1.0 Introduction
Head of MI5, Ken McCallum, disclosed that European nations have expelled over 400 undeclared Russian intelligence officers since the invasion of Ukraine. Countries like France, Belgium, and Germany have also notably taken significant action. Additionally, the Finnish intelligence and security service SUPO has highlighted the impact of these expulsions. They noted that visa refusals for replacements have weakened Moscow’s intelligence presence in the Nordic region. On 4 April, Politico reported that the Russian SVR and GRU are attempting to rebuild their human espionage networks, particularly focusing on military aid in Ukraine. [Source]
Russia’s espionage activities in Europe have reached unprecedented levels, marked by covert operations and the dissemination of sensitive information, including leaked phone conversations. On 7 March, RUSI reported that the magnitude of Russian infiltration is soaring to Cold War-era levels, with an extensive network penetrating European nations since the Ukrainian invasion [Source]. Despite setbacks in early 2022, Russia’s intelligence agencies have regrouped, employing new tactics such as using proxy actors and recruiting agents with legitimate cover stories.
Russian intelligence agencies, including the FSB, SVR and GRU, have faced setbacks and humiliations in recent years. In 2020, FSB operatives tasked with poisoning Alexei Navalny were unsuccessful in their attempt [Source]. However, they have adapted and learned from their mistakes, undergoing reforms and consolidating their efforts. The GRU has also established a new “Service for Special Activities” and Unit 54654. Their goal is to build a network of spies operating under “full legalization,” recruiting individuals through front companies and targeting foreign students [Source] [Source].
The Wagner Group, the private military company with Russian influence, has also been under reorganization. This restructuring was initiated by the Kremlin following a mutiny and the death of its leader, Yevgeny Prigozhin. This restructuring aims to enhance coordination and efficiency within Russia’s intelligence apparatus [Source]. Additionally, Russian cyber-activity remains strong, with elite hacking groups targeting NATO countries and major corporations. This highlights Russia’s commitment to employing technological means to further its strategic objectives.
1.1 History
Russian espionage history is marked by a long and intricate legacy of covert operations, dating back centuries. Originating in the Imperial era, Russia’s intelligence evolved significantly under the Soviet regime, making espionage central to statecraft. The Soviet Union’s intelligence agencies, notably the KGB, gained notoriety for their extensive global network of spies and operatives. They engaged in espionage, subversion, and propaganda on an unprecedented scale.
During World War II, Russian spying activities in Europe were extensive and strategically significant. The Soviet Union, through its intelligence agency, the NKVD, recruited bright young men from Cambridge University into its covert ranks. This effort aimed to infiltrate key branches of British intelligence, such as MI-5 and MI-6, gather valuable intelligence, and influence Western policies. During the 1930s Soviet intelligence successfully recruited members of the famous Cambridge Five.
The Cambridge Spy Ring, consisting of individuals like Guy Burgess, Anthony Blunt, Donald Maclean, Harold Adrian “Kim” Philby, and John Cairncross, served in Soviet espionage efforts. Russian agents from the NKVD recruited the Cambridge Spy ring. These spies passed sensitive information to Soviet handlers under the guise of serving the Comintern. Their actions compromised British intelligence and led to the exposure of Manhattan Project secrets altering the course of the war. This also shaped post-war geopolitics.
1.1.1 Post-Soviet Union
Following the collapse of the Soviet Union, Russia’s intelligence services underwent restructuring, yet retained their prominence in national security strategy. With the dissolution of the USSR in 1991, the KGB was disbanded, leading to the creation of several successor agencies [Source],[Source]. The main successor agency to the KGB was the Federal Security Service (FSB), which took over many of the KGB’s domestic security functions [Source]. Additionally, the Foreign Intelligence Service (SVR) was established to handle foreign intelligence operations, taking over the external intelligence functions previously handled by the KGB [Source].
Aside from the FSB and SVR Russian intelligence, the GRU is also an integral part of the Russian intelligence apparatus. The GRU, or the Main Intelligence Directorate (Glavnoye Razvedyvatel’noye Upravleniye), is the military intelligence agency of the Russian Federation. Established in 1918 during the Russian Civil War, the GRU’s primary mission is to gather intelligence related to national security and military affairs, both domestically and internationally [Source]. The GRU is responsible for providing intelligence to Russian military leadership, supporting military operations, and conducting covert activities abroad. Its activities encompass a wide range of areas, including strategic analysis, espionage, sabotage, and cyber operations. The GRU’s reputation for clandestine operations and its role in shaping Russian foreign policy make it a significant player in global intelligence affairs.
