Russian hostile activity costs the UK at least £2 billion (US$2.7 billion) annually, according to a recent report by Scottish MP Graeme Downie, who has called on the government to measure the full economic impact. But that figure is just the baseline. A profound shift in Moscow's approach to sabotage means the real cost is set to climb.
While Russia still maintains Cold War-era target lists—critical transit nodes, military sites, energy and communication infrastructure—it has traded highly trained operatives for cheap technology and expendable recruits. The switch to a quantity-over-quality model presents a much more volatile threat.
This model borrows from the logic of distributed computing: networks of cheap, unreliable parts where individual breakdowns are expected, yet the overall system still gets the job done. By generating a high volume of low-cost operations that often fail individually, Moscow still achieves its objectives of causing outsized psychological disruption and steadily exhausting Western security services.
From diplomats to gig operatives
The operational transformation surged after Russia's full-scale invasion of Ukraine in 2022. Within months, over 400 Russian intelligence officers operating under diplomatic cover were expelled across Europe. That number has since climbed to more than 700. The mass purge was expected to cripple Russia's spy networks, but it instead accelerated Moscow's pivot towards what research by my colleagues and I in 2024 defined as “gig-economy” operatives.
In place of declared “diplomats” well known to local counterintelligence officers, operations have been outsourced to disposable proxies recruited for a pittance. These people are often unaware of who their handlers are or their mission's real goals. This new campaign brings to life former CIA chief James Woolsey's 1993 description of the post-Cold War security landscape as a “jungle of venomous snakes.”
Recruited on messaging apps and paid in cryptocurrency, gig-economy operatives have been tasked with arson, property damage, beatings, kidnappings, and assassinations—including plots on US soil, a stark breach of Cold War conventions. While many of these plots have been amateurish, the intent behind them and their potential damage are real. The campaigns have blurred the lines between theatrics and physical damage, from mock coffins beneath the Eiffel Tower to graffiti designed to stoke antisemitic tensions across Paris.
Arson targets have ranged from a warehouse in London storing aid for Ukraine to an Ikea store in Lithuania and a paint factory in Poland. Western intelligence also narrowly averted catastrophe in 2025 when incendiary devices planted on DHL cargo planes caught fire in freight depots on the ground rather than mid-flight.
Beyond commercial property, Moscow's campaign has targeted critical infrastructure. At sea, the playbook has escalated from plausible deniability to overt military posturing. Since 2023, Russian-linked commercial vessels flagged from China to the Cook Islands have repeatedly severed power and data cables by dragging their anchors across the seabed. The Russian authorities have backed this with hard power, from scrambling fighter jets to deter Estonian authorities from approaching a suspected vessel in 2025, to deploying intelligence ships and submarines close to Western lines.
A parallel escalation has unfolded in the air. Operations began with electronic interference and drone surveillance disrupting commercial aviation, as well as probing European military bases and transport hubs to test air defenses and map blind spots. They have since graduated to overt airspace violations by Russian military aircraft and missiles, while armed drones have repeatedly crashed or detonated in Polish, Latvian, and Moldovan territory.
This pattern crossed from deniable sabotage into a direct physical attack in August 2026 when an explosives-laden drone crashed into the wing of a parked Ukrainian cargo plane at Leipzig/Halle Airport in Germany. The device failed to detonate, averting a major explosion on an aircraft that had previously transported military ammunition. The incident exposed not only Moscow's escalatory ambitions but also the sharp decline in professionalism within Russian intelligence. Rather than the elite officers Cold War doctrine called for, the Russian handler relied on amateur recruits who botched the job.
Yet for Moscow, operational failures are almost as useful as successes. A botched strike still generates media panic, exhausts European security services, and projects a menacing shadow far beyond Russia's real capabilities. The same logic underpins the Kremlin's cyber campaigns, where merely threatening critical infrastructure is often enough to achieve intimidation. Cyberattacks on a Norwegian dam and a Swedish heating plant, both in 2025, caused negligible physical damage but generated alarming headlines and psychological effects.
This evolving threat has implications beyond Europe. As Sino-Russian cooperation reshapes Indo-Pacific deterrence, Moscow's gig-economy model could easily be exported to Asia, where espionage disputes with India and other partners complicate regional security. The shift also echoes broader trends in AI-driven espionage, where technology lowers the barrier to entry for state-backed sabotage. For Western intelligence, the challenge is no longer just countering elite spies but managing a diffuse, unpredictable network of disposable operatives—a task that will only grow more costly.
