Gig model of Russian subversion is a nightmare for Western intelligence services

Elisabeth Braw is a senior fellow at the Atlantic Council, the author of the award-winning “Goodbye Globalization” and a regular columnist for POLITICO.

Who set fire to the Marywilska 44 shopping mall in Poland last year? In May, authorities in Warsaw announced they now know the answer, and that the perpetrators were ordinary civilians recruited by Russia.

The arrangement is very on trend. The Kremlin has been using freelancers to carry out dirty deeds across Europe with increasing frequency — and those freelancers can be anyone. The strategy is as sinister as it is effective. It’s also a law enforcement nightmare.

The fire that ripped through the Polish mall in the early hours of May 12, 2024 had been so fierce, it spread swiftly across the vast facility. By the time firefighters managed to extinguish the blaze, it had destroyed 80 percent of the building and the majority of the shopping center’s 1,400 stores.

At first, it seemed massive misfortune had struck the center’s merchants. But much of the incident was suspicious — accidental sparks rarely travel that far that quickly. Ever since the fire, police had been investigating.

And on May 11 this year, Polish Prime Minister Donald Tusk finally announced that the authorities had identified the culprit: “We now know for sure that the great fire of the Marywilska shopping center in Warsaw was caused by arson ordered by Russian special services. Some of the perpetrators have already been detained; all the others are identified and [are being] sought. We will get you all!” he said.

The following day, Foreign Minister Radosław Sikorski told the BBC: “We have evidence that they commissioned people living in Poland, they commissioned them on Telegram and paid them to set fire to this huge shopping mall.”

But this fire is just the latest example of what I call “freelance” gray-zone aggression: hostile states carrying out harmful acts against other countries through one-off contractors.

For instance, before Germany’s federal election in February 2024, hundreds of Germans found their cars sabotaged, their exhaust pipes blocked by insulation foam and their windows covered in posters with the countenance of then-Greens leader and Vice Chancellor Robert Habeck. “Be greener!” the signs commanded.

It looked like the work of overzealous party supporters. But police made a completely different discovery: The sabotage was committed by various small-time criminals who were recruited by a Russian agent on the messaging app Viber. The agent had promised — and delivered — payment of €100 per car, one of the suspects told the police.

And that’s just one example.

Last summer, a parcel burst into flames at a DHL depot in Leipzig. Then another parcel caught fire in Warsaw — and another in Birmingham. Authorities and investigative journalists later found that a man in Vilnius had dropped the parcels off at DHL in the Lithuanian capital. The packages contained cosmetics, sex toys and massage pillows, and were to be sent to addresses in Britain and Poland. Two of them exploded on arrival, another during a stopover in Leipzig. Had they exploded in the air, lives would have been lost.

Then, a few months later, a man in Poland dropped off what turned out to be two suspicious packages to be delivered to the U.S. — an attempt to scout out future parcel bomb routes, investigative journalists reported. A month later, three Ukrainians carried out a similar scheme in Germany. These attempted attacks, too, were instigated by Russia (in this case, the GRU military intelligence service) and executed by freelancers recruited via apps.

By the time firefighters managed to extinguish the blaze, it had destroyed 80 percent of the building and the majority of the shopping center’s 1,400 stores. | Leszek Syzmanksi/EPA

I have also been told with a high degree of confidence, by an entity monitoring hostile-state activity, that entities affiliated with Russian artillery units have been identified within Finnish steel facilities.

And last month, homes linked to U.K. Prime Minister Keir Starmer were damaged in arson attacks that undeniably pointed to Moscow as well. The police charged two Ukrainians and one Romanian, who conspired with “others unknown.” The latter, a Russian speaker born in Ukraine, had been studying at Canterbury Christ Church University while working in construction and as a model.

If a student and part-time model can turn out to be behind a one-off gig for Russia, so could thousands of others in Britain, Germany, Poland, Lithuania — essentially any Western country. The gig model works well for Russia because it allows it to easily recruit freelancers, or “disposable agents” as they’re sometimes called.

“The more eye-catching shift this year has been Russian state actors turning to proxies for their dirty work, including private intelligence operatives and criminals from both the U.K. and third countries,” MI5 Director General Ken McCallum said last October.

The arrangement works well for the freelancers, too, as they can take on gigs without committing to a career in the Kremlin’s service.

But as the incidents to date illustrate, this type of gig gray-zone aggression is highly disruptive and dangerous. We risk the prospect of constant attacks, while the taskmasters on the other side of the chat watch their gig workers sow destruction as their own involvement remains virtually impossible to prove, let alone prosecute or avenge. And they don’t just operate from Russia either — other hostile states are already using the gig model and are likely to expand it.

For law enforcement, tackling this problem is almost impossible, especially in open societies where we don’t track people’s every move the way, say, China does. But if we all do our part, we’ll at least have a chance of curtailing this sinister campaign. Citizens can report situations that look unusual, while companies and authorities can step up the surveillance of their facilities — as all manner of gig attacks are likely to be carried out around buildings.

Dismantling this new mode of operation won’t be as easy as “see it, say it, sorted.” However, if most of us decide to be more alert and report our findings, criminals will be less tempted to do the dirty deeds of hostile states. No doubt those who have since been arrested now regret their part in this scheme.