Russia recruits online sympathizers for sabotage in Europe, officials say

Russia recruits online sympathizers for sabotage in Europe, officials say

MUNICH — When a man was seen taking photos of a U.S. military garrison in a Bavarian town where Ukrainian troops are being trained to use the M1 Abrams tank last October, it sparked an investigation that led to the first evidence that Russia was planning sabotage attacks in Germany, security officials said.

The suspect, a Russian-born German citizen, discussed possible targets in Germany – including the US compound in Grafenwoehr – with a person with ties to Russian military intelligence using an encrypted messaging app, according to six Western security officials.

Dieter Schmidt, 39, and an alleged co-conspirator were charged with espionage in April, the first arrests in Germany of suspected saboteurs working for Moscow. Europe has grappled with a rapid increase in Moscow-led sabotage attacks and plots in the months that followed, as Russia focuses on increasing the cost of Western support for Ukraine.

“Russia is fighting the West in the West, on Western territory,” said a senior NATO official who, like others, spoke on condition of anonymity to discuss sensitive material. “We are really increasing our focus on that.”

Secretary of State Antony Blinken announced a response to the Kremlin’s increasing “hybrid attacks” on frontline states and NATO members in Prague on May 31. (Video: The Washington Post)

Secretary of State Antony Blinken said that at a NATO meeting in Prague last month, “virtually all allies” raised the issue of “the Kremlin intensifying its hybrid attacks on frontline states and NATO members, setting fire to and sabotaging supply depots, disregarding maritime borders and demarcations in the Baltics, launching an increasing number of cyberattacks, and continuing to spread disinformation.”

The question of how far Moscow will expand its efforts and how the West should respond will occupy part of this week’s NATO summit in Washington. Western officials say the Russian operations they have detected appear designed to stay below the threshold of an open armed attack while stoking public unrest, and their numbers are growing.

In Britain, four men were charged in April with arson attacks on a London warehouse carrying aid supplies for Ukraine. Authorities said the attack was paid for by Russian intelligence. In early May, a fire broke out at the Diehl weapons factory outside Berlin – and investigators said they were looking into a possible link to Russian intelligence. In Poland, a shopping centre outside Warsaw burned down in May and Polish police arrested nine men shortly afterwards, claiming they were part of a Russian ring involved in “beatings, arson and attempted arson”, including an arson attack on a paint factory in Wroclaw and an Ikea store in Lithuania.

On May 12, arsonists burned down the Marywilska 44 shopping center in Warsaw. Polish police arrested nine men allegedly involved in a Russian crime ring. (Video: Wawa Hot News 24 via Storyful)

In June, French police arrested a man of Russian-Ukrainian nationality for allegedly planning an act of violence after explosive device construction materials were found in his hotel room outside Paris following an apparent accidental explosion. Czech Prime Minister Petr Fiala said a Latin American man accused of an attempted arson attack on a bus depot in Prague last month was “probably” funded and hired by Russian agents.

A treasure trove of Kremlin documents The data, obtained by a European intelligence agency and reviewed by The Washington Post, illustrates the extent of Russia’s efforts to identify potential recruits.

The documents show that in July 2023, Kremlin political strategists examined the Facebook profiles of more than 1,200 people they believed to be workers at two major German plants – Aurubis and BASF in Ludwigshafen – to identify employees who could be manipulated to foment unrest.

The strategists created Excel spreadsheets analyzing the profiles of all employees and highlighting posts that expressed employees’ anti-government, anti-immigrant, or anti-Ukraine views.

At BASF’s chemical plant, special attention was paid to workers’ attitudes toward the closure of several plants in spring 2023 due to rising production costs, including the increase in natural gas prices. This would lead to the loss of 2,600 jobs. At Aurubis’ metal plant, strategists noted anti-immigrant views in the posts of some workers, according to one of the documents.

“We can focus on stirring up ethnic hatred,” wrote one of the strategists. “Or on organizing strikes for social services.”

German officials said they were not aware of any incidents at BASF or Aurubis that could be linked to Russia, but added that they took the Kremlin’s activities very seriously and believed they showed how Moscow was using social media to recruit agents.

Daniela Rechenberger, a BASF spokeswoman, declined to comment on the affected employees but said the company is “continuously strengthening its capabilities to prevent, detect and respond to safety risks.”

“We have no evidence of this – nor are we aware of any social unrest within the Group,” explained Aurubis spokesman Christoph Tesch.

Kremlin spokesman Dmitry Peskov told the Washington Post that the allegations of Russian sabotage were “nothing more than stoking anti-Russian hysteria.”

“All these assumptions and allegations are unfounded,” he said, adding that the authenticity of the claims was “more than doubtful.”

The expulsion of hundreds of suspected Russian intelligence officers who worked under official cover as diplomats immediately after Russia’s invasion of Ukraine was intended to limit Moscow’s ability to conduct covert operations. But increasingly, officials say, Moscow is working with proxies, including those it recruits online.

“We tried to react as we would have during the Cold War. But that is not how Russia acts today,” Lithuanian Foreign Minister Gabrielius Landsbergis said in an interview. “Social media alone offers many opportunities to find people to support them in their activities. So if you can do it online, you may not even need a handler in NATO countries.”

Although activity via social media carries a higher risk of detection, Moscow appears to be casting an indiscriminate net in its search for allies. Communication via encrypted apps and seemingly random targeting make Russian operations harder to detect, officials say.

“It’s extremely decentralized,” Landsbergis said. “It could be refugees, people down on their luck. It could be criminals, basically anyone who thinks it’s a good idea to make a few thousand euros (by sabotage for Russia) and that the risk might not be too high.”

Russia may also believe that outsourcing such operations gives it a degree of deniability while maximizing the potential to sow chaos, officials say. “They are doing what is possible,” a senior European security official said.

A Russian academic with close ties to senior Russian diplomats stressed that it was not possible to link Moscow to all the incidents cited by Western security officials. “But if this conflict continues, both sides will resort to such distorted methods of fighting more and more often,” he added.

Schmidt, the man arrested for scouting the U.S. military facility in Germany, had posted on Facebook about his exploits fighting with Russian-backed separatists in eastern Ukraine between 2014 and 2016. His deployment appears to have been a successful attempt to identify potential ideological allies, German security officials said. Law enforcement authorities said they are still investigating whether Schmidt received financial compensation for his efforts.

Schmidt, who has both German and Russian citizenship and came to Germany as a teenager, was also tasked with finding other people within the German-Russian community in his Bavarian hometown of Bayreuth who could assist in the act of sabotage, according to investigators.

One of those recruits was Alexander Jungblut, another Russian-born German who was arrested along with Schmidt in April and also charged with espionage.

“Jungblut mainly researched on the Internet and supported Schmidt,” said a German security official. Among other things, he collected information about an American company with branches in Bavaria.

Attorneys for Schmidt and Jungblut did not respond to requests for comment.

NATO Secretary General Jens Stoltenberg said in June that the alliance’s defense ministers had agreed on increased information sharing, improved protection of critical infrastructure and further restrictions on Russian intelligence services to curb Moscow’s operations.

But Lithuania’s Landsbergis said far greater efforts were needed. “From our perspective, it does not look like Russia is deliberately avoiding casualties,” Landsbergis said. “It is just a coincidence that there have not been any so far. We will have to react … If Russia advances on our territory, the best response is to allow Ukraine to push back.”

Belton reported from London and Rauhala from Brussels. Cate Brown in Washington and Ellen Francis in Brussels contributed to this report.