by a ring convicted in the U.K.

Richard Moore, the head of Britain’s foreign intelligence service, called it a “staggeringly reckless campaign” in November.

It is often difficult to prove Russia’s involvement, and the Kremlin denied carrying out a sabotage campaign against the West. But more and more governments are publicly attributing attacks to Russia.

The alleged disruption has a double purpose, James Appathurai, the NATO official responsible for the alliance’s response to such threats, told the AP.

One is to create “political disquiet” and undermine citizens’ support for their governments and the other is to “undercut support for Ukraine,” said Appathurai, deputy assistant secretary-general for Innovation, Hybrid, and Cyber.

During the investigation, the AP spoke to 15 current officials, including two prime ministers, and officials from five European intelligence services, three defense ministries and NATO, in addition to experts.

The AP mapped the incidents, showing the vast scope of the alleged campaign, which experts say is particularly worrying at a time when U.S. support for Ukraine is wavering and European allies are questioning Washington’s reliability as a security partner and ally.

What is happening?

The cases are varied, and the largest concentrations are in countries that are major supporters of Ukraine.

Some incidents had the potential for catastrophic consequences, including mass casualties, as when packages exploded at shipping facilities in Germany and the U.K. Western officials said they suspected the packages were part of a broader plot by Russian intelligence to put bombs on cargo planes headed to the U.S. and Canada.

In another case, Western intelligence agencies uncovered what they said was a Russian plot to kill the head of a major German arms manufacturer that is a supplier of weapons to Ukraine.

European authorities are investigating several cases of damage to infrastructure under the Baltic Sea, including to a power cable linking Estonia and Finland. Finnish authorities detained a ship, suspected of being part of Russia’s “shadow fleet” used to avoid sanctions, after that cable and others were damaged.

When a fake French Defense Ministry website claimed citizens were being called up to fight in Ukraine, a French minister denounced it as Russian disinformation. German authorities suspect Russia was behind a campaign to block up scores of car tailpipes ahead of national elections, according to a European intelligence official who spoke on condition of anonymity to discuss sensitive matters.

Officials from Estonia, Poland, Latvia and Finland, meanwhile, have accused Russia and Belarus of directing migrants to their borders.

Putin’s spokesperson, Dmitry Peskov, told the AP that the Kremlin has never been shown “any proofs” supporting the accusations and said “certainly we definitely reject any allegations.”

Hundreds of cases suspected

The AP scoured through hundreds of incidents suspected to be linked to Russia since Moscow’s invasion that were reported in open sources such as local media and government websites.

They were included in AP’s tally only when officials drew a clear link to Russia, pro-Russian groups or ally Belarus. Most of the accusations were made to or reported by AP, either at the time they occurred or during the course of this investigation. Fourteen cases were reported by other news organizations and attributed to named officials.

In about a quarter of the cases, prosecutors have brought charges or courts have convicted people of carrying out the sabotage. But in many more, no specific culprit has been publicly identified or brought to justice.

A ‘bolder’ approach

Countries have always spied on their enemies and long waged propaganda campaigns to further their interests abroad. But since the invasion of Ukraine, Moscow has become “bolder,” hitting the West with sabotage, vandalism and arson in addition to the tactics it previously used, including killings and cyberattacks, said Elisabeth Braw, an expert on the attacks at the Atlantic Council in Washington.

“The way you can weaken a country today is not by invading it,” she said.

China has also been accused of espionage and cyber operations in Europe, and The Wall Street Journal reported that Ukrainian authorities were responsible for blowing up the Nord Stream 1 and 2 pipelines in 2022. Kyiv has denied this.

“Multiple countries engage in hybrid operations,” said David Salvo, managing director of the Alliance for Securing Democracy at the German Marshall Fund. “Russia is the overwhelming culprit in Europe.”

Addressing the issue

A coordinated approach — especially sharing intelligence — is critical to tracking and countering the threats, Appathurai said.

That cooperation — never easy since intelligence is not shared collectively across NATO members — faces new challenges now, as the Trump administration increasingly questions the role of the alliance, embraces Russia and spars with its European partners.

Still, as the scale of the campaign becomes clearer, some nations are becoming more assertive.

Appathurai pointed to the approach to suspected sabotage in the Baltic Sea, where NATO has launched a mission to protect critical infrastructure.

“If we are to have a chance of stemming the threat,” Braw said, “then we have to work together.”