Strategic Counterintelligence Assessment | Belarusian KGB and Military Intelligence | Russian–Belarusian Hybrid Operations | European Security and NATO Resilience | 2026–2031
Geographic and analytical scope: Poland, Belarus and the Russian Federation, with operational implications for Lithuania, Germany, Italy, France, the United Kingdom, the European Union and NATO; assessment of documented intelligence activities from 2022 to 6 November 2026, with a strategic outlook through 2031.
Executive Summary — Bottom Line Up Front
The central security problem is the use of low-cost, locally recruited intermediaries to translate foreign intelligence requirements into activity inside European territory, potentially progressing from information collection and propaganda to operational reconnaissance, sabotage preparation and physical attacks.
Polish prosecutorial records establish that recruitment through digital messaging platforms, compensated photographic assignments, propaganda distribution and preparation for subsequent instructions have already occurred in investigations involving foreign intelligence activity. A 2 July 2026 prosecution announcement described recruitment through Telegram, photographic documentation of critical infrastructure, posters, graffiti and cryptocurrency payments. National Public Prosecutor’s Office — 2 July 2026.
A separate February 2026 investigation identified suspected Belarusian military intelligence activity across Poland, Germany and Lithuania, concerning critical infrastructure and facilities relevant to NATO defence. National Public Prosecutor’s Office — 23 February 2026.
The operational consequences are demonstrated by documented Russian-directed sabotage investigations. Polish prosecutors attributed the May 2024 Marywilska 44 commercial-centre fire to an organised operation conducted on behalf of Russian intelligence, while the November 2025 railway attacks created an immediate danger of a train disaster. National Public Prosecutor’s Office — 2 April 2026; National Public Prosecutor’s Office — 19 November 2025.
Principal judgment: The verified pattern establishes a credible counterintelligence threat to Poland and allied states. However, the identity, command structure and operational scale of any newly reported Belarusian KGB recruitment campaign must be distinguished from the already documented cases. The public official records examined do not independently establish that every reported leaflet assignment originates from the Belarusian KGB.
Decision consequence: Effective prevention requires detecting the transition from ostensibly minor paid assignments to intelligence-directed activity, protecting strategically consequential infrastructure, maintaining legally proportionate investigative powers and strengthening cross-border intelligence cooperation without treating nationality or migration status as evidence of hostile activity.
Belarusian Intelligence, Russian Sabotage and Europe’s Hidden Infrastructure Vulnerability: The Cost of Defending NATO from Within
Europe is strengthening its eastern borders while foreign intelligence networks have demonstrated the ability to operate inside the civilian infrastructure on which its defence depends. Poland’s response exposes the contradiction: approximately PLN 10 billion committed to the Eastern Shield programme for 2024–2028, while Russian-directed networks have been prosecuted for espionage, commercial arson and attacks on railway infrastructure. Belarusian intelligence investigations now extend across Poland, Germany and Lithuania. The threat is no longer defined exclusively by hostile forces approaching NATO territory, but by the ability of foreign services to exploit civilian access, digital communications and infrastructure dependencies within it. The governing security question is whether European governments can convert legal authority, counterintelligence and infrastructure investment into effective prevention before relatively inexpensive clandestine operations impose disproportionate economic, military and political costs.
The financial imbalance is becoming a defence problem
The figures illustrate the asymmetry. Poland’s Eastern Shield programme carries a planned financial envelope of approximately PLN 10 billion over 2024–2028, intended to strengthen border defence, detection, warning and military-support infrastructure. Yet Poland’s Internal Security Agency (ABW) has disclosed a Russian-directed intelligence network comprising at least 30 individuals, including an original group of 16 detained participants subsequently reported convicted. The network combined reconnaissance, propaganda activity and preparations for more serious operations. Its strength was not a conventional military capability but its ability to organise dispersed tasks through intermediaries already present in Poland. Eastern Shield — Polish Government, June 2024; Camera-Network Investigation — ABW.
The military implications are measurable. On 23 November 2025, NATO reported that its Polish logistical hub supporting Ukraine handled approximately 18,000 tonnes of material per month. This is reported operational throughput, not maximum capacity or total assistance delivered through Poland. Nevertheless, it establishes the scale of an allied logistical function dependent on transport infrastructure, communications, personnel and supporting services. The destruction or interruption of one supporting service need not eliminate the entire operation to impose additional costs, delays and security requirements. The actual consequences would depend on redundancy, inventory and restoration capacity—variables not quantified in the published record. NATO Logistics Hub in Poland — NATO, November 2025.
The European Union has also recognised the problem institutionally. Its proposed Military Mobility Package of November 2025 envisages an EU-wide military mobility area by 2027, including measures to simplify procedures and improve cross-border movement. The proposal identifies administrative and infrastructure constraints affecting military transport; it does not establish that the projected system is already operational. Europe’s defence ambitions therefore remain dependent on civilian transport capacity and the implementation of national and European measures whose costs cannot be assessed solely through military procurement budgets. Military Mobility Package — European Commission, November 2025.
A commercial warehouse can become an instrument of geopolitical pressure
The investigation into the 12 May 2024 fire at Warsaw’s Marywilska 44 commercial centre demonstrates how economic infrastructure can become a target of foreign intelligence-directed sabotage without possessing an explicit military function. Polish prosecutors attributed the arson to an organised group acting on behalf of Russian intelligence. Their April 2026 announcement nevertheless acknowledged that the individuals who directly ignited the fire had not been identified. Organisational attribution and identification of direct perpetrators are separate evidentiary conclusions. Commercial Arson Indictment — Polish National Public Prosecutor’s Office, April 2026.
The investigation extended beyond Marywilska 44. Prosecutors identified the 13–14 April 2024 fire at an OBI store in Warsaw, the 9 May 2024 IKEA fire in Vilnius and preparations for another operation at an IKEA facility in Riga. The Riga attack was not completed. On 25 March 2026, prosecutors filed an indictment against five individuals associated with the wider proceedings. The geographical distribution is consequential: attacks, suspected organisers, evidence and judicial responsibilities can span several states, while commercial operators bear the immediate consequences in the jurisdictions where destruction occurs. Commercial Arson Indictment — Polish National Public Prosecutor’s Office, April 2026.
Such destruction affects more than the value of damaged premises. Retailers, tenants, employees, insurers, suppliers and transport providers face different forms of exposure. Reconstruction costs, business interruption, employment consequences and emergency expenditure cannot be consolidated into a credible economic-loss estimate without audited evidence. The prosecution also described efforts to record fires and emergency-service responses for propaganda purposes. Physical damage could therefore serve a second function: producing material intended to extend the political effect beyond the immediate commercial loss. The available evidence establishes that alleged objective, not the scale of any resulting change in public opinion. Marywilska 44 Investigation — Polish National Public Prosecutor’s Office, May 2025.
The railway attacks exposed the limits of conventional infrastructure protection
The 15–16 November 2025 incidents affecting Poland’s railway Line 7 marked another form of escalation. Prosecutors described explosive damage near Mika and interference with railway infrastructure near Gołąb, creating an immediate danger of railway catastrophe. Two Ukrainian citizens were accused of carrying out the attacks for Russian intelligence and subsequently fleeing to Belarus. The prosecutorial attribution concerns Russian intelligence; the suspects’ nationality and reported destination do not independently establish Belarusian KGB command. Railway Sabotage Investigation — Polish National Public Prosecutor’s Office, November 2025.
Railway infrastructure illustrates the economic difference between destroying an asset and interrupting a service. Transport continuity depends on tracks, signalling, communications, traction systems, safety inspections and operational authorisations. A physically limited incident may require wider restrictions until safe movement is restored. Its consequences depend on the duration of interruption and the availability of alternative services, not simply the cost of replacing damaged equipment. The railway investigation established serious safety implications, but the published prosecution record does not quantify destroyed military shipments, national freight losses or a measurable reduction in NATO readiness. Those distinctions determine whether government spending addresses demonstrated vulnerabilities or politically compelling but unverified assumptions.
The European Union’s Critical Entities Resilience Directive (EU) 2022/2557 addresses this wider dependency problem across 11 sectors, including energy, transport, health, water, digital infrastructure and food-related activities. Member states were required to identify critical entities under the directive’s framework by July 2026. The significance is regulatory: a facility’s economic and security relevance depends increasingly on the essential services it provides and on other systems relying upon them. Identification and legal compliance, however, do not guarantee operational continuity under attack. Critical Infrastructure Resilience — European Commission, January 2026.
Minsk and Moscow share interests, but attribution cannot be politically convenient
The intelligence relationship between Belarus and Russia requires particular precision. Polish proceedings establish different institutional categories: activity attributed to the Belarusian State Security Committee, commonly known as the KGB; activity attributed to Belarusian military intelligence; and Russian-directed networks employing individuals of several nationalities. Their strategic interests may overlap, but public evidence does not establish that every operation is governed by a unified command structure.
A particularly consequential case emerged on 9 February 2026, when Poland’s ABW arrested Pavel T., a Belarusian citizen suspected of conducting reconnaissance for Belarusian military intelligence between June 2024 and February 2026. The alleged activity extended across Poland, Germany and Lithuania, involving critical infrastructure and facilities relevant to Polish and NATO defence. German and Lithuanian intelligence authorities cooperated with Poland in the investigation. The case demonstrates that the institutional concern extends beyond Belarusian opposition communities, but remains an allegation subject to judicial proceedings. Belarusian Military Intelligence Investigation — Polish National Public Prosecutor’s Office, February 2026.
The distinction has financial and diplomatic consequences. Sanctions, criminal prosecutions and bilateral intelligence cooperation depend on identifying the relevant actors and their conduct. On 8 October 2026, the Council of the European Union extended restrictive measures against Russian destabilising activities until 9 October 2027, covering 80 individuals and 20 entities. These listings impose defined financial and travel restrictions; they do not constitute criminal convictions or establish responsibility for every incident in Poland. Incorrectly merging Russian and Belarusian institutional attribution would weaken the evidentiary foundation on which such measures are justified. Russian Hybrid Activities: Restrictive Measures — Council of the EU, October 2026.
Stronger criminal law cannot replace faster, legally admissible evidence
Poland’s 17 August 2023 reform of Article 130 of its Criminal Code expanded the statutory treatment of foreign intelligence activity, including preparatory conduct and sabotage-related offences. Under Article 130 §7, specified sabotage or terrorism-related conduct undertaken for foreign intelligence carries imprisonment for at least ten years or life; §8 separately addresses qualifying preparation. The legislation creates grounds for intervention before completed destruction in defined circumstances, but it does not eliminate the obligation to establish the offence and respect criminal-procedure safeguards. Polish Criminal Code Amendment — August 2023.
A further reform entered into force on 31 October 2026, strengthening judicial oversight of operational surveillance conducted by authorised Polish services. Courts receive additional supervisory powers concerning the conduct and results of surveillance. The reform arrived as digital communications and cross-border financial records were becoming central to the investigation of clandestine activity. Greater investigative capability and stronger oversight are not necessarily opposing objectives: unlawfully collected evidence can compromise prosecution, while inadequate safeguards can weaken public confidence and cooperation. Judicial Oversight of Operational Surveillance — Polish Legislation, September 2026.
At EU level, Regulation (EU) 2023/1543 became applicable on 18 August 2026, establishing European Production and Preservation Orders for specified electronic evidence. The framework provides a general ten-day response period for covered production orders and eight hours in qualifying emergencies. These are legal deadlines, not observed average processing times. Together with financial-transfer traceability under Regulation (EU) 2023/1113, applicable since 30 December 2024, the instruments can strengthen lawful access to certain forms of evidence. They cannot, without corroboration, prove that a payment or online account belongs to a foreign intelligence organisation. EU e-Evidence Framework — European Commission; Regulation (EU) 2023/1113 — European Parliament and Council.
Europe has common obligations but no single authority responsible for the entire threat
Poland and Lithuania confront the geographical consequences of proximity to Belarus; Germany contributes allied logistics and military coordination through NATO’s NSATU headquarters in Wiesbaden; Italy’s obligations include implementation of NIS2 through Legislative Decree No. 138 of 4 September 2024; France’s National Strategic Review 2025 identifies hostile interference and resilience as national-security concerns; and the United Kingdom’s Strategic Defence Review 2025 connects critical infrastructure protection to military effectiveness. These are different national responsibilities, not interchangeable security models. Italian Legislative Decree 138/2024 — Normattiva; French National Strategic Review 2025 — SGDSN; UK Strategic Defence Review 2025 — Ministry of Defence.
NATO’s North Atlantic Treaty reinforces the distinction. Article 3 concerns the capacity to resist armed attack, Article 4 provides for security consultations, and Article 5 establishes collective defence under specified conditions. An intelligence-directed sabotage incident does not automatically trigger Article 5. National authorities remain responsible for criminal investigations and relevant infrastructure protection, while NATO addresses allied defence and preparedness. The European Union contributes regulatory obligations, judicial cooperation, financial restrictions and military-mobility initiatives within its own competences. The North Atlantic Treaty — NATO, April 1949.
The unresolved institutional problem is implementation across those boundaries. EU rules may improve financial traceability, but intelligence attribution still depends on investigators. NATO can coordinate military requirements, but civilian infrastructure is operated under national and commercial arrangements. The forthcoming direct supervisory responsibilities of the EU’s Anti-Money Laundering Authority, scheduled to begin for selected institutions in 2028, will add another financial supervisory capability, not a substitute for national counterintelligence. The effectiveness of European coordination will therefore depend on evidence exchange, clearly assigned responsibilities and actual service continuity rather than the number of authorities involved. EU Anti-Money Laundering Package — Council of the EU, May 2024.
The next 24 months will reveal who absorbs the cost
Between November 2026 and November 2028, European governments face a measurable implementation test. Poland’s Eastern Shield programme will approach its planned 2028 completion horizon; the EU’s proposed military-mobility architecture carries a 2027 objective; newly applicable electronic-evidence rules must demonstrate operational results; and AMLA is scheduled to begin direct supervision of selected financial institutions in 2028. None of these milestones, taken alone, establishes that essential infrastructure is safer or hostile networks easier to disrupt.
The costs of inadequate implementation will fall first on infrastructure operators, whose investment, insurance, restoration and compliance obligations are not automatically reimbursed by defence budgets. Businesses and employees will bear the commercial consequences of interruption. Transport users and logistics providers will absorb delays and additional operating costs. National governments will face emergency expenditure, investigative burdens and pressure to strengthen protection. Allied defence institutions may encounter additional constraints where civilian services supporting military requirements are affected. The distribution of those costs cannot be quantified from the published record, but the transmission mechanisms are identifiable.
There is also a political and legal cost. Belarusian opposition communities and Ukrainian residents cannot be treated collectively as intelligence risks because individuals from those nationalities appear in criminal investigations. Such an approach would undermine lawful cooperation and potentially discourage reporting of coercion. The Council of Europe’s Resolution 2669 of 25 June 2026, addressing transnational repression, reinforces the need for protective reporting mechanisms and proportionate state responses. The security value of credible community cooperation belongs in the same institutional calculation as surveillance authority and criminal prosecution. Fighting Back against Transnational Repression — Parliamentary Assembly of the Council of Europe, June 2026.
By November 2028, the relevant measure of progress will not be the volume of public warnings or the severity of announced penalties. It will be whether Poland and its European partners can demonstrate faster lawful evidence acquisition, more reliable identification of foreign intelligence direction, effective interruption of serious preparations and documented continuity of essential services. The cost of failing that test will be borne by taxpayers, infrastructure companies, workers and allied logistical systems—not by the organisations that can commission an operation remotely and leave European institutions to finance its consequences.
Navigational Index
Pillar I — Intelligence Architecture, Recruitment and Operational Penetration
Chapter 1. Belarusian Intelligence Institutions and the Evolution of Extraterritorial Operations : The institutional roles of the Belarusian KGB and military intelligence; state-security objectives; the relationship with Russian intelligence services; and the evidentiary limits of attributing individual operations to specific organisations.
Chapter 2. Recruitment Mechanisms and the Transformation of Civilian Intermediaries into Intelligence Assets : Digital recruitment, low-value assignments, financial inducement, task escalation, identity collection, coercion risks, compartmentalisation and the distinction between deliberate participation and manipulated cooperation.
Chapter 3. Poland’s Documented Espionage Networks: Arrests, Prosecutions and Operational Lessons : Counterintelligence investigations involving Belarusian and Russian intelligence interests; prosecution records; military reconnaissance; diaspora surveillance; infrastructure photography; criminal convictions; and unresolved proceedings.
Pillar II — Infrastructure Exposure, Hybrid Escalation and European Security
Chapter 4. Critical Infrastructure and the Operational Geography of Hybrid Threats : Transport networks, military logistics, industrial facilities, defence-support infrastructure, communications systems and the particular significance of Polish territory to NATO’s eastern security architecture.
Chapter 5. From Intelligence Collection to Sabotage: Operational Escalation and Strategic Effects : The distinction between espionage and sabotage; documented arson and railway incidents; operational dependencies; cascading economic and security consequences; plausible escalation pathways; and evidentiary requirements for linking separate incidents.
Chapter 6. European and NATO Security Implications: National Responsibilities and Alliance Coordination : Separate assessments of Poland, Lithuania, Germany, Italy, France and the United Kingdom; EU criminal-justice and infrastructure-resilience instruments; NATO coordination; and the institutional limits of collective responses.
Pillar III — Counterintelligence Governance, Risk Indicators and Strategic Outlook
Chapter 7. Counterintelligence Law, Financial Tracing and Democratic Resilience : Polish criminal law, investigative authority, intelligence-sharing, suspicious financial flows, digital platforms, privacy safeguards, civil liberties and protection against hostile exploitation of migrant and opposition communities.
Chapter 8. Strategic Scenarios, Early-Warning Architecture and the 2026–2031 Outlook : Evidence-based future pathways, measurable warning indicators, operational response thresholds, policy alternatives, cross-border coordination requirements and a final integrated assessment of European institutional resilience.
Master Abstract
The central finding: recruitment is an operational process, not necessarily a single criminal act
The most consequential characteristic of contemporary intelligence activity conducted through civilian intermediaries is the separation between the apparent simplicity of an individual assignment and the strategic purpose of the organisation commissioning it. Taking a photograph, displaying a poster, producing a video or collecting publicly observable information may appear insignificant when examined independently. Within an intelligence-directed system, however, successive tasks can establish a person’s reliability, availability, geographic reach and willingness to accept progressively more intrusive instructions. The security significance arises from the relationship between the assignment, the coordinator, the intended recipient of the information and any subsequent operational use.
This mechanism is not merely theoretical. On 2 July 2026, Poland’s National Public Prosecutor’s Office announced charges against a Belarusian citizen, Aliaksei B., and a Polish citizen, Rafał G., in an investigation concerning activity for a foreign intelligence service. Prosecutors described recruitment of individuals of different nationalities through Telegram, assignments involving photographic documentation, posters and graffiti, remuneration through a cryptocurrency wallet, and continued availability for additional instructions. The underlying investigation concerned activities between March 2024 and February 2025, while the charges announced against the two individuals concerned alleged conduct during 2024–2025. National Public Prosecutor’s Office — 2 July 2026. Portal Gov.pl
The analytical implication is substantial: counterintelligence assessments cannot rely solely on the immediate physical consequences of a task. They must assess the continuity of instruction, the source of payment, the operational destination of information and the possibility of subsequent tasking. At the same time, a small paid assignment is not, by itself, evidence of espionage. Attribution requires corroborating evidence of intelligence direction or an applicable criminal offence.
Belarusian operations extend beyond opposition surveillance
Polish official records demonstrate that Belarusian intelligence-related investigations encompass at least two distinct strategic functions. The first concerns surveillance of Belarusian opposition communities abroad. In August 2024, prosecutors reported that a Belarusian citizen identified as Daria A. had been indicted for allegedly providing information about organisations supporting the Belarusian opposition, including their activities, structures and financing. Prosecutors stated that Belarusian authorities subsequently exploited such information in political propaganda. This establishes the importance of diaspora-related collection within the publicly documented case, although the existence of an indictment must not be conflated with a final conviction. National Public Prosecutor’s Office — 2 August 2024. Portal Gov.pl
The second function concerns defence and infrastructure intelligence. On 9 February 2026, Poland’s Internal Security Agency arrested Pavel T., a Belarusian citizen suspected of participating in Belarusian military intelligence activities from June 2024 to February 2026 across Poland, Germany and Lithuania. Investigators identified the reconnaissance of critical infrastructure and facilities important to Polish and NATO defence as the alleged activity. Cooperation between Poland’s ABW, Germany’s Federal Office for the Protection of the Constitution and Lithuania’s State Security Department contributed to the investigation. These proceedings demonstrate a documented multinational counterintelligence concern, without establishing that all Belarusian and Russian intelligence operations operate under a unified command structure. National Public Prosecutor’s Office — 23 February 2026. Portal Gov.pl
The escalation problem: tactical expendability and strategic damage
Foreign intelligence-directed sabotage presents an asymmetry between the resources required to engage an intermediary and the consequences that a successful operation may generate. This becomes particularly significant where commercially accessible locations or civilian transport infrastructure intersect with defence logistics, public safety and economic continuity.
On 2 April 2026, Polish prosecutors disclosed an indictment involving five individuals in an investigation of Russian intelligence-directed arson and sabotage activities. The proceedings encompassed the April 2024 OBI fire in Warsaw, the May 2024 IKEA fire in Vilnius, the May 2024 Marywilska 44 fire in Warsaw and preparations for an additional operation in Riga. The prosecution distinguished completed incidents from attempted or preparatory conduct and acknowledged that direct perpetrators of the Marywilska 44 arson remained unidentified. This distinction is essential: evidence of an organised sabotage framework does not establish identical perpetrators, command channels or operational methods in every incident. National Public Prosecutor’s Office — 2 April 2026. Portal Gov.pl
The November 2025 railway incidents illustrate a different category of consequence. Prosecutors described explosive damage to railway infrastructure near Mika, disruption of traction infrastructure near Gołąb and direct danger to railway traffic. Their investigation alleged that two Ukrainian citizens carried out the attacks for Russian intelligence and subsequently fled to Belarus. The alleged nationality of direct participants must be separated from the intelligence service directing the activity, and allegations against individuals must remain subject to the applicable judicial process. National Public Prosecutor’s Office — 19 November 2025. Portal Gov.pl
The strategic issue for European governments
The relevant security perimeter is no longer adequately described by the geographical location of an intelligence service or the nationality of its officers. It is determined by the ability to direct, finance and exploit individuals operating inside allied jurisdictions. Poland’s territory is particularly important because of its defence responsibilities, eastern-border exposure and supporting role in European security. However, the February 2026 investigation involving Germany and Lithuania, together with documented investigations of sabotage activity across multiple EU states, demonstrates that the issue cannot be addressed exclusively through national security measures.
For the EU, the challenge concerns institutional coordination, protection of critical entities, investigation of transnational networks and the management of information manipulation. For NATO, it concerns the security of military-support infrastructure and the consequences of interference with allied readiness and mobility. For national governments, it concerns reconciling effective prevention with judicial standards, fundamental rights, financial oversight and the protection of vulnerable communities from foreign coercion.
The strategic assessment therefore centres on three questions: whether small compensated tasks form part of a directed recruitment process; whether subsequent assignments create access to strategically relevant information or facilities; and whether intelligence coordination can identify dangerous transitions before physical sabotage occurs. These questions are more consequential than the nominal amount paid for an isolated assignment, particularly where the public record does not yet establish the scale or command structure of a newly alleged recruitment campaign.
Key Evidence Table
The following evidence establishes the documented operational baseline. Allegations, criminal charges, indictments and convictions are distinguished because they represent different procedural and evidentiary stages.
| Indicator | Value/status | Reference date | Definition/scope | Issuer | Exact source |
|---|---|---|---|---|---|
| Recruitment for foreign intelligence activity | 2 individuals charged | 2 Jul 2026 | Belarusian and Polish suspects; recruitment through Telegram, photographs, posters, graffiti and cryptocurrency payments | National Public Prosecutor’s Office | Official announcement |
| Suspected Belarusian military intelligence activity | 1 suspect arrested | 9 Feb 2026 | Alleged reconnaissance in Poland, Germany and Lithuania during Jun 2024–Feb 2026 | ABW / National Public Prosecutor’s Office | Official announcement |
| Belarusian intelligence espionage prosecution | 1 woman indicted | 25 Jul 2024 | Alleged collection concerning organisations supporting Belarusian opposition movements | National Public Prosecutor’s Office | Official indictment announcement |
| Belarusian military intelligence conviction | Sentence increased to 4 years | 28 Mar 2025 | Appeal concerning Andrei R.; retrial ordered for the second defendant after an earlier acquittal | Poznań District Prosecutor’s Office | Appeal decision announcement |
| Foreign intelligence-directed arson investigations | 5 individuals indicted | 25 Mar 2026 | Proceedings involving Poland, Lithuania and preparations concerning Latvia | National Public Prosecutor’s Office | Official indictment announcement |
| Railway sabotage | 2 suspected direct perpetrators | 15–16 Nov 2025 | Explosive and other damage affecting railway infrastructure on Line 7 | National Public Prosecutor’s Office | Official investigation announcement |
| Belarusian citizen accused of preparing sabotage | 1 individual indicted | 27 Jul 2026 | Alleged warehouse reconnaissance and arson preparation; cryptocurrency remuneration | ABW | Official announcement |
| EU restrictive measures against Russian destabilisation | 80 individuals, 20 entities | 8 Oct 2026 | Sanctions listings under the EU framework addressing Russian destabilising activities abroad | Council of the EU | Council decision announcement |
Evidence status: Publicly disclosed official records. Counts refer to individual proceedings or sanctions listings and must not be added together to infer the number of unique intelligence operatives, networks or incidents. Criminal allegations are not equivalent to judicial findings of guilt.
Competing Operational Explanations and Pathways
Three distinct, potentially overlapping explanations are relevant to the assessment of small paid assignments linked to suspected intelligence recruitment.
| Explanation | Diagnostic support | Disconfirming evidence or limitation | Observable indicators | Current standing |
|---|---|---|---|---|
| Intelligence-directed recruitment and task escalation | Officially documented use of intermediary recruitment, photographs, propaganda tasks, payments and subsequent instructions | Individual leaflet campaigns cannot automatically be attributed to a particular intelligence service | Repeated tasking, identifiable coordination, links to intelligence-controlled accounts, increasingly sensitive assignments | Established as an operational pattern in documented investigations; attribution of a particular new campaign remains unresolved |
| Information manipulation without subsequent physical sabotage | Documented propaganda-related intelligence activity and poster or graffiti assignments | Disinformation activity does not by itself prove planned sabotage | Coordinated messaging, repeated distribution, political targeting, absence of subsequent infrastructure-related instructions | Credible alternative or parallel function |
| Criminal or opportunistic intermediary activity without verified state direction | Small payments and remote assignments are not uniquely characteristic of intelligence operations | Evidence of a foreign intelligence coordinator would substantially weaken this explanation | Independent financial motivation, absence of intelligence links, no coherent sequence of sensitive tasking | Requires investigation on a case-by-case basis |
The existence of an intelligence recruitment methodology does not prove that every observed activity employs it. The decisive differentiators are attribution, continuity of command, the nature of the requested information and the demonstrable relationship between individual actions and an external intelligence requirement.
Principal Intelligence Gaps and Watch Indicators
Attribution and command architecture
The most consequential unresolved issue is whether newly alleged recruitment activity can be connected through authenticated communications, financial evidence or competent investigative findings to the Belarusian KGB, Belarusian military intelligence, Russian intelligence or independent intermediaries.
A confirmed attribution would materially affect the appropriate national and international response. Without such evidence, organisational responsibility should remain provisional.
Recruitment scale and financial mechanisms
The number of individuals approached, the proportion accepting assignments, the geographic concentration of activities and the financial resources available to organisers are not established by the official records examined. Consequently, neither the operational scale of a new campaign nor any numerical estimate of its success rate is defensible.
Relevant indicators include repeated use of common tasking channels, coordinated payment patterns and independently corroborated connections between initial recruitment and later operational instructions.
Operational escalation and infrastructure exposure
The principal warning indicator is a documented progression from low-consequence tasks to collection concerning sensitive facilities, security procedures, defence-related logistics or preparations for physical interference.
No assumption should be made that all intelligence-directed collection necessarily culminates in sabotage. A network may remain focused on information acquisition, influence activity or monitoring of opposition communities.
Cross-border coordination
Investigations involving Poland, Germany and Lithuania demonstrate the importance of cooperation between national services. Further assessment should examine whether intelligence and judicial coordination can reliably connect activities dispersed across multiple jurisdictions before those activities produce strategic effects.
Protection of diaspora communities and social cohesion
Foreign intelligence services can exploit financial vulnerability, identity information, personal relationships and concerns about relatives abroad. Such mechanisms warrant investigation where supported by evidence, but they do not justify a presumption of suspicion toward Belarusian or Ukrainian residents collectively.
Early reporting pathways, confidential protection mechanisms and proportionate investigative safeguards are therefore part of the security architecture, not secondary humanitarian considerations.
Strategic Decision Implications
The policy question is not simply whether European governments should increase surveillance of suspicious activity. It is how to establish an intelligence-led system capable of detecting hostile coordination while preserving the legal distinction between ordinary civilian conduct and participation in a foreign intelligence operation.
For Poland, the priority concerns coordination between counterintelligence, prosecutors, infrastructure operators and military-security authorities, particularly where civilian and defence-related systems intersect. For Germany and Lithuania, documented cross-border investigations make the timely exchange of actionable evidence especially relevant. For Italy, France and the United Kingdom, the principal assessment requirement is to examine whether comparable recruitment mechanisms could affect their own military-support infrastructure, transport systems and strategic industries; the Polish evidence does not independently establish equivalent operational penetration in those countries.
At EU level, investigative cooperation, infrastructure resilience, financial-tracing mechanisms and responses to foreign information manipulation have complementary functions. The Council’s 8 October 2026 decision to extend restrictive measures against Russian destabilising activities until 9 October 2027, covering 80 individuals and 20 entities, demonstrates an existing EU-level response, but sanctions listings are not a substitute for identifying and disrupting individual operational networks. Russia’s Hybrid Activities: Council Prolongs Restrictive Measures until October 2027 — Council of the European Union — October 2026. Consilium
For NATO, the strategic concern is the possible exploitation of civilian access to infrastructure supporting allied mobility, preparedness and sustainment. Counterintelligence cooperation must therefore account for activities that are individually small but operationally connected, without presuming that every suspicious incident is attributable to the same state or command structure.
The central intelligence judgment is that the documented threat is not the isolated recruitment assignment, but the capacity of foreign intelligence networks to convert dispersed civilian activity into coordinated intelligence or sabotage capability. Identifying that conversion early is the essential preventive requirement for European security institutions.
Dashboard :
PILLAR I — INTELLIGENCE ARCHITECTURE, RECRUITMENT AND OPERATIONAL PENETRATION
Belarusian State-Security Operations, Russian Intelligence Networks and the Penetration of European Civilian Environments
Institutional Intelligence Assessment | Poland–Belarus–Russia | 2022–2026 | Strategic Outlook 2026–2031
Chapter 1. Belarusian Intelligence Institutions and the Evolution of Extraterritorial Operations
Principal judgment: Belarusian intelligence activity affecting Poland cannot be understood exclusively as an extension of Russian intelligence operations, nor can it be assessed as an entirely separate national-security system. Official Polish investigations establish distinct activity attributed to Belarusian state-security and military intelligence services, while other proceedings identify Russian intelligence structures employing Belarusian nationals and intermediaries. This distinction is operationally consequential: shared strategic interests, military integration and the nationality of recruited individuals do not establish common command, identical intelligence requirements or institutional responsibility for a particular operation.
