On May 27, Polish Foreign Minister Radoslaw Sikorski announced the introduction of restrictions on the movement of Russian diplomats on its territory, citing evidence that the Russian state is involved in authorising sabotage operations on its soil.

This followed a series of announcements by the prime minister. On May 14, Donald Tusk announced his government would invest an additional 100 million zloty (about 23 million euros) in Poland’s security agencies, as well as reverse a decision made under the previous Law and Justice (PiS) government to shut down regional branches of the Internal Security Agency (ABW), the institution in charge of combatting covert activities and terrorism.

To justify his decisions, the prime minister said there was a “growing threat in Europe and in Poland regarding the aggressive actions of the Russian and Belarusian intelligence services”. The scale of these actions has of late become “bigger and more disturbing”, he added, informing that, in recent weeks, Poland had prevented “attempts at direct action, including sabotage and attempted arson”.

Over the subsequent weeks, the Polish government kept the issue in the headlines. On May 21, Tusk told TVN24 that nine people had been arrested and charged with “involvement in acts of sabotage in Poland and on behalf of Russian services”. Judging by the list of such arrests available on the website of ABW, the figure given by Tusk seemed to be a summary of recent events as opposed to a single new development.

The following day, he announced the formation of a commission to evaluate Russian influence among the Polish political class, designed to feed information to prosecutors. During the TVN24 interview the previous night, Tusk had suggested that inquiries about Russian influence in Poland have appeared to converge on the person of Antoni Macierewicz, a former PiS defence minister and hardliner – a notion previously explored by investigative journalist Tomasz Piatek in his book Macierewicz i jego tajemnice (“Macierewicz and his secrets”).

In parallel to these announcements, several fires broke out in May across Poland, including at Warsaw’s largest shopping centre at Marywilska 44, which led to speculation, including by government officials, that these might have been the result of Russian sabotage. There has not, however, so far been any evidence publicised to indicate that.

Indeed, the ordinary Polish citizen could be forgiven for feeling a sense of a heightened, imminent Russian threat on Polish territory following these incidents, coupled with the ominous statements and speculation coming out of the government.

Certainly, there seems to be unanimity among security experts that Russian covert actions are a real risk for Poland and the rest of Europe today. But how seriously should we take the incidences that have happened in Poland to date?

Arrested developments

Internal Security Agency (ABW) officers escorts a civilian suspected of espionage Stanislaw Sz. (C) after a hearing at the District Court in Warsaw, Poland, 17 October 2014. EPA/LESZEK SZYMANSKI POLAND OUT: FACE PIXELATE DUE TO POLISH LAW

Contacted by BIRN, Poland’s counterintelligence agency did not give a precise number of arrests or convictions related to Russian covert operations but referred us to the information on its website. Since the start of the war in Ukraine in 2022, ABW indicates 28 people have been arrested on charges related to espionage or sabotage in favour of Russia, leading to the pressing of charges against 19 individuals; a couple of others were expelled. These numbers are indicative, as not every arrest or conviction has an entry on the ABW page, to the best of BIRN’s knowledge.

But what is clear is that the arrests have intensified over the last year, especially in recent months.

ABW arrested in April a Polish man who had allegedly expressed his readiness to cooperate with Russia’s GRU military intelligence agency, including providing information about the Rzeszow-Jasionka airport, the main hub through which military and other aid for Ukraine transits. ABW claims the information this man was to provide would likely be used to organise an attempt to murder the Ukrainian president, Volodymyr Zelensky.

In late January, a Ukrainian man was arrested for planning, on instruction from Russian intelligence agencies, to set fire to facilities located “close to elements of strategically important infrastructure” in the south-western city of Wroclaw. In late May, three men allegedly part of the same network were arrested in other locations in Poland.

The Polish security agencies have also been closely cooperating with their Czech and European peers in helping to dismantle the Voice of Europe disinformation network – a vast influence and propaganda operation whose rolling up is continuing to ensnare various European politicians and aides.

On January 19, in connection to the Voice of Europe affair, a Polish man described as “well placed in national and European parliamentarians’ circles” was charged with spying for Russia, including conducting “propaganda actions, disinformation and provocations”. The Poles have been continuing the investigation since, with searches across the country and sequestering tens of thousands of euros in March.

In April, two Polish men were arrested for allegedly attacking Russian activist Leonid Volkov in front of his home in Vilnius. The Poles were linked to extremist football hooligan networks and seem to have been hired for the job by a Belarusian working for Russia.

Finally, in what is likely to be the biggest spy-related operation to date, charges were laid against 16 individuals for being part of a Russian spying network in November 2023. Their actions included the “reconnaissance of military facilities and critical infrastructure, monitoring and documenting the passage of transports to Ukraine, and preparations for the derailment of trains to Ukraine.” The members of the network, originating from Poland, Ukraine and Belarus, are already in prison, most serving final sentences.

