On Russia's (Shadow) War Against NATO

Testimony before the Helsinki Commission

Below is a written statement I provided the Helsinki Commission on Sep. 24, 2024 about Russia’s assassination and sabotage operations across NATO territory, going back nearly a decade. If you’d like to watch the full hearing, it’s available here.

The title of this hearing employs the evocative adjective “shadow” to characterize the nature of Russia’s war on the West. That term certainly could encompass Russia’s vast influence and election interference campaigns; its firehose of disinformation and propaganda schemes, including those recently anatomized by the Justice and State Departments; its crippling and costly cyberattacks. 

All of these active measures have been met with what I’d call IED responses: indictments, expulsions and designations. Useful in their own right, but insufficient for dealing with the full-scope of Russia’s other war, which is being waged in broad daylight on the territories of NATO and the European Union. 

This war involves the use of chemical and radiological weapons, small arms, explosives, armed proxies and sleeper agents. It has consisted of assassination, sabotage, and insurrection. It has yielded an ever-growing number of casualties and fatalities, many of them unintended or what we euphemistically term “collateral damage,” not that Moscow worries too much about that.

This war’s perpetrators, meanwhile, have all been personally rewarded by Vladimir Putin with promotion, state medals and commendations, seats in Russian parliament or high-level positions within the Russian government. Some are accredited diplomats now serving abroad in Russian embassies. Others are running an ongoing program to remotely recruit Western citizens to carry out kidnappings, provocations, vandalism, murder or terrorism throughout Europe, aimed almost always at undermining coalition support for Ukraine.

Much of what we know about the history of this Russian war is still being reconstructed in the present as erstwhile cold cases for which we have only now found evidence of Russian culpability. One conclusion to draw from this is that, as terrifying as what we know of what Russia has done to and in NATO countries, more terrifying is what we don’t. 

A brief precis or refresher may be in order since this war started nearly two decades ago.

In 2006, operatives attached to Russia’s domestic security organ, the FSB, poisoned and killed Russian defector-turned-British informant Alexander Litvineko with polonium-210, a highly lethal radioactive isotope, traces of which were later uncovered all over well-trafficked locations in London and Hamburg and on commercial aircraft. Among other things, Litvineko had blown the whistle on the FSB’s false-flag terrorist bombings of apartment buildings in Moscow, bombings which furnished the pretext for Russia’s grisly second war in Chechnya. He had also been helping British and Spanish authorities anatomize Russia’s vast organized crime network in Europe, a network that depended and still depends heavily on the patronage and assistance of Russian officials and Russia’s intelligence organs. 

It took only a decade for the full facts of the Litvinenko assassination to be adjudicated by a retired high court judge. In the intervening period, the Kremlin’s cutthroats and saboteurs remained quite busy killing people and setting things off on NATO and EU soil.

In November 2011 members of Unit 29155, the black-ops unit of the GRU, Russia’s military intelligence service, blew up an ammunition depot in the Bulgarian town of Lovnidol. This facility housed munitions, including 152-millimeter artillery shells, destined for the armies of Georgia and Ukraine. Georgia at that time was busy rearming itself in the wake of its 2008 “summer war,” which began after Russia invaded the country, then home to a pro-Western government. Ukraine, however, was then under the presidency of a pro-Russian leader, Viktor Yanukovych, and still three years away from the Revolution of Dignity that would cause Yanukovych’s flight to Russia and Russia’s subsequent invasion and seizure of Crimea. The intensity of the flames caused by secondary explosions from igniting ammunition in Lovnidol was such that rescue and salvage teams could not safely reach the site for ten days after the initial blast.

Things could have easily been worse. The explosives used for the Lovnidol bombing were planted in the ammunition consignments in the Czech Republic and those consignments were driven by trucks to Bulgaria, traversing 745 miles of European terrain and bypassing Bratislava, Budapest, Belgrade and Sofia, three NATO and EU capitals, home to tens of millions of people. Unit 29155 technicians constructed the detonators for the bombs themselves and they malfunctioned resulting in premature explosions, an untold number of civilians could have been killed.

My investigative team at The Insider was only able to attribute the Lovnidol attack to Unit 29155 thirteen years after the fact, in October 2023. It should not be lost on this body that this act of state terrorism against a NATO member and U.S. ally occurred in the midst of the U.S.-Russian “reset.” That policy was predicated on the notion that “America’s most significant national security interests and priorities could be advanced most effectively through cooperation, not an adversarial relationship with Russia,” in the words of President Barack Obama.