The Belarusian security apparatus: institutional functions and strategic priorities
Belarus maintains a state-security structure in which domestic political surveillance, counterintelligence, external intelligence collection and military-security functions exist within a highly centralised political environment. The State Security Committee of the Republic of Belarus, conventionally designated KGB, occupies a central position in this architecture. Its institutional responsibilities encompass state-security and counterintelligence functions, while military intelligence operates through the Belarusian defence establishment. These organisations have different areas of competence, although intelligence requirements concerning opposition organisations, military infrastructure, external political relationships and national defence can overlap. The European Union has described Belarusian state institutions as operating within a political system characterised by extensive restrictions on independent political activity, suppression of civil society and transnational pressure on dissidents. That assessment is relevant to the intelligence environment because it provides a documented political context for collection activity directed at Belarusian communities outside the country, rather than demonstrating the internal operational orders of any particular service. The European Union and Belarus — European External Action Service — October 2024; Time for Accountability and Justice: Rule of Law under Threat in Belarus — European External Action Service — September 2025.
The institutional significance of the Belarusian KGB is therefore not limited to conventional foreign espionage. For a government whose political-security system treats organised opposition as a domestic security concern, the movement of politically active citizens beyond national borders does not necessarily remove them from the attention of security institutions. Information about organisations, funding structures, political contacts and public activities abroad can retain domestic political value in Belarus. Such information may support surveillance, administrative or criminal pressure, identification of relationships between organisations, or official narratives intended to discredit opposition groups. The specific use to which information is put, however, must be established from the relevant investigation rather than assumed from the broader political environment.
This distinction is demonstrated by the Warsaw prosecution involving Daria A. According to Poland’s National Public Prosecutor’s Office, the defendant allegedly transmitted information during 2023 to officers of the Belarusian state-security committee concerning organisations supporting the Belarusian opposition, including their organisational structures, activities and financing. Prosecutors further stated that Belarusian authorities subsequently used the material in political messaging portraying opposition organisations as extremist and alleging Polish involvement in preparing hostile activity against Belarusian infrastructure. The case illustrates a possible functional relationship between intelligence collection and political-information operations: information obtained through an intelligence channel may subsequently be used to formulate or support a public state narrative. The official record establishes the prosecution’s allegation and the institution to which the activity was attributed; it does not disclose the complete intelligence tasking process, internal authorisation chain or all downstream uses of the collected information. Akt oskarżenia przeciwko obywatelce Białorusi oskarżonej o szpiegostwo — Prokuratura Krajowa — August 2024.
Belarusian military intelligence presents a different operational problem. Whereas monitoring opposition organisations produces information relevant to the political-security interests of the Belarusian government, military reconnaissance can produce information directly relevant to the defence of neighbouring states and their allies. Military-support facilities, critical infrastructure and strategically significant civilian installations can become collection subjects because their condition, activities or supporting functions may affect military preparedness. The public record does not establish the internal structure of Belarusian military intelligence in sufficient detail to reconstruct its directorates, regional networks, operational staffing or exact relationship with the KGB. Nevertheless, Poland’s February 2026 investigation provides direct official evidence that Belarusian military intelligence, rather than the KGB alone, forms part of the threat environment affecting NATO countries.
In that investigation, Polish authorities alleged that Pavel T., a Belarusian citizen arrested on 9 February 2026, participated between June 2024 and February 2026 in intelligence activity involving locations in Poland, Germany and Lithuania. The stated objects of interest included critical infrastructure and facilities important to the defence of Poland and NATO. The National Public Prosecutor’s Office identified Belarusian military intelligence as the beneficiary of the alleged activity, and stated that cooperation between Poland’s Internal Security Agency, Germany’s Federal Office for the Protection of the Constitution and Lithuania’s State Security Department contributed to the investigation. This is a concrete institutional attribution by a competent prosecuting authority, although the underlying intelligence, the extent of the alleged network and any resulting judicial findings must be distinguished from the charges themselves. Zarzut dla obywatela Białorusi za szpiegostwo na rzecz białoruskiego wywiadu wojskowego — Prokuratura Krajowa — February 2026; Zatrzymanie obywatela Białorusi — Polish Special Services — February 2026.
Institutional separation between political intelligence, military intelligence and Russian-directed operations
A defensible assessment of Belarusian intelligence requires separating institutional identity from operational association. There are at least three analytically distinct categories: activity attributed directly to Belarusian state-security structures, activity attributed directly to Belarusian military intelligence, and activity attributed to Russian intelligence in which Belarusian citizens or Belarusian territory are involved. Treating these categories as interchangeable would distort the available evidence, particularly where prosecutors identify the receiving service or the nationality of participants but do not publish the entire command hierarchy.
| Intelligence or security actor | Documented institutional or operational function | Evidentiary example | Implication for attribution | Official record |
|---|---|---|---|---|
| Belarusian KGB / State Security Committee | State-security functions and intelligence-related activity concerning political organisations | Daria A. prosecution concerning Belarusian opposition-support organisations | Identifies alleged Belarusian state-security interests; does not establish participation in every military or sabotage case | Prokuratura Krajowa, August 2024 |
| Belarusian military intelligence | Military and defence-related intelligence collection | Pavel T. investigation concerning facilities in Poland, Germany and Lithuania | Explicitly attributed to Belarusian military intelligence by Polish authorities | Prokuratura Krajowa, February 2026 |
| Russian Federal Security Service (FSB) | Russian intelligence activity involving clandestine networks in Poland | ABW identified an alleged Russian FSB-linked organiser of a multinational espionage and sabotage network | Establishes a separate Russian institutional connection, notwithstanding Belarusian participation | ABW, camera-network investigation |
| Russian intelligence networks employing foreign nationals | Recruitment, reconnaissance, propaganda and sabotage-related activity | Lublin proceedings involving Ukrainian, Belarusian and Russian participants | Recruited nationality is not a reliable indicator of the directing intelligence service | Prokuratura Krajowa, Russian-directed network investigation |
| Polish ABW and prosecutors | Counterintelligence investigation, evidence collection and criminal prosecution within their respective legal competences | Investigations and proceedings disclosed between 2022 and 2026 | Establishes the official evidentiary and procedural basis for publicly attributed cases | Prokuratura Krajowa, February 2026 |
The distinction between Belarusian and Russian intelligence is particularly important because different institutions may pursue overlapping political or military objectives without using identical networks. A Belarusian state-security service may be interested in opposition organisations, their financial supporters or political relationships, while Belarusian military intelligence may seek information relevant to neighbouring armed forces. Russian intelligence may separately direct sabotage-oriented networks involving people of several nationalities. These activities can reinforce the strategic interests of both governments without necessarily requiring a single operational headquarters. Conversely, the absence of a publicly disclosed Belarusian intelligence officer in a Russian-directed network does not establish that Belarusian services had no knowledge of the activity. Both propositions require evidence that the public record may not contain.
This evidentiary separation also matters when assessing activities conducted from Belarusian territory. A suspect’s departure through Belarus, a communication link with a person located there, or the use of Belarusian infrastructure may provide relevant investigative leads. None automatically establishes that the Belarusian KGB ordered, financed or controlled the activity. Intelligence attribution requires identifying the organisational relationship between the person issuing instructions, the resources supporting those instructions and the state institution ultimately receiving or exploiting their results. This is particularly important when one government is closely aligned with another but maintains its own security institutions.
The Russia–Belarus relationship: strategic integration without automatic operational identity
The relationship between Minsk and Moscow is central to the regional intelligence environment because Belarus occupies a geographical and military position directly affecting Poland, Lithuania and Ukraine. NATO’s official assessment identifies Belarusian support for Russia’s war against Ukraine, including the provision of territory and infrastructure, and describes deepening Russian–Belarusian military integration as a concern for Alliance security. The European External Action Service also records Belarus’s participation in Russia’s war-related security environment and the deterioration of EU–Belarus relations after February 2022. These institutional positions establish substantial military and geopolitical alignment; they do not, on their own, document the exact command relationships governing individual clandestine operations inside Poland. Relations with Russia — NATO; The European Union and Belarus — European External Action Service — October 2024.
Military integration has several consequences for intelligence assessment. First, overlapping defence interests increase the likelihood that both countries value information concerning NATO military activity, transport infrastructure and regional security arrangements. Second, shared strategic objectives can generate similar collection priorities even where intelligence organisations operate separately. Third, the movement of forces, equipment and military support through territories bordering Belarus creates an environment in which apparently civilian infrastructure can acquire military relevance. Fourth, the political relationship provides a basis for cooperation but does not reveal the extent of shared databases, operational exchanges, financing arrangements or direct tasking relationships between particular services.
The documented Russian-directed network in Poland illustrates this problem from another direction. In a public communication concerning the so-called camera-network investigation, Poland’s ABW stated that investigators had identified a Russian national linked to the FSB who allegedly established, financed and directed a criminal network operating in Poland. ABW described a group comprising at least 30 individuals, with activities including espionage, sabotage-related preparations and propaganda. The agency also reported that 16 members had been detained in 2023, including 12 Ukrainian citizens, three Belarusian citizens and one Russian citizen. These figures establish a multinational recruitment profile within a case publicly attributed to Russian intelligence. They cannot be used to calculate the share of Belarusian recruits across all operations, nor do they justify assigning a Belarusian institutional identity to that network. Kolejne zarzuty w sprawie działalności siatki szpiegowskiej, tzw. „kamerkowców” — Agencja Bezpieczeństwa Wewnętrznego.
The national composition is analytically significant because it demonstrates how the distinction between the directing service and the person carrying out an assignment can become obscured in public discussion. The nationality of a person conducting reconnaissance does not establish the nationality of the intelligence organisation commissioning it. Nor does the presence of multiple nationalities prove a deliberate strategy to provoke hostility between those national communities. Such a strategy may be compatible with information-manipulation objectives, but it must be established through documentary evidence or a sufficiently clear pattern of attributed operations before being presented as an operational intention.
The evolution of the Belarus-related threat after 2020
The political developments following Belarus’s August 2020 presidential election altered the European security relationship with Minsk. The European Union rejected the legitimacy of the electoral process, condemned the repression of peaceful demonstrators and opposition actors, and redirected significant elements of its engagement toward Belarusian society and civil organisations rather than the authorities. The subsequent Russian invasion of Ukraine in February 2022 added a military-security dimension to an already deteriorated political relationship. Belarusian territory and infrastructure became part of the documented environment supporting Russia’s military campaign, while Poland and Lithuania remained geographically exposed to the resulting confrontation between Russian–Belarusian security interests and NATO’s eastern members. The European Union and Belarus — European External Action Service — October 2024.
The evolution of extraterritorial security activity therefore needs to be understood through two related but separate developments. The first is political: Belarusian opposition structures, independent media organisations and supporting networks increasingly operated beyond the immediate control of domestic Belarusian authorities. This created enduring incentives for information collection concerning people and organisations outside Belarus. The second is military: the war in Ukraine and the resulting regional security environment increased the importance of Polish and allied infrastructure to the Russian–Belarusian strategic relationship. The combination broadens the subjects that may attract intelligence interest, but it does not establish that a single recruitment network serves both functions.
European institutions continued to document transnational repression in 2026. In a statement before the United Nations Human Rights Council on 29 June 2026, the EU identified repression extending beyond Belarus, alongside restrictions on civil society and misuse of anti-extremism and anti-terrorism mechanisms. In a separate institutional statement in September 2025, the EEAS described politically motivated proceedings and intimidation affecting Belarusians living abroad. These observations support the conclusion that extraterritorial political-security pressure forms part of the Belarusian government’s documented external conduct. They do not provide a public inventory of KGB personnel, covert networks or operational expenditures. HRC 62: EU Statement on the Situation of Human Rights in Belarus — European External Action Service — June 2026; Time for Accountability and Justice: Rule of Law under Threat in Belarus — European External Action Service — September 2025.
The relationship between domestic repression and foreign intelligence operations is therefore institutionally plausible and supported in part by documented proceedings, but it is not universally demonstrable for every overseas activity. Information gathered about opposition organisations can be relevant to political control, while information concerning military facilities can be relevant to defence planning. The strategic overlap lies in the ability of intelligence services to pursue those objectives beyond national borders through networks that operate within foreign civilian environments.
Attribution standards and limits of the open official record
A rigorous assessment must distinguish evidence of an intelligence activity from evidence identifying the institution directing it. Polish prosecutorial documentation often provides the legal characterisation of alleged conduct, the period and location of activity, the individuals charged, and the intelligence service to which investigators attribute the activity. It does not necessarily disclose the underlying communications, technical intelligence, financial records, witness testimony or intelligence-sharing material supporting that attribution. Such omissions may reflect investigative confidentiality rather than evidentiary weakness, but they limit the independent conclusions that can be reached from open sources.
Four levels of attribution are useful for institutional reporting. Individual attribution identifies the person alleged or proven to have conducted an act. Network attribution connects that individual to coordinators or other participants. Service attribution identifies the intelligence organisation directing or benefiting from the activity. State-policy attribution establishes the relationship between that activity and decisions made by competent political or security authorities. A case may provide strong evidence at one level and limited information at another. For example, a criminal conviction can establish an individual’s participation in espionage without publicly resolving every question about the strategic decisions of the foreign government concerned.
| Attribution level | Evidence required for a defensible conclusion | What official Polish records can establish | What must remain unresolved without further evidence |
|---|---|---|---|
| Individual conduct | Witness evidence, communications, recordings, forensic findings or judicial determinations | Arrests, allegations, prosecutions and convictions, depending on procedural stage | Undisclosed conduct or untested allegations |
| Network organisation | Documented relationships between participants and coordinators | Group membership, recruitment and operational relationships alleged or proven in particular cases | Complete network membership and undiscovered cells |
| Intelligence-service responsibility | Competent investigative attribution supported by case evidence | Named Belarusian or Russian service in official announcements | Full internal tasking and undisclosed inter-service cooperation |
| Political authorisation | Documentary or other reliable evidence connecting operations to state-level decisions | Broad state-security context and official institutional positions | Specific executive instructions for individual clandestine operations |
| Strategic intent | Corroborated evidence of objectives, targets and anticipated effects | Identified intelligence interests and attributed operational activity | Unpublished campaign plans and future operational decisions |
The distinction has a direct consequence for the assessment of newly reported recruitment activity. A campaign involving provocative publications, modest payments and subsequent requests concerning facilities may be consistent with documented recruitment mechanisms. It would nevertheless require independently attributable communications, payment information, investigative findings or other competent evidence before being classified as a confirmed KGB operation. Similarity of technique is supporting context, not conclusive organisational identification.
Key judgments — Chapter 1
Belarusian state-security activity and Belarusian military intelligence represent distinguishable components of the external threat environment documented by Polish authorities. Russia’s intelligence services constitute an additional operational actor, including in cases involving Belarusian nationals. Military and political alignment between Moscow and Minsk increases the relevance of shared strategic interests, but published evidence does not permit a blanket inference of unified clandestine command. The most important analytical distinction is therefore between a state-security objective, the intelligence institution pursuing it, the recruited person carrying out the task and the evidence demonstrating the relationship among them.
What would change the assessment
The principal institutional judgment would change if a court record, official investigation or disclosed intelligence document established direct operational integration between specific Belarusian and Russian recruitment networks, identified a common command structure, or demonstrated that one intelligence service systematically delegated external missions to another. Conversely, evidence that apparently related campaigns were independently organised, privately motivated or falsely attributed would require narrowing the assumed degree of coordination.
Open official record
The consequential missing records concern the operational command relationships between Belarusian intelligence institutions, documented financial channels connecting external recruits to those institutions, and any publicly releasable findings concerning cross-border intelligence cooperation with Russia. The available official evidence establishes differentiated institutional activity but does not permit reconstruction of the Belarusian clandestine intelligence system as a complete organisational chart.
Chapter 2. Recruitment Mechanisms and the Transformation of Civilian Intermediaries into Intelligence Assets
Principal judgment: The defining operational feature of digitally mediated intelligence recruitment is the ability to separate the person commissioning an assignment from the individual executing it, while preserving sufficient communication, financial and organisational control to obtain useful results. Polish investigations demonstrate that foreign intelligence networks have employed remote coordinators, remunerated civilian assignments, photographic collection, propaganda tasks and arrangements for further instructions. The security problem is not the monetary value or apparent simplicity of an initial task, but the circumstances in which a sequence of assignments establishes an intelligence relationship and creates opportunities for more consequential activity.
Recruitment economics: why low-cost assignments create disproportionate security exposure
The economics of civilian intermediary recruitment differ substantially from the traditional conception of espionage based on trained intelligence officers, diplomatic cover or privileged institutional access. A foreign intelligence organisation seeking information about an accessible location does not necessarily need to deploy an officer into the target country if a locally present individual can provide the required observation. The same principle applies to certain information-manipulation activities and preparatory actions that do not demand specialised training. The recruited individual supplies physical presence, access to ordinary civilian environments and the ability to perform a specific task, while a remote coordinator supplies instructions, selection criteria and payment. This division potentially reduces the direct operational exposure of the organisation commissioning the activity, although it can also create vulnerabilities through communications, financial transfers and human error.
The official Polish case record provides direct evidence of this operating model. The National Public Prosecutor’s Office announced on 2 July 2026 that Aliaksei B., a Belarusian citizen, and Rafał G., a Polish citizen, had been charged with activity for a foreign intelligence service during 2024–2025. Investigators described the recruitment of individuals of different nationalities through Telegram, the production and transmission of photographs relating to critical infrastructure and strategically relevant facilities, the placement of posters and graffiti, cryptocurrency payments and readiness to accept subsequent assignments. The reported functions of the network therefore extended beyond one form of information collection: they combined intelligence-related observation, propaganda activity and the maintenance of a pool of individuals available for further direction. Kolejne zarzuty dla dwóch osób w śledztwie dotyczącym szpiegostwa i dywersji — Prokuratura Krajowa — July 2026.
The strategic significance of this combination lies in the potential flexibility of a decentralised recruitment structure. An individual capable of distributing materials is not necessarily capable of conducting technically useful reconnaissance, and a person who accepts a photographic assignment is not necessarily willing to participate in physical interference. Nevertheless, a remote coordinator can learn whether an individual responds to instructions, remains reachable, meets an agreed deadline and provides material of the requested type. These are general indicators of compliance and reliability, not evidence that a specific person has consented to espionage or will progress to sabotage. Their importance emerges when the same participant receives additional tasks whose nature, sensitivity or legal consequences materially change.
From the perspective of the commissioning organisation, recruitment creates potential access without necessarily creating permanent employment or a long-term financial obligation. From the recruited person’s perspective, however, the relationship can be materially less transparent. The individual may know only a pseudonym, a messaging account, a payment arrangement and a description of the immediate activity. The origin of the instructions, the intended recipient of the information and the possible use of that information may remain concealed. Such opacity can support deception, but it also complicates criminal attribution: investigators must determine whether the participant knew or intended to support a foreign intelligence activity, rather than assume that completion of a suspicious task conclusively establishes the necessary legal elements.
The financial dimension is equally important. A payment represents potential remuneration, but it can also establish a transactional connection between a coordinator and a participant. The format of that connection matters to investigators because it may preserve records of timing, recipients, account relationships or digital transfers. However, payment through cryptocurrency does not automatically make a transaction untraceable, and a conventional bank transfer does not automatically establish the true identity of the ultimate intelligence beneficiary. Both propositions depend on the specific financial infrastructure, intermediaries and evidence accessible to competent authorities. Official Polish investigations establish cryptocurrency remuneration in several cases; they do not disclose a complete comparative analysis of financial instruments used by every foreign intelligence network.
Distinguishing recruitment contact, participation and coercion
A critical limitation of many public assessments is the tendency to treat recruitment as a single event. In reality, the intelligence and legal significance of a contact can change as instructions, knowledge and behaviour develop. Receiving an unsolicited message is not equivalent to accepting an intelligence assignment. Accepting an apparently ordinary job is not necessarily equivalent to knowingly serving a foreign intelligence organisation. Performing a prohibited act under threats or deception raises questions materially different from voluntary participation in a clandestine operation. These distinctions are essential both for accurate counterintelligence assessment and for avoiding indiscriminate suspicion toward people approached by hostile actors.
The 2023 Polish legislative reform of espionage offences is relevant because it expanded the legal treatment of different forms of foreign intelligence activity. The amended Article 130 of the Polish Criminal Code distinguishes, among other matters, participation in or activity for a foreign intelligence service, the provision of information, declared readiness to act for a foreign intelligence service and certain organisational or preparatory forms of conduct. Its application remains dependent on the precise statutory elements and the evidence in each case. The current consolidated criminal code was officially published on 16 October 2026, incorporating the legal framework applicable at the report’s cut-off. Act of 17 August 2023 Amending the Criminal Code and Certain Other Acts — Polish Electronic Legal Information System — August 2023; Consolidated Text of the Criminal Code, Journal of Laws 2026 Item 1342 — Polish Electronic Legal Information System — October 2026.
For investigative purposes, the central analytical issue is whether an individual progresses from receiving an unexplained request to knowingly accepting activity directed against the interests of a state on behalf of a foreign intelligence service. Establishing that transition may require the content of communications, the nature of the requested task, statements made by the participant, corroborating financial evidence and the circumstances in which the activity occurred. Repeated assignments are relevant but cannot independently substitute for the elements of the offence. The distinction is particularly important when individuals are vulnerable to financial pressure, threats or manipulation, since the same outward action may conceal materially different degrees of knowledge and voluntariness.
An additional concern is the possibility of coercive retention after an initial assignment. Personal information, financial records, identifying documents or evidence of earlier cooperation could potentially become instruments of pressure. This is a plausible mechanism of coercion, not a universally established feature of the Polish cases. The publicly available prosecutorial materials do not provide sufficient evidence to determine how frequently coordinators resorted to blackmail, whether they systematically collected identity information for coercive purposes or what proportion of participants attempted to disengage after their first task. Such propositions should remain conditional until supported by disclosed evidence.
The wider Belarusian political environment makes protection against coercion an important institutional consideration. European Union statements have documented pressure on Belarusian political opponents and civil society actors abroad, including forms of transnational repression. That record supports concern about intimidation and vulnerability but does not justify treating Belarusian emigrants collectively as potential intelligence recruits. A sound security framework must distinguish people recruited voluntarily for unlawful activity from people approached, deceived, intimidated or pressured by a foreign organisation. The latter may be valuable witnesses or individuals requiring protection rather than presumptive offenders. HRC 62: EU Statement on the Situation of Human Rights in Belarus — European External Action Service — June 2026; Time for Accountability and Justice: Rule of Law under Threat in Belarus — European External Action Service — September 2025.
Digital platforms and the separation of operational functions
The documented use of Telegram in Polish investigations illustrates a broader change in the accessibility of remote tasking. A coordinator does not necessarily require a physical meeting, a conventional agent-handling relationship or continuous direct supervision to assign a task and receive its output. Messaging platforms can facilitate communication across borders, while digital financial instruments can support payment without the coordinator entering the target country. These characteristics can make small assignments administratively convenient and permit organisers to communicate with individuals located in different jurisdictions. They also create evidentiary opportunities for investigators, since relevant communications, account information, devices and financial records may be recoverable through lawful procedures.
The 2026 Aliaksei B. and Rafał G. investigation identifies several functions within one officially described structure: recruitment, information collection, visible propaganda activity, payment and availability for additional instructions. The prosecutor’s announcement does not establish that every participant performed every function. Nor does it establish how many coordinators existed, whether the same account controlled all assignments or whether the structure had direct contact with a named Belarusian intelligence officer. The central finding is narrower and more defensible: Poland has documented an investigation in which digital recruitment, compensated assignments and continued readiness to follow instructions were components of alleged activity for foreign intelligence. Kolejne zarzuty dla dwóch osób w śledztwie dotyczącym szpiegostwa i dywersji — Prokuratura Krajowa — July 2026.
This separation of functions also affects the interpretation of material collected by civilian intermediaries. A photograph of an accessible building is not necessarily sensitive in isolation. Its significance depends on whether it answers a particular intelligence requirement, contributes to a wider collection effort or supplies information not otherwise available at the required time. Equally, a poster or graffiti assignment may have limited direct intelligence value yet still be relevant as a paid act of political messaging or as part of an organisation’s documented relationship with a participant. The analytical error would be to presume that every propaganda task conceals a later sabotage mission. The opposite error would be to dismiss an established intelligence-directed task solely because its physical execution appears trivial.
The Polish government has recognised the broader problem publicly. In 2026, ABW and Polish public television developed the Cichy Front public-awareness initiative, which explains how seemingly innocuous online contact and small assignments can feature in hostile activity, including threats involving transport, energy and communications infrastructure. The campaign encourages members of the public to avoid direct confrontation, refrain from publishing sensitive observations that could interfere with an investigation, and report genuine concerns to the competent authorities. This is evidence of an official prevention approach; the campaign’s illustrative scenarios should not be mistaken for proof that every depicted recruitment sequence occurred exactly as shown in a particular investigation. Cichy Front — Agencja Bezpieczeństwa Wewnętrznego and Telewizja Polska — 2026.
An evidence-based model of recruitment progression
The following table separates observable conduct from the inference that investigators may reasonably consider. It is an analytical classification for defensive assessment, not a claim that all documented networks followed an identical sequence.
| Observed stage | Possible activity | What can legitimately be inferred | Evidence needed for stronger attribution | Principal analytical limitation |
|---|---|---|---|---|
| Initial contact | Unsolicited digital communication or offer of paid work | A recruitment approach may have occurred | Authenticated communications and identification of the sender | Many legitimate commercial contacts share superficial features |
| First remunerated assignment | Distribution, documentation or another limited task | A transactional relationship may have begun | Task content, instructions, payment records and context | Payment does not independently establish intelligence direction |
| Repeated compliance | Multiple assignments from a coordinator | An ongoing relationship may exist | Continuity of communication and corroborated task history | Repetition is not proof of hostile intent |
| Intelligence-related collection | Requests concerning facilities or activities relevant to security | The task may serve an intelligence requirement | Evidence of foreign intelligence direction and operational purpose | Publicly observable information is not automatically classified or criminal |
| Continued availability | Agreement to accept subsequent instructions | The coordinator may retain access to the participant | Communications demonstrating the nature and purpose of the arrangement | Future participation cannot be presumed from earlier acceptance |
| Sabotage-related preparation | Conduct linked to planned unlawful interference | A potential transition toward a more serious offence may have occurred | Competent investigative findings establishing intent and relevant preparatory conduct | Preparation must be distinguished from completed sabotage |
| Disengagement or cooperation with authorities | Refusal, reporting or provision of evidence | Opportunity to interrupt hostile activity and establish the facts | Documented communication with competent authorities | Initial contact does not establish criminal liability |
The progression model is useful because it explains why early reporting can be important even before an operation results in physical damage. It is equally useful because it prevents an undifferentiated interpretation of suspicious conduct. Each movement between categories requires new evidence. A person may refuse later instructions, remain unaware of the ultimate beneficiary, recognise the deception and report it, or be involved in an activity that is not intelligence-related at all. Operational assessment must preserve those possibilities.
Financial arrangements: transaction evidence, remuneration and investigative limits
The financial element of recruitment deserves separate treatment because small payments can be misinterpreted in two opposite ways. Their limited nominal value may lead observers to underestimate the activity, while their association with espionage investigations may lead others to interpret every comparable transfer as an intelligence payment. Neither interpretation is defensible without context. The value of a transaction does not necessarily reflect the value of information obtained, the seriousness of an intended offence or the resources available to the directing organisation. A payment can compensate a limited activity, reimburse expenses, retain a participant’s cooperation or support an organisational function whose purpose is not apparent from the transaction alone.
Polish official investigations provide concrete evidence of cryptocurrency-based remuneration. The July 2026 indictment of Vitalij S., a Belarusian citizen accused of preparing a sabotage operation, illustrates the relationship between a paid reconnaissance assignment and alleged subsequent unlawful intent. According to ABW, the defendant was tasked through Telegram, conducted reconnaissance of a warehouse, produced a recording and transmitted the material to the commissioning party. The agency stated that he received payment in cryptocurrency. Investigators alleged that the activity formed part of preparations for an arson attack that could have endangered property on a substantial scale. The individual was arrested on 13 August 2025, while the indictment reached court on 27 July 2026. The official record therefore describes both the investigative discovery of preparatory conduct and its subsequent legal development, without establishing a completed arson attack. Obywatel Białorusi oskarżony o planowanie aktu dywersji na zlecenie obcego wywiadu — Agencja Bezpieczeństwa Wewnętrznego — July 2026.
The case also demonstrates why financial evidence cannot be analysed independently of communications and conduct. Payment confirms a financial relationship if the transaction and its participants are sufficiently authenticated, but it does not necessarily identify the ultimate intelligence service. The nature of the assignment, the sequence of instructions and the criminal investigation’s attribution of the commissioning party are essential additional elements. In the Vitalij S. case, ABW publicly identified activity on behalf of a foreign intelligence service but did not, in the announcement examined, name the ultimate foreign service. The defendant’s Belarusian citizenship does not resolve that question.
| Financial or transactional question | Officially documented evidence | Information not established publicly | Decision relevance |
|---|---|---|---|
| Were recruits remunerated? | Yes, in the Russian-directed camera-network proceedings and other identified cases | Complete payment histories for every participant | Supports investigation of compensated operational relationships |
| Were cryptocurrencies used? | Yes, in the July 2026 recruitment investigation and the Vitalij S. case | Complete wallet ownership, exchange pathways and ultimate funding sources | Requires transaction evidence combined with communications and legal attribution |
| Did remuneration establish foreign intelligence direction? | Prosecutors described payments in investigations already attributed to foreign intelligence activity | Whether payment alone would independently establish direction | Prevents overreliance on financial indicators |
| Were participants financially dependent on the network? | Not established by the published case records | Income, debt, personal financial circumstances and sustained dependence | Relevant to coercion and voluntariness, but not inferable from payment records alone |
| Did organisers use financial information for blackmail? | Not established in the examined official announcements | Specific coercive communications and use of personal information | Requires independent evidence of threats or exploitation |
| What was the average assignment cost? | No verified official aggregate available | Comparable transaction-level dataset | No defensible aggregate cost or recruitment-efficiency estimate |
The financial evidence therefore supports a qualitative conclusion rather than a quantitative estimate of network economics. Officially reported cases demonstrate that payments form part of the mechanism, but the material examined does not establish the cost per successfully recruited participant, the financial scale of Belarusian or Russian operations, or a reliable comparison between different recruitment channels.
The legal boundary between ordinary work and participation in foreign intelligence
The Polish Criminal Code is relevant not only because it permits prosecution but because it provides the framework within which apparently ordinary actions acquire criminal significance. Article 130 addresses specified forms of participation in foreign intelligence activity and related conduct, with different requirements and penalties depending on the applicable subsection. The law does not transform every photograph, payment or online conversation into espionage. The factual relationship between an individual and the foreign intelligence activity remains central to determining whether an offence has been committed.
