One time becomes prepared an attack on the life of the CEO of the German arms manufacturer Rheinmetall. Then an attempt is made to tamper with drinking water in a barracks in Cologne. Yet another time, passenger planes are bombarded with misleading radar signals. Or become coffins delivered to the Eiffel Towershortly after President Macron hinted at sending French troops to Ukraine.
The number of attacks, sabotage attempts and bullying that the West has had to deal with in recent years is now as dangerous as it is extensive, says Bart Schuurman. According to the professor of Terrorism and Political Violence at Leiden University it is “very likely” that Russia is behind this. Together with two employees, he created based on online sources an overview of incidents since February 2022, the month of the Russian invasion of Ukraine. Schuurman came to just over fifty incidents, but not only that: their number increased sharply in 2024 compared to the two previous years, as did their aggressive nature.
Western politicians and military personnel have been warning for some time about the so-called ‘hybrid warfare’ by Russia. Last Thursday NATO Secretary General Mark Rutte still did that. Yet Schuurman was shocked by what he encountered. “There were also very serious issues, such as attacks on people and public facilities and incidents in civil aviation. In particular, the number of sabotage actions increased rapidly. The ‘stage’ is also shifting to the west, also towards the Netherlands.”
Dutch holidaymakers
Our country appears once on the Leiden list: Russian influence with disinformation and propaganda via Voice of Europethe television channel that was financed by Dutch entrepreneurs. “But Dutch holidaymakers who are on a plane whose radar is disrupted are actually also part of this,” says Schuurman. Based on his analysis, he believes that the Netherlands should take into account sabotage of public facilities, such as power stations or water supplies. “That is much more likely than a conventional attack by Russia.”
A detailed, factual overview of the Russian shadow war against the West has been lacking until now, at least in the Netherlands. The problem is often the so-called ‘attribution’: what can you attribute to whom? Schuurman and his two employees opted for a ‘cautious approach’. “We did not rely on one or two experts who point to Moscow,” says the professor. “We only included cases when Western intelligence services or politicians did so, or when the event fit a pattern, such as attacks on water treatment plants.”
The attack on the French high-speed line right before the Olympic Games in Paris last July is not on the list. This was quickly attributed to far-left activists. The crash of the DHL device near Vilnius in Lithuania last month is also not included. That was the result of technical failure. The same applies to the “very damaging” cyber attacks that, according to Schuurman, are taking place on parts of the Dutch infrastructure. “There are too many for such a list. Moreover, our project focuses on incidents that are visible in the physical domain.”
A Finnish border guard steps into a tent where asylum seekers are accommodated. When Russia started deliberately sending migrants across the border, Finland temporarily closed its borders with the country.
Photos Emmi Korhonen/AFP
In their dataset, the Leiden scientists also return to incidents that fizzled out. This was summarized in quick succession in July of this year two postal packages with highly flammable, chemical material flame in DHL transport aircraft in Leipzig and Birmingham. The package in the first aircraft should actually have been passed on to another aircraft, but this was canceled due to a delay. If this had happened, we would have been faced with a terrorist attack with potentially enormous consequences, says Schuurman.
Other anti-Western actions also remain – according to Schuurman wrongly – largely under the radar of the general public, such as Russian reconnaissance over the North Sea or Baltic Sea, or military areas. “These may seem like classic espionage activities, but in a real crisis or war situation they could – in retrospect – have been very important as preparations for sabotage.”
Mind-boggling list
Experts of Russian espionage techniques react with shock to Schuurman’s inventory. “I think it is a mind-boggling list,” says Ben de Jong, also affiliated with Leiden University. “These practices go much further than we are used to from the Russians during the Cold War.” At that time, as far as De Jong can remember, there were no attacks on CEOs of arms industries.
Western politicians and military personnel have been warning for some time about the so-called ‘hybrid warfare’ by Russia
According to him, there is another important difference. “Russia’s current, large-scale investments in disinformation campaigns in the West are striking. Russian disinformation has always existed, but large-scale attempts to fuel polarization in the West with incorrect and seriously misleading information are fairly new.”
An example of Russian disinformation are heavily inflated reports about drastic price increases as a result of the Western boycott of Russian gas. “Such messages are much more likely to be widely distributed than about forty years ago, due to the unregulated Big Tech in the US and the growing distrust in society, including towards our own government,” says De Jong. Moscow further fuels this polarization by sending large groups of migrants to the borders with Finland and Poland and helping them with the obstacles there.
Russia expert De Jong believes it is right that Schuurman has included influence operations such as via Voice of Europe in his list. More general, anti-Ukrainian disinformation campaigns from Russia are not included in the overview.
Western answer
How should the West respond? Classic criminal or diplomatic responses do not work or fall short, it appears. Commander of the Armed Forces Onno Eichelsheim said on Sunday Outside court how difficult it is to tackle ships involved in sabotage in international waters. “That requires an amendment to the law,” said the senior soldier.
There has been a standoff for weeks over a Chinese cargo ship that departed earlier from a Russian port. The Yi Peng 3 is said to have deliberately damaged two submarine fiber optic cables when the ship sailed over them. The cargo ship is anchored off the Danish island of Anholt, but Danish authorities are not allowed to board without permission from Beijing.
Moscow also remains out of harm’s way in other ways, says spy expert De Jong. As an example he gives the thwarted attack on the CEO of Rheinmetall, the highly secured Armin Papperger. “Moscow does not carry out such sensitive operations itself, but recruits criminals for them via social media such as Telegram. In the German press they have now been referred to as ‘Road yard agent‘.”
Until now, smaller criminals were mainly recruited for simple jobs such as arson or graffiti. “Apparently they are now also allowed to carry out assassinations.” The clients are difficult to tackle via the criminal route, De Jong fears.
Moscow does not carry out sensitive operations itself, but recruits criminals via social media such as Telegram
In the near past, the West often responded to greatly increased Russian activity with expulsions of diplomats. “That weapon has now become quite blunt,” notes De Jong. “Since February 2022, around 750 Russian diplomats, or actually ‘pseudo-diplomats’, have been expelled from Europe. There aren’t many left.”
Below the threshold
The NATO treaty also offers no solution in the short term. When is a terrorist or sabotage act so harmful that Article 5 (an attack on one is an attack on all) may be called? Bruno Kahl, the head of the German AIVD (Federal Night Service) recently speculated openly on declaring this article applicable in response to the Russian hybrid actions.
The only time Article 5 has been invoked so far was shortly after September 11, 2001, the attack on the World Trade Center in New York and the Pentagon near Washington. “The threshold is very high, partly because of the far-reaching consequences,” says professor of military law Marten Zwanenburg (University of Amsterdam and the Dutch Defense Academy). Article 5 is based on the right to self-defense under the UN Charter, after an ‘armed attack’. “According to the International Court of Justice, an armed attack is: use of force with a certain scale and consequences. The actions mentioned here always remain below that threshold.”
Nevertheless, Zwanenburg sees more and more discussion among fellow lawyers about alternative grounds for applying the article. “Then it concerns, for example, whether not so much an incident, but a series of incidents would qualify as an armed attack,” says the professor. The actions would have to be aimed against the same country, and what strikes Schuurman and his employees is the breadth of attacks on different countries.
Onno Eichelsheim said on Sunday that he wanted to “discuss with the cabinet” about “amending the law” to combat Russian espionage and sabotage in, for example, the North Sea. Leiden espionage expert De Jong believes that something should be done faster. “Russia too often gets the idea that it can get away with impunity.” According to him, the moment is fast approaching when it must be made clear to Moscow that “similar sabotage actions will be taken against Russia if this continues.”
