Russian services are recruiting amateur spies, sending them to the Old Continent for destabilization operations. The German newspaper “Die Zeit” has investigated this phenomenon that is confounding Western intelligence.
It’s still early on this Saturday, June 1. The French capital has just awakened, but there’s already bustling activity near the Eiffel Tower. However, these aren’t tourists. A white van is making repeated trips along Quai Jacques-Chirac. Inside are Mahmud H. (name changed) and two other men. Parking is prohibited on this multi-lane street that runs right in front of the Eiffel Tower. Nevertheless, the three men are determined to stay in the area with their vehicle; they have a mission to fulfill.
The van eventually stops right in front of the Eiffel Tower, despite the parking ban. Mahmud H. and the others get out and unload their cargo on the sidewalk: five coffins, each one covered with a French flag, resembling national funeral ceremonies, inscribed with “French Soldiers of Ukraine.” As if these were French soldiers who had fallen in the line of duty in Ukraine. Images of the operation subsequently circulate on the Russian messaging app Telegram.
Police observe the scene – their report is included in a police document we were able to review – but the men and the vehicle disappear before they can intervene. This strange operation sends ripples of concern through the Paris police. The Olympics are approaching, and the country fears terrorist attacks. The police search for the vehicle and the men. They quickly locate the vehicle and its driver, a 39-year-old Bulgarian. Mahmud H., a 25-year-old Berliner of Palestinian descent, and a 16-year-old Ukrainian are arrested in the afternoon as they prepare to take a FlixBus to Berlin.
All three are placed in custody, and their mobile phones are examined. The police are soon convinced they’ve encountered three representatives of a new type of spy working for Russian intelligence services. This type of spy has increasingly been confronting all security agencies in Western Europe. These agents are anything but traditional: they are untrained amateurs, poorly paid, and loosely brought together.
Disposable Spies
In the night preceding the coffin operation, the driver had come from Sofia in a vehicle rented in Bulgaria. The two other men had arrived from Berlin. None of the three were known to German or French security services. Mahmud H. later claimed to have participated in the operation to protest against the war in Ukraine, but this seems unlikely. The three men are unemployed. According to investigators, they did not know who their handler was or what he sought to achieve through this operation. For them, only the money mattered.
Men like them are a nightmare for security services: they have never appeared on their radars, are not politically active, and certainly are not known as spies. Previously, security services were familiar with Russian diplomats who ostensibly acted as cultural attachés or embassy staff while actually working for intelligence services. Many of them have been expelled from most EU countries, and the Kremlin has evidently found new means to recruit agents.
Confidential conversations we’ve had with members of intelligence services from several countries depict this new recruitment model. Russia now finds its saboteurs on Telegram, Instagram, or TikTok. Its intelligence services search the internet for young, enthusiastic individuals who are not yet “on the right path,” to use the words of a member of the German security services.
Known cases help to define a pattern. Things always start small: want to earn 5 dollars in cryptocurrency? How about doing a tag? Could you take a photo of a certain location for 100 euros? After completing the first mission, others follow, better-paid and riskier. And if someone like Mahmud H. gets caught, the sponsors almost never suffer consequences. Thus, German intelligence refers to them as low-level agents or single-use agents.
Disinformation and Arson
For months, these disposable agents guided by Russia have been operating in Western Europe. They are one aspect of the hybrid war Vladimir Putin is waging against the West. They spray red hands on the Holocaust memorial in Paris, display signs against NATO or Ukraine’s struggle at unrelated demonstrations, or deposit fake coffins.
Like Putin’s army of trolls on social media, these auxiliaries are recruited to leave their messages in the streets of the West. These operations may seem insignificant, but their accumulation has an effect. They spread disinformation, sow doubt, and create a feeling that something is wrong. And these are not the only missions for which these auxiliaries are called upon.
Andrés Alfonso de la Hoz de la Cruz is 26 years old and comes from Ciénaga, a city in northern Colombia. After school and military service, he began working in agriculture and at a quarry but clearly dreams of a better future. One day, while on a Telegram group dedicated to potential jobs abroad, a Russian asks him if he wants to work in Europe. The man is willing to finance his trip. De la Hoz agrees, traveling first to Spain, then to Poland.