The August 2023 amendment is particularly material because Polish legislators expressly addressed the evolving security environment and changing methods of intelligence activity. The reform extended the statutory treatment of espionage beyond the narrower historical understanding of transmitting state secrets and established legal provisions covering other forms of foreign intelligence engagement. The consequence for investigators is that the timing of conduct, the applicable statutory wording and the precise allegations all matter. The consequence for public reporting is that a charge under Article 130 must be described by its specific legal basis rather than reduced indiscriminately to the word espionage. Act of 17 August 2023 Amending the Criminal Code and Certain Other Acts — Polish Electronic Legal Information System — August 2023; Consolidated Criminal Code — Polish Electronic Legal Information System — October 2026.
These distinctions also affect the treatment of people who report recruitment approaches. Effective prevention requires potential witnesses to understand that reporting suspicious contact is different from admitting criminal participation. A person approached by an unknown coordinator may have information valuable to investigators even if no assignment was accepted. Conversely, a participant who has knowingly performed unlawful acts may face criminal consequences notwithstanding subsequent cooperation. Competent authorities must assess those circumstances under the applicable law. Public communication should encourage early reporting without promising legal immunity that no general official record establishes.
Information manipulation as an independent operational objective
Paid propaganda activity should not automatically be treated as a preliminary stage of physical sabotage. It may serve a separate operational function: increasing social uncertainty, circulating false claims, provoking political reactions, creating misleading public evidence or supporting narratives advantageous to a foreign government. A network that combines propaganda distribution with information collection may be multifunctional, but the functions need not be causally sequential.
The July 2026 Polish investigation is significant because prosecutors described photographic material being exploited for propaganda purposes by the Belarusian authorities. This creates a documented link, within that investigation, between collection activity and political communication. The association differs from the claim that a specific poster or photograph necessarily preceded sabotage. It also differs from attributing every provocative leaflet to the Belarusian KGB. Investigators identified a foreign intelligence relationship and propaganda-related exploitation in a concrete case; extending that conclusion to another campaign would require additional evidence. Kolejne zarzuty dla dwóch osób w śledztwie dotyczącym szpiegostwa i dywersji — Prokuratura Krajowa — July 2026.
The distinction has consequences for public security and democratic resilience. A provocative publication can be intended to influence public perceptions even when it creates no direct physical danger. The use of national symbols, security-related language or references to occupation can potentially increase the apparent credibility or emotional impact of such material. Yet the presence of those elements is insufficient for attribution. Governments must distinguish genuine public-safety information, satire, political expression and demonstrably coordinated foreign intelligence activity. Failure to do so could undermine public confidence, interfere with legitimate expression and inadvertently amplify the message that a hostile actor intended to circulate.
Key judgments — Chapter 2
Digitally mediated recruitment provides foreign intelligence networks with a means of obtaining civilian access and task-specific information without routinely deploying personnel into the target jurisdiction. Polish official records establish cases involving Telegram coordination, photographic assignments, propaganda, cryptocurrency remuneration and preparation for additional instructions. These elements can coexist within a single investigation but should not be treated as a universal operational sequence. The decisive investigative distinction concerns knowledge, intent, direction and the verified relationship between the participant’s conduct and a foreign intelligence organisation.
What would change the assessment
The principal assessment would be strengthened by official disclosure of authenticated communications demonstrating a progression from initial paid assignments to more sensitive intelligence or sabotage-related instructions. It would be materially narrowed by evidence that suspected campaigns lacked foreign intelligence direction, involved independently motivated activity or were incorrectly linked through superficial similarities. A verified dataset covering recruitment attempts, accepted assignments, refusals, payments and subsequent conduct would also permit stronger conclusions about frequency and progression; such a dataset is not available in the official public record examined.
Open official record
The principal gaps concern the number of successful recruitment approaches, the scale of payments, the extent of coercive recruitment, the role of financial vulnerability, the operational identities of coordinators and the proportion of cases involving voluntary disengagement. These are material unknowns rather than values that can be estimated reliably from the individual investigations available.
Chapter 3. Poland’s Documented Espionage Networks: Arrests, Prosecutions and Operational Lessons
Principal judgment: The Polish counterintelligence record demonstrates that clandestine activity involving Belarusian and Russian intelligence interests has progressed beyond isolated incidents into documented criminal proceedings concerning organised networks, infrastructure reconnaissance, political surveillance and preparations for sabotage. The evidentiary value of these cases is not uniform. Some have resulted in convictions, others remain at the investigation or indictment stage, and several involve Russian-directed structures rather than operations attributed to Belarusian institutions. Distinguishing those categories reveals both the extent of the documented security problem and the limitations of claims about its overall scale.
The Polish prosecution record as a source of operational evidence
The Polish National Public Prosecutor’s Office and the Internal Security Agency have published a substantial record of investigations involving foreign intelligence activity since 2022. These official disclosures are unusually important for institutional analysis because they provide dates, locations, legal classifications, prosecutorial findings and, where proceedings have concluded, sentencing outcomes. They also demonstrate the difference between intelligence information that may exist within a security service and evidence that becomes publicly available through criminal proceedings. The public case record cannot be treated as a comprehensive inventory of hostile operations: it consists of matters detected, investigated and disclosed by Polish authorities, and its composition is influenced by investigative priorities, confidentiality requirements, prosecutorial decisions and judicial outcomes.
The principal documented cases can be divided into four evidentiary groups. The first consists of convictions establishing participation in foreign intelligence activity. The second consists of investigations or indictments explicitly attributed to Belarusian state-security or military intelligence. The third comprises Russian-directed networks in which Belarusian nationals participated alongside people of other nationalities. The fourth consists of proceedings involving foreign intelligence-directed preparations for sabotage, where the ultimate commissioning service may not have been publicly named. The categories overlap in subject matter but cannot be merged into a single count of Belarusian intelligence operatives.
This distinction is indispensable when reporting numerical findings. The original Lublin camera-network proceedings involved 16 detained and subsequently convicted individuals, while later investigations involved additional suspects connected to the broader structure. Those later individuals cannot automatically be included among the original 16, and the size of the suspected network cannot be presented as the number convicted. Similarly, a Belarusian national prosecuted for activity on behalf of Russian intelligence cannot be counted as a proven Belarusian KGB operative merely because of citizenship. The following sections preserve those distinctions.
The Lublin camera-network investigation: from a sixteen-person prosecution to a wider intelligence structure
The camera-network investigation represents one of the clearest officially documented examples of a foreign intelligence-directed network operating through civilian intermediaries in Poland. On 22 November 2023, the National Public Prosecutor’s Office announced an indictment against 16 individuals accused of participating in an organised criminal group and acting for foreign intelligence against Polish interests. According to the prosecution, the group’s activity between January and March 2023 included reconnaissance of critical infrastructure, military facilities and maritime ports, with operations extending across locations including Biała Podlaska, Chełm, Medyka, Przemyśl, Rzeszów and Warsaw. Participants provided information to their commissioning parties and received remuneration. The investigation was conducted in cooperation with ABW and attributed the network to Russian intelligence. Lubelski pion PZ PK skierował akt oskarżenia przeciwko 16 członkom siatki szpiegowskiej działającej na terytorium RP — Prokuratura Krajowa — November 2023.
The first group of convictions was announced on 19 December 2023, when prosecutors reported that 13 defendants had been sentenced by the Lublin Regional Court. The sentences ranged from one year and one month to six years’ imprisonment. The court also imposed financial penalties and ordered confiscation of criminal proceeds, while one defendant was dealt with under provisions applicable to minors. Subsequent official ABW reporting established that all 16 originally detained members had ultimately been convicted, with sanctions including imprisonment, fines and confiscation of financial benefits. These successive announcements must be read chronologically: the figure of 13 reflects the December 2023 judicial outcome, whereas the later figure of 16 reflects the subsequently reported result concerning the entire original detained group. Lubelski pion PZ PK doprowadził do skazania 13 członków siatki szpiegowskiej — Prokuratura Krajowa — December 2023; Kolejne zarzuty w sprawie działalności siatki szpiegowskiej, tzw. „kamerkowców” — Agencja Bezpieczeństwa Wewnętrznego.
The operational significance of the network is greater than the number of convicted participants. ABW subsequently described an organised structure comprising at least 30 individuals and stated that investigators identified a Russian citizen linked to the FSB who allegedly founded, financed and directed the organisation. The agency reported that the network’s activity included reconnaissance, propaganda and sabotage-related tasks, and that the investigation disrupted a planned attack on trains carrying weapons and humanitarian assistance to Ukraine. The latter statement is an official description of an allegedly prevented operation; it must not be converted into an assertion that an attack was successfully executed. Nor does the reported size of at least 30 persons mean that all those individuals were arrested, convicted or assigned identical functions. Kolejne zarzuty w sprawie działalności siatki szpiegowskiej, tzw. „kamerkowców” — Agencja Bezpieczeństwa Wewnętrznego.
The case demonstrates how an apparently dispersed collection effort can be relevant to a geographically extensive security problem. The locations identified in the prosecution record were not confined to a single border crossing or military installation. They included transport-related locations and critical infrastructure in different parts of Poland, suggesting a network capable of producing geographically distributed information. The significance lies less in the number of individual observations than in their possible combination by a directing organisation. Information from multiple locations can provide a broader picture of infrastructure conditions and activities than an isolated observation. That inference does not require reconstructing the network’s unpublished operational plan or identifying specific military movements.
The nationality data are also material. Official Polish disclosures identify the original 16 detained members as 12 Ukrainian citizens, three Belarusian citizens and one Russian citizen. The figures describe the composition of a particular detained group and not the demographics of foreign intelligence recruitment in Poland generally. They are insufficient to estimate the propensity of any national community to participate in espionage. The case instead establishes that a Russian-directed organisation could involve people of different nationalities and that the nationality of the recruited individual was not necessarily the nationality of the directing state. Zarzuty za organizowanie działalności rosyjskiego wywiadu w Polsce i kierowanie grupą szpiegowsko-dywersyjną — Prokuratura Krajowa.
Numerical reconstruction of the camera-network proceedings
| Procedural or operational indicator | Verified value | Relevant period | Interpretation | Official source |
|---|---|---|---|---|
| Originally indicted individuals | 16 | November 2023 | Original prosecution cohort | Prokuratura Krajowa, November 2023 |
| Ukrainian citizens among the original detained group | 12 | 2023 | Nationality within the detained cohort | ABW, camera-network investigation |
| Belarusian citizens among the original detained group | 3 | 2023 | Nationality within the detained cohort; not proof of Belarusian institutional direction | ABW, camera-network investigation |
| Russian citizens among the original detained group | 1 | 2023 | Nationality within the detained cohort | ABW, camera-network investigation |
| Convictions initially announced | 13 | December 2023 | First publicly announced judicial result | Prokuratura Krajowa, December 2023 |
| Original defendants subsequently reported convicted | 16 | Later ABW reporting | Total convictions concerning the original detained group | ABW, camera-network investigation |
| Reported imprisonment range | 13 months–6 years | Judicial outcomes | Sentence range, not an average | ABW, camera-network investigation |
| Broader suspected network | At least 30 individuals | Later investigation | Described network membership, not conviction total | ABW, camera-network investigation |
The figures support two different conclusions. Judicial proceedings established criminal liability for the original detained cohort, while the wider investigation identified a larger alleged organisation and suspected leadership links. The appropriate institutional interpretation is that the convictions validated a defined part of the network’s criminal activity, not that they established the full membership, total expenditure, complete command hierarchy or every intended operation of the larger structure.
The identification of alleged Russian network leadership
A subsequent National Public Prosecutor’s Office announcement identified Mikhail Mirgorodski as an alleged organiser directing activities from Russian territory for the Russian Federal Security Service. The prosecutor described a continuing investigation against eight individuals, including three Belarusian citizens, two Russian citizens, one Ukrainian citizen, one Polish citizen and one Lithuanian citizen. Four were additionally suspected of involvement in an organised criminal group. The announcement also made clear that many suspects could not be formally served with charges because they were outside Poland. These are allegations in an ongoing investigation, not convictions of the newly identified suspects. Zarzuty za organizowanie działalności rosyjskiego wywiadu w Polsce i kierowanie grupą szpiegowsko-dywersyjną — Prokuratura Krajowa.
The reported existence of a coordinator located outside Poland illustrates a central challenge of transnational counterintelligence: national authorities may successfully identify and prosecute domestic participants while encountering jurisdictional and practical obstacles when attempting to bring foreign-based organisers before a court. Identification, criminal charging and physical custody are separate outcomes. A suspect named in a prosecution announcement may remain beyond the immediate reach of the prosecuting jurisdiction, while investigative cooperation with other states may be necessary to obtain additional evidence or restrict the suspect’s movements. These limitations do not undermine the convictions already obtained against other participants, but they prevent the public record from being treated as evidence that the entire network was dismantled or all responsible persons brought to trial.
The evolution from the original 16-person proceedings to the wider investigation also demonstrates why network-related numbers require precise definitions. An initial group of convicted individuals and a later group of suspects are not necessarily mutually exclusive datasets, and the total membership described by intelligence investigators may be broader than either judicial cohort. A simple addition of the published figures would therefore produce a misleading total. Reliable institutional reporting should identify the relevant cohort, publication date and procedural status each time a number is used.
Belarusian military intelligence in the Poznań proceedings
The Poznań proceedings provide an earlier, legally consequential example of activity explicitly attributed to Belarusian intelligence. On 29 April 2024, the Regional Court in Poznań convicted Andrei R., a Belarusian citizen, of participating in Belarusian intelligence activity directed against Poland. According to the prosecution, the conduct occurred between 6 March and 4 April 2022 and involved reconnaissance of military facilities and civilian installations important to national defence. The first-instance sentence was three years’ imprisonment. A second Belarusian defendant, Dymitri N., was acquitted at that stage. Wyrok skazujący obywatela Białorusi za działalność szpiegowską — Prokuratura Okręgowa w Poznaniu — May 2024.
The case subsequently changed on appeal. The Poznań District Prosecutor’s Office announced that on 28 March 2025, the Court of Appeal increased Andrei R.’s sentence to four years’ imprisonment and set aside the acquittal of Dymitri N., ordering further proceedings concerning the latter. The distinction matters: the appellate decision produced a more severe sentence for the convicted defendant, while the second defendant’s position remained subject to renewed judicial consideration. Setting aside an acquittal does not itself establish guilt. Skuteczna apelacja prokuratora w sprawie o szpiegostwo — Prokuratura Okręgowa w Poznaniu — March 2025.
The relevant strategic lesson is that Belarusian intelligence-related reconnaissance of Polish defence-support facilities had already been the subject of judicial proceedings concerning activity in the early months of Russia’s full-scale invasion of Ukraine. It is important, however, not to reconstruct a broader mission from the limited public findings. The official announcement establishes the general categories of infrastructure and the court’s conclusions concerning one defendant. It does not provide the complete target inventory, the intelligence service’s internal assessment of the collected material or the downstream operational use of that material.
Diaspora intelligence collection and the Daria A. proceedings
The Daria A. investigation differs substantially from the infrastructure-focused cases because the alleged collection target was an organisational and political environment rather than a military or transport installation. Polish prosecutors reported that Daria A. was arrested in December 2023 and subsequently indicted on 25 July 2024. They alleged that during 2023 she repeatedly provided officers of the Belarusian KGB with information concerning organisations supporting the Belarusian opposition, including their activities, structures and financing. According to the prosecution, the Belarusian authorities then used the information to support propaganda alleging extremist conduct by opposition organisations and hostile activity involving Poland. Akt oskarżenia przeciwko obywatelce Białorusi oskarżonej o szpiegostwo — Prokuratura Krajowa — August 2024.
The case is significant for three analytically separate reasons. First, it demonstrates that the subject of alleged intelligence collection can be an organisation operating legally within Poland rather than a classified military facility. Second, it identifies a potential relationship between externally collected information and subsequent political propaganda. Third, it illustrates how intelligence activity directed against an exile community can simultaneously affect the political interests of the host state, particularly where the information is allegedly employed to accuse that state of supporting unlawful activity. Those conclusions arise from the prosecution’s allegations; a complete judicial evaluation would require the final court record.
The protection of Belarusian communities abroad is a distinct counterintelligence concern because civil organisations may simultaneously be lawful participants in Polish public life and subjects of foreign intelligence interest. Treating those organisations as potential collection targets is not equivalent to treating their members as suspects. Indeed, the alleged objective of collecting information about opposition organisations indicates that such communities can be affected by intelligence activity even when they have no involvement in unlawful conduct. A counterintelligence response that fails to maintain that distinction could undermine trust and reduce the willingness of witnesses or targeted individuals to provide information to Polish authorities.
The Pavel T. investigation: a cross-border military intelligence case
The Pavel T. proceedings represent a different category of institutional concern because Polish prosecutors explicitly identified Belarusian military intelligence activity spanning three NATO member states. The suspect was arrested on 9 February 2026. The alleged conduct covered June 2024 to February 2026 and included reconnaissance of critical infrastructure and facilities relevant to Polish and NATO defence in Poland, Germany and Lithuania. On 10 February 2026, prosecutors presented a charge under Article 130 §1 of the Polish Criminal Code, and on 11 February a court ordered three months of pretrial detention. The investigation was publicly described as ongoing. Zarzut dla obywatela Białorusi za szpiegostwo na rzecz białoruskiego wywiadu wojskowego — Prokuratura Krajowa — February 2026.
The cross-border character materially differentiates this investigation from cases confined to a single Polish jurisdiction. It suggests that the alleged intelligence requirement was not limited to one local installation or a purely domestic Polish matter. The relevance to NATO is explicit in the prosecutor’s description of the facilities concerned, but the public announcement does not disclose the exact locations, the nature of the information allegedly acquired or whether the activities formed part of a larger network. Consequently, the case establishes a formal multinational intelligence allegation and documented cooperation among security services, not a complete reconstruction of the underlying military collection plan.
The involvement of Germany’s BfV and Lithuania’s VSD is also institutionally significant. The Polish special-services communication stated that cooperation among those services contributed to identifying the scope of Belarusian intelligence interests affecting NATO states. This is evidence of operational counterintelligence cooperation among national authorities, rather than proof that all relevant information is routinely shared across the Alliance or that a permanent joint investigative structure existed for every related case. Zatrzymanie obywatela Białorusi — Polish Special Services — February 2026.
The Vitalij S. proceedings: reconnaissance connected to alleged sabotage preparation
The Vitalij S. case is particularly important because it concerns the relationship between intelligence-directed observation and preparation for physical interference. According to ABW, the Belarusian citizen was arrested on 13 August 2025 after investigators identified activity related to the possible arson of a warehouse in the Lublin region. The agency reported that he conducted reconnaissance of the location, produced a video and sent it to the person commissioning the assignment. Remuneration was allegedly provided in cryptocurrency, while Telegram was used for recruitment and communication. The indictment was filed on 27 July 2026. Obywatel Białorusi oskarżony o planowanie aktu dywersji na zlecenie obcego wywiadu — Agencja Bezpieczeństwa Wewnętrznego — July 2026.
This case provides a concrete example of why the purpose of a reconnaissance assignment matters. The alleged collection was not described merely as general observation of a building; it was connected by investigators to preparations for an arson offence. The distinction between the completed reconnaissance and the alleged intended sabotage is essential. ABW stated that the planned activity was detected and prevented before execution. Reporting the incident as a completed warehouse attack would therefore contradict the official record.
It is equally important to preserve the limits of service attribution. The ABW announcement described conduct on behalf of a foreign intelligence service but did not publicly identify that service in the specific account examined. The defendant’s nationality does not establish the identity of the commissioning organisation. The proceedings support the conclusion that foreign intelligence-directed sabotage preparation can involve locally present civilian intermediaries; they do not independently establish that the Belarusian KGB commissioned this particular operation.
The 2026 recruitment investigation and its procedural complexity
The July 2026 announcement concerning Aliaksei B. and Rafał G. provides evidence of continued investigations into remote recruitment and foreign intelligence-directed activity beyond the original 2023 camera-network proceedings. Polish prosecutors stated that both individuals were detained on 25 June 2026 and charged with acting for foreign intelligence in 2024–2025. The underlying investigation concerned conduct across several Polish cities between March 2024 and February 2025 and included recruitment through an internet communicator, photographic documentation, posters, graffiti and payment from cryptocurrency wallets. The report also identified propaganda exploitation by Belarusian authorities. Kolejne zarzuty dla dwóch osób w śledztwie dotyczącym szpiegostwa i dywersji — Prokuratura Krajowa — July 2026.
The announcement distinguished the circumstances of the two defendants. Aliaksei B. was placed in pretrial detention for three months, while Rafał G. was subjected to non-custodial preventive measures, including police supervision and restrictions on leaving Poland. Such differences reflect procedural decisions made in the individual cases and do not establish different levels of ultimate criminal responsibility. Pretrial measures are designed to address legally relevant risks during proceedings; they are not substitutes for a judgment on guilt.
The same announcement also described a broader investigation in which five suspects had previously been detained, including Ukrainian and Belarusian citizens. It indicated that three remained in pretrial detention, one was subject to a measure involving a juvenile facility, and one had died, resulting in discontinuation of proceedings concerning that person. These details show that the case was not simply a two-person prosecution and that its procedural structure involved several individuals at different stages. Nevertheless, the public record does not justify adding all named and unnamed individuals to a single total of confirmed Belarusian intelligence operatives, nor does it establish a direct organisational connection to the earlier camera-network group.
Comparative judicial record: institutional attribution, procedural status and evidentiary significance
The cases examined demonstrate that the term Belarus-related espionage covers different legal and organisational situations. The table below distinguishes activity directed by Belarusian intelligence, activity attributed to Russian intelligence involving Belarusian participants, and cases in which the foreign commissioning service is not publicly identified. This distinction is essential for preventing the erroneous consolidation of separate investigations into an assumed single Belarusian intelligence network.
| Case or investigation | Period of alleged conduct | Attributed directing service | Public procedural status | Principal significance | Official source |
|---|---|---|---|---|---|
| Andrei R. / Poznań | Mar–Apr 2022 | Belarusian intelligence | Conviction; sentence increased to 4 years on appeal in Mar 2025 | Judicially established Belarusian intelligence-related reconnaissance | Poznań District Prosecutor’s Office, March 2025 |
| Dymitri N. / Poznań | Related 2022 proceedings | Belarusian intelligence alleged | Acquittal set aside; further proceedings ordered | Appellate review does not establish guilt | Poznań District Prosecutor’s Office, March 2025 |
| Camera-network original cohort | Jan–Mar 2023 | Russian intelligence | 16 convictions subsequently reported | Organised multinational espionage network | ABW, camera-network investigation |
| Camera-network wider structure | Investigation continuing beyond original cohort | Russian FSB-linked leadership alleged | Additional suspects identified and charged | Distinction between convicted participants and alleged external coordinators | Prokuratura Krajowa, wider network investigation |
| Daria A. | 2023 | Belarusian KGB | Indicted Jul 2024; no later final judgment established in the records examined | Alleged opposition surveillance and propaganda exploitation | Prokuratura Krajowa, August 2024 |
| Pavel T. | Jun 2024–Feb 2026 | Belarusian military intelligence | Charged Feb 2026; pretrial detention ordered | Alleged reconnaissance across three NATO member states | Prokuratura Krajowa, February 2026 |
| Vitalij S. | Preparatory activity detected by Aug 2025 | Foreign intelligence service not publicly specified | Indicted Jul 2026 | Alleged reconnaissance supporting planned arson | ABW, July 2026 |
| Aliaksei B. and Rafał G. | 2024–2025 | Foreign intelligence; Belarusian propaganda exploitation identified | Charged Jun 2026 | Digital recruitment, infrastructure documentation, propaganda and continued tasking | Prokuratura Krajowa, July 2026 |
The judicial distinctions in this table prevent several otherwise consequential analytical errors. A conviction provides a different basis for conclusion than a charge. A first-instance acquittal subsequently set aside does not become a conviction. A foreign intelligence service named in a prosecution announcement represents an official institutional attribution, but the full underlying evidentiary record may remain unavailable. Finally, the recruitment of individuals of several nationalities cannot be used to infer the ethnic or national composition of an intelligence organisation’s permanent personnel. The public record establishes particular proceedings and findings, not an exhaustive register of all clandestine activity affecting Polish territory.
Poland’s counterintelligence response: operational detection and judicial constraints
The documented record reveals an important institutional division of responsibility between the detection of suspected intelligence activity and its subsequent prosecution. ABW performs security and counterintelligence functions within its statutory competence, while prosecutors supervise criminal investigations and present charges before courts. Judicial authorities determine criminal liability and impose the relevant procedural or penal measures. International cooperation may contribute information or investigative support, but it does not eliminate the legal requirements applying to evidence, detention, extradition or trial in the competent jurisdiction.
The distinction matters because a counterintelligence operation can achieve a preventive result before a court has established the full criminal case. A suspected sabotage plan may be interrupted, communications secured and participants detained while prosecutors continue establishing the evidentiary basis for particular offences. Conversely, a completed conviction may concern only a defined subset of a larger intelligence structure. In the camera-network case, the original 16 defendants were eventually reported convicted, while investigators continued examining suspected organisers and additional participants. In the Vitalij S. proceedings, ABW reported that the planned sabotage activity had been prevented before execution, but the indictment remained a separate judicial stage. These cases illustrate different forms of state response and should not be measured as though arrests, disruptions and convictions were interchangeable outcomes. Kolejne zarzuty w sprawie działalności siatki szpiegowskiej, tzw. „kamerkowców” — Agencja Bezpieczeństwa Wewnętrznego; Obywatel Białorusi oskarżony o planowanie aktu dywersji na zlecenie obcego wywiadu — Agencja Bezpieczeństwa Wewnętrznego — July 2026.
The Polish record also demonstrates that effective detection cannot be assessed solely by counting convictions. A government may prevent an operation without releasing the underlying intelligence, and the absence of a subsequent public criminal announcement does not establish that a suspected activity was harmless or that investigative work ceased. At the same time, official statements about prevented attacks must retain their attributed status until the applicable evidence is adjudicated. For institutional planning, different measures are needed to assess network identification, operational interruption, successful prosecution and the protection of potentially affected infrastructure. The available public documents do not permit a reliable national performance measurement across all these categories.
Counterintelligence outcomes: what the published evidence can and cannot measure
| Performance dimension | Publicly observable evidence | What can be concluded | What cannot be concluded |
|---|---|---|---|
| Network detection | Individuals identified and investigations disclosed | Particular suspected networks came under investigation | National detection rate for all hostile networks |
| Network disruption | Arrests, detention and announced prevention of particular operations | Specific activities or preparations were interrupted | Every connected network capability was eliminated |
| Criminal prosecution | Charges, indictments and court proceedings | The state pursued legal accountability in identified cases | Every suspect was guilty or will be convicted |
| Judicial outcome | Convictions and appellate decisions | Criminal liability established in the relevant judicial proceedings | Complete responsibility for all alleged network activity |
| Cross-border cooperation | Official ABW–BfV–VSD cooperation in the Pavel T. case | Authorities cooperated in a specific investigation | Full intelligence-sharing effectiveness across NATO |
| Financial recovery | Fines and confiscation orders in the camera-network proceedings | Financial sanctions formed part of judicial consequences | Total financial resources of the wider intelligence organisation |
| Strategic prevention | Announced interruption of a planned railway attack and alleged arson preparation | Particular dangerous activities were prevented according to competent authorities | Elimination of the wider sabotage threat |
The absence of comprehensive performance measures is not a reason to disregard the documented successes of Polish investigators. It means that conclusions must remain tied to the particular outcomes publicly established. A set of successful prosecutions demonstrates enforcement capability in those cases, while a continuing stream of investigations demonstrates that the underlying security problem has not been conclusively resolved. Neither observation provides a statistically valid estimate of the total number of active networks or the likelihood that an individual recruitment attempt will lead to sabotage.
Operational and institutional lessons from the documented cases
The first lesson concerns the value of organisational attribution. The Polish record contains activity explicitly linked to Belarusian intelligence, activity explicitly linked to Russian intelligence and cases in which the commissioning foreign service has not been publicly identified. This differentiation is essential when governments consider diplomatic responses, criminal investigations, sanctions and intelligence cooperation. Misidentifying the directing institution risks directing resources toward the wrong network, overstating the involvement of one state or failing to recognise operational distinctions between organisations pursuing overlapping objectives.
The second lesson concerns the distinction between reconnaissance and its intended use. Infrastructure observation can support a variety of purposes, from intelligence collection to physical attack preparation. The Poznań proceedings established a case involving reconnaissance relevant to Polish defence. The Pavel T. investigation alleged reconnaissance concerning infrastructure and defence-related facilities across multiple NATO states. The Vitalij S. indictment concerned observation allegedly undertaken as part of arson preparations. These activities share a broad category of information collection but differ in their attributed purpose, legal status and potential consequence. Defensive assessment must therefore evaluate the evidence connecting observation to a specific intelligence or criminal objective rather than classify every instance of photography as an equivalent threat.
The third lesson concerns the limits of nationality-based interpretation. The documented camera-network cohort included Ukrainian, Belarusian and Russian citizens working within a structure attributed to Russian intelligence. The Polish citizen Rafał G. was charged alongside a Belarusian citizen in the 2026 recruitment investigation. These findings demonstrate that locally present intermediaries can have different citizenships and legal statuses. They do not establish that the communities from which such individuals originate are collectively vulnerable to recruitment at a measurable rate or that nationality itself provides a reliable indicator of hostile conduct. Institutional prevention must remain focused on evidence of specific behaviour, relationships and intelligence direction.
The fourth lesson concerns the importance of protecting legitimate civil organisations from hostile information collection. The Daria A. proceedings indicate that political opposition-support organisations operating in Poland can be subjects of alleged foreign intelligence activity. Unlike the military reconnaissance cases, the relevant information concerned organisational relationships, structures and financing. This creates a different protection requirement: organisations may need confidence that reporting intimidation or suspicious contact will not automatically expose members to indiscriminate scrutiny. Public authorities also need to distinguish an organisation’s legitimate political activity from foreign intelligence efforts to penetrate, monitor or discredit it.
The fifth lesson concerns the practical limits of criminal prosecution against foreign-based organisers. The wider camera-network investigation identified alleged leadership connected with Russian intelligence operating beyond Polish territory. Even where an investigation establishes sufficient grounds to charge a suspect, the ability to obtain custody and conduct proceedings may depend on international legal cooperation and the suspect’s location. This creates a difference between identifying responsibility and securing accountability through a national court. The distinction is particularly significant where operational structures span several states and participants can be replaced or recruited through remote communications. Zarzuty za organizowanie działalności rosyjskiego wywiadu w Polsce i kierowanie grupą szpiegowsko-dywersyjną — Prokuratura Krajowa.
The sixth lesson concerns the separation of procedural status from strategic interpretation. A person charged with espionage remains subject to the presumption of innocence, while a conviction establishes liability for the offences determined by the court. Intelligence analysis can examine the significance of allegations, particularly when issued by a competent authority, but must preserve their procedural status. This is especially important in a politically charged security environment where premature attribution can affect diplomatic relations, public confidence and perceptions of national communities. The court record provides the strongest basis for conclusions about criminal liability, while official investigative announcements remain important but differently weighted evidence of suspected activity.