1.2 Symbols
FSB – Logo
.
GRU logo
SVR logo
Beyond traditional insignias, Russia’s spies employ covert imagery and narratives to maintain secrecy and camouflage their activities
2.0 Organisation/Agencies involved
On February 20, a RUSI report underscored Russia’s emphasis on unconventional warfare tactics preceding its 2022 invasion of Ukraine. These tactics include sabotage, subversion, and destabilisation activities carried out by undeclared Russian forces in the “grey zone”[Source]. Since the invasion, however, European states have shifted their attention to Russian spy networks within the continent.
The Russian special services, particularly the FSB and the GRU, play significant roles in executing Russia’s unconventional military activities. The FSB has been involved in recruiting and managing agent networks in Ukraine. They plan for occupation administration and establish counterintelligence regimes in occupied territories. Meanwhile, the GRU focuses on restructuring its operations to expand its capacity in strategic areas posing threats to NATO members. On 6 February, the Security Service of Ukraine reported on Telegram that it had neutralised a network of FSB counterintelligence officers [Source].
Following the expulsion of its spy networks from around Europe in 2022, Russia has intensified its clandestine activities across the continent. Through the establishment of Committees of Special Influence and the restructuring of GRU units, such as Unit 29155 and the newly formed Unit 54654 [Source]. Russia’s 161 Centre has changed, consolidating into units for training, operational planning, and execution. The centre has also taken steps to tighten its security measures, reducing vulnerability. Veterans from Unit 29155 have also reportedly shifted to the Service headquarters to manage operational activities.
Current recruitment to Unit 29155 focuses on individuals without military backgrounds, trained within the GRU, reflecting a shift towards generating cleanskins for operations. Unit 54654 operates differently, recruiting personnel without military contracts and contractors through front companies to avoid government records. It focuses on human intelligence and support structures through a network of illegals. These personnel often hold non-defence-related positions to conceal their identities and operations [Source].
2.1 Financing
According to an article by the Financial Times, Russian covert operations now use foreign nationals in politics, business and organised crime. Intelligence officers claim that the Kremlin has changed its modus operandi to include an increased use of “proxy” intelligence actors. These proxy actors are sometimes not aware of their employer. On May 31, the Wall Street Journal reported that Artem Uss, a Kremlin-linked businessman, was accused of illegally exporting American military weapons to Russia. Later, WSJ revealed he fled to Russia after being put under house arrest in Italy. Russian funding sources for intelligence operations range from state coffers to covert channels, ensuring operatives have the necessary resources for their missions[Source][Source].
On 20 February, the BBC reported that the Russian government was offering a “regime survival package” for African countries in exchange for natural resources [Source]. This offer comes after a rebranding of the Wagner group to the Africa Corps controlled by the Kremlin. According to the Blood Gold Report, Russia has extracted $2.5bn worth of gold from Africa, which has likely funded its operations in Ukraine [Source].
3.0 Operations
Russian Recruitment seems to take place in foreign embassies, target officials or politicians, use deep cover agents also known as “illegals” and sleeper spy cells around Europe. Traditionally the GRU was Russia’s foreign intelligence but the roles have shifted [Source].
In neutral countries such as Austria and Switzerland, Russian spies work out of embassies using the advantage of diplomatic cover. The countries have become “safe hubs” to run the operations out of and according to the Financial Times about 150 known Russian agents are still operating under their diplomatic cover [Source][Source]. A Norwegian domestic intelligence service report stated that they “expect Russia will try to compensate for the loss of the intelligence officers [by], among other things, sending more visiting agents” [Source]. In 2021, Jose Assis Giammara a Brazilian academic was exposed as a Russian undercover officer and is now awaiting trial [Source].
3.1 General Public
There have been several attempts by Russian security agencies to use the general public as spies around Europe. Covert operatives were also operating as guards to embassies or as students in various countries and involved with research groups and government projects. Recent attempts include using “illegals’ to infiltrate institutions such as the International Criminal Court in the Hague. On 26 March, The Guardian reported that Sergey Cherkasov, using a cover identity, completed a master’s degree at John Hopkins University and won an internship with the ICC. He posed as a Brazilian citizen named Victor Muller Ferreira. US authorities also reported that they believe Cherkasov is a GRU operative [Source].