Besides the arrests, another key incident happened in May, when a Polish judge, Tomasz Szmydt, fled to Belarus and requested political asylum there, sparking fears that he had been a Russian or Belarusian asset all along.

What is becoming clear, say intelligence experts, is that these Polish examples are in line with a wider European trend identified by security experts, whereby Russia, devoid of its extensive network of intelligence operatives since the full-scale invasion of Ukraine, is outsourcing its spying and sabotage to cheaper local providers.

‘Cut price’ spying

Polish Prime Minister Donald Tusk (R) and Polish National Defence Minister Wladyslaw Kosiniak-Kamysz (C) take part in a briefing with the command of the uniformed services at the Polish Border Guard facility in Dubicze Cerkiewne, Hajnowka County, north-eastern Poland, 29 May 2024. EPA-EFE/ARTUR RESZKO

As part of an investigation published in May, the Wall Street Journal spoke to a 23-year-old Ukrainian called Maxim Leha, who is currently in prison in the eastern city of Lublin. The Polish authorities consider him to be the leader of the 16-man spying network. Based on Leha’s account, most of the spies recruited in Poland by GRU contacts were young Ukrainians, Belarusians or Poles, adrift young men looking to earn a bit of extra cash.

The job they had to do was oftentimes simple: stick a phone camera to a pole next to where trains carrying military aid to Ukraine are passing and later share the footage. But, by using multiple sources like these, the Russians can gather significant amounts of intelligence, security experts agree.

In another example provided to BIRN by Pawel Makowiec, a cybersecurity expert at CyberDefense24.pl website, members of the Kremlin-linked hacker group Cyber Army of Russia Reborn accessed a wastewater utility in Wydminy, north-east Poland, in January, recording themselves as they played around with the control panel at the plant.

“This is a big security fail since the hackers got in,” Makowiec comments. “But what you also see on the video is that the hackers didn’t really know what they were doing when they were pushing those buttons around. They were not able to cause any actual damage at the plant.”

Indeed, Gazeta Wyborcza’s report on one of the football fans arrested for attacking Volkov in Vilnius said the man is likely to have been ignorant about the political dimension of the attack he was paid to do.

The WSJ calls this approach to spying “low cost” and “low risk” for Russia. Beginning with 2018’s Novichok poisoning in the UK, the discovery the same perpetrators were responsible for the 2014 Vrbetice munitions depot explosion in Czechia and then the full-scale invasion of Ukraine, European states expelled around 500 Russian diplomats, including many individuals considered to be spies. This has forced Russia’s various intelligence agencies to rebuild those networks using non-professional hires, oftentimes Russian-speaking individuals – including Ukrainian, Belarusian or Russian refugees – already based in the target countries.

“These cheap and seemingly bumbling efforts are nothing to be sneered at,” a senior Western military intelligence official told the WSJ. “They are part of a large toolbox of intelligence gathering that has helped Russia destroy key materiel with minimum investment.”

A major 2024 report by the Royal United Services Institute (RUSI), the UK’s leading security think tank, reached a similar conclusion. “Russia is using unconventional methods to expand its influence, evade containment, and destabilise and disrupt its adversaries – and is making progress in several directions,” it said.

“Russian methods are often unsophisticated and there is a litany of failures,” the authors wrote. “Nevertheless, they persist, and so there is a requirement for sustained vigilance.”

Back in Poland, Makowiec also thinks it would be naïve to dismiss the Russian threat, while also cautioning that it is important to avoid knee-jerk reactions and instead analyse events carefully, as some of them probably have nothing to do with Russia.

He gives an example of an incident from last summer, when trains were stopped on the tracks after an alarm sound was sent on the internal radio system. While many media reported it is as likely to be caused by Russia, Makowiec says such situations are actually commonplace in Poland as the radio system is easy to access.

“We are a frontline country and transport hub for Ukraine, no wonder people always suspect it’s the Russians when something like this happens. But we have to be very careful in assessing what happened,” he says.

“At least when it comes to cybersecurity, I’m not too worried,” Makowiec adds. “Our cybersecurity experts are in the global lead and governmental websites have really stepped up security measures in the last years. Still, the Russians might always surprise us.”

Certainly, Poland is facing a wave of disinformation, cyber-attacks and attempts at sabotage and espionage. But the level so far might not merit the level of panic that one can feel when watching the news over the past few weeks.

Writing for Gazeta Wyborcza, journalist Dominika Maciejasz reminded readers that Polish cities face fires every hot season, many of which are caused by waste companies trying to illegally get rid of waste.

If officials bring up the Russian suspicion with every incident even when there is no evidence pointing in that direction, Maciejasz argues, “the effect will be that an avalanche of speculation will spread and start living a life of its own”.

One of the possible consequences of that could be to make Poles more suspicious of Ukrainian and Belarusian refugees, or simply cause panic among the public – both effects that, ironically, Russia is looking to achieve in Poland.