Evidence gaps affecting strategic interpretation
The official record does not disclose how many individuals were approached but refused recruitment, how frequently tasking remained limited to propaganda, how many participants understood the ultimate foreign intelligence connection or whether networks attributed to different services shared personnel and communication infrastructure. It also does not provide complete financial accounts of the organisations involved. The published material therefore supports conclusions about the existence and characteristics of particular networks, but not reliable estimates of recruitment success rates, national operational expenditure or the size of all active Belarusian-linked intelligence structures.
Further uncertainty concerns the relationship between publicly identified defendants and undisclosed coordinators. In several investigations, the name or institutional connection of the alleged directing party remains absent from the published announcement. This can reflect investigative confidentiality, incomplete evidence or legal restrictions on disclosure. It cannot be resolved by inferring organisational responsibility from a defendant’s citizenship, the location of an operation or similarities with another case. Those indicators may guide further investigation but do not substitute for independently supported attribution.
Finally, the public case record does not establish a uniform operational progression from propaganda to espionage to sabotage. Some documented investigations concern political-information collection, others military-related reconnaissance, and others preparatory conduct associated with alleged physical interference. The existence of these functions within the wider regional threat environment does not establish that every participant progresses through them or that every network is designed to perform all three.
Key judgments — Chapter 3
Poland’s judicial and prosecutorial record establishes the presence of multiple foreign intelligence-related operational patterns rather than a single homogeneous Belarusian espionage structure. The Lublin camera-network proceedings provide evidence of a Russian-directed multinational organisation, including a convicted original cohort and a broader alleged network. The Poznań case establishes judicial findings concerning Belarusian intelligence-related reconnaissance. The Daria A. proceedings identify alleged political-information collection attributed to the Belarusian KGB, while the Pavel T. investigation identifies alleged Belarusian military intelligence activity involving three NATO member states. The Vitalij S. and July 2026 recruitment cases further demonstrate how civilian assignments, digital communications and payments feature in investigations concerning foreign intelligence-related activity. The strongest strategic interpretation is therefore an environment of differentiated but potentially overlapping intelligence interests, supported by documented criminal cases and constrained by the limits of public attribution.
What would change the assessment
The assessment would change materially if subsequent judgments established additional organisational links among the networks examined, if publicly released evidence identified common coordinators or financing structures, or if competent authorities demonstrated that an operation previously attributed to one service was directed by another. It would also change if appellate proceedings overturned relevant convictions, if indictments resulted in acquittals or if investigators concluded that apparently related activities had no foreign intelligence connection. Each such development would require updating the relevant case classification rather than revising the entire threat environment indiscriminately.
Open official record
The most consequential outstanding records are the final judicial outcomes in proceedings not established as concluded, any further appeal or retrial results in the Poznań cases, authenticated findings concerning the alleged leadership of the wider camera-network structure, and publicly releasable evidence identifying the commissioning services in investigations where attribution remains unspecified. Until those records are available, the strongest conclusions remain those attached to particular competent official findings and completed judicial decisions.
Pillar I — Integrated Institutional Assessment
The three chapters establish a coherent but differentiated account of the Belarus-related intelligence environment affecting Poland. The institutional baseline identifies distinct Belarusian state-security and military intelligence functions within a political and military relationship closely aligned with Russia. The recruitment analysis explains how locally present intermediaries may become involved in foreign intelligence-related activity through remote communications, compensated assignments and continuing relationships with coordinators. The judicial analysis demonstrates that Polish authorities have documented, investigated and prosecuted several operational manifestations of this problem, including networks attributed to Russian intelligence and separate cases attributed to Belarusian institutions.
The evidence does not support presenting all these operations as one centrally controlled intelligence campaign. Nor does it support reducing the security problem to the alleged conduct of one national community. The relevant unit of analysis is the documented relationship between an intelligence organisation, its intermediaries, the assigned activity and the intended operational result. That relationship determines whether conduct can be attributed to a particular service, whether criminal liability is established and what policy or counterintelligence measures may be justified.
From a strategic perspective, the documented evolution is important because the operational boundary between civilian activity and security-relevant intelligence collection depends increasingly on purpose, coordination and information use rather than the outward appearance of the action. The same civilian environment may be used for legitimate commercial, political or personal activity while also attracting foreign intelligence requirements. The governing analytical challenge is to identify hostile direction without converting ordinary civilian behaviour into a presumption of espionage.
The institutional implication extends beyond Poland. The February 2026 allegations involving Germany and Lithuania establish the relevance of cross-border investigations, while the Russian-directed camera-network proceedings demonstrate the use of multinational recruitment structures. European security institutions therefore face a problem involving investigative competence, evidence-sharing, legal accountability and the protection of legitimate civilian activity. The three elements must be considered together: greater investigative reach without evidentiary discipline risks over-attribution, while strict reliance on completed convictions alone would exclude relevant early-warning information from ongoing investigations.
The final judgment of Pillar I is that European counterintelligence exposure is best understood as a problem of distributed foreign intelligence direction operating across national, civilian and institutional boundaries. The official record establishes important components of that threat, but it does not yet permit a complete measurement of active network strength, a comprehensive attribution of all suspected recruitment activity or a reliable prediction of individual operational outcomes. Those limitations should guide subsequent analysis of infrastructure vulnerability, operational consequences and European security coordination.
PILLAR II — INFRASTRUCTURE EXPOSURE, HYBRID ESCALATION AND EUROPEAN SECURITY
Chapter 4. Critical Infrastructure and the Operational Geography of Hybrid Threats
Principal judgment: Poland’s strategic exposure to foreign intelligence-directed interference derives not simply from its proximity to Belarus and Russia, but from the concentration of defence-support functions within civilian infrastructure networks that must simultaneously sustain economic activity, public services, military mobility and assistance to Ukraine. Official NATO and European Commission records establish that these functions depend on interconnected transport, logistics, communications, energy and industrial systems extending across several jurisdictions. The most consequential vulnerability is therefore not necessarily the physical destruction of an individual installation, but the potential interruption of a service upon which several civilian and military activities depend. The evidence supports a systemic resilience assessment; it does not establish that every component of these networks has been targeted, penetrated or compromised.
Poland as a strategic interface between European transport systems and NATO’s eastern defence architecture
Poland occupies a distinctive position in the European security system because it combines geographical exposure to Belarus and Russia with a substantial role in the movement, reception and support of allied military capabilities. Its territory also supports the international assistance architecture established for Ukraine following Russia’s full-scale invasion in February 2022. These responsibilities generate requirements for infrastructure that extend beyond the protection of military bases. Railways, roads, airports, storage facilities, maintenance services, communications providers and energy supply systems all contribute, to varying degrees, to the continuity of military-support activity. Their importance is not identical, and military relevance should not be inferred simply because an installation is located near a border. Nevertheless, the European Commission’s military-mobility framework expressly recognises that effective European defence depends on transport infrastructure whose principal peacetime purpose may be civilian. Proposal for a Regulation on Establishing a Framework of Measures to Facilitate the Transport of Military Equipment, Goods and Personnel across the Union — European Commission, COM(2025) 847 — November 2025; Military Mobility — European Commission.
This produces a fundamental distinction between military infrastructure and dual-use infrastructure. A military installation has an explicit defence purpose, while dual-use infrastructure performs civilian functions but may also support the movement, maintenance, supply or protection of armed forces. The dual-use category includes transport facilities, communications systems, certain storage and industrial capabilities, and other services whose military relevance depends on operational circumstances. A railway used predominantly for commercial transport can become important to military mobility without ceasing to serve civilian passengers and freight. An airport can support scheduled commercial aviation while also accommodating authorised military or logistical activity. A communications provider may serve households, industrial customers and public authorities simultaneously. Such functional overlap complicates protection responsibilities because the relevant assets may be privately owned, regulated by civilian authorities or distributed across several administrative jurisdictions.
The operational consequence is that defence readiness cannot be evaluated exclusively by the number of troops, vehicles or military installations available. A force may possess equipment and trained personnel while depending on external infrastructure to move, maintain and sustain them. The European Commission’s November 2025 Military Mobility Package acknowledges this broader problem by proposing a common framework intended to reduce regulatory barriers, facilitate cross-border movement and address infrastructure limitations. The Commission described the objective of creating an EU-wide military mobility area by 2027, including measures intended to simplify procedures and improve coordination between national authorities. This was a legislative proposal and policy objective, not evidence that a fully integrated European military transport area had already become operational. Commission Moves towards ‘Military Schengen’ and Transformation of Defence Industry — European Commission — November 2025; Military Mobility — European Commission.
Poland’s importance within this architecture is demonstrated by the functioning of NATO Security Assistance and Training for Ukraine, or NSATU. Established following the July 2024 Washington Summit and operational by December 2024, NSATU coordinates training and the provision of equipment to Ukraine through a headquarters in Wiesbaden, Germany, and logistical facilities in the eastern part of the Alliance. NATO distinguishes its coordination of assistance and logistics on allied territory from the onward delivery of equipment into Ukraine. This organisational boundary is relevant to the legal and military interpretation of NSATU’s activities, but it does not diminish the importance of the infrastructure that enables equipment to reach the logistical system. Relations with Ukraine — NATO.
A particularly important operational figure was disclosed by NATO on 23 November 2025, when the Alliance reported that its logistical hub in Poland managed approximately 18,000 tonnes of material per month for subsequent delivery to the Ukrainian Armed Forces. This figure is a reported monthly throughput, not a statement of the facility’s maximum design capacity, its guaranteed future performance or the tonnage of weapons alone. It also does not describe all military assistance crossing Polish territory. Nevertheless, it provides a rare official quantitative measure of the scale of an allied logistical activity whose continuity depends on secure infrastructure, personnel, transport coordination and supporting services. The same announcement stated that the hub benefited from allied air defence, including Patriot systems operated by German forces, with Dutch personnel expected to assume the relevant mission subsequently. The presence of air defence protection demonstrates the military importance attributed to the facility; it does not establish the absence of other physical, cyber or intelligence-related vulnerabilities. NATO Deputy Secretary General Visits Logistics Hub Providing Vital Equipment for Ukraine’s Defence — NATO — November 2025.
The throughput figure permits a useful scale interpretation without inventing a disruption scenario. Using the published monthly figure, an illustrative annualised equivalent would be approximately 216,000 tonnes if the same throughput were maintained for twelve consecutive months. That calculation is not an official annual result and cannot be interpreted as evidence of actual annual deliveries. It simply demonstrates the scale implied by the reported monthly activity under an expressly stated constant-rate assumption. Any estimate of material delayed by a sabotage incident would require additional information concerning the affected service, interruption duration, available alternatives, inventory buffers and actual operational flows. None of those variables is sufficiently established for this hub in the public record to support a numerical sabotage-loss model.
Official infrastructure and defence-mobility indicators
| Indicator | Verified value or status | Reference date | Measurement or policy meaning | Analytical limitation | Official source |
|---|---|---|---|---|---|
| Material handled by the Polish NSATU logistical hub | Approximately 18,000 tonnes/month | Nov 2025 | Reported monthly material throughput for onward support to Ukraine | Not maximum capacity or total national throughput | NATO, November 2025 |
| Illustrative annualised equivalent | 216,000 tonnes | Calculated from Nov 2025 figure | 18,000 multiplied by 12, assuming unchanged monthly activity | Not an observed annual figure | Underlying NATO figure |
| NSATU establishment | Operational by Dec 2024 | 2024 | NATO coordination of military assistance and training | Does not identify every transport route or facility | NATO, Relations with Ukraine |
| NSATU headquarters | Wiesbaden, Germany | Current official NATO description | Allied command and coordination function | Headquarters location is not a complete logistics map | NATO, Relations with Ukraine |
| Eastern Shield programme | Approximately PLN 10 billion | Government programme adopted Jun 2024 | Planned Polish border defence infrastructure expenditure for 2024–2028 | Programme envelope, not verified expenditure to date | Polish Prime Minister’s Chancellery, June 2024 |
| EU-wide military mobility area | Target year 2027 | Commission initiative, Nov 2025 | Intended harmonisation of European military transport arrangements | Target, not completed capability | European Commission, November 2025 |
| Proposed cross-border administrative processing | Maximum 3 days | Commission proposal, Nov 2025 | Proposed procedure for specified military movements | Proposed regulatory standard, not proof of current compliance | European Commission, November 2025 |
The contrast between physical throughput, programme expenditure and regulatory targets is important. Eighteen thousand tonnes per month is an operational flow. Approximately PLN 10 billion is a planned programme financial envelope. The proposed 2027 mobility area is an institutional target, while the proposed three-day administrative period is a regulatory design feature. These indicators cannot be combined into a single measure of military readiness, because they describe different dimensions, time periods and institutional responsibilities.
Transport networks: continuity of service as a defence requirement
The November 2025 railway attacks demonstrate that transport infrastructure can become the subject of foreign intelligence-directed physical interference. The National Public Prosecutor’s Office identified damage to railway infrastructure on Line 7, connecting Warszawa Wschodnia and Dorohusk, in incidents investigated between 15 and 17 November 2025. Prosecutors described damage to tracks near Mika and to railway traction infrastructure near Gołąb, and alleged that the conduct created an immediate danger of railway catastrophe. The case establishes the security significance of transport continuity and passenger safety; the public record does not provide a verified monetary estimate of the resulting national economic losses or a comprehensive measure of disrupted defence transport. Zarzuty za akty dywersji przeciwko infrastrukturze kolejowej — Prokuratura Krajowa — November 2025.
Transport infrastructure requires analysis as a service system rather than a collection of isolated physical assets. Railway availability depends on more than the condition of the track itself. Signalling, communications, traction power where applicable, operational personnel, dispatch systems, maintenance capacity and safe traffic-management procedures all contribute to the ability to deliver transport services. An incident affecting one element can require temporary restrictions across a wider operational area while authorities determine whether continued movement is safe. The resulting disruption may therefore exceed the visible physical damage, although the extent of any such disruption depends on the specific configuration of the affected network and the availability of alternatives.
The European Commission has expressly recognised these interdependencies in its proposed military-mobility framework. The November 2025 proposal addresses transport infrastructure capable of accommodating military requirements and identifies broader resilience considerations relating to communications, navigation, control, energy supplies and network redundancy. It also proposes cooperation among member states along shared military-mobility corridors. These provisions are relevant because they treat secure mobility as a combined infrastructure, administrative and resilience problem rather than merely a question of purchasing additional transport equipment. Proposal for a Regulation on Establishing a Framework of Measures to Facilitate the Transport of Military Equipment, Goods and Personnel across the Union — European Commission, COM(2025) 847 — November 2025.
A further complication concerns the division between routine economic efficiency and security resilience. Commercial transport systems are ordinarily managed to deliver reliable services within financial, technical and capacity constraints. Defence resilience introduces additional considerations, including continuity under deliberate disruption, the ability to maintain essential operations during emergencies and coordination with public authorities when security restrictions affect normal service. Greater redundancy may improve resilience but entails capital costs, maintenance obligations and potential operational inefficiencies. Conversely, an infrastructure policy focused exclusively on short-term utilisation can underestimate the value of alternative capacity during an exceptional event. The appropriate balance cannot be determined from the existence of one railway attack; it requires asset-level evidence about service demand, alternative capacity, repair times and the economic consequences of interruption.
Eastern Shield: the relationship between territorial defence and internal infrastructure resilience
Poland’s National Deterrence and Defence Programme — Shield East, adopted by the government on 10 June 2024, provides an important example of national investment intended to strengthen security along the borders with Belarus and Russia. The government allocated an approximate programme envelope of PLN 10 billion for 2024–2028 and described objectives relating to detection, warning, defence infrastructure, military mobility, protection of personnel and the ability to counter hostile movement. The programme’s published scope includes defensive infrastructure and logistical support functions. These are official programme intentions, not a complete audited inventory of works delivered by November 2026. The Task of the State Is to Protect and Defend the Border — Chancellery of the Prime Minister of Poland — June 2024.
The programme illustrates a necessary distinction between strengthening the geographical border and securing the wider infrastructure system behind it. Defensive works can make hostile military activity more difficult in the area they cover, while transport and logistics systems elsewhere in the country remain subject to their own operational risks. An intelligence-directed attack on a civilian facility does not necessarily require an adversary to cross a fortified international border using conventional military forces. It may instead involve persons already present within the relevant jurisdiction. Consequently, territorial defence and internal counter-sabotage protection address different but complementary dimensions of national security.
The same distinction applies to military mobility. Infrastructure intended to impede an adversary’s movement must be coordinated with the continuing requirement for Polish and allied forces to move within defended territory. Those objectives are not inherently contradictory, but they require careful planning and competent control. The public programme description identifies both denial-oriented measures and capabilities supporting Polish military movement. It does not, however, establish the final operational effectiveness of individual works, the resilience of every associated civilian service or the degree to which the programme reduces the risks demonstrated by the November 2025 railway attacks.
Civilian industrial infrastructure and defence-support dependencies
Industrial facilities represent an additional dimension of European security because military capabilities depend on manufacturing, maintenance, repair, logistics and a wide range of services that may be supplied by civilian companies. The relevant industrial exposure includes not only firms producing complete defence equipment but also enterprises providing components, electronics, mechanical systems, communications technology, energy-related services, transportation and specialised technical support. The European Commission’s defence policy identifies industrial capacity, production speed and supply-chain readiness as important elements of European defence preparedness through 2030. Its objectives include strengthening production capacity and improving the European defence market, but those policy ambitions should not be confused with evidence that particular factories have been targeted by Belarusian intelligence. Future of European Defence — European Commission.
The security relevance of an industrial facility depends on its role in a supply chain and the consequences of losing its output or services. A production site may be important because it produces specialised components, while another may be important because it provides a common service to several manufacturers. A transport warehouse may hold commercially ordinary inventory but support deliveries required by strategically important customers. The same physical installation can therefore have different consequences depending on the time of interruption, available inventories and substitutability of the service. Without procurement data, supply-chain maps and verified production dependencies, it would be analytically unsound to rank individual industrial facilities by supposed strategic vulnerability.
The 2024–2026 arson investigations show that large commercial premises can be targets of foreign intelligence-directed sabotage even when they are not identified as military production facilities. This broadens the security implications beyond defence-sector companies. The physical destruction of commercial infrastructure may produce losses for employees, suppliers, customers, insurers and surrounding communities. It may also generate political effects through fear, uncertainty and the perception that public authorities cannot protect ordinary economic activity. However, commercial arson should not automatically be classified as an attempt to disrupt weapons production or military logistics. The prosecutorial record must establish the objective of a particular operation before such a conclusion is drawn. Akt oskarżenia w sprawie podpaleń obiektów wielkopowierzchniowych na rzecz wywiadu Federacji Rosyjskiej — Prokuratura Krajowa — April 2026.
Telecommunications, digital infrastructure and the continuity of physical operations
Digital infrastructure is relevant to this threat environment because modern transport, industrial and logistical services rely on information systems to coordinate activity and maintain operational visibility. Telecommunications, data centres, digital service providers and network operators contribute to the continuity of civilian economic functions, while specialised communication systems also support security and defence. Yet the existence of foreign intelligence-directed physical sabotage does not prove that the same networks possess advanced cyber capabilities or have compromised operational technology. Cyber intrusion, physical surveillance and sabotage are distinct activities with different evidence requirements.
The EU’s NIS2 Directive, Directive (EU) 2022/2555, provides a legal framework for cybersecurity risk management and incident reporting across a broad range of important sectors, including energy, transport, health, water, digital infrastructure and certain manufacturing activities. Its applicability depends on entity type, size, sector and statutory exceptions. The separate Critical Entities Resilience Directive, Directive (EU) 2022/2557, addresses the resilience of essential services against a wider range of natural and human-caused risks, including hybrid threats and terrorism. Their interaction is particularly relevant where a physical security incident affects digitally managed operations or a cyber incident disrupts a service with substantial physical consequences. Directive (EU) 2022/2555 on Measures for a High Common Level of Cybersecurity across the Union — European Parliament and Council — December 2022; Directive (EU) 2022/2557 on the Resilience of Critical Entities — European Parliament and Council — December 2022.
The legal distinction matters because physical resilience and cybersecurity are neither identical nor automatically administered by the same authority. Security requirements may differ according to the entity’s sector, public or private status and national implementing legislation. A facility can be subject to cybersecurity obligations without every physical installation it operates being designated a critical entity under the resilience framework. Similarly, a critical service may depend on suppliers or networks outside the direct regulatory perimeter of the principal operator. Effective protection therefore requires understanding the dependency between services rather than assuming that compliance with one legal instrument guarantees continuity across the entire system.
Infrastructure exposure matrix: economic, operational and institutional consequences
| Infrastructure domain | Verified strategic function or legal coverage | Principal disruption consequence | Required evidence for asset-level assessment | Relevant official source |
|---|---|---|---|---|
| Rail transport | Civilian mobility and possible military transport | Service interruption, safety risks and delayed movement | Operator records, traffic data, repair documentation and alternative capacity | European Commission, Military Mobility |
| Airports and logistics facilities | Support to military assistance and civilian transport | Interruption of material handling and transport coordination | Verified throughput, recovery capacity and operational dependencies | NATO, November 2025 |
| Energy infrastructure | Essential services supporting households, industry and transport | Potential cross-sector operational interruption | Network topology, redundancy and service-continuity evidence | Directive (EU) 2022/2557 |
| Telecommunications and digital infrastructure | Coordination, connectivity and essential digital services | Communications and digitally mediated service disruption | Technical incident records and dependencies | Directive (EU) 2022/2555 |
| Industrial and manufacturing facilities | Production and maintenance capabilities | Output interruption, supply delays and commercial losses | Production data, customer dependence and substitution capacity | European Commission, Future of European Defence |
| Commercial premises | Employment, trade and public-facing economic services | Property damage, employment interruption and potential intimidation | Judicial records, economic-loss assessments and verified motive | Prokuratura Krajowa, April 2026 |
| Border defence infrastructure | Territorial deterrence and military mobility | Reduced effectiveness of specified defensive functions | Programme completion, acceptance testing and operational evaluation | Polish Government, June 2024 |
The matrix identifies exposure categories, not confirmed target lists or numerical risk rankings. The documented operational cases establish that selected transport and commercial infrastructure have been attacked or investigated as sabotage targets. The remaining categories are included because their systemic importance is recognised in official defence and resilience frameworks. Their inclusion should not be interpreted as evidence that a particular Belarusian or Russian network has successfully accessed them.
Key judgments — Chapter 4
Poland’s infrastructure security is inseparable from its position within NATO’s eastern defence architecture and the European system supporting Ukraine. NATO’s reported monthly logistics throughput establishes a substantial allied support function, while the European Commission’s mobility proposals demonstrate the institutional importance of cross-border civilian infrastructure. The most relevant security concept is continuity of essential services across interconnected civilian and military systems, rather than the protection of military installations in isolation. Infrastructure exposure must be evaluated using verified dependencies, recovery capacity and service consequences; geography or strategic importance alone cannot establish the probability of attack.
What would change the assessment
The assessment would change with authoritative evidence showing that critical transport or logistics services possess materially greater or lower redundancy than presently established, that infrastructure programmes have achieved verified operational milestones, or that specific foreign intelligence networks have obtained access to previously unidentified service dependencies. Detailed incident-impact assessments, audited programme expenditure and independently documented recovery performance would permit stronger conclusions about the scale of national exposure.
Open official record
The principal missing information concerns comparable disruption-duration data, the operational redundancy of strategically important services, cross-border transport recovery arrangements, verified military mobility constraints and published assessments of how infrastructure interruptions affect civilian and defence-support functions. These gaps prevent the construction of defensible numerical damage estimates or a ranked list of vulnerable facilities.
Chapter 5. From Intelligence Collection to Sabotage: Operational Escalation and Strategic Effects
Principal judgment: The Polish and Lithuanian prosecutorial record establishes that foreign intelligence-directed activity has resulted in physical sabotage affecting commercial premises and railway infrastructure, with additional cases concerning attempted attacks, preparations and assistance to perpetrators. The most significant strategic development is the demonstrated relationship between clandestine coordination and incidents capable of producing substantial public-safety, economic and political consequences. The evidence does not support treating every incident as the product of one operational campaign: the 2024 commercial arson proceedings and the November 2025 railway attacks involve different disclosed investigative findings, participants and operational circumstances, even though Polish authorities attribute both to activity benefiting Russian intelligence.
Sabotage as a security category: the distinction between intelligence gathering, destructive intent and completed harm
Espionage and sabotage may occur within the same hostile security environment, but they are not interchangeable categories. Espionage principally concerns the acquisition or transmission of information for an intelligence purpose, subject to the elements established by the applicable law. Sabotage concerns interference intended to damage, disrupt or impair assets, services or operations. Preparatory conduct can be criminally relevant before an attack is completed, while a completed act of physical destruction does not necessarily establish that intelligence collection preceded it. The distinction matters because the evidentiary requirements, operational consequences, investigative priorities and potential sanctions differ materially.
Poland’s 2023 amendments to Article 130 of the Criminal Code are relevant to this distinction because they introduced or strengthened provisions addressing activity for foreign intelligence services, including acts connected with sabotage and terrorist offences. In the November 2025 railway investigation, prosecutors cited Article 130 §7, alongside provisions concerning danger to land transport and explosive materials. The legal characterisation was consequently more specific than an ordinary property-damage allegation: the prosecutor alleged conduct carried out for Russian intelligence that created a direct risk of a railway catastrophe. The applicable criminal provisions and the attribution to a foreign intelligence service are essential to understanding the charges, although guilt remains a matter for the competent court. Act of 17 August 2023 Amending the Criminal Code and Certain Other Acts — Polish Electronic Legal Information System — August 2023; Zarzuty za akty dywersji przeciwko infrastrukturze kolejowej — Prokuratura Krajowa — November 2025.
The strategic effect of sabotage depends not solely on destruction but on the relationship between physical harm and essential service continuity. Damage to a structure may be economically significant yet produce only local service interruption if viable alternatives exist. Less extensive physical damage can have wider consequences if it requires the suspension of a service whose safe operation cannot be assured until inspections, repairs and authorisation are complete. The nature of the affected system, the period of interruption, alternative capacity, emergency response and public confidence are therefore indispensable variables. Without those observations, it is possible to describe an attack and its demonstrated safety consequences but not to calculate a defensible national economic loss or military-readiness impact.
The 2024 commercial arson investigations: physical destruction and information exploitation
The 2024 attacks on large commercial premises are especially important because the Polish prosecutorial record connects physical sabotage with the recording and intended dissemination of evidence of the attacks. The 2 April 2026 announcement by the National Public Prosecutor’s Office concerned an indictment filed on 25 March 2026 against five individuals in an investigation of an organised group allegedly carrying out arson and sabotage operations on behalf of Russian intelligence. The indictment covered events involving an OBI store in Warsaw, an IKEA store in Vilnius, the Marywilska 44 commercial centre in Warsaw and preparations concerning an IKEA store in Riga. The investigation also concerned alleged coordination by individuals located outside Poland and participation by persons whose procedural status differed across related proceedings. Akt oskarżenia w sprawie podpaleń obiektów wielkopowierzchniowych na rzecz wywiadu Federacji Rosyjskiej — Prokuratura Krajowa — April 2026.
The chronology matters because it distinguishes confirmed incidents from operations that remained preparatory. Prosecutors identified the OBI fire in Warsaw during 13–14 April 2024, the IKEA fire in Vilnius on 9 May 2024, and the Marywilska 44 fire on 12 May 2024. The investigation also identified preparations during May 2024 for an attempted attack on an IKEA facility in Riga, which was not carried out. These are not four completed destructive incidents. The Riga component is legally and analytically different because the published indictment describes preparation followed by intervention that prevented execution.
The prosecution additionally reported that a separate judicial proceeding had resulted in the conviction of three Ukrainian citizens on 18 September 2025 for participation in an organised criminal group of a sabotage and terrorist character. Two were also convicted of obstructing the investigation through assistance provided to another participant after the Vilnius and Warsaw incidents. Those convictions concern their judicially determined conduct; they should not be represented as judgments establishing that each convicted individual personally ignited every commercial fire. The distinction is material because participation in an organised criminal group, assistance after an offence and direct execution of arson are separate forms of conduct. Wyrok skazujący trzy osoby za udział w zorganizowanej grupie przestępczej o charakterze sabotażowo-terrorystycznym — Prokuratura Krajowa — October 2025.
The Marywilska 44 fire: the distinction between organisational attribution and unidentified direct perpetrators
The destruction of the Marywilska 44 commercial centre in Warsaw on 12 May 2024 provides an important case study in attribution. In its 12 May 2025 public announcement, the National Public Prosecutor’s Office stated that investigators had established the fire was deliberately caused by members of an organised criminal group acting on the instructions of Russian intelligence. The prosecutorial account also described the alleged involvement of an individual tasked with documenting the fire for subsequent use in propaganda. These findings are materially different from an unsupported assertion that the fire was necessarily caused by a Belarusian intelligence operative. The official attribution concerns Russian intelligence, and the investigation identified specific alleged relationships among the participants. Zarzuty w związku z pożarem hali przy ul. Marywilskiej 44 — Prokuratura Krajowa — May 2025.
The April 2026 indictment announcement provided an important qualification: investigators had not yet identified the direct perpetrators who physically started the Marywilska 44 fire. This does not negate the prosecution’s attribution of the incident to the organised group, but it narrows the conclusions that may be drawn about the individual execution of the attack. There is a distinction between identifying a criminal organisation, identifying persons who participated in coordination or documentation, and establishing which individuals directly performed the destructive act. A publication that collapses these categories would overstate the investigative record and potentially misrepresent the procedural status of those involved. Akt oskarżenia w sprawie podpaleń obiektów wielkopowierzchniowych na rzecz wywiadu Federacji Rosyjskiej — Prokuratura Krajowa — April 2026.
The economic implications extend beyond the immediate fire damage. A large commercial centre supports relationships among property owners, tenants, workers, suppliers, insurers, transport companies and consumers. Destruction can interrupt commercial activity, create employment consequences and generate claims concerning property, business interruption and contractual obligations. Nevertheless, the official prosecution announcements examined do not provide a complete, audited estimate of the Marywilska 44 incident’s economic damage, insured losses, public expenditure or effect on employment. Consequently, it would be inappropriate to attach an independently invented monetary figure to those consequences. The correct interpretation is that the type of asset affected creates multiple potential economic transmission channels, while their realised magnitude requires separate documentary evidence.
The recording of the incident introduces a second dimension. According to prosecutors, individuals involved in the wider investigation received instructions concerning the documentation of fires and emergency-service responses, with material intended for propaganda exploitation. This suggests that the effect sought by the organisers was not necessarily limited to destruction of property. A recorded attack can also become an information product intended to demonstrate operational reach, generate fear or reinforce hostile narratives. Those objectives are attributed to the criminal organisation in the official investigation, rather than inferred solely from the existence of recordings. The public record does not permit a reliable measurement of the propaganda’s audience, public-opinion impact or subsequent influence on political decisions. Zarzuty w związku z pożarem hali przy ul. Marywilskiej 44 — Prokuratura Krajowa — May 2025.