The Russian contacts him again, asking to photograph a Polish arms factory for 5,000 zlotys, about 1,100 euros. The young Colombian complies. His handler informs him that he’s passed the test and immediately assigns his next mission: he must go to Prague and set fire to buses parked at a location. The Russian intermediary tells him that the vehicle owner wants to commit insurance fraud. The payment is 3,000 dollars (about 2,800 euros). What De la Hoz doesn’t know is that the site is actually a bus depot of the DPP, the local public transport network in Prague.
On the night of July 7 to 8, the Colombian sneaks into the site and sets fire to two buses before being discovered by a security employee. She manages to extinguish the fire; he succeeds in fleeing. The police issue a wanted notice and quickly find him. De la Hoz has since been imprisoned in the Czech Republic, facing a charge of terrorism and up to twenty years in prison. The investigation revealed that another man had previously been recruited by Russians to photograph the depot, likely to prepare for the attack.
A Well-Oiled Operation
Sergejs Hodonovic also found himself in front of the court in Riga, Latvia. According to court records, this young Latvian was lured by small jobs on Telegram. The first took him to Tallinn, Estonia. Together with another young man, he was supposed to tag the phrase “Killnet hacked you” on a wall. Killnet is the name of a group of Russian hackers, but the phrase means nothing to these young men. They don’t know that the wall is part of NATO’s cyber-defense center in Tallinn. Nor do they realize that the center is simultaneously targeted by an attack from Russian cyber troops. The next mission was to spy on the Latvian Air Force airfield in Lielvarde. But this time, Hodonovic is caught.
Latvian authorities manage to identify his handler. It’s a young Latvian who states during his interrogation that he searched for and recruited individuals like Sergejs Hodonovic online at the request of someone named “Alexander,” then assigned tasks to them. For each successful mission, he received a commission, 200 euros for photographs of the military airfield, for example. The only stipulation was that the disposable agents shouldn’t be Russian nationals. He had understood that he was working for Russian services. The missions he assigned included starting fires. And there have been several in Europe.
At the end of last year, for instance, a paint factory burned down in Wroclaw, Poland. Polish authorities arrested a young Ukrainian in January, accusing him of being paid by Russian intelligence for the attack. In March, a warehouse belonging to a Ukrainian company burned down in northeast London. Five British nationals are under investigation for arson. They reportedly acted on behalf of Russian intelligence.
In May, a fire broke out at a factory belonging to German arms manufacturer Diehl. The case has not yet been resolved, but American intelligence has indications pointing towards an attack commissioned by Russia. German security services neither confirm nor deny this. However, they assert that “it is now almost irrelevant,” as the effect is already excellent from the perspective of Russian propaganda: investigators, intelligence services, the media, and the public speculate about a potential Russian origin, and that’s exactly what Russia seeks – to sow doubt within Western society.
“Dividing Society”
According to a member of the German security services, the Russians are testing the limits of what they can achieve with their disposable agents.
“This is a strategy that could still go much further.”
Several signs indicate as much. The latest case involves sending incendiary bombs by plane. So far, the consequences have not been too severe, but these seemingly harmless packages were undoubtedly set to explode mid-flight. Several of these bombs have been discovered, including two in Germany. One ignited a container at DHL’s logistics center at Leipzig Airport. A suspect was apprehended in Lithuania, suspected of acting on behalf of the Russians.
As early as 2015, the coordinator of the German intelligence services established a working group bringing together territorial security services and intelligence agencies to address the hybrid warfare conducted by Russia. The group presented a confidential “common situation report” in 2016 that shed light on Moscow’s propaganda, misinformation, and psychological operations. The services believed at the time that Russia viewed itself as “in open conflict with the Western world.” It sought to “exacerbate divergences within the EU” and “divide German society.”
Today, things are clearer, and Western security services are cooperating increasingly closely to combat this challenge. In Germany, a working group called “Hybrid,” composed of members from various security agencies, meets weekly in the basement of the intelligence services to review potential new cases.
And there are many, according to participants. The sheer volume of operations suspected to have been ordered by Russia already poses a problem, as it consumes considerable resources within the police and intelligence services. The authorities are far from seeing everything, despite their efforts.
For example, they only became aware of Mahmud H. when we inquired about him. His handler, whom French police managed to identify, was also unknown in Germany. Expelled by France, Mahmud H. is back in Berlin. He is not easy to find. His family claims they do not know where he is. We attempt to contact him multiple times through messages and calls. He sometimes answers the phone but refuses to discuss his case further. He only adds one thing: after the Paris operation, he already had another mission; he was to go to Prague.
Kai Biermann, Zdislava Pokorná, Christina Schmidt.