In February, authorities in the UK arrested Orlin Roussev, Bizer Dzhambazov, Katrin Ivanova, Ivan Stoyanov, and Vanya Gaberova for their involvement in a Russian spy ring operating within the UK. Between August 2020 and February 2023, they conducted surveillance activities on individuals and locations. Mr Roussev organised the hub, which operated in a seaside resort of Great Yarmouth [Source]. On February 17, the New York Times reported authorities caught a children’s football coach in Germany spying for Russia. The man, a former German soldier, worked for Germany’s Federal Intelligence Service (BND) as a director of the technical reconnaissance unit [Source].
3.2 Political
On 29 January, the European Parliament launched an investigation into Tatjana Zdanoka, a Latvian member of the EU legislature, on suspicions of spying for Russia. Zdanoka is believed to have operated on behalf of the FSB. Zdanoka is a leader of the LKS (Latvian Russian Union) party known to be pro-Kremlin. The party supported Russia’s annexation of Crimea and refused to denounce the invasion in 2022 [Source] [Source]. In March, Politico reported that Russian intelligence used a Serbian national to infiltrate EU discussions and push for pro-Kremlin talking points. The Serbian national Novica Antic met with officials in Brussels as well as EUROMIL and EPSU representatives. Politico also reported that Antic closely collaborated with FSB official Vyacheslav Kalinin and received invitations to meet with senior officials in the Russian military in 2019 and 2020. [Source].
3.3 Military
Russia’s intelligence apparatus encompasses various units which are strategically positioned across Europe. The units include diplomats posing as spies, turned officials, deep-cover agents, and sleeper cells. Since the Russian invasion of Ukraine in 2022, the GRU military intelligence, the FSB and the SVR reorganised to refine their espionage tactics and support military operations. The recent operation has aimed at gathering Western secrets, exacerbating divisions within NATO and undermining support for Ukraine [Source].
On 1 March, Russian propagandists released conversations between German generals discussing long-range missiles to Ukraine and targeting the Crimean Bridge. Germany confirmed the discussions on 3 March and claimed to have started investigations into the leak. [Source][Source]
In 2022, Bellingcat investigators revealed a deep-cover spy from the GRU operating in Naples. Maria Adela going by the name Kuhfeldt Rivera posed as a Latin American jewelry designer. She owned a store near NATO’s Allied Joint Force Command base and was able to make friends with senior NATO officials for nearly a decade [Source][Source].
4.0 Conclusions
Russia’s intelligence activities in Europe have reached unprecedented levels, reminiscent of the Cold War era. Expulsions of undeclared Russian intelligence officers from various European countries and increased scrutiny highlight the gravity of the situation. Cooperation among Western intelligence agencies has intensified. Despite botched operations and the restructuring of private military companies like the Wagner Group, Russia’s intelligence apparatus has adapted. It employs new tactics and strategies to further its geopolitical objectives. From infiltrating diplomatic circles to recruiting deep-cover agents and sleeper cells, Russian intelligence agencies pose significant challenges to European security. However, increased awareness and cooperation among European states, along with ongoing efforts to bolster counterintelligence capabilities, are essential in mitigating the threats posed by Russian espionage activities.
4.1 Future Trajectories
There is a growing awareness among European nations of the presence and activities of Russian spies, largely because of increasing espionage-related incidents and arrests. The expulsion of hundreds of undeclared Russian intelligence officers from Europe, along with high-profile arrests and revelations of covert operations, has served as a wake-up call for European security agencies and policymakers. These incidents highlight the extent and sophistication of Russian espionage efforts, prompting increased scrutiny across the continent. Spies being caught and exposed show a heightened level of awareness and responsiveness among European security agencies. While heightened awareness and vigilance are positive, it’s crucial to note Russian intelligence’s adaptability and resilience. They will likely adjust tactics in response to scrutiny, seeking new vulnerabilities and exploiting evolving geopolitics. Therefore, ongoing investments in counterintelligence are crucial to stay ahead of Russian espionage in Europe.
Looking ahead, it is likely that Russia will continue to prioritise espionage and subversion as key elements of its foreign policy toolkit. As tensions between Russia and the West persist, especially in the aftermath of the Ukraine crisis, Moscow is expected to intensify its efforts to gather intelligence. Additionally, it aims to sow discord and undermine Western institutions and alliances. This may involve further recruitment attempts, exploiting neutral countries’ vulnerabilities, and manipulating Europe’s political, economic, and social dynamics. Technological advancements, especially in cyber warfare, will likely play a prominent role in Russian espionage, posing new challenges for European security agencies. Therefore, maintaining vigilance, enhancing cooperation, and investing in robust counterintelligence measures will be crucial for confronting and mitigating Russian espionage threats in the years ahead.