The Vilnius and Riga components: why transnational operations complicate responsibility
The Vilnius IKEA fire on 9 May 2024 demonstrates that the relevant organised criminal investigation was not confined to Polish territory. Polish prosecutors described preparations, participation by multiple individuals, transport-related assistance and subsequent documentation of the event. The broader investigation involved locations in Poland, Lithuania and Latvia, while individuals suspected of organisational coordination were associated with activities extending across additional European jurisdictions. The resulting evidentiary problem is inherently transnational: conduct may occur in one country, planning or communication in another, and prosecution in a third, depending on the jurisdictional and legal circumstances of the case. Akt oskarżenia w sprawie podpaleń obiektów wielkopowierzchniowych na rzecz wywiadu Federacji Rosyjskiej — Prokuratura Krajowa — April 2026.
The Riga component is important precisely because an attempted operation did not develop into a completed destructive incident. The prosecution reported that the individual associated with the preparations was arrested in Lithuania before the intended attack could be carried out. This creates a distinct measure of preventive effectiveness, although the prosecution’s account does not establish that all associated participants or coordinators were brought into custody. The prevention of one planned incident and the continuation of a wider investigation can coexist. An assessment focused exclusively on completed attacks would omit the relevance of detected preparations, while an assessment that counted the Riga case as another completed fire would inflate the observed number of destructive incidents.
The transnational pattern also demonstrates why responsibility cannot be divided neatly by the location of the damaged property. A commercial fire in Lithuania may generate investigative evidence in Poland, while suspected coordinators may be located elsewhere. National legal systems retain their respective jurisdictional competences, but effective investigation may require evidence exchange, assistance in locating suspects, judicial cooperation and coordination of proceedings to avoid duplication or procedural conflict. These are institutional consequences directly supported by the multinational nature of the cases, although the precise contents of confidential cooperation arrangements are not publicly established.
Comparative evidence table: the commercial sabotage proceedings
| Incident or proceeding | Date | Location | Publicly reported status | Attribution and evidentiary boundary | Official source |
|---|---|---|---|---|---|
| OBI commercial-store fire | 13–14 Apr 2024 | Warsaw, Poland | Completed fire included in the 2026 indictment | Alleged participation within Russian intelligence-directed sabotage proceedings | Prokuratura Krajowa, April 2026 |
| IKEA fire | 9 May 2024 | Vilnius, Lithuania | Completed incident; criminal investigation and prosecution | Russian-directed organised group alleged; participation differentiated among defendants | Prokuratura Krajowa, April 2026 |
| Marywilska 44 fire | 12 May 2024 | Warsaw, Poland | Completed incident; investigation continuing into direct perpetrators | Russian intelligence-directed arson attributed by prosecutors; direct ignition perpetrators not identified in Apr 2026 announcement | Prokuratura Krajowa, April 2026 |
| Planned IKEA fire | May 2024 | Riga, Latvia | Preparations identified; attack not executed | Prevented operation, not completed arson | Prokuratura Krajowa, April 2026 |
| First group conviction | 18 Sep 2025 | Warsaw judicial proceedings | Three individuals convicted | Convictions concerning organised-group participation and specified additional offences | Prokuratura Krajowa, October 2025 |
| Further indictment | Filed 25 Mar 2026 | Warsaw judicial proceedings | Five defendants indicted | Charges do not constitute final judicial findings of guilt | Prokuratura Krajowa, April 2026 |
The evidence establishes a geographical distribution of suspected activity but does not establish a complete operational inventory. The prosecutorial announcements concern particular incidents and defendants; the overall number of additional attempts, abandoned plans or undetected participants cannot be inferred from these records. Nor is there a sufficient official basis to treat the 2024 arson investigation as organisationally identical to the subsequent railway sabotage investigation.
Railway sabotage in November 2025: direct danger to public safety
The November 2025 railway incidents represent a distinct escalation in the documented consequences of foreign intelligence-directed operations. The National Public Prosecutor’s Office reported that on 17 November 2025 it opened an investigation into sabotage affecting railway infrastructure on Line 7, including damage near Mika and Gołąb. In a subsequent announcement on 19 November, prosecutors stated that the evidence supported allegations against two Ukrainian citizens, Oleksandr K. and Yevhenii I., for actions allegedly committed on behalf of Russian intelligence. The prosecution described the use of an explosive device to damage railway track near Mika and separate interference with railway infrastructure near Gołąb, creating a direct danger of serious transport accidents. The authorities stated that the suspects had left Poland for Belarus before they could be detained. Śledztwo w sprawie aktów dywersji przeciwko infrastrukturze kolejowej — Prokuratura Krajowa — November 2025; Zarzuty za akty dywersji przeciwko infrastrukturze kolejowej — Prokuratura Krajowa — November 2025.
The legal significance lies in the combination of alleged foreign intelligence direction and the potential for catastrophic harm. The prosecution expressly referred to direct danger to the lives and health of numerous people and to property on a large scale. This distinguishes the investigation from a case concerning minor property damage or ordinary vandalism. The alleged use of destructive means against active railway infrastructure created a safety problem independent of any separately demonstrated impact on military transport. It is therefore unnecessary, and unsupported, to claim that a particular weapons shipment was destroyed or that NATO logistics suffered a measurable interruption in order to recognise the gravity of the acts described by prosecutors.
The public record also demonstrates that the investigation extended beyond the two suspected direct perpetrators. On 24 November 2025, the National Public Prosecutor’s Office announced that Volodymyr B., another Ukrainian citizen arrested on 20 November, had been charged with assisting the perpetrators by facilitating activities connected with the attacks. The prosecution distinguished this alleged assistance from direct execution. This differentiation matters because criminal networks may include participants whose alleged roles vary substantially, while evidentiary standards must still be met for each person. It does not justify reconstructing the complete operational organisation, reporting hierarchy or wider command structure beyond what the prosecutor disclosed. Zarzut pomocnictwa do aktów dywersji na infrastrukturę kolejową — Prokuratura Krajowa — November 2025.
A particularly consequential distinction concerns the suspects’ reported departure to Belarus. The prosecution stated that the two alleged direct perpetrators fled there after the incidents. This is relevant to the ability of Polish authorities to obtain custody and conduct proceedings, but it does not by itself establish that the Belarusian KGB commissioned or supervised the attack. The official attribution of the railway operation concerned Russian intelligence. A suspected transit or refuge location and an intelligence-service command relationship are different propositions. The latter requires additional evidence.
Incident severity, economic consequences and the danger of false precision
The distinction between observed harm and potential harm is crucial. In the railway investigation, prosecutors alleged direct danger to railway traffic and the possibility of a catastrophe, not that a passenger train had actually derailed with mass casualties. In the commercial arson investigations, fires occurred and caused destruction, while the full economic cost and detailed distribution of losses are not established by the cited prosecution announcements. A rigorous assessment must not substitute hypothetical consequences for recorded results.
The appropriate analytical framework separates immediate physical effects, service interruption, economic transmission, institutional response and longer-term consequences. Immediate effects are ordinarily established through forensic records, operator reports and documented damage assessments. Service interruption requires evidence of unavailable capacity, restrictions and recovery. Economic transmission requires data concerning output, employment, lost revenue, repair expenditure, insurance and substitute activity. Institutional consequences include emergency mobilisation, investigations and changes to security practices. Public-confidence effects require survey, behavioural or comparable evidence before being quantified.
| Consequence category | Commercial arson cases | Railway sabotage case | Evidence needed for quantification |
|---|---|---|---|
| Physical damage | Completed fires documented | Railway infrastructure damage documented | Forensic and engineering assessments |
| Human casualties | No general casualty total established from the cited prosecution record | Direct danger established in the allegations; mass-casualty outcome not reported | Official casualty and medical records |
| Service interruption | Commercial activity affected by completed fires | Infrastructure safety and transport continuity affected by the incidents | Operator interruption and restoration records |
| Direct economic loss | No audited aggregate in cited prosecution releases | No verified national loss figure in cited prosecution releases | Insurance, repair and financial records |
| Employment consequences | Potentially material for affected commercial activity | Possible indirect effects through transport disruption | Employment and business-continuity data |
| Military-logistics impact | Not established for the commercial incidents | No quantified military shipment loss established | Defence logistics and operator evidence |
| Criminal responsibility | Convictions and indictments concerning specified participation | Suspects charged or sought; individual roles differentiated | Final court judgments and subsequent proceedings |
| Political-information effects | Propaganda use alleged and described by prosecutors | Intimidation and public destabilisation alleged as objectives | Documented dissemination and reliable impact assessment |
The table deliberately excludes invented monetary losses or hypothetical death tolls. Such quantities could be calculated only after obtaining the necessary official datasets and adopting transparent assumptions. The absence of those figures does not reduce the seriousness of the incidents; it protects the distinction between established consequences and plausible but unmeasured effects.
The economic transmission of sabotage: direct damage, service losses and systemic consequences
A sabotage incident can generate economic consequences through several channels, but their importance depends on the affected asset. Direct physical damage may require repair or reconstruction expenditure, while interruption of commercial services can result in lost sales, delayed deliveries and additional operating costs. Insurance may redistribute part of the financial burden without eliminating the underlying economic loss. Emergency services, investigative authorities and infrastructure operators may also incur costs that are not captured by the property owner’s accounts. The cumulative national effect, however, cannot be inferred merely by summing visible damage estimates because expenditure transfers, insurance payments, substitution and delayed rather than permanently lost activity must be treated consistently.
Transport disruption has a different economic structure from the destruction of a commercial building. A railway incident may affect service capacity even where the underlying physical repair is comparatively limited, because safe operations require inspection and authorisation. The economic impact depends on actual traffic restrictions, alternative transport availability, the duration of interruption and the value of affected movements. If cargo is delayed rather than lost, its economic treatment differs from permanently destroyed goods. If an alternative route is available, additional transport costs may arise without complete interruption of the underlying activity. These distinctions are necessary for any defensible assessment of the impact on industry, public transport or military logistics.
The policy implication is that restoration and continuity may be as important as the prevention of physical damage. A resilient system does not require an implausible guarantee that no incident will occur; it requires proportionate protection, the ability to detect disruptions, lawful emergency response, and credible procedures for maintaining or restoring essential services. This principle is reflected in the EU’s Critical Entities Resilience Directive, which requires identified critical entities to assess relevant risks and take proportionate measures to enhance resilience. Article 12 expressly encompasses cross-sector and cross-border risks, including hybrid threats, while Article 13 addresses resilience measures and planning. Directive (EU) 2022/2557 on the Resilience of Critical Entities — European Parliament and Council — December 2022.
Sabotage and information operations: the strategic significance of documented publicity requirements
The commercial arson investigations provide an unusual evidentiary basis for examining the relationship between physical sabotage and information operations because the prosecution described instructions to document fires and emergency responses. The significance of such documentation is not solely that it confirms the occurrence of an event. According to investigators, material was intended for propaganda dissemination. Physical interference and public communication can therefore form separate but connected components of the same alleged criminal activity. A destructive incident generates a visible event, while its recorded representation may be used to influence perceptions beyond those directly affected. Zarzuty w związku z pożarem hali przy ul. Marywilskiej 44 — Prokuratura Krajowa — May 2025.
However, the existence of a propaganda objective does not establish that the information operation achieved its intended result. The number of people who viewed a recording, the degree to which they believed its message and any resulting change in political attitudes require separate evidence. Nor should the existence of recording instructions be interpreted as proof that all sabotage campaigns employ the same methods. The legally material finding is that the particular organised group described by prosecutors combined physical attacks with documentation intended for wider exploitation.
This distinction has practical consequences for public authorities. Accurate and timely communication can reduce the space for false claims following a major incident, while premature attribution or disclosure of unverified details can create additional confusion. Public statements should therefore distinguish confirmed physical facts, investigative hypotheses and judicial findings. They should also avoid disclosing information that could compromise ongoing investigations or the protection of essential infrastructure. These requirements create a tension between the legitimate public demand for explanation and the operational need to preserve evidence and investigative integrity.
Escalation pathways without fabricated probabilities
The documented incidents support several possible pathways of further hostile activity. One is the continuation of geographically dispersed physical sabotage affecting commercial property and public confidence. Another concerns interference with transport infrastructure whose safe operation is essential to civilian mobility and may also support defence requirements. A third involves intelligence-directed preparations interrupted before execution. These pathways are not mutually exclusive, and no reliable public base rate establishes their relative probability over the next five years.
| Strategic pathway | Evidence supporting relevance | Potential consequence | Observable confirmation | Principal uncertainty |
|---|---|---|---|---|
| Continued attacks on commercial assets | 2024 completed fires and 2026 indictments | Property loss, business interruption and public anxiety | Competent official findings establishing further directed incidents | Frequency and network continuity |
| Further transport sabotage | November 2025 railway investigation | Safety danger, service suspension and potential logistical disruption | Verified infrastructure incidents with foreign intelligence attribution | Actual impact on national transport and defence logistics |
| Prevented preparatory operations | Riga preparations and other disrupted cases | Reduced immediate harm but continued investigative burden | Documented arrests, charges or disclosed interruption of planned activity | Undetected preparatory activity |
| Coordinated information exploitation | Recording requirements described in the arson investigations | Possible amplification of disruption through hostile messaging | Authenticated links between an incident and organised dissemination | Actual influence on public perceptions |
| Cross-border criminal organisation | Poland–Lithuania–Latvia arson proceedings | Complex investigation and accountability challenges | Judicial records identifying common participants and coordinators | Complete international network structure |
The relevant warning indicators concern authenticated connections between incidents, continuity of foreign intelligence direction, credible evidence of preparations and documented operational consequences. Numerical probabilities are not assigned because the official record does not supply a sufficiently reliable denominator of attempted operations or a validated forecasting model. An increase in reported investigations alone would not establish an equivalent increase in underlying activity: it could also reflect changes in detection, disclosure or enforcement.
Key judgments — Chapter 5
The commercial arson and railway sabotage investigations establish distinct forms of foreign intelligence-directed physical interference within the European security environment. The 2024 commercial incidents demonstrate completed destruction and, according to prosecutors, the intended propaganda exploitation of recorded attacks. The November 2025 railway case demonstrates allegations involving direct danger to public transport safety, while subsequent charges identified suspected assistance to the alleged perpetrators. The official record supports attribution to Russian intelligence in these investigations, but not a blanket inference that the Belarusian KGB controlled them. Economic and military consequences should be assessed through verified service disruption and operational dependencies rather than speculative loss calculations.
What would change the assessment
Further final judgments identifying individual perpetrators, foreign coordinators and organisational links would refine the attribution of the incidents. Audited damage assessments and infrastructure-operator reports could establish the scale of economic consequences. Evidence connecting separate attacks to common funding, command or planning arrangements would strengthen conclusions concerning coordinated campaigns. Conversely, judicial rejection of material allegations or verified evidence of unrelated perpetrators would require narrowing the relevant conclusions.
Open official record
The principal unresolved records concern final judicial outcomes in the 2026 arson proceedings, identification of the direct perpetrators of the Marywilska 44 fire, subsequent proceedings concerning the railway suspects, verified economic-loss assessments, restoration timelines and evidence sufficient to establish or exclude organisational links between separate investigations.
Chapter 6. European and NATO Security Implications: National Responsibilities and Alliance Coordination
Principal judgment: The European response to intelligence-directed sabotage is constrained by a fundamental institutional division: national governments retain primary responsibility for domestic security, criminal investigation and protection of infrastructure under their jurisdiction, while the European Union establishes common regulatory, judicial-cooperation and economic instruments, and NATO provides the framework for collective defence, military readiness and allied security consultation. These responsibilities intersect but are not interchangeable. The documented threat is therefore best addressed through compatible national capabilities and cross-border cooperation rather than by assuming the existence of a single European authority with comprehensive jurisdiction over espionage, criminal sabotage, infrastructure protection and military operations.
The strategic geography of European security responsibilities
The exposure of European states to intelligence-directed interference is not geographically uniform. Poland and Lithuania directly border Belarus and occupy an important position on NATO’s eastern flank. Germany has a different strategic function, combining military command, industrial capacity, transport infrastructure and support for allied operations. Italy and France contribute through their defence industries, logistics systems, infrastructure and military commitments, while the United Kingdom combines NATO responsibilities with a separate national regulatory system outside the European Union. Their different legal and geographical positions matter because identical policy instruments may not be available or appropriate in every jurisdiction.
The 2025–2026 security environment has also required NATO to strengthen its eastern posture. Following Russian drone incursions into Polish airspace in September 2025, NATO announced Eastern Sentry on 12 September 2025, an enhanced vigilance activity designed to strengthen allied protection and coordination along the eastern flank. The Alliance also maintains Baltic Sentry, launched in January 2025 in response to concerns about critical undersea infrastructure. These activities demonstrate NATO’s recognition of a wider security environment involving territorial defence, surveillance, infrastructure protection and emerging technological threats. They are not, however, evidence that NATO has assumed general police authority over civilian infrastructure or responsibility for prosecuting suspected saboteurs. NATO Launches Eastern Sentry to Bolster Posture along Eastern Flank — NATO — September 2025; Strengthening NATO’s Eastern Flank — NATO.
A second geographical distinction concerns the location of military-support infrastructure relative to the frontline or external border. A logistics headquarters in Germany, a transport operator in Poland and an infrastructure supplier in another member state may contribute to the same broader defence-support function while operating under different national authorities. The dependence of one service on another creates a collective resilience interest, but not necessarily a unified command relationship. This is why the European Commission’s military-mobility policy addresses the coordination of transport arrangements, infrastructure improvements and administrative procedures, while NATO’s operational role concerns military assistance, planning and readiness within the Alliance’s own competence. Military Mobility — European Commission; Relations with Ukraine — NATO.
Poland: domestic security, civil protection and the management of allied infrastructure
Poland’s security responsibilities extend beyond counterintelligence investigations. Its institutions must protect the continuity of civilian services, maintain public safety, coordinate with military authorities and fulfil relevant international commitments. The Act of 5 December 2024 on Population Protection and Civil Defence, which entered into force principally on 1 January 2025, establishes a broad statutory framework for civil protection. Its Article 8 identifies infrastructure necessary for population protection and civil defence, including shelter, water, food, medical supplies, energy, fuel, communications, transport, emergency response and public services. This statutory scope demonstrates that Poland’s domestic resilience framework recognises dependencies extending well beyond conventional military facilities. Act of 5 December 2024 on Population Protection and Civil Defence — Sejm of the Republic of Poland — December 2024.
The law also distinguishes national, regional and local responsibilities. This distribution is important because an incident involving an essential service may require emergency response, civilian administrative decisions and criminal investigation simultaneously. The institution responsible for investigating possible foreign intelligence involvement is not necessarily the authority responsible for restoring the affected service or assisting the local population. Effective response therefore depends on coordination across distinct legal mandates, not on treating one agency as responsible for every consequence of an incident.
Poland’s infrastructure and defence programmes address complementary requirements. Eastern Shield concerns military and border defence infrastructure, while the civil-protection framework addresses continuity of essential civilian services. The former is supported by a planned financial envelope of approximately PLN 10 billion for 2024–2028; the latter establishes a broader statutory basis for public protection and civil defence. These frameworks should not be combined into a single spending total or interpreted as evidence that funds have been disbursed equally across all resilience functions. Programme appropriations, statutory obligations and actual expenditure remain distinct categories. The Task of the State Is to Protect and Defend the Border — Polish Prime Minister’s Chancellery — June 2024; Act of 5 December 2024 on Population Protection and Civil Defence — Sejm of the Republic of Poland — December 2024.
For Poland, the principal institutional challenge is coordinating protection of infrastructure that simultaneously supports civilian life and military requirements. The state must preserve the normal functioning of transport, energy and communications services while ensuring that emergency responses do not unnecessarily compromise defence-related activities. The existence of a foreign intelligence threat does not justify unlimited collection of information about residents or indiscriminate restrictions on civilian activity. Security measures require an identifiable legal basis, proportionality, competent supervision and a relationship to the threat being addressed.
An additional challenge concerns the handling of cross-border incidents. Where alleged perpetrators leave Poland or investigators identify coordinators outside its territory, national prosecution may depend on judicial assistance and international cooperation. Poland’s ability to investigate domestic offences remains substantial, but its ability to obtain custody of suspects located abroad is constrained by legal procedures and the cooperation of other states. These are structural limitations of transnational criminal justice rather than evidence of a failure by any particular Polish institution.
Lithuania: an eastern-border state facing intelligence, infrastructure and political-security pressures
Lithuania’s security environment differs from Poland’s in scale and geography but shares several strategically important characteristics. It borders Belarus, participates in NATO’s eastern defence architecture and maintains intelligence institutions responsible for evaluating threats associated with Russia and Belarus. Its 2026 National Threat Assessment, prepared jointly by the State Security Department and Defence Intelligence and Security Service, identified Russia and Belarus as major sources of security concern and described Belarusian intelligence activity directed against opposition communities. The assessment specifically addressed the use of extremist designations and remote recruitment of agents in operations affecting Belarusian democratic opposition activity abroad. National Threat Assessment 2026 — State Security Department of the Republic of Lithuania.
The Lithuanian assessment is significant because it provides an independent national institutional perspective on the relationship between state-security pressure and recruitment beyond Belarus. Although the Polish and Lithuanian records concern different investigations, they demonstrate that the problem is recognised by more than one national intelligence authority. This strengthens the basis for treating extraterritorial Belarusian intelligence activity as a regional security concern. It does not establish that all operations described by the two countries involve identical personnel or centralised command.
Lithuania also has direct experience of the commercial sabotage investigations described in Chapter 5. The Vilnius IKEA fire is a documented event within proceedings attributed by Polish prosecutors to a Russian intelligence-directed organised group. The Lithuanian jurisdiction and the Polish investigation therefore illustrate the practical importance of cooperation across national legal systems. Relevant evidence can concern individuals, movements and communications associated with several jurisdictions, while the physical harm occurs within one state’s territory. The public prosecution record establishes this transnational character but does not disclose the full contents of Lithuanian–Polish investigative cooperation. Akt oskarżenia w sprawie podpaleń obiektów wielkopowierzchniowych na rzecz wywiadu Federacji Rosyjskiej — Prokuratura Krajowa — April 2026.
Lithuania’s institutional priorities consequently encompass defence-related counterintelligence, protection of democratic opposition organisations, resilience of essential services and cooperation with neighbouring states. These priorities are connected but should remain analytically distinct. Intelligence collection concerning political organisations does not necessarily entail physical sabotage, while the existence of a sabotage incident does not establish that it was directed by Belarusian intelligence. The strongest policy basis is the documented combination of separate threat categories and the need to maintain investigative capacity appropriate to each.
Germany: a logistics and industrial centre within the European defence system
Germany’s strategic significance in this assessment derives from its role in European defence logistics, military command and critical infrastructure. NATO’s NSATU headquarters is located in Wiesbaden, while German personnel and capabilities have contributed to the protection of the Polish logistical hub supporting Ukraine. These functions connect German military responsibilities to infrastructure operating beyond Germany’s national territory. They also demonstrate that the security of support activities may depend on arrangements between several allies rather than on one national defence institution. Relations with Ukraine — NATO; NATO Deputy Secretary General Visits Logistics Hub Providing Vital Equipment for Ukraine’s Defence — NATO — November 2025.
Germany has also developed a more explicit national framework for the physical resilience of critical infrastructure. The KRITIS-Dachgesetz, which the German government states entered into force on 17 March 2026, establishes nationwide and cross-sector requirements intended to strengthen the protection of essential infrastructure. The government identifies relevant areas including energy, transport, health and drinking water, and describes requirements concerning risk assessment, physical protection and the capacity to maintain services during disruptive incidents. The legislation complements cybersecurity measures rather than replacing them. Stärkerer Schutz kritischer Infrastrukturen — German Federal Government — September 2026.
The relevance of this framework to hostile intelligence activity lies in its treatment of infrastructure protection as a systemic responsibility shared by competent authorities and operators. Physical sabotage risks cannot be managed exclusively through technical cybersecurity rules, while infrastructure operators may be unable to evaluate foreign intelligence threats independently. Government risk assessments and security requirements therefore form an important bridge between national threat knowledge and the operational decisions of essential-service providers.
The German framework also illustrates the need to distinguish regulatory coverage from universal protection. An infrastructure law may establish standards, risk assessments and reporting duties, but compliance does not guarantee that incidents will never occur. Its effectiveness depends on the implementation of legally applicable requirements, the identification of relevant operators, the quality of risk information and the ability to restore services. The legislation’s entry into force in March 2026 is a verifiable legal milestone; it is not proof that every affected operator had fully implemented all operational requirements by November of that year.
For Germany, the principal security issue is therefore the convergence of defence-support obligations and domestic infrastructure resilience. Its responsibilities include maintaining the conditions under which allied logistics and military coordination can function while protecting essential national services. The Polish and Lithuanian investigations provide evidence of foreign intelligence activity in the wider region, but they do not establish a complete inventory of sabotage threats against German facilities. Any such country-specific threat assessment must rely on competent German findings rather than extrapolation from Polish cases alone.
Italy: industrial, transport and cybersecurity resilience within the wider European defence system
Italy’s position differs from that of Poland and Lithuania because it is not a direct land-border state with Belarus. Its exposure is instead principally associated with its membership of NATO and the European Union, its transport and industrial infrastructure, its contribution to European defence capabilities and the dependencies connecting its economy to other member states. This does not establish that Italian infrastructure has been penetrated by the Belarusian networks identified in Poland. It establishes a legitimate basis for assessing how cross-border disruption, supply-chain interruption and foreign intelligence-related threats may affect Italy’s national and allied responsibilities.
Italy implemented NIS2 through Legislative Decree No. 138 of 4 September 2024, which entered into force on 16 October 2024. The decree establishes national cybersecurity obligations and identifies the Agenzia per la Cybersicurezza Nazionale (ACN) as the competent NIS authority, the single point of contact and the institution responsible for CSIRT Italia functions within the framework defined by the legislation. These responsibilities are relevant to infrastructure resilience because digitally dependent services can experience disruption through incidents affecting networks and information systems. However, the ACN’s cybersecurity competence should not be confused with a universal mandate to investigate every form of physical sabotage or foreign espionage. Legislative Decree No. 138 of 4 September 2024 — Italian Republic, Normattiva — October 2024.
The Italian case requires particular care in evaluating industrial exposure. Italian manufacturing and logistical services can be relevant to European defence supply chains without every participating enterprise being designated critical infrastructure. The consequences of disruption depend on actual contractual relationships, specialised production capabilities, alternative suppliers, inventory levels and delivery commitments. A company producing components for defence equipment may occupy a different position from a provider of general industrial materials, and those differences cannot be resolved through broad sector classifications alone. The European Commission’s Readiness 2030 agenda establishes the importance of strengthening industrial capacity and supply-chain resilience across the Union, but it does not identify every Italian firm whose interruption would materially affect allied readiness. Future of European Defence — European Commission.
Italy’s policy challenge is therefore to integrate infrastructure risk management with its industrial and European commitments without assuming that the eastern-border threat environment is geographically replicated within Italian territory. Cross-border supply chains and military mobility create dependencies even where a country does not share a frontier with the principal hostile state. European regulatory requirements can support common minimum standards, while national authorities retain competence over their respective security and criminal-justice functions. The relevant question is not whether Italy should imitate Poland’s border defence programme, but whether its own critical services and defence-support activities have sufficiently documented continuity arrangements for disruptions affecting European networks.
A further distinction concerns the relationship between physical and digital protection. Italian NIS2 implementation provides a basis for cybersecurity governance, but physical sabotage requires additional competencies and safeguards. The EU’s Critical Entities Resilience framework addresses wider service-continuity threats, including deliberate physical interference, through the applicable national implementation arrangements. The two frameworks are complementary; their existence does not justify describing Italian infrastructure as fully protected or as having a verified level of resilience superior or inferior to another country’s.
France: strategic autonomy, comprehensive defence and hostile interference
France approaches these risks through a national security framework that gives substantial importance to sovereignty, defence capabilities, societal resilience and protection against hostile interference. Its National Strategic Review 2025, published by the Secretariat-General for Defence and National Security on 14 July 2025, updates the earlier 2022 framework and addresses a deteriorated international environment in which hybrid strategies, information manipulation and threats affecting national cohesion form part of the strategic challenge. The official review identifies Russia as a principal source of hostile hybrid activity affecting France and its allies, while situating these threats within a broader approach to national defence and resilience. Revue nationale stratégique 2025 — Secrétariat général de la défense et de la sécurité nationale — July 2025.
This institutional perspective is relevant to the Polish sabotage cases because it recognises the possibility that hostile activity may seek effects beyond immediate physical damage. Information manipulation, public intimidation and interference with essential services can affect a state’s ability to maintain social and economic continuity. Nevertheless, a national strategic review is not itself a judicial attribution of a specific operation. It establishes the French government’s strategic assessment and policy orientation, not proof that the individuals involved in the Polish investigations also operated in France.
France’s responsibilities are additionally shaped by its defence industry, transport systems, communications infrastructure and participation in NATO and European security initiatives. The relevant national challenge is to preserve the ability of civilian and military institutions to function under disruption while maintaining legal distinctions between intelligence activity, criminal investigation and public regulation. A broader conception of national defence can support coordination, but it does not remove the need for competent authorities to establish facts and apply the relevant legal framework.
The French government’s approach also demonstrates the importance of information integrity in a security crisis. Public communication should provide reliable factual information and avoid amplifying unverified attribution. Hostile interference may exploit uncertainty surrounding an incident, but excessive secrecy or premature certainty can also undermine institutional credibility. The appropriate policy balance depends on the nature of the investigation, public safety requirements and the legal rights of affected individuals. These considerations are relevant across Europe, although their implementation remains jurisdiction-specific.
The United Kingdom: NATO security commitments and national critical-infrastructure resilience
The United Kingdom occupies a different institutional position because it is a NATO member but no longer belongs to the European Union. Consequently, the EU’s Critical Entities Resilience and NIS2 directives do not impose member-state transposition obligations on the United Kingdom. UK infrastructure protection is governed by its own statutory and regulatory arrangements, while NATO obligations continue to apply according to the North Atlantic Treaty. This distinction prevents the erroneous presentation of EU legislation as a common directly applicable framework across all European allies.
The Strategic Defence Review 2025, published by the UK government in June 2025, explicitly identifies the need for stronger home defence and national resilience. It describes critical national infrastructure as fundamental to civilian life and military effectiveness, and addresses the possibility of sabotage and cyber activity affecting essential services during periods of heightened strategic confrontation. The review also calls for closer cooperation among defence authorities, government and infrastructure operators, including greater clarity about which elements of civilian infrastructure are essential to sustaining military operations. These are official strategic assessments and policy recommendations, not evidence that every contemplated measure had already been implemented. The Strategic Defence Review 2025: Making Britain Safer, Secure at Home, Strong Abroad — UK Ministry of Defence — June 2025.
The UK’s emphasis on national resilience is particularly relevant because it connects physical infrastructure protection with the capacity to support military operations in a wider European crisis. Its defence responsibilities depend on transport, energy, digital and industrial services that cannot be evaluated solely through conventional military inventories. This resembles the dependency problem identified in Poland, but the geographical and regulatory conditions differ. The UK does not require an eastern-border defence programme equivalent to Poland’s Eastern Shield; it requires arrangements suited to its own infrastructure, geography, military commitments and national authorities.
For the United Kingdom, cooperation with EU member states remains relevant where incidents involve multinational criminal networks or infrastructure serving cross-border activities. However, such cooperation depends on the applicable legal arrangements and cannot be described as automatic participation in every EU regulatory mechanism. NATO provides an important collective defence framework, but it does not replace national criminal jurisdiction or create a general European police authority. This makes the separation of security functions particularly important when discussing a country that participates fully in NATO but operates outside the EU’s internal legal architecture.
Comparative national framework: strategic functions, legal instruments and institutional limits
| Country | Principal documented security function | Relevant official framework | Main institutional responsibility | Important limitation | Official source |
|---|---|---|---|---|---|
| Poland | Eastern defence, allied logistics and population protection | Civil Protection Act 2024; Eastern Shield | National defence, civil protection and security authorities | Border infrastructure investment does not independently ensure internal service resilience | Civil Protection Act, 2024; Eastern Shield, 2024 |
| Lithuania | Eastern defence, intelligence and counterintelligence | National Threat Assessment 2026 | National intelligence and defence institutions | Threat assessment is not proof that every identified risk has materialised | Lithuanian VSD, 2026 |
| Germany | Allied logistics, industrial support and infrastructure continuity | KRITIS-Dachgesetz, in force Mar 2026 | National authorities and regulated operators | Legal entry into force does not establish full implementation | German Federal Government, 2026 |
| Italy | Industrial and transport continuity; European defence support | Legislative Decree 138/2024 implementing NIS2 | ACN for defined cybersecurity responsibilities; other competent national bodies for separate functions | Cybersecurity governance is not equivalent to comprehensive physical sabotage protection | Normattiva, 2024 |
| France | Comprehensive defence, resilience and countering hostile interference | National Strategic Review 2025 | National defence, security and resilience institutions | Strategic doctrine does not establish the results of individual investigations | SGDSN, 2025 |
| United Kingdom | NATO defence, home defence and critical national infrastructure | Strategic Defence Review 2025 | UK government, defence authorities and relevant infrastructure regulators | EU directives do not apply as member-state obligations | UK Ministry of Defence, 2025 |
This comparison does not provide a national security ranking. The countries differ in geography, military responsibilities, legal instruments and available official evidence. The fact that Germany adopted a particular infrastructure statute in 2026, for example, cannot be used to conclude that its infrastructure is necessarily more resilient than that of France or Italy. Such a judgment would require comparable implementation data, service-continuity measures and disruption outcomes.
The European Union: physical resilience, cybersecurity and cross-border obligations
The EU’s infrastructure-resilience framework is principally relevant because essential services increasingly depend on systems extending across national boundaries. The Critical Entities Resilience Directive (EU) 2022/2557 establishes a framework requiring member states to assess risks and identify critical entities, with corresponding obligations for those entities to assess risks and implement proportionate resilience measures. According to the European Commission, the directive covers 11 sectors: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, and food production, processing and distribution. The directive entered into application on 18 October 2024, and the Commission identified July 2026 as the deadline by which member states were to identify critical entities under the framework. This deadline is a legal implementation milestone, not verification that every member state had completed all required identification procedures by the report’s cut-off. Critical Infrastructure Resilience at EU Level — European Commission — January 2026; The Critical Entities Resilience Directive Enters into Application — European Commission — October 2024.
The directive is especially relevant to the sabotage environment because it does not define resilience solely in terms of cybersecurity. Its risk framework includes deliberate physical interference, insider threats and cross-border consequences. Article 12 requires identified critical entities to assess relevant risks, including dependencies on other essential services, while Article 13 requires proportionate technical, security and organisational measures. The provisions recognise that an incident may affect several sectors or countries through dependencies even where the initial physical damage is geographically limited. Directive (EU) 2022/2557 on the Resilience of Critical Entities, Articles 12–13 — European Parliament and Council — December 2022.
An important feature is the treatment of entities of particular European significance. The Commission explains that a critical entity providing essential services to six or more EU member states may fall within this additional framework, which provides for enhanced advice and coordination under the directive’s criteria. This threshold reflects the recognition that the effects of infrastructure disruption can cross borders and that the importance of a service cannot always be assessed solely by the state in which the operator is established. It does not automatically classify every multinational company or transport provider as such an entity; the legal requirements and identification procedures must still be satisfied. Critical Infrastructure Resilience at EU Level — European Commission — January 2026.
NIS2 provides a complementary cybersecurity framework. It addresses risk-management measures, incident reporting and regulatory supervision for covered entities in sectors of high criticality and other critical sectors. The overlap between NIS2 and the Critical Entities Resilience Directive creates opportunities for coordinated protection, but their legal scopes differ. Some public authorities whose functions concern national security, defence or law enforcement fall outside specified NIS2 provisions, while other entities may be subject to different requirements depending on sector and national implementation. Consequently, a legally accurate assessment must identify the applicable instrument and competent national authority rather than assume that all critical infrastructure is subject to a single set of identical obligations. Directive (EU) 2022/2555 on Measures for a High Common Level of Cybersecurity across the Union — European Parliament and Council — December 2022.
EU military mobility: ambition, implementation and security constraints
Military mobility illustrates another institutional area in which national competence and European coordination interact. The Commission’s November 2025 proposal seeks to facilitate the movement of military personnel, equipment and goods across the Union, including through administrative harmonisation and infrastructure improvements. The initiative recognises that defence readiness can be affected by regulatory restrictions and technical limitations as well as by deliberate interference. Its objective of establishing an EU-wide military mobility area by 2027 therefore depends on legal adoption, administrative implementation and the availability of suitable infrastructure. Commission Moves towards ‘Military Schengen’ and Transformation of Defence Industry — European Commission — November 2025.
The proposed framework is not equivalent to an unconditional military right to use every civilian transport facility or an automatic transfer of national defence powers to the European Commission. Member states retain legally relevant responsibilities for transport regulation, security and military activity within their jurisdictions. The practical value of European coordination lies in improving compatibility and reducing avoidable administrative or infrastructural obstacles while respecting those national competences.
The threat of sabotage introduces an additional condition: improving the speed of military transport does not necessarily improve the resilience of the underlying networks unless security and continuity requirements are addressed alongside efficiency. A more integrated system may permit better use of alternative routes and cross-border cooperation, but it may also create stronger dependencies among national services. Its resilience therefore requires evidence of redundancy, incident management and recovery arrangements. The Commission’s initiative identifies the importance of these issues, but the available record does not establish the completed operational performance of a future EU-wide mobility area.
EU restrictive measures: political and financial tools separate from criminal prosecution
The EU’s response to Russian destabilising activity includes a restrictive-measures framework adopted in October 2024. On 8 October 2026, the Council prolonged the measures until 9 October 2027, reporting that the regime covered 80 individuals and 20 entities. The measures include asset freezes, restrictions on making funds or economic resources available to listed persons and entities, and travel bans applicable to listed individuals. These are EU restrictive measures, not findings that every listed person has been convicted in a national criminal court. Russia’s Hybrid Activities: Council Prolongs Restrictive Measures until October 2027 — Council of the European Union — October 2026.
The distinction is important because sanctions and criminal prosecutions have different legal objectives and evidentiary structures. Criminal proceedings determine individual liability for offences under the applicable law, subject to judicial safeguards. EU restrictive measures seek to impose specified financial or travel consequences on listed persons and entities under the relevant EU legal framework. A sanctions designation may be relevant to financial compliance and institutional responses, but it does not itself establish the identity of every participant in a sabotage operation. Nor does the existence of a sanctions regime guarantee that intelligence-directed activity will cease.
The Council also linked its October 2026 decision to the European Council’s June 2026 concerns about continued hybrid attacks and the need to strengthen resilience, protect critical infrastructure and improve preparedness. This provides a documented political basis for collective EU action. Nevertheless, the responsibility for investigating specific criminal acts and protecting individual facilities remains distributed among the competent national authorities and operators. The EU’s collective response is therefore an important supplement to, rather than a replacement for, national enforcement. Russia’s Hybrid Activities: Council Prolongs Restrictive Measures until October 2027 — Council of the European Union — October 2026.
NATO: resilience, consultation and collective defence are distinct legal functions
NATO’s relevance to intelligence-directed sabotage must be analysed through the specific obligations of the North Atlantic Treaty. Article 3 requires allies, individually and collectively, to maintain and develop their capacity to resist armed attack. Article 4 provides for consultation when an ally considers its territorial integrity, political independence or security threatened. Article 5 concerns collective defence in response to an armed attack within the treaty’s applicable conditions. These provisions have different thresholds and functions. The existence of a suspected sabotage incident does not automatically mean that an armed attack has occurred for Article 5 purposes. The North Atlantic Treaty, Articles 3–5 — North Atlantic Treaty Organization — April 1949.
Article 3 is particularly relevant to infrastructure resilience because an ally’s capacity to resist armed attack depends in part on the availability of essential civilian and military services. The treaty does not prescribe a single national model for regulating private infrastructure, but it establishes a collective defence context in which national preparedness matters to the Alliance as a whole. Consequently, weaknesses in transport, communications or logistical support can become matters of allied interest even where the infrastructure remains under national or private management.
Article 4 provides a consultation mechanism without requiring the prior establishment of an Article 5 armed attack. The September 2025 airspace incidents and NATO’s subsequent Eastern Sentry initiative demonstrate the Alliance’s capacity to respond to a deteriorating security environment through consultation and enhanced military vigilance. Such responses remain distinct from the criminal investigation of clandestine interference with civilian facilities, which continues to depend on competent national authorities. NATO Launches Eastern Sentry to Bolster Posture along Eastern Flank — NATO — September 2025.
Article 5 must be interpreted with particular care. The treaty establishes that an armed attack against one or more allies within its relevant geographical scope is considered an attack against all, while each ally determines the action it considers necessary to assist the attacked state, including the possible use of armed force. A sabotage operation could raise serious security concerns without necessarily satisfying the legal and political conditions for collective defence. Its scale, effects, attribution and surrounding circumstances would be relevant to any assessment, but the open prosecutorial records concerning the commercial fires and railway incidents do not establish that NATO treated those events as Article 5 armed attacks.
Comparison of EU and NATO institutional instruments
| Instrument or framework | Legal or institutional function | Relevant scope | What it can contribute | What it does not establish | Official source |
|---|---|---|---|---|---|
| NATO Article 3 | Individual and collective capacity to resist armed attack | NATO allies | Defence preparedness and resilience obligations | A specific criminal offence or infrastructure-protection standard | North Atlantic Treaty |
| NATO Article 4 | Security consultation | NATO allies | Political consultation concerning threats | Automatic collective military response | North Atlantic Treaty |
| NATO Article 5 | Collective defence after an armed attack | Treaty-defined conditions | Assistance to an attacked ally | Automatic classification of every sabotage incident as armed attack | North Atlantic Treaty |
| CER Directive 2022/2557 | Resilience of critical entities | 11 specified sectors | Risk assessment, protective measures and cross-border coordination | Universal security guarantees or complete national implementation | European Commission, January 2026 |
| NIS2 Directive 2022/2555 | Cybersecurity governance | Covered public and private entities | Cyber risk management, reporting and supervision | Comprehensive investigation of physical sabotage | Directive (EU) 2022/2555 |
| Military Mobility Package | Proposed cross-border military transport framework | EU member states, subject to adoption | Administrative and infrastructure coordination | An already completed EU military mobility area | European Commission, November 2025 |
| EU hybrid-activity sanctions | Financial and travel restrictions | Persons and entities listed under EU law | Restriction of resources and movement of listed actors | Criminal convictions or complete disruption of clandestine networks | Council of the EU, October 2026 |
The instruments operate at different levels. NATO addresses alliance security and defence. EU legislation establishes common requirements and cooperation mechanisms within the competences granted to the Union. National authorities retain essential roles in intelligence, policing, civil protection and enforcement. Effective coordination requires these functions to complement one another without implying powers that the applicable legal instruments do not confer.
Strategic coordination problems: responsibility, evidence and implementation
The first coordination problem concerns intelligence attribution. National security services may identify information relevant to another member state’s infrastructure or legal jurisdiction, but the publicly available record rarely discloses the complete mechanisms through which that information is exchanged. The February 2026 investigation involving Poland, Germany and Lithuania demonstrates that cooperation can occur in specific cases. It does not prove that every relevant organisation receives identical intelligence at the same time or that all intelligence can lawfully be shared without restrictions. Effective cooperation must therefore account for confidentiality, source protection, evidentiary admissibility and differences in national competence.
The second problem concerns the relationship between infrastructure operators and public authorities. Governments may possess threat intelligence unavailable to private companies, while operators may possess technical and commercial information necessary to assess the consequences of an incident. Neither type of information is automatically sufficient. A security service may identify a credible threat without knowing the operator’s exact recovery arrangements, while an operator may understand its infrastructure but lack the evidence necessary to attribute suspicious conduct to a foreign organisation. The CER and NIS2 frameworks seek to strengthen relevant risk governance, but implementation remains dependent on legally applicable national arrangements and operational cooperation.
The third problem concerns continuity across borders. A disruption in one country can affect services in another through transport, energy, communications or production dependencies. Yet an incident within one national jurisdiction may be investigated and managed primarily under that state’s law. EU coordination can help address cross-border implications, while NATO coordination may become relevant where allied military readiness is affected. Such arrangements require careful separation of information-sharing, operational command, public regulation and judicial action. The existence of an international security interest does not automatically transfer legal authority over an incident.
The fourth problem concerns proportionality. Preventive measures can impose costs on operators, travellers, businesses and residents. Additional restrictions may protect particular assets while affecting economic activity or civil liberties. Measures should therefore be connected to documented risks, assessed for operational effectiveness and periodically reviewed. The appropriate objective is not maximum restriction in every circumstance, but a justified balance between security, service continuity, legal safeguards and the resources required for implementation.
Institutional response options and implementation trade-offs
| Policy option | Principal authority | Expected effect | Implementation burden | Time to effect | Reversibility and principal downside |
|---|---|---|---|---|---|
| Strengthen lawful cross-border exchange of relevant investigative information | Competent national security and judicial authorities | Earlier identification of connected cases | Secure procedures, legal compatibility and staff resources | Potentially near term where cooperation already exists | Procedural changes generally reversible; disclosure and privacy risks must be managed |
| Improve critical-entity risk assessment and resilience planning | National competent authorities and covered operators | Better identification of service dependencies and continuity requirements | Technical assessment, operator expenditure and supervision | Medium term; depends on implementation | Plans can be revised; administrative burden and misallocation of resources are risks |
| Integrate civilian transport continuity into military-mobility planning | National transport and defence authorities, with applicable EU and NATO coordination | Greater compatibility between civilian services and defence needs | Infrastructure analysis, legal coordination and possible capital expenditure | Medium to long term | Physical investments less reversible; opportunity costs and competing transport needs |
| Strengthen legally governed incident reporting and public communication | National authorities and operators | More reliable information and potentially earlier detection | Reporting systems, training and verification procedures | Near to medium term | Procedures adjustable; excessive reporting and false positives may reduce effectiveness |
| Improve financial compliance concerning sanctioned actors | National competent authorities and regulated financial institutions | Restrictions on access to financial resources by listed parties | Compliance and investigative capacity | Near term for existing measures | Listings subject to legal review; false identification and circumvention remain concerns |
| Enhance cooperation between civil infrastructure authorities and NATO-related defence planning | National governments and relevant allied institutions | Better understanding of defence-support dependencies | Inter-agency coordination and protection of sensitive information | Medium term | Arrangements adjustable; classification and competence barriers may limit information exchange |
These options are complementary rather than mutually exclusive. Their feasibility depends on existing institutional capacity, legislative competence, available funding and the sensitivity of the information involved. They should not be ranked by assumed effectiveness without comparable implementation and outcome data. In particular, a measure that appears relatively inexpensive administratively may require significant organisational change, while a capital-intensive infrastructure improvement may produce benefits extending beyond security, such as greater service reliability or transport capacity. The full economic assessment would require costed proposals and verified operational objectives.
The 2026–2031 European outlook: integration, implementation and unresolved exposure
The coming five-year period is shaped by several identifiable official policy horizons. Poland’s Eastern Shield programme covers 2024–2028. The European Commission’s military mobility initiative identifies 2027 as a target for the proposed EU-wide framework. The European defence-readiness agenda extends toward 2030, while the Critical Entities Resilience Directive establishes continuing requirements for national identification, risk assessment and protective measures. The EU’s restrictive-measures framework against Russian destabilising activity has been extended through 9 October 2027. These are different kinds of milestones: some concern infrastructure programmes, others proposed legislation, regulatory implementation or time-limited sanctions. Their simultaneous existence does not establish that all associated security outcomes will be achieved. The Task of the State Is to Protect and Defend the Border — Polish Prime Minister’s Chancellery — June 2024; Future of European Defence — European Commission; Critical Infrastructure Resilience at EU Level — European Commission — January 2026; Russia’s Hybrid Activities: Council Prolongs Restrictive Measures until October 2027 — Council of the European Union — October 2026.
The principal strategic uncertainty is whether implementation will reduce the consequences of deliberate disruption faster than hostile actors change their methods or organisational arrangements. The official record demonstrates that states have recognised the problem and adopted or proposed measures, but it does not provide a validated forecasting model for the future frequency of sabotage operations. Nor does it establish the full population of active networks. As a result, the assessment cannot responsibly assign numerical probabilities to particular attack scenarios or assert that the threat will necessarily intensify at a specified annual rate.
A more defensible approach is to identify observable changes in resilience. Relevant indicators include the documented completion of infrastructure programmes, the extent of national implementation of applicable EU requirements, verified improvements in emergency restoration, evidence of effective cross-border investigations and published findings concerning disrupted operations. An increase in arrests or prosecutions may indicate greater hostile activity, better detection or changes in reporting practices; interpretation requires supporting evidence. Similarly, the absence of publicly disclosed attacks over a period cannot independently establish that clandestine recruitment or preparatory activity has ceased.
Key judgments — Chapter 6
European security responsibilities remain distributed among national governments, EU institutions and NATO. Poland and Lithuania face particular geographical and counterintelligence concerns associated with their eastern-border positions, while Germany’s defence-logistics role, Italy’s industrial and cybersecurity responsibilities, France’s comprehensive security framework and the United Kingdom’s NATO-centred national resilience requirements create different forms of exposure. The EU provides important common instruments for infrastructure resilience, cybersecurity, military mobility and sanctions, but these do not replace national criminal jurisdiction or intelligence functions. NATO contributes collective defence, consultation and military preparedness under treaty provisions whose legal thresholds must not be conflated with the occurrence of an individual sabotage offence.
What would change the assessment
The assessment would change materially if official implementation records demonstrated substantial improvements or persistent failures in cross-border infrastructure resilience, if new legislation altered the distribution of national and EU competences, or if NATO adopted and implemented additional arrangements directly affecting the protection of civilian infrastructure supporting allied operations. Further judicial findings connecting multiple European incidents through common command or financing structures could also alter the relative importance of multinational investigative coordination. A verified change in the legal status of the proposed military-mobility framework would require distinguishing newly binding provisions from the original Commission proposal.
Open official record
The most consequential unresolved questions concern the actual implementation of critical-entity obligations across member states, the effectiveness of national infrastructure-restoration arrangements, the operational readiness of proposed military-mobility improvements, and the measurable results of intelligence and criminal-justice cooperation. Publicly available official records provide substantial information about legal frameworks and selected incidents, but they do not permit a comprehensive comparison of national resilience performance or a reliable estimate of the future scale of intelligence-directed sabotage.
Pillar II — Integrated Strategic Assessment
The combined evidence establishes that European infrastructure security, economic continuity and military readiness increasingly intersect within the same civilian operating environment. Poland’s role in NATO’s eastern logistics architecture provides a concrete example: the Alliance reported approximately 18,000 tonnes of material handled per month by its Polish NSATU hub in November 2025, while the European Commission’s military-mobility agenda recognises the importance of transport systems and cross-border coordination to broader defence readiness. These facts demonstrate the strategic significance of civilian infrastructure without establishing that a particular sabotage incident disrupted the documented NATO logistics flow. NATO Deputy Secretary General Visits Logistics Hub Providing Vital Equipment for Ukraine’s Defence — NATO — November 2025; Military Mobility — European Commission.
The sabotage record demonstrates that the threat is not confined to information gathering. Polish prosecutors have attributed completed commercial arson incidents to an organised group operating on behalf of Russian intelligence and have pursued separate investigations concerning dangerous interference with railway infrastructure. The legal and factual distinction between these cases remains essential. Different defendants, incidents and evidentiary records cannot be combined into a single proven operational command structure without additional corroboration. The existence of Russian-directed activity does not independently establish Belarusian KGB responsibility for the same operations, even where suspected individuals subsequently travelled to Belarus or Belarusian citizens were involved in other documented investigations. Akt oskarżenia w sprawie podpaleń obiektów wielkopowierzchniowych na rzecz wywiadu Federacji Rosyjskiej — Prokuratura Krajowa — April 2026; Zarzuty za akty dywersji przeciwko infrastrukturze kolejowej — Prokuratura Krajowa — November 2025.
The economic dimension follows from the dependence of essential services on reliable infrastructure, not from unverified assumptions about the monetary cost of individual attacks. Direct property damage, service interruption, lost output, additional operating expenditure and public emergency costs must be measured separately using competent evidence. The fact that a facility is strategically important does not establish that its temporary unavailability would produce an unrecoverable military or economic loss. Conversely, apparently limited physical damage can require substantial safety procedures or restoration measures before a service can resume. The decisive variables are actual continuity, redundancy, recovery time and the dependencies connecting the affected service to wider civilian and defence functions.
The institutional response is consequently multidimensional. National governments remain responsible for the lawfully exercised security, criminal-justice and civil-protection functions within their jurisdictions. The EU’s Critical Entities Resilience Directive and NIS2 establish complementary regulatory frameworks, while the military-mobility agenda addresses constraints affecting cross-border defence transport. NATO’s treaty structure provides the framework for allied resilience, consultation and collective defence, but the legal conditions governing these functions remain distinct. The result is not a unified European security authority; it is a system whose effectiveness depends on competent national implementation and cooperation across different legal and operational responsibilities. Critical Infrastructure Resilience at EU Level — European Commission — January 2026; The North Atlantic Treaty — NATO — April 1949.
The final assessment of Pillar II is that the strategic consequences of foreign intelligence-directed sabotage depend on the service relationships surrounding the affected infrastructure, the demonstrable objectives and capabilities of the responsible network, and the capacity of competent institutions to maintain or restore essential operations. The public record establishes a serious and geographically distributed security challenge, but it does not justify invented national risk scores, speculative economic losses or an assumption that all hostile incidents belong to one centrally coordinated campaign. European resilience through 2031 will be determined not merely by the adoption of security instruments, but by their verified implementation, the continuity of essential services and the effectiveness of lawful cooperation across national and allied institutions.
PILLAR III — COUNTERINTELLIGENCE GOVERNANCE, RISK INDICATORS AND STRATEGIC OUTLOOK
Chapter 7. Counterintelligence Law, Financial Tracing and Democratic Resilience
Principal judgment: The capacity of European states to prevent foreign intelligence-directed interference depends on more than the severity of espionage legislation or the investigative resources available to security services. It depends on the compatibility of criminal law, intelligence authorities, judicial oversight, financial intelligence, access to electronic evidence and mechanisms protecting individuals exposed to foreign coercion. As of 6 November 2026, Poland has a substantially developed statutory framework for prosecuting foreign intelligence activity and, following legislation entering into force on 31 October 2026, strengthened judicial oversight of operational surveillance. At European level, the framework for financial traceability and cross-border electronic evidence has also undergone important changes. The outstanding institutional challenge is whether these legal powers can be translated into timely, admissible and operationally useful information without compromising fundamental rights or incorrectly associating entire migrant communities with foreign intelligence activity.
Polish criminal law: the legal architecture of espionage, intelligence cooperation and sabotage
The starting point for evaluating Poland’s counterintelligence governance is Article 130 of the Polish Criminal Code, substantially revised by the Act of 17 August 2023. The legislation distinguishes participation in foreign intelligence activity, the provision of information, declared readiness to assist foreign intelligence, organisation or direction of intelligence activity, activity conducted on Polish territory for foreign intelligence without the required authorisation, and sabotage or terrorism-related offences involving foreign intelligence. The distinction is essential because the legal significance of individual conduct depends on the specific statutory elements rather than on whether the conduct resembles an espionage technique. A photograph, payment, electronic communication or contact with a foreign national cannot automatically establish the offence. What matters is the legally relevant relationship between the defendant’s conduct, the foreign intelligence activity and the particular requirements of the provision invoked by prosecutors. Act of 17 August 2023 Amending the Criminal Code and Certain Other Acts — Sejm of the Republic of Poland — August 2023. ELI
The revised Article 130 creates a graduated structure of criminal liability. Under §1, participation in or activity for foreign intelligence against Poland is punishable by imprisonment for at least five years. Under §2, providing foreign intelligence with information whose disclosure may harm Poland carries a minimum of eight years’ imprisonment, with life imprisonment available under the statutory provision. Section 3 addresses specified conduct involving declared readiness to act for foreign intelligence or the collection, storage or acquisition of information for such purposes, with a sentencing range of six months to eight years. Section 4 establishes more severe liability for organising or directing foreign intelligence activity described in §1, with imprisonment for at least ten years or life imprisonment. These distinctions demonstrate that Polish legislation differentiates forms of involvement and culpability instead of defining all suspicious conduct as a single undifferentiated offence. Act of 17 August 2023 Amending the Criminal Code, Article 130 §§1–4 — Sejm of the Republic of Poland — August 2023.
The law also addresses an important jurisdictional distinction. Article 130 §6 concerns participation in foreign intelligence activity conducted on Polish territory without the consent of the competent authority, even where the activity is not directed against Poland itself. This provision is particularly relevant to a state hosting foreign nationals, political organisations, international institutions and allied military activities. It recognises that unauthorised foreign intelligence activity inside Poland can constitute an offence even when the direct intelligence target is another country. Its application nevertheless requires establishing the applicable legal elements, including the nature of the activity and the absence of the relevant consent; it does not criminalise ordinary foreign political association or all collection of publicly available information. Act of 17 August 2023 Amending the Criminal Code, Article 130 §6 — Sejm of the Republic of Poland — August 2023.
Article 130 §7 provides a separate and more severe basis for addressing sabotage, diversionary acts and terrorism-related offences committed while participating in or acting for foreign intelligence. It provides for imprisonment for at least ten years or life imprisonment, while §8 criminalises preparation for offences specified in §7, with imprisonment from six months to eight years. This is a legally significant distinction between preparatory conduct and completed criminal acts. A defendant need not necessarily have completed the intended destructive action for specified preparatory behaviour to become criminally relevant, but the prosecution must still establish the statutory elements of preparation and the connection required by the provision. The legal framework therefore permits earlier intervention than would be possible if prosecution required completed physical destruction, while preserving the distinction between a legally defined preparatory offence and an unproven assumption about future intent. Act of 17 August 2023 Amending the Criminal Code, Article 130 §§7–8 — Sejm of the Republic of Poland — August 2023.
A further jurisdictional provision deserves attention. Article 112a, introduced through the same 2023 reform, addresses the application of Polish criminal law to specified offences committed using information or telecommunications systems where the conduct produces, or could produce, effects in Poland harming enumerated state interests. This provision has potential relevance to cross-border digital conduct because the person issuing instructions or conducting an unlawful activity may not be physically present in Poland. However, the provision cannot be interpreted as unlimited universal jurisdiction over every online communication involving Polish infrastructure or residents. Its scope depends on the nature of the offence, the technological means involved and the legally specified consequences for Polish state interests. Act of 17 August 2023 Amending the Criminal Code, Article 112a — Sejm of the Republic of Poland — August 2023.
The current temporal reference must also be stated accurately. Poland published a consolidated text of the Criminal Code on 16 October 2026, reflecting the legal status identified by the promulgating authority as of 27 September 2026. A consolidated text is a reference instrument incorporating specified legislative changes; the operative law at a particular date also requires attention to subsequent amendments and their entry into force. For historical proceedings, the applicable substantive criminal law must be determined according to the legally relevant time of the alleged conduct and the rules governing changes in criminal legislation. It would therefore be incorrect to apply the most recent sentencing provisions indiscriminately to conduct committed before their effective date. Consolidated Text of the Criminal Code, Journal of Laws 2026 Item 1342 — Sejm of the Republic of Poland — October 2026. Kodeks karny
Statutory comparison of the principal espionage offences
| Provision | Conduct addressed | Statutory imprisonment | Principal evidentiary distinction | Official source |
|---|---|---|---|---|
| Article 130 §1 | Participation in or activity for foreign intelligence against Poland | At least 5 years | Establishing the foreign intelligence relationship and the legally relevant conduct against Poland | Polish Criminal Code Amendment, Article 130 §1 — August 2023 |
| Article 130 §2 | Provision of information potentially harmful to Poland while participating in or acting for foreign intelligence | At least 8 years, or life imprisonment | Nature of the information, its potential harmfulness and the intelligence relationship | Article 130 §2 — August 2023 |
| Article 130 §3 | Specified declarations of readiness or preparatory information-acquisition activity | 6 months–8 years | Legally relevant intent, readiness or acquisition activity | Article 130 §3 — August 2023 |
| Article 130 §4 | Organisation or direction of activity described in §1 | At least 10 years, or life imprisonment | Organisational responsibility rather than mere participation | Article 130 §4 — August 2023 |
| Article 130 §5 | Specified participation by a public official or person serving in the defined territorial military capacity | At least 8 years, or life imprisonment | Statutory status and conduct under §1 | Article 130 §5 — August 2023 |
| Article 130 §6 | Unauthorised foreign intelligence activity on Polish territory not directed against Poland | 6 months–8 years | Territorial activity and the absence of legally required consent | Article 130 §6 — August 2023 |
| Article 130 §7 | Sabotage, diversionary activity or terrorism-related offences for foreign intelligence | At least 10 years, or life imprisonment | Proof of the specified serious conduct and foreign intelligence relationship | Article 130 §7 — August 2023 |
| Article 130 §8 | Preparation for the conduct specified in §7 | 6 months–8 years | Statutorily qualifying preparation rather than completed sabotage | Article 130 §8 — August 2023 |
These statutory ranges describe the law established by the 2023 amendment; they are not observed sentencing averages, automatic outcomes or predictions of penalties in pending proceedings. Individual judicial outcomes depend on the charges established, applicable legal provisions, evidence, procedural rules and sentencing considerations. A legal framework containing severe penalties may increase the potential consequences of participation, but its existence alone does not establish deterrent effectiveness. Evaluating deterrence would require evidence regarding knowledge of the law, perceptions of detection, prosecution outcomes and behavioural responses, none of which can be inferred from sentencing provisions alone.
The division of investigative authority and the importance of lawful intelligence collection
Poland’s Internal Security Agency (ABW) exercises statutory functions concerning internal state security, counterintelligence and specified offences threatening state interests. Its powers derive principally from the Act of 24 May 2002 on the Internal Security Agency and Intelligence Agency, as subsequently amended. Article 5 establishes the relevant responsibilities of ABW, including identifying, preventing and detecting espionage, terrorism, unlawful disclosure of classified information and other specified offences affecting state security. The institutional mandate is broad but legally defined. It does not eliminate the separate responsibilities of prosecutors, courts, police, military counterintelligence or other competent authorities. Consolidated Act on the Internal Security Agency and Intelligence Agency, Journal of Laws 2026 Item 937 — Sejm of the Republic of Poland — July 2026. ELI
The operational distinction between intelligence collection and criminal prosecution is fundamental. Security services can seek to identify threats before sufficient evidence exists to bring a criminal charge. Criminal proceedings, by contrast, require evidence capable of supporting allegations under the applicable procedural law, with the defendant entitled to legal safeguards. Information that is operationally useful may not automatically be admissible or suitable for disclosure in court. Sources may be confidential, information may originate from a foreign partner, or the method of collection may be subject to specific legal restrictions. Effective counterintelligence governance must therefore address the process by which lawfully collected intelligence can contribute to criminal investigations without compromising protected information or undermining the rights of individuals.
This requirement becomes more difficult when potential evidence consists of electronic communications, digital payment records and material held by commercial platforms. A communication may be relevant to the identification of an alleged coordinator, while the legal authority to obtain and use it depends on the circumstances, the applicable procedure and the location of the service provider or data. An intelligence service’s general mandate to identify espionage does not provide an unrestricted power to obtain every account record. Judicial authorisation, statutory limitations and applicable data-protection obligations remain relevant.
October 2026: Poland’s strengthened judicial oversight of operational surveillance
A particularly important development occurred shortly before the report’s cut-off. Poland’s Act of 4 September 2026 on Amending Laws to Strengthen Judicial Supervision of Operational Surveillance was published on 30 September 2026 and entered into force on 31 October 2026. The legislation amends provisions governing several authorised services, including ABW, police, the Border Guard and military counterintelligence bodies. Its declared purpose is to strengthen judicial supervision, harmonise specified procedural rules and reinforce safeguards protecting individual rights during operational surveillance. The timing is consequential: the legislation had entered into force only six days before the present assessment, so its practical implementation and long-term effectiveness cannot yet be evaluated from a completed performance record. Act of 4 September 2026 on Strengthening Judicial Oversight of Operational Surveillance, Journal of Laws 2026 Item 1281 — Sejm of the Republic of Poland — September 2026. ELI
The Polish government’s official explanation identifies several significant changes. Courts are to receive information about the results of operational surveillance after its completion and may request information concerning its conduct while it remains ongoing, including relevant materials. The legislation also provides additional powers for courts or prosecutors to terminate operational surveillance where the evidentiary circumstances justify doing so, together with procedures concerning information about the destruction of materials that cannot lawfully be used in criminal proceedings. These reforms matter because judicial oversight does not end with the initial authorisation of a surveillance measure. Ongoing supervision and subsequent review can help assess whether the measure remained legally justified, whether relevant procedural requirements were observed and whether collected information was handled lawfully. Act Strengthening Judicial Oversight of Operational Surveillance Signed by the President — Polish Special Services — September 2026. Portal Gov.pl
The relationship between oversight and effectiveness should not be framed as a simple trade-off in which greater surveillance authority necessarily produces better security and stronger safeguards necessarily reduce operational capacity. Judicial procedures can impose administrative requirements, but they can also improve the legal reliability of investigations and reduce the risk that evidence is later challenged because of improper collection. The relevant question is whether the institutions can apply authorisation, review and evidence-management procedures in a timely and legally sound manner. That depends on implementation, resources and judicial practice rather than the text of the law alone.
There is also an important temporal qualification concerning the underlying statutory materials. The consolidated ABW legislation published in July 2026 predates the September amendment that entered into force on 31 October. It must therefore be read together with the later legislation when evaluating the legal framework at the November 2026 cut-off. Relying exclusively on the July consolidated text would risk overlooking operative oversight changes. Conversely, the government’s September explanatory announcement is evidence of the reform’s objectives and principal provisions, not a substitute for the legislation itself. Consolidated ABW Act — Sejm of the Republic of Poland — July 2026; Operational Surveillance Oversight Amendment — Sejm of the Republic of Poland — September 2026.
Surveillance governance: legal safeguards and operational consequences
| Governance component | Legal or institutional baseline | Relevant operational benefit | Safeguard or limitation | Official source |
|---|---|---|---|---|
| Counterintelligence competence | ABW Act, Article 5 | Identification and investigation of threats to state security | Powers remain subject to statutory competence | ABW Act, 2026 |
| Operational surveillance | ABW Act, Article 27, as amended | Lawful collection of information in qualifying investigations | Statutory conditions and judicial authorisation requirements | ABW Act, 2026 |
| Strengthened judicial supervision | September 2026 amendment, effective 31 October | Judicial review of surveillance conduct and results | Courts and prosecutors exercise defined supervisory functions | Act, September 2026 |
| Termination of unjustified surveillance | 2026 amendment | Ability to end measures where continuing them is not justified | Requires application of statutory standards | Polish Special Services, September 2026 |
| Handling inadmissible materials | 2026 amendment | More accountable treatment of materials subject to legal restrictions | Destruction and reporting duties governed by law | Polish Special Services, September 2026 |
| Criminal liability | Criminal Code, Article 130 | Prosecution of defined foreign intelligence offences | Proof of statutory elements and criminal-procedure guarantees | Criminal Code, 2026 |
| Cross-border digital offences | Criminal Code, Article 112a | Jurisdictional framework for specified offences using information systems | Legally defined effects and state interests required | Amendment, August 2023 |
The table identifies distinct legal functions rather than a single investigative sequence. A competent authority may possess jurisdiction over a particular offence without automatically being entitled to use every surveillance technique. Similarly, judicial authorisation of a measure does not determine whether the person under investigation is guilty. These legal distinctions must be preserved if operational intelligence is to be converted into reliable evidence and subsequently withstand judicial scrutiny.
Financial tracing: the difference between identifiable transactions and proven intelligence financing
Financial intelligence is an important potential source of evidence because covert operations involving remunerated intermediaries may leave records connecting payments, accounts, devices and communications. The investigative significance of a transfer, however, depends on more than its amount or payment method. A transaction may identify a payer, beneficiary, intermediary or service provider, but the ultimate person controlling the funds may remain unresolved. A payment may be compatible with a legitimate commercial relationship or a foreign intelligence-directed activity; the financial record alone is not necessarily decisive. The appropriate institutional approach is therefore evidence-led transaction analysis connected to a legally relevant investigation, rather than treating small international transfers or the use of cryptocurrency as presumptive espionage indicators.
The European legal framework has changed materially in this area. Regulation (EU) 2023/1113, applicable from 30 December 2024, extends requirements concerning information accompanying transfers of funds to specified crypto-asset transfers. Its purpose includes improving the traceability of covered transfers by requiring relevant payment and crypto-asset service providers to transmit and manage information concerning the originator and beneficiary. This is not a universal requirement that every transaction on every blockchain disclose the ultimate beneficial controller publicly. The obligations apply within the defined regulatory scope, and investigators still need lawful access to relevant information and evidence linking transactions to persons or offences. Regulation (EU) 2023/1113 on Information Accompanying Transfers of Funds and Certain Crypto-assets — European Parliament and Council — May 2023. Eur-Lex
The European Banking Authority’s Travel Rule Guidelines, applicable from the same date, establish guidance for payment service providers, intermediary payment service providers, crypto-asset service providers and intermediaries concerning missing or incomplete information accompanying transfers. The guidelines explain the procedures expected of covered providers and contribute to more consistent implementation of the regulation. Their relevance to counterintelligence is indirect but important: better transaction documentation may support legally authorised investigations into suspicious financial relationships. The rules were designed for anti-money-laundering and counter-terrorist-financing purposes; their existence does not independently classify foreign intelligence recruitment payments as money laundering or terrorist financing. Guidelines on Information Requirements in Relation to Transfers of Funds and Certain Crypto-asset Transfers — European Banking Authority — July 2024. European Banking Authority
The distinction between traceability and intelligence attribution becomes especially important when funds pass through several intermediaries or when a transaction originates outside the EU regulatory perimeter. An EU-regulated provider may hold information about its direct customer or a covered transfer, but that information does not necessarily reveal the foreign intelligence organisation ultimately commissioning an assignment. Corroboration may require judicially obtained communications, evidence of account control, transaction histories and relevant international cooperation. Investigators must also distinguish suspicious financial activity from proven criminal financing: a suspicious transaction report is an investigative input, not a judicial finding of guilt.
The EU’s broader anti-money-laundering reform creates a further institutional development. On 30 May 2024, the Council adopted a legislative package introducing a harmonised framework for private-sector anti-money-laundering obligations, revised national institutional arrangements and the establishment of the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) in Frankfurt. The package strengthens the coordination of national supervisors and financial intelligence units, while AMLA is intended to exercise direct supervision over selected higher-risk financial-sector entities beginning in 2028. This is an important future institutional milestone, but it must not be described as direct AMLA supervision already operating across all relevant financial institutions in November 2026. Anti-money Laundering: Council Adopts Package of Rules — Council of the European Union — May 2024; Questions and Answers on the New EU Anti-Money Laundering Authority — European Commission — 2024.
Financial-tracing mechanisms should therefore be evaluated through their actual legal and operational coverage. The existence of a payment infrastructure within the EU can facilitate lawful data acquisition under specified circumstances, but it cannot guarantee identification of every remote coordinator. Financial intelligence units, supervisory authorities, law-enforcement agencies and intelligence services also have different legal functions. The institutional value arises from appropriately authorised cooperation among them, not from assuming that the anti-money-laundering system operates as a general counterespionage surveillance network.
Financial evidence and institutional competence
| Financial or evidentiary element | Applicable framework | What may be established | What cannot be inferred automatically | Principal authority or institutional role |
|---|---|---|---|---|
| Covered bank or payment transfer | Regulation (EU) 2023/1113 | Originator and beneficiary information within the legal scope | Ultimate intelligence-service control | Regulated providers and competent authorities |
| Covered crypto-asset transfer | Regulation (EU) 2023/1113 | Required transfer information and associated compliance records | Identity of every person controlling external addresses | Crypto-asset service providers and competent authorities |
| Missing transfer information | EBA Travel Rule Guidelines | Compliance concerns requiring prescribed procedures | A completed espionage offence | Covered providers and AML/CFT supervisors |
| Suspicious financial activity | National AML/CFT legal arrangements | Grounds for financial intelligence assessment | Criminal guilt or foreign intelligence attribution | National financial intelligence units |
| Selected high-risk financial-sector supervision | AMLA framework | EU-level supervision when applicable | Universal AMLA jurisdiction over all payment providers | AMLA and national supervisors |
| Asset freezing under EU restrictive measures | Relevant EU sanctions regulations | Restrictions affecting listed persons and entities | Criminal conviction or proof of involvement in an unrelated incident | National competent authorities and regulated entities |
| Financial evidence in criminal proceedings | Applicable criminal procedure and judicial cooperation | Transactional evidence lawfully obtained and admitted | Complete operational command structure without corroboration | Prosecutors, investigators and courts |
Relevant official instruments are Regulation (EU) 2023/1113 — European Parliament and Council — May 2023, EBA Travel Rule Guidelines — European Banking Authority — July 2024, and Anti-money Laundering: Council Adopts Package of Rules — Council of the EU — May 2024.
Cross-border electronic evidence: a significant change in the European legal framework in 2026
The ability to investigate remote recruitment depends increasingly on whether competent authorities can lawfully obtain electronic evidence held by service providers operating across national borders. Relevant information can include account registration details, communications, records identifying the timing of interactions and other electronically stored material. The evidence may be located outside the state investigating the offence, even where the conduct under investigation affected people or infrastructure within that state’s territory. This creates jurisdictional and procedural requirements that are distinct from the technical ability to access data. The legal basis for requesting information, the identity of the issuing authority, the applicable safeguards and the obligations of the receiving provider all matter.
The EU’s e-Evidence Package, adopted in 2023, is particularly consequential at the November 2026 cut-off because its principal Regulation became applicable on 18 August 2026. The accompanying Directive, concerning designated establishments and legal representatives of service providers, applied from 18 February 2026. Regulation (EU) 2023/1543 establishes European Production Orders and European Preservation Orders for specified electronic evidence in criminal proceedings. The European Commission explains that the framework permits a competent judicial authority in one participating member state to obtain specified electronic evidence directly from a relevant service provider or its representative in another participating state under the applicable conditions. This differs from relying exclusively on traditional mutual legal assistance procedures. E-evidence: Cross-border Access to Electronic Evidence — European Commission — 2026. European Commission
The Regulation establishes a general response deadline of ten days for covered European Production Orders and a deadline of eight hours for qualifying emergency requests, subject to the regulation’s requirements and safeguards. These are legally prescribed response periods, not verified average processing times in intelligence investigations. The difference matters because a statutory deadline does not establish that the requested evidence will necessarily exist, be accessible, remain relevant or lead to successful attribution. It also does not eliminate the legal conditions for issuing an order or the rights of affected persons and providers. E-evidence: Cross-border Access to Electronic Evidence — European Commission — 2026.
The existing European Investigation Order, established under Directive 2014/41/EU, remains an important separate mechanism for obtaining evidence in criminal proceedings. The European Commission describes an ordinary recognition period of 30 days, followed by a general 90-day period for execution after the relevant decision, subject to the directive’s exceptions and applicable procedural conditions. Unlike the e-Evidence framework focused on specified categories of electronic evidence, the European Investigation Order has a wider scope covering investigative measures such as witness examinations, banking information and certain forms of covert investigation. The instruments should therefore be regarded as complementary rather than interchangeable. Taking of Evidence in Another EU Country — European Commission. European Commission
On 23 June 2026, the Commission adopted a proposal to recast the European Investigation Order Directive. The proposal seeks to modernise cross-border evidence gathering and provide additional rules concerning remote participation in criminal proceedings. At the report’s cut-off, it must be described as a proposal, not an enacted replacement for the operative directive. This distinction is important for institutional planning because future procedural improvements cannot be assumed to be available under existing law before the applicable legislative and implementation requirements are satisfied. Taking of Evidence in Another EU Country — European Commission, 2026.
Cross-border evidence instruments and their limitations
| Instrument | Principal scope | Official procedural timeframe | Institutional benefit | Limitation | Source |
|---|---|---|---|---|---|
| European Production Order, Regulation (EU) 2023/1543 | Specified electronic evidence held by relevant service providers | General response within 10 days | Direct judicially governed cross-border acquisition | Conditions, notification and refusal safeguards apply | European Commission, e-Evidence |
| Emergency European Production Order | Qualifying urgent electronic-evidence requests | 8-hour response period | Accelerated access in legally defined emergencies | Emergency conditions must be satisfied | European Commission, e-Evidence |
| European Preservation Order | Preservation of specified electronic evidence | Subject to the Regulation’s provisions | Reduces the risk of relevant evidence being lost before lawful production | Preservation does not itself authorise unrestricted disclosure | European Commission, e-Evidence |
| European Investigation Order, Directive 2014/41/EU | Broad range of cross-border criminal investigative measures | Generally 30 days for recognition and 90 days for execution thereafter | Judicial cooperation beyond electronic evidence | Specific refusal grounds and procedural requirements | European Commission, Taking Evidence Abroad |
| Proposed recast of European Investigation Order | Modernisation of cross-border evidence procedures | Proposal adopted 23 June 2026 | Potential future improvements | Not an operative replacement at the cut-off | European Commission, 2026 |
The practical value of these mechanisms depends on competent judicial authorities identifying which evidence is necessary, obtaining it through the correct legal route and preserving its reliability. Electronic data may be technically accessible but legally unsuitable for a particular investigative purpose. Conversely, legally obtained data may be insufficient to identify the ultimate foreign intelligence beneficiary. Evidence acquisition improves investigative opportunity; it does not remove the analytical distinction between a person controlling an account, a financial intermediary, a coordinator and a foreign intelligence organisation.
Digital platforms: obligations, jurisdiction and freedom of expression
The role of messaging services and online platforms requires separating several forms of regulatory intervention. A platform may be subject to obligations concerning illegal content, transparency, cooperation with authorities and data protection, but those obligations are not equivalent to an unrestricted duty to monitor private communications on behalf of intelligence services. The Digital Services Act, Regulation (EU) 2022/2065, establishes a European framework governing intermediary services, including requirements concerning notices of illegal content, transparency and systemic-risk management for designated very large platforms and search engines. The European Commission emphasises that the Act does not itself define every category of illegal content; the relevant illegality must arise under applicable EU or national law. Digital Services Act: Questions and Answers — European Commission. Shaping Europe’s digital future
This distinction is particularly relevant to foreign information operations. A publication may contain false information without necessarily constituting a criminal offence, while another may involve a legally prohibited threat, incitement or other unlawful content. Removing or restricting content solely because it is politically provocative can interfere with lawful expression. The DSA also includes protections intended to address arbitrary moderation and support transparency, while preserving the requirements of other applicable legislation. Therefore, measures directed at suspected foreign intelligence recruitment should focus on conduct meeting relevant legal criteria and on competent investigative processes, not on an assumption that unusual political language establishes hostile intelligence direction.
Polish criminal law provides an additional, more specific distinction. Article 130 §9, introduced in the 2023 reform, criminalises specified disinformation activity undertaken while participating in or acting for foreign intelligence where the legally defined purpose involves serious disruption to the political system or economy of Poland, an allied state or an international organisation of which Poland is a member, or influencing decisions by the relevant public authorities. This is substantially narrower than a general prohibition of inaccurate political speech: the provision requires the applicable foreign intelligence relationship and the specified purpose and conduct. It must not be interpreted as authorising the prosecution of ordinary political disagreement or independent journalism merely because the information is contested. Act of 17 August 2023 Amending the Criminal Code, Article 130 §9 — Sejm of the Republic of Poland — August 2023. ELI
The combination of criminal law, digital-service regulation and cross-border evidence procedures creates distinct investigative tools. The Criminal Code defines offences. The Digital Services Act regulates covered intermediary services. The e-Evidence framework provides mechanisms for specified judicial requests. None is a substitute for the others. A state cannot establish criminal responsibility merely because a platform removes a post, and the continued availability of a message does not establish that its contents are lawful under every relevant criminal provision.
Personal-data protection and the distinction between civilian, law-enforcement and national-security processing
Democratic resilience requires a legally coherent approach to personal information. The EU Charter of Fundamental Rights, particularly Articles 7 and 8, protects private and family life, communications and personal data. Article 47 protects the right to an effective remedy and fair trial. These rights are relevant when authorities investigate communications, financial accounts or relationships among people living in the EU. However, the applicable data-protection regime depends on the institution processing the information and its legal purpose. It would be inaccurate to state that the General Data Protection Regulation governs all intelligence and national-security processing without exception. Charter of Fundamental Rights of the European Union, Articles 7, 8 and 47 — European Union. EUR-Lex
The Law Enforcement Directive, Directive (EU) 2016/680, specifically addresses personal-data processing by competent authorities for the prevention, investigation, detection or prosecution of criminal offences and the execution of criminal penalties. It provides a separate framework from the GDPR for covered law-enforcement purposes and includes safeguards concerning the processing of data relating to victims, witnesses and suspects. Activities falling outside EU law, including certain national-security activities, are not automatically governed by the Law Enforcement Directive. The correct legal analysis therefore requires determining the processing authority, the purpose, the applicable national provisions and the relevant EU-law scope. Legal Framework of EU Data Protection — European Commission. European Commission
This distinction is important because counterintelligence investigations can involve individuals with materially different legal positions. A person receiving an unsolicited recruitment message may be a witness or potential victim. A person deliberately participating in an unlawful intelligence operation may become a suspect. A political organisation whose members are being monitored by a foreign service may require protection. Information concerning these categories should not be treated as interchangeable or retained indefinitely without regard to the applicable legal basis. Data quality, access controls, permissible uses and procedural remedies are therefore essential elements of effective security governance.
An additional institutional risk arises when information concerning nationality, language, immigration status or political association is used as an informal substitute for evidence of hostile conduct. Such an approach would be analytically unreliable because these characteristics do not establish a foreign intelligence relationship. It could also discourage reporting and weaken confidence in public authorities. A lawful and effective counterintelligence framework should be capable of identifying relevant conduct while avoiding indiscriminate classification of communities as security threats.
Protecting Belarusian and Ukrainian communities from coercion and transnational repression
The protection of communities abroad represents an important security requirement in its own right. Foreign intelligence organisations may attempt to exploit personal vulnerability, relationships with relatives abroad, financial dependence or concerns about legal status. Such mechanisms are plausible and recognised in wider institutional discussions of transnational repression, but their occurrence and frequency must be established in individual cases rather than assumed for every person approached by an unfamiliar contact.
The Parliamentary Assembly of the Council of Europe adopted Resolution 2669 on 25 June 2026, concerning transnational repression. The resolution describes practices through which states or their proxies intimidate, silence or harm individuals beyond national borders, including unlawful surveillance, coercive interference and misuse of international legal mechanisms. It calls for stronger protection, dedicated reporting channels, institutional coordination and attention to the vulnerability of affected diaspora communities. This is an adopted parliamentary resolution setting out political and legal recommendations; it should not be presented as legislation automatically creating identical criminal offences across all Council of Europe member states. Resolution 2669, Fighting Back against Transnational Repression — Parliamentary Assembly of the Council of Europe — June 2026. Details tab
The European External Action Service has also documented continuing pressure against Belarusian civil society. On 9 August 2026, the EEAS stated that more than 800 people remained arbitrarily detained in Belarus according to its public assessment and reiterated concern about persecution and intimidation of civil society representatives both inside and outside the country. This figure concerns persons described as arbitrarily detained in the EU statement; it is not an estimate of intelligence recruitment targets or the number of people facing direct coercion in Poland. On 25 August 2026, the EEAS separately condemned the Belarusian authorities’ designation of several EU-supported information and educational initiatives as extremist information sources. These developments provide specific institutional evidence of continuing political pressure extending toward externally connected civil organisations. Belarus: Statement Marking Six Years since the Presidential Elections — European External Action Service — August 2026; Belarus: Statement on the Designation of EU-supported Initiatives as Extremist Information Sources — European External Action Service — August 2026. EEAS+1
The policy consequence is that reporting mechanisms must distinguish voluntary unlawful participation from approaches involving deception or intimidation. A person may receive a suspicious request without understanding its source, and reporting the contact may provide useful information to investigators. Confidentiality and protection arrangements should therefore be evaluated not merely as humanitarian measures but as conditions potentially affecting the availability and reliability of evidence. However, governments should not promise automatic immunity, residency protection or witness status without a specific legal basis. The protections available depend on national law, the circumstances and the competent authority’s decisions.
For Ukrainian communities, the relevant principle is the same. The nationality of an individual accused of acting for Russian intelligence cannot establish collective responsibility among Ukrainian residents. Foreign intelligence organisations may recruit individuals of different nationalities, but the existence of particular criminal proceedings does not provide a statistically valid basis for estimating recruitment rates across national populations. A security strategy that relies on broad nationality-based suspicion risks undermining cooperation with the very communities that may possess relevant information about suspicious approaches.
A governance framework for community protection and legally reliable reporting
| Institutional requirement | Proposed measure | Authority or legal basis | Expected security contribution | Safeguard against misuse |
|---|---|---|---|---|
| Confidential recruitment reporting | Accessible channels for reporting suspected foreign intelligence approaches | Competent national security and law-enforcement authorities | Earlier identification of potentially relevant conduct | Clear distinction between reporting contact and admitting guilt |
| Protection against intimidation | Case-specific witness, victim or protection arrangements | Applicable national law | Reduced vulnerability to coercion and retaliation | Individual assessment and appropriate judicial safeguards |
| Community engagement | Multilingual information about lawful reporting and available assistance | National authorities and authorised civil organisations | Improved accessibility and trust | No blanket surveillance based on nationality |
| Data-quality controls | Separate confirmed facts, allegations and uncorroborated reports | Applicable law-enforcement and national data rules | Reduced false attribution | Access restrictions, review and correction mechanisms |
| Judicially supervised surveillance | Application of lawful authorisation and review procedures | Polish ABW legislation and 2026 amendment | More reliable investigative collection | Necessity, proportionality and statutory oversight |
| Cross-border assistance | Judicial cooperation when offences or evidence span jurisdictions | EU and national criminal-procedure frameworks | Improved admissible evidence collection | Procedural rights and legal restrictions |
| Protection of political organisations | Targeted response to documented intimidation or unlawful intelligence activity | Competent national authorities and applicable law | Preserves freedom of association and access to reporting | Avoids treating lawful opposition activity as suspicious |
These proposed measures require implementation through the competent national authorities and relevant legal processes. Their expected benefits are analytical judgments, not measured results from a completed evaluation. The framework should therefore be assessed using operational outcomes, procedural compliance and the experiences of affected individuals rather than the number of outreach campaigns or surveillance requests alone.
Key judgments — Chapter 7
The legal framework available to Poland and its European partners has developed substantially. Polish Article 130 distinguishes several forms of foreign intelligence-related criminal conduct, while the October 2026 surveillance reform strengthens defined judicial oversight mechanisms. EU legislation applicable since 2024 and 2026 provides additional financial-traceability and electronic-evidence instruments, with AMLA’s direct supervision of selected institutions scheduled to begin in 2028. These developments increase the range of legally available instruments but do not establish their practical effectiveness in individual investigations. Democratic resilience also requires safeguards distinguishing suspects, witnesses, victims and lawfully active communities, especially where foreign repression creates potential coercive pressure.
What would change the assessment
The assessment would change with authoritative data demonstrating the effectiveness or shortcomings of the newly applicable surveillance and electronic-evidence frameworks, documented judicial findings concerning the admissibility of evidence obtained through those mechanisms, or independently verified evaluations of protections afforded to individuals reporting foreign intelligence approaches. Revisions to the applicable legal instruments, changes in their judicial interpretation or evidence of systemic misuse would also require reconsideration of the balance between investigative capability and fundamental rights.
Open official record
The most consequential outstanding information concerns implementation of the October 2026 Polish surveillance safeguards, the practical operation of the EU e-Evidence instruments, comparable data on legally authorised cross-border requests, and evidence concerning the safety and effectiveness of reporting mechanisms for people subjected to foreign intelligence approaches. The existing legal framework is detailed; its operational results remain insufficiently measured in the public record.
Chapter 8. Strategic Scenarios, Early-Warning Architecture and the 2026–2031 Outlook
Principal judgment: The strategic requirement for 2026–2031 is to establish an evidence-based system capable of distinguishing isolated suspicious conduct from coordinated foreign intelligence activity, identifying legally meaningful escalation before serious harm occurs, and measuring the resilience of institutions responsible for prevention, investigation and service continuity. The available record supports several plausible future pathways but does not provide a statistically defensible basis for assigning numerical probabilities to their occurrence. The appropriate planning model is therefore a structured system of alternative scenarios, observable indicators, explicit decision rules and institutional performance measures. Such a model must account for both security failure and investigative overreach, because inaccurate attribution, disproportionate surveillance and the loss of cooperation from affected communities can themselves reduce effective counterintelligence capability.
The strategic baseline: why the next five years require measurable institutional performance
The period through 2031 will test several legal and institutional instruments introduced or substantially developed before the November 2026 cut-off. Poland’s strengthened surveillance oversight has only recently entered into force. The EU’s e-Evidence Regulation became applicable in August 2026. The European anti-money-laundering framework is moving toward greater supervisory integration, with AMLA expected to begin direct supervision of selected higher-risk institutions in 2028. Critical-infrastructure resilience and military-mobility arrangements are also subject to implementation and policy objectives extending toward the end of the decade. These developments create an opportunity for more coherent prevention, but the existence of new legislation does not automatically improve investigative outcomes or continuity of essential services. Operational Surveillance Oversight Amendment — Sejm of the Republic of Poland — September 2026; E-evidence: Cross-border Access to Electronic Evidence — European Commission — 2026; Questions and Answers on AMLA — European Commission — 2024.
The future threat environment cannot be forecast simply by extending the number of publicly reported investigations. Official disclosures are not a complete census of covert activity. They reflect the intersection of hostile conduct, investigative detection, decisions to prosecute, judicial processes and public communication. An increase in public announcements could indicate more hostile operations, stronger investigative capabilities or different disclosure practices. A reduction could indicate effective prevention, reduced activity or incomplete detection. Without an estimate of the underlying number of attempts and comparable reporting standards, annual announcement totals cannot provide a reliable direct measure of threat intensity.
The appropriate unit of analysis should therefore shift from the quantity of reported incidents toward the relationship between evidence, decisions and outcomes. A useful system would record whether a suspicious approach was corroborated, whether the identity of a coordinating party was established, whether the activity was legally classified, whether relevant institutions received actionable information, and whether an identified risk resulted in preventive intervention or a confirmed incident. These questions permit assessment without assuming that all cases are equivalent or that every report represents a genuine foreign intelligence operation.
The same principle applies to infrastructure consequences. Measuring national resilience through the absence of completed sabotage incidents is inadequate because preventive activity, recovery capacity and contingency arrangements may be important even where no major incident occurs. Conversely, a completed attack does not necessarily demonstrate systemic failure if essential services continue or recover effectively. The relevant performance variables include service availability, restoration time, verified operational impact and the proportionality of the institutional response. Such measures require data from competent authorities and operators, not speculative security scores.
Five strategic pathways for 2026–2031
The evidence supports five principal future pathways, which may coexist rather than forming mutually exclusive outcomes. They are formulated as planning alternatives, not forecasts with numerical probabilities. No ranking is assigned because the official record does not provide a reproducible base rate for comparing their likelihood.
Pathway A — Persistent low-level intelligence recruitment without major physical escalation. Under this pathway, foreign intelligence organisations continue seeking information and conducting limited influence-related activity through remote communications and locally accessible assignments, but the detected activity does not consistently progress to substantial physical sabotage. The supporting mechanism is the relatively low organisational burden of commissioning discrete activities from intermediaries. This pathway remains compatible with the existing public record because documented espionage, recruitment and information operations do not universally culminate in destructive conduct. Its principal security consequence would be the continuing investigative burden associated with separating genuine intelligence activity from ordinary transactions, political expression and unrelated suspicious behaviour.
Pathway B — Recurrent infrastructure-related sabotage with geographically dispersed incidents. This pathway involves the continuation of intelligence-directed physical interference affecting civilian or dual-use services, with individual incidents potentially occurring in different jurisdictions. Its plausibility rests on the existence of officially attributed sabotage investigations, but the public record does not permit conclusions about future attack frequency or the likelihood of a particular sector being targeted. A major consequence would be the requirement for authorities to coordinate physical protection, public safety, forensic investigation and service restoration without assuming that separate incidents share the same operational command.
Pathway C — Stronger prevention and improved disruption of recruitment networks. This pathway assumes that national authorities make effective use of improved judicial cooperation, electronic-evidence mechanisms, financial information and lawful reporting channels. It is consistent with the introduction of new legal instruments and the existence of demonstrated national investigative capabilities, but implementation remains an empirical question. The decisive evidence would be documented improvements in legally compliant case development, early identification of harmful activity and the interruption of credible preparations. A reduction in publicly disclosed incidents alone would not prove success; the relevant indicators must include independently interpretable operational outcomes.
Pathway D — Regulatory development without equivalent operational integration. This pathway assumes that states adopt or implement legal frameworks but continue encountering practical gaps in institutional cooperation, data quality, staffing, procedural compatibility or infrastructure continuity. It is a credible planning alternative because legislation and operational performance are different categories. However, the official record does not establish that such gaps will necessarily persist. The relevant evidence would concern implementation delays, repeated procedural failures, unresolved jurisdictional obstacles and the inability to translate legally available mechanisms into timely decisions.
Pathway E — Intensified coercion and hostile exploitation of political or migrant communities. Under this pathway, foreign state institutions or intermediaries increase pressure on people living abroad, including through intimidation, surveillance or misuse of information concerning personal relationships. The Council of Europe’s 2026 resolution and EU statements on Belarus provide documentary support for treating transnational repression as an existing security and human-rights concern. They do not establish how frequently future coercion will occur or how many affected individuals might subsequently participate in unlawful intelligence activity. The principal consequence would be the need to combine protection, reporting and investigation while avoiding the assumption that a victim of coercion is necessarily a willing intelligence asset. Resolution 2669, Fighting Back against Transnational Repression — Parliamentary Assembly of the Council of Europe — June 2026; Belarus: Statement Marking Six Years since the Presidential Elections — European External Action Service — August 2026.
Strategic pathways and evidence that would change their standing
| Pathway | Principal causal mechanism | Supporting baseline | Evidence strengthening the pathway | Evidence weakening the pathway | Institutional consequence |
|---|---|---|---|---|---|
| A. Persistent limited recruitment | Remote coordination of discrete tasks | Documented recruitment and intelligence-related proceedings | Verified continuing low-level tasking without further serious offences | Sustained authenticated evidence of escalation | Continued intelligence-led investigation and targeted reporting |
| B. Recurrent sabotage | Foreign-directed interference with civilian services | Official sabotage investigations | New attributed incidents with common or separate documented organisers | Sustained prevention confirmed by broader investigative evidence | Greater importance of continuity and emergency-response performance |
| C. Improved prevention | Effective use of legal and institutional capabilities | New electronic-evidence and oversight instruments | Documented early interruption and procedurally sound investigations | Repeated evidence failures or ineffective cooperation | Stronger emphasis on implementation quality |
| D. Implementation fragmentation | Institutional and procedural incompatibility | Multiple national and EU frameworks | Persistent legal delays, data incompatibility or deficient coordination | Verified improvements in cross-border case handling | Need for targeted governance correction |
| E. Increased coercion | Foreign pressure against individuals abroad | Official transnational-repression findings | Corroborated intimidation, threats and related recruitment evidence | Reduced incidents supported by independent reporting and protection evidence | Enhanced protection and lawful evidence collection |
These pathways are deliberately not assigned percentages. They overlap in both time and mechanism, and no verified official dataset establishes the probability of transition between them. A state could improve prosecution while hostile activity continued, or experience infrastructure disruption while simultaneously reducing coercion against particular communities. Requiring such pathways to total 100 percent would create artificial precision and conceal their non-exclusive character.
Designing an early-warning system without arbitrary risk scores
The purpose of early warning is to identify developments that justify a proportionate institutional response before serious consequences become unavoidable. It is not to classify every unusual action as hostile or to assign unsupported numerical values to people, communities or locations. An effective system must distinguish indicators of possible concern, corroborated evidence of intelligence direction and circumstances justifying urgent protective action. The threshold for beginning a lawful preliminary assessment is different from the threshold required for intrusive surveillance, criminal charges or emergency intervention. Those differences arise from the applicable legal framework and the potential consequences for affected persons.
A defensible indicator system should record at least five dimensions: the observation itself, its evidentiary quality, the legally relevant context, corroboration by independent material and the authority competent to act. The system should also record the outcome of the decision and whether the initial interpretation was subsequently confirmed or rejected. Without this feedback, an early-warning system can accumulate alerts without improving its ability to distinguish genuine threats from false positives.
The indicators must be associated with observable conduct or verifiable institutional information. Nationality, political affiliation, immigration status or ordinary use of a communications service do not independently demonstrate hostile intelligence participation. Similarly, the circulation of provocative political material cannot be equated automatically with a criminal foreign information operation. The evidentiary context is decisive, particularly where intrusive state powers could be invoked.
Proposed counterintelligence early-warning indicator register
| Indicator | Observable evidence | Evidentiary requirement | Initial responsible function | Decision significance | False-positive concern |
|---|---|---|---|---|---|
| Credible report of a foreign intelligence approach | First-hand report with preserved original communications | Authentication and contextual assessment | Competent national security or law-enforcement authority | May justify preliminary review | Impersonation, misunderstanding or unrelated solicitation |
| Repeated unexplained requests for security-sensitive information | Documented messages and task history | Proof of continuity and relevant purpose | Competent investigative authority | May strengthen grounds for further lawful investigation | Legitimate research or commercial work |
| Evidence connecting a coordinator to a foreign intelligence service | Authenticated communications, competent official findings or corroborated organisational evidence | Independent verification and lawful collection | Counterintelligence authorities | Materially strengthens attribution | False identity or misleading account association |
| Financial transactions connected to an investigated network | Verified transaction records and account relationships | Legal access, identity corroboration and relevance | Financial intelligence and investigative authorities | May establish financing relationships | Legitimate payments with superficial similarities |
| Credible threat against a person approached for recruitment | Authenticated threats or corroborating testimony | Individual assessment and protection requirements | Police, security and victim-protection authorities | May require protective intervention | Incomplete or manipulated reports |
| Preparatory conduct meeting statutory criteria | Evidence relevant to the applicable criminal offence | Prosecutorial assessment under national law | Investigators and prosecutors | May support criminal intervention before completion | Misclassification of lawful preparation |
| Verified infrastructure-security incident | Operator incident report and competent findings | Evidence of actual disruption and cause | Operator, emergency authorities and competent investigators | May require immediate service protection and investigation | Accidental or technical incidents initially appearing suspicious |
| Confirmed cross-border network relationship | Corroborated participants, communications or judicial findings | Legally reliable information exchange | National authorities and judicial-cooperation mechanisms | May justify coordinated investigation | Coincidental contacts or duplicated reporting |
| Recurrent legally defective evidence collection | Court rulings or documented procedural deficiencies | Identifiable legal or procedural failure | Judicial and institutional oversight | Indicates governance weakness | Different case circumstances incorrectly treated as systemic |
| Failure to meet verified restoration requirements | Operator records compared with applicable standards | Defined service and measured interruption | Competent infrastructure and regulatory authorities | Indicates continuity weakness | Exceptional conditions outside the standard’s scope |
The register is a proposed analytical instrument. It does not replace national law or establish new surveillance powers. The relevant authority must decide whether an observation satisfies the lawful threshold for a particular action. Its value lies in disciplined recording of evidence, uncertainty and decisions rather than numerical categorisation unsupported by data.
Operational response thresholds: separating observation, corroboration and imminent danger
A practical governance framework should distinguish four decision states without assigning arbitrary numerical risk scores.
Initial concern exists when information suggests a possible foreign intelligence connection but independent corroboration is insufficient. The appropriate response may include lawful preliminary review, preservation of voluntarily supplied information and referral to the competent authority. It should not automatically produce intrusive surveillance or public attribution.
Corroborated intelligence concern exists when reliable evidence supports an identifiable relationship with foreign intelligence activity or a relevant offence. Depending on the circumstances and applicable law, competent authorities may consider further investigative measures, judicial applications and cooperation with other jurisdictions. The evidence necessary to authorise an intrusive measure remains defined by law rather than by an internally invented risk category.
Credible operational danger exists when competent authorities have specific information indicating a serious risk to persons or essential services. The appropriate response may include urgent protective action, emergency coordination and legally authorised investigation. The public record does not justify inventing a universal operational trigger applicable to every infrastructure sector; the nature of the threat and the responsible authority’s statutory obligations determine the action.
Confirmed incident or completed offence requires procedures directed at public safety, evidence preservation, service restoration and potential criminal accountability. The outcome should subsequently be reviewed to determine whether warning information was available, whether the response complied with the law and what measures could improve future performance.
Decision framework for competent authorities
| Decision state | Minimum evidentiary condition | Permissible institutional response in principle | Authority and safeguard | Review requirement |
|---|---|---|---|---|
| Initial concern | Specific report requiring assessment | Preliminary lawful review and appropriate referral | Competent authority under national law | Confirm, reject or maintain the allegation with stated reasons |
| Corroborated concern | Reliable evidence supporting a defined investigative question | Legally authorised investigation or judicial application where justified | Applicable statutory and judicial requirements | Periodic necessity and proportionality review |
| Credible danger | Specific information indicating serious potential harm | Proportionate emergency protection and competent investigation | National emergency, security and criminal law | Review of necessity, action and consequences |
| Confirmed incident | Verified occurrence requiring response | Emergency services, forensic investigation, continuity measures and prosecution where appropriate | Responsible national institutions | Operational, judicial and independent oversight as applicable |
| Post-incident evaluation | Documented action and outcome | Remediation and institutional improvement | Competent governance and oversight bodies | Verification that corrective measures were implemented |
A major benefit of explicitly separating these states is the reduction of two opposing errors: failure to act on credible danger and excessive intervention based on weak or misleading information. Both can have significant security consequences. The former may permit preventable harm, while the latter may undermine legal proceedings, expose innocent people to unjustified intrusion and damage cooperation with affected communities.
Measuring counterintelligence effectiveness: indicators with defined denominators
A credible national performance system must distinguish activity from effectiveness. The number of investigations opened, reports received or surveillance applications submitted indicates workload but does not establish successful prevention. Equally, the number of individuals convicted reflects judicial outcomes within a defined cohort, not necessarily the proportion of all hostile actors operating within the country. Performance indicators become meaningful only when their numerator, denominator, reporting period and responsible institution are specified. Where the relevant denominator cannot be established, the result should remain an absolute count or qualitative finding rather than an invented percentage.
A suitable framework would distinguish investigative timeliness, evidentiary quality, legal compliance, cross-border cooperation, protection of affected persons and continuity of essential services. These measures require different data sources and cannot be combined without a justified model. For example, an increase in timely electronic-evidence requests could improve investigative capacity while leaving the number of completed prosecutions unchanged during the reporting period. Similarly, a reduction in infrastructure restoration time could improve operational resilience without changing the frequency of attempted incidents. Each measure captures a different institutional function.
The 2026 EU e-Evidence framework provides a useful example of the distinction between legal standards and operational measurement. A ten-day response requirement for specified European Production Orders establishes a legal benchmark. It does not establish the proportion of requests fulfilled, the completeness of the evidence obtained or the number of investigations successfully concluded. Those outcomes would require actual administrative and judicial data. The same distinction applies to judicial supervision under the October 2026 Polish reform: the existence of a legal power to review surveillance does not by itself measure how often courts exercise it or the consequences of their review. E-evidence: Cross-border Access to Electronic Evidence — European Commission — 2026; Act Strengthening Judicial Oversight of Operational Surveillance — Polish Special Services — September 2026.
Proposed institutional performance dashboard: measurable variables rather than invented scores
| Performance measure | Definition | Required data | Reporting interval | Responsible function | Interpretation constraint |
|---|---|---|---|---|---|
| Initial review timeliness | Median time from receipt of a sufficiently documented report to initial competent review | Report timestamps and review records | Quarterly | Designated national reporting authority | Only comparable where intake criteria remain stable |
| Corroboration rate | Cases with documented corroboration divided by eligible reviewed reports | Case register and corroboration decisions | Quarterly or annually | Investigative oversight function | A high rate may reflect selective intake rather than better detection |
| Judicial compliance rate | Legally reviewed surveillance measures satisfying applicable procedural requirements divided by reviewed measures | Authorisation and review records | Annually | Competent judicial or oversight authority | Requires legally reliable and comparable classifications |
| Evidence-request timeliness | Median and distribution of actual response times for comparable requests | Judicial requests and responses | Quarterly | Judicial-cooperation authorities | Different instruments and urgency categories must remain separate |
| Evidence usability | Legally obtained material accepted or used in relevant proceedings, reported by category | Court and prosecution records | Annually | Prosecutorial and judicial institutions | Admissibility and probative value are not identical |
| Cross-border coordination completion | Documented joint actions completed within the applicable procedural framework | Competent authority cooperation records | Annually | National and international cooperation bodies | Complexity varies materially between cases |
| Protection response timeliness | Time from validated urgent protection request to competent response | Protected case records | Quarterly or annually | Appropriate victim or witness protection function | Data confidentiality is essential |
| Critical-service restoration time | Time to restore the defined essential service after a qualifying disruption | Operator incident and restoration records | Per incident and annually | Critical infrastructure operators and regulators | Must distinguish partial from full restoration |
| Corrective-action completion | Verified completed actions divided by formally required remediation actions | Audit and implementation records | Annually | Competent oversight authority | Completion does not independently prove effectiveness |
| False-positive correction | Cases in which an initial attribution was formally corrected, with reasons recorded | Case reviews and independent oversight findings | Annually | Investigative and oversight institutions | A higher count can reflect better correction practices |
No numerical performance values are assigned because the required national datasets have not been established in the public evidence examined. The table instead specifies the variables that would allow competent institutions to produce auditable measurements. For meaningful cross-country comparisons, states would also need compatible definitions, reporting periods and treatment of confidential information. Without such harmonisation, apparent differences in performance could reflect administrative practices rather than real differences in security capability.
Cross-border coordination: judicial instruments, institutional authority and practical dependencies
European coordination is most effective when the relevant institution is chosen according to the legal and operational problem. A criminal investigation requiring evidence from another EU member state may use the European Investigation Order or, within its applicable scope, the e-Evidence mechanisms. Investigations concerning organised criminal activity across several jurisdictions may benefit from a Joint Investigation Team, established through an agreement between competent authorities for a specified purpose and duration. Europol describes Joint Investigation Teams as instruments for coordinating investigations and prosecutions conducted in parallel across countries, while the applicable framework determines the roles and powers of the participating authorities. A JIT is not an automatically established intelligence alliance, and it does not remove national judicial or legal requirements. Joint Investigation Teams — Europol; Taking of Evidence in Another EU Country — European Commission.
The institutional problem is therefore one of selecting the correct cooperation mechanism. A foreign intelligence threat report may initially be relevant to national counterintelligence institutions, while admissible evidence for prosecution may require a judicial instrument. A suspected financial relationship may require cooperation with regulated entities or financial intelligence authorities. A confirmed infrastructure incident may involve operators, emergency services and sector regulators. These functions can converge within a larger investigation, but they do not have identical legal thresholds or responsibilities. Coordination should preserve those distinctions while preventing important information from remaining isolated in institutions unable to act upon it.
The legal differences between EU and non-EU partners also matter. Judicial and law-enforcement cooperation among EU member states may benefit from Union instruments, while cooperation involving the United Kingdom, other European countries or jurisdictions outside Europe depends on their respective legal arrangements. NATO participation does not automatically confer access to EU criminal-procedure mechanisms. Similarly, intelligence cooperation between allied services does not necessarily make the underlying information admissible in a national criminal court. The requirement to distinguish operational intelligence from evidentiary material remains central.
A particularly important risk is the loss of information during transitions between institutions. A security service may identify a potential threat, an operator may recognise the importance of particular technical information, and a prosecutor may require evidence in a specific legally admissible form. If the relevant information is not documented and communicated appropriately, the decision process may be delayed or compromised. Conversely, unrestricted distribution of sensitive information can endanger investigations, reveal protected sources or violate data-protection requirements. The institutional objective should therefore be lawful and purposeful information exchange, supported by clear responsibilities and auditable decisions.
Cross-border coordination responsibility matrix
| Institutional function | Primary competent participants | Appropriate cooperation instrument or framework | Expected output | Principal legal or operational limitation |
|---|---|---|---|---|
| Foreign intelligence threat assessment | Competent national security services | Applicable bilateral and multilateral intelligence cooperation | Corroborated threat assessment | Classified information and source protection |
| Cross-border criminal evidence | Prosecutors and judicial authorities | European Investigation Order or applicable e-Evidence instruments | Legally obtained evidentiary material | Judicial competence, safeguards and scope |
| Joint multinational investigation | Participating national investigative and judicial authorities | Joint Investigation Team where legally appropriate | Coordinated investigation and prosecution | Agreement, defined purpose and national powers |
| Financial intelligence exchange | Financial intelligence units and competent authorities | Applicable AML/CFT cooperation arrangements | Financial intelligence relevant to lawful investigations | Confidentiality and statutory-purpose restrictions |
| Electronic service-provider records | Competent judicial authorities and service providers | Regulation (EU) 2023/1543 where applicable | Preservation or production of specified data | Legal conditions, deadlines and available records |
| Civilian infrastructure continuity | Operators and competent national authorities | National resilience law and relevant EU sector instruments | Service protection and restoration | Operational resources and legal competence |
| Allied defence coordination | National defence institutions and NATO | North Atlantic Treaty and applicable NATO arrangements | Military preparedness and allied consultation | National sovereignty and treaty conditions |
| Protection of threatened individuals | Competent national protection and judicial authorities | Applicable national law | Individual protection and lawful evidence collection | Confidentiality, eligibility and proportionality |
The framework does not require the creation of a new supranational intelligence agency. It requires effective use of existing authorities and instruments according to their respective competencies. Creating additional coordination structures may be justified where a defined gap exists, but organisational expansion should not be treated as an end in itself. The appropriate measure of success is whether the resulting arrangements improve legally sound decisions and protective outcomes.
Policy alternatives for 2026–2031: feasibility, cost categories and second-order effects
The most defensible policy options concern the quality and integration of existing capabilities rather than uncosted proposals for unlimited surveillance or infrastructure expansion. Financially credible recommendations require distinguishing operational expenditure, capital investment, personnel costs, regulatory compliance and recurring maintenance. The publicly available material does not permit a defensible total budget for a new Europe-wide counterintelligence programme, nor does it support assigning invented costs to individual measures. It is nevertheless possible to identify the main cost drivers, implementation requirements and likely institutional effects.
Option 1 — Strengthen lawful early reporting and evidence preservation. National security and law-enforcement authorities could improve the accessibility and consistency of mechanisms through which individuals and organisations report suspected foreign intelligence approaches. Implementation would involve guidance, secure intake procedures, appropriate staff training and processes for referral to competent institutions. The expected effect is earlier access to potentially relevant information, but the actual benefit would depend on trust, reporting quality and investigators’ capacity to distinguish relevant material from unrelated complaints. The principal risk is excessive collection or retention of information about people who have not committed an offence. Reversibility is relatively high for administrative procedures, although improperly disclosed personal data cannot necessarily be retrieved.
Option 2 — Improve cross-border evidentiary coordination. Competent judicial authorities could develop more consistent procedures for selecting and using the European Investigation Order and e-Evidence instruments. The implementation burden would involve legal training, secure systems, technical support and clear allocation of responsibilities. The expected effect is improved access to legally relevant evidence where the necessary conditions are satisfied. The main limitation is that a faster procedure does not guarantee that useful evidence exists or that a foreign intelligence organisation can be attributed. Changes to administrative practice are generally reversible, but improper evidence handling can have lasting consequences for proceedings.
Option 3 — Integrate financial intelligence with corroborated criminal investigations. Competent authorities could strengthen lawful cooperation among financial intelligence units, prosecutors and investigators concerning transactions already connected to relevant cases. This would require appropriate legal gateways, specialised analytical capacity and secure information handling. The potential benefit is better identification of financial relationships associated with suspected networks, while the principal risk concerns excessive suspicion of legitimate transactions or incorrect attribution through incomplete financial data. The measure should therefore be evaluated by the quality of corroborated evidence rather than the quantity of transactions examined.
Option 4 — Strengthen protection against transnational coercion. Governments could improve confidential reporting and assistance for individuals who experience threats, intimidation or pressure from foreign actors. Implementation would involve coordination among competent security, law-enforcement and protection authorities and, where appropriate, authorised community organisations. The expected effect is reduced vulnerability and improved access to evidence from people willing to report coercion. The principal risk is failure to protect confidentiality or the creation of expectations exceeding the legal protections available. Policy design must therefore remain grounded in existing law and individual circumstances.
Option 5 — Audit resilience implementation rather than relying exclusively on legislative adoption. National authorities responsible for essential-service resilience could evaluate whether covered operators have translated applicable legal requirements into functioning continuity arrangements. This would require technical assessment, audit capacity and access to relevant operator records. The expected benefit is better understanding of actual service resilience rather than nominal compliance. The main burdens concern operator expenditure, supervisory resources and the need to protect commercially or strategically sensitive information. Physical investments may be difficult to reverse, so priorities should be based on evidenced service dependencies and cost-effectiveness rather than speculative threat rankings.
Option 6 — Establish recurring independent review of investigative proportionality and outcomes. Competent oversight institutions could examine the lawful use of investigative powers, correction of erroneous attributions and implementation of procedural safeguards. The expected benefit is greater legal reliability and institutional accountability. The main implementation burden concerns judicial and administrative capacity, while the principal risk is the disclosure of sensitive information or the imposition of procedures that are poorly matched to operational realities. The September 2026 Polish legislation provides a current statutory foundation for stronger judicial oversight, but practical assessment should follow actual implementation rather than assume success at the point of entry into force. Act of 4 September 2026 on Strengthening Judicial Oversight of Operational Surveillance — Sejm of the Republic of Poland — September 2026.
Comparative policy decision table
| Option | Competent authority | Main resource burden | Expected time to initial effect | Reversibility | Principal risk | Preferred evaluation |
|---|---|---|---|---|---|---|
| Early reporting improvement | National security and law-enforcement authorities | Staffing, intake systems and training | Near term | High for procedures | False positives and privacy concerns | Reporting quality, lawful referral and review timeliness |
| Cross-border evidence coordination | Judicial and prosecutorial authorities | Legal expertise, secure systems and administration | Near to medium term | Moderate to high | Procedural invalidity or misuse | Actual request timeliness and evidentiary usability |
| Financial-intelligence integration | FIUs and competent investigative authorities | Specialist staff and analytical systems | Medium term | Moderate | Incorrect attribution or excessive data processing | Corroborated financial findings |
| Protection against coercion | National protection and security authorities | Confidential support and coordination | Near to medium term | Administrative arrangements adjustable | Retaliation and loss of confidentiality | Protection outcomes and lawful reporting |
| Infrastructure resilience audits | Sector regulators and covered operators | Technical assessment and remediation costs | Medium to long term | Varies by investment | Excessive costs or misdirected investment | Verified continuity and restoration performance |
| Independent oversight improvement | Courts and statutory oversight authorities | Judicial and administrative capacity | Medium term | Depends on legal design | Inefficient procedures or inadequate protection of sensitive material | Compliance findings and corrective-action completion |
These options are not ranked by estimated security effectiveness because comparable empirical cost-benefit data are unavailable. The table instead allows decision-makers to identify which authority would be responsible, the type of resources required, the likely implementation horizon and the principal downside. A more formal cost-benefit analysis would require national administrative data, operator-level costs and verified operational outcomes.
Strategic milestones, institutional dependencies and decision points through 2031
The five-year horizon contains several identifiable institutional milestones, but they differ in legal status and evidentiary significance. The October 2026 Polish oversight reform has already entered into force, while the European e-Evidence framework has only recently become applicable. AMLA’s planned direct supervisory functions begin later, and the implementation of critical-entity resilience requirements is a continuing responsibility of member states. These timelines create an opportunity for systematic evaluation, provided that governments distinguish the entry into force of a legal instrument from its actual operational performance.
The most important near-term requirement is the collection of baseline implementation data. Without such data, later claims of improvement or deterioration cannot be assessed reliably. For example, if a judicial cooperation mechanism reduces the formal period within which a service provider must respond, performance cannot be demonstrated solely by repeating the statutory deadline. Authorities would need actual response-time distributions, information about incomplete responses and evidence concerning procedural outcomes. Similarly, assessing community protection requires records of assistance and legally permissible outcome measures, rather than an assumption that public information campaigns necessarily produce greater reporting confidence.
The medium-term requirement is compatibility among institutional datasets and definitions. Cross-country comparisons become unreliable when one state reports initial suspicions, another reports investigations opened and a third reports only completed prosecutions. These quantities describe different stages of the criminal-justice process. A European assessment should therefore distinguish them explicitly and avoid constructing aggregate intelligence-threat statistics from incompatible national reporting categories.
The longer-term requirement is to evaluate whether institutional improvements have affected substantive outcomes. This includes the ability to respond to credible threats without unnecessary interference with lawful activity, the reliability of judicially obtained evidence, the protection of vulnerable individuals and the continuity of essential services. Such an evaluation requires sustained measurement and independent scrutiny. It cannot be completed merely by adopting another strategy document or establishing an additional coordination body.
2026–2031 institutional milestone and evidence register
| Period | Established milestone or analytical review point | Status at 6 Nov 2026 | Required evidence for subsequent assessment | Consequence if unresolved |
|---|---|---|---|---|
| October 2026 | Polish judicial surveillance oversight reform | In force from 31 Oct 2026 | Implementation records and competent judicial review | Unmeasured effectiveness of strengthened safeguards |
| August 2026 onward | EU e-Evidence Regulation | Applicable from 18 Aug 2026 | Actual request and response outcomes | Uncertainty concerning practical improvement in evidence access |
| 2027 | EU military mobility policy target | Policy and legislative development, not completed capability established | Adopted legal instruments and verified implementation | Incomplete evidence of cross-border mobility improvements |
| 2027 | EU critical-entity resilience review | Continuing national implementation obligations | Competent national identification, assessment and supervision records | Uncertainty concerning regulatory coverage and actual resilience |
| 2027 | AMLA preparation for direct supervision | Institutional development toward 2028 | Selection methodology and supervisory preparation | Uncertainty concerning operational readiness |
| 2028 | Planned AMLA direct supervision | Future scheduled function | Official commencement and supervisory outcomes | Inability to evaluate effects on selected high-risk institutions |
| 2028–2029 | Medium-term national resilience review | Proposed analytical review point | Comparable service-continuity and implementation records | Persistent uncertainty regarding effectiveness of national measures |
| 2030 | European defence-readiness policy horizon | Strategic policy objective | Verified programme milestones and operational outputs | Gap between announced capability and delivered readiness |
| 2031 | Five-year counterintelligence assessment | Future review horizon | Consistent longitudinal evidence across investigation, oversight, protection and resilience | Inability to distinguish structural improvement from changes in disclosure |
The established legal and institutional references include the Polish Surveillance Oversight Amendment — Sejm of the Republic of Poland — September 2026, EU e-Evidence Framework — European Commission — 2026, AMLA Institutional Timetable — European Commission — 2024, and Critical Infrastructure Resilience at EU Level — European Commission.
The proposed 2028–2029 and 2031 review points are analytical recommendations rather than existing legal deadlines. They are included because institutional performance cannot be measured from a single year’s observations, particularly when new legislation becomes applicable only during the initial period. A credible longitudinal evaluation would distinguish changing investigative activity from changes in reporting practice, compare legally equivalent proceedings and examine whether service-continuity outcomes improve under comparable circumstances.
Strategic warning signs that would justify revising the assessment
A material change in the strategic assessment would require evidence that changes the underlying understanding of foreign intelligence direction, institutional vulnerability or the effectiveness of preventive action. The appearance of a new suspicious communication channel or a single unverified report would not necessarily satisfy that standard. By contrast, authenticated evidence linking previously separate investigations to a common directing organisation could alter the assessment of operational coordination. A final judicial decision establishing responsibility for conduct previously attributed only provisionally could strengthen or narrow attribution. Documented failures in legally required infrastructure continuity could change the understanding of service resilience, while effective protection and successful intervention supported by competent findings could demonstrate improvement.
The following distinctions are important. Evidence of increased hostile activity is not equivalent to an increase in public reporting. Evidence of improved prevention is not equivalent to a reduction in completed attacks. Evidence of stronger legal capacity is not equivalent to more intrusive powers. Evidence of democratic resilience is not equivalent to the absence of complaints or public controversy. Each judgment requires a defined observation and a reliable basis for comparing it with prior conditions.
A formal review process should also preserve disconfirming evidence. Where a suspected intelligence connection is rejected by competent investigators or a court, that outcome should inform the evaluation rather than disappear from institutional statistics. Where an incident originally attributed to deliberate interference is subsequently established to have been accidental, the correction should be recorded. Where a person reports coercion but is incorrectly categorised as a willing participant, the error should be examined for its consequences. These safeguards are essential if a counterintelligence system is to improve its discriminatory accuracy rather than merely increase the volume of information collected.
Final net assessment — European counterintelligence resilience through 2031
The evidence available as of 6 November 2026 supports a substantial institutional concern: foreign intelligence organisations can exploit cross-border communications, locally present intermediaries and civilian economic activity to pursue objectives that may be difficult to identify at their earliest stages. European states possess legal and operational instruments capable of investigating defined offences, obtaining evidence and protecting essential services, but the relevant authorities remain distributed across national jurisdictions and different institutional mandates. The central challenge is therefore to connect credible information with lawful and timely decisions while preserving evidentiary integrity, individual rights and continuity of public services.
The evolution of the legal framework is significant. Poland’s 2023 criminal-law reform addresses multiple forms of foreign intelligence activity, including specified preparatory offences and serious sabotage-related conduct. Its September 2026 legislation strengthens judicial oversight of operational surveillance. The EU’s e-Evidence instruments improve the legal framework for obtaining specified electronic records across borders, while financial-traceability obligations and the developing AMLA system provide additional regulatory and supervisory capabilities within their respective scopes. These changes demonstrate institutional adaptation, but their practical effectiveness must be established through implementation data and judicially reliable results rather than inferred from legislative adoption. Polish Criminal Code Amendment — Sejm of the Republic of Poland — August 2023; Polish Judicial Oversight Amendment — Sejm of the Republic of Poland — September 2026; EU e-Evidence Framework — European Commission — 2026; EU Anti-Money Laundering Legislative Package — Council of the European Union — May 2024.
An important feature of this challenge is that security and democratic safeguards are not inherently opposing objectives. Lawful surveillance, judicial control, accurate evidence handling and protection against coercion can contribute to the reliability of investigations. Conversely, indiscriminate suspicion, weak attribution and the misuse of personal information can damage cooperation, undermine legitimate organisations and compromise proceedings. This relationship is particularly important where foreign governments are documented as exerting political pressure on communities living abroad. The Council of Europe’s 2026 response to transnational repression recognises the need for dedicated reporting and protective arrangements, while EU fundamental-rights instruments establish legal safeguards relevant to many forms of institutional action. Resolution 2669, Fighting Back against Transnational Repression — Parliamentary Assembly of the Council of Europe — June 2026; Charter of Fundamental Rights of the European Union — European Union.
From a governance perspective, the decisive question through 2031 is whether European institutions can consistently identify legally meaningful foreign intelligence activity before serious consequences arise, while maintaining accurate attribution and avoiding disproportionate interference with lawful civilian conduct. The available official record does not support numerical estimates of the total active recruitment population, the likelihood of sabotage escalation or the comparative effectiveness of all national systems. These limitations should shape the design of future intelligence assessments rather than be concealed through speculative probabilities or arbitrary rankings.
The appropriate future standard is evidence-based institutional performance: identifiable legal responsibilities, reliable investigative cooperation, verifiable financial and electronic evidence, judicial safeguards, effective protection for threatened individuals and documented continuity of essential services. A system achieving these conditions would possess a stronger basis for preventing and managing foreign intelligence-directed threats, although no legal or organisational framework can guarantee that every hostile operation will be detected.
The final integrated judgment is that European counterintelligence resilience must be measured by the quality of lawful prevention, attribution, protection and recovery—not by the intensity of political declarations, the number of surveillance powers available or the volume of suspicious activity reported. The 2026–2031 period provides a defined horizon in which recently adopted instruments can be evaluated against those standards, with the resulting evidence determining whether further institutional reforms are justified.