The Lovnidol explosion was followed by a sequel performance, in 2012, at a second Bulgarian weapons depot in the town of Stralzha-Marash. Unit 29155 did this one, too, and ammunition stored at this facility was similarly intended for Georgia and Ukraine. Three people were killed and 18 others seriously wounded in Stralzha-Marash. One hundred and fifty Bulgarians in neighboring villages were evacuated. 

Two years later, in 2014, Unit 29155 destroyed a Czech Ministry of Defense-owned ammunition depot in the Moravian town of Vrbětice, about eight months after “little green men” – Russian soldiers and special forces without insignias – first turned up in Crimea. Vrbětice, in fact, was where Unit 29155 had three years earlier planted the explosives used in the Lovnidol attack. This bombing killed two Czech security guards and set off 50 metric tons of stored materiel. The fire was so intense that Vrbětice also had to be evacuated. 

In all, between 2011 and 2024, there were over half a dozen Russian sabotage operations throughout the Czech Republic and Bulgaria, all targeting their weapons export industries and all in some way linked to security assistance for Kyiv. Well-trained 29155 operatives, many with combat experience in post-Soviet Russian wars in Chechnya and Georgia, followed their original crimes with ones aimed at covering them up: they set fire to the police-forensic center in Sofia where the evidence of the previous attacks was kept, further shrouding the provenance and perpetrators of those attacks in mystery.

Unit 29155 only managed to gain access to well-guarded military facilities in Eastern Europe because decades earlier it had dispatched a family of “illegals” – Russian spies working outside of diplomatic cover – to the Czech Republic. The Šapošnikovs even ended up buying a villa in Halkidiki, Greece, which Unit 29155 operatives have used as their safehouse in the Mediterranean. (Described as “child-friendly,” the villa is still listed for rent on a few booking websites, in case any members of the Commission are in search of a quick and easy holiday destination.)

Then Russia to murder the man arming Ukraine.

In 2015, Unit 29155 poisoned Emilian Gebrev, the CEO of the Bulgarian defense company EMCO, using an as-yet unidentified substance similar in properties to the Russian military-grade nerve agent Novichok, along with Gebrev’s son and factory manager. All three survived.

One member Unit 29155, a saboteur who partook in the attacks on EMCO, helped organize and foment an unsuccessful coup in Montenegro the following year, using imported Serbian militants. The purpose of this attempt at regime change was to forestall or stop the Balkan state’s imminent accession to NATO.

Unit 29155’s most notorious act of war was one that made international headlines, probably because it was the second use of a Russian weapon of mass destruction on British soil. 

In March 2018, Alexander Mishkin and Anatoly Chepiga, two members of Unit 29155 who had taken part in the Vrbětice bombing, traveled to Salisbury, England where they slathered Novichok on the door handle of a house belonging Sergei Skripal, a defector from the GRU who had spied for MI6, been caught and imprisoned in Russia, then traded back to London as part of an American-led spy swap in 2010. (We traded a ring of Russian illegals burrowed into North America, including Anna Chapman, who now runs a thriving clothing line back in Russia.) 

The Novichok nearly killed Skripal and his daughter Yulia, who was visiting from Moscow. This failed assassination resulted in 13,000 hours of decontamination of a sleepy cathedral city and the death of one British woman, Dawn Sturgess, whose boyfriend recovered the fake perfume bottle in which the Novichok was smuggled into the UK. While one might consider it a tactical failure in that the Skripals survived, the Salisbury attack can also be seen as a strategic victory. Apart from the pervasive terror and paranoia it caused America’s closest ally, it also served as a powerful deterrent for would-be defectors and informants in Russian intelligence. Betrayal means death, no matter how long ago or what legal proceedings may have followed.

Then again, if you’ve been opposed to Russia for most of your life, you face a similarly grim fate. 

In 2019, an FSB assassin named Vadim Krasikov gunned down a Chechen dissident and former military commander, Zelimkhan Khangoshvili, in Berlin’s Tiergarten Park. Khangoshvili, as I reported not long afterward, had been an agent of Georgia’s Interior Ministry and quite helpful in its counterterrorism and counterespionage operations, against jihadists and FSB officers alike. He also provided valuable intelligence to the CIA station in Tbilisi. Krasikov was arrested, convicted and sentenced to life in prison in Germany. In August, Krasikov was traded back to Russia as the highest prize in the Biden administration’s prisoner swap, which saw, among others, Evan Gershkovich and Paul Whelan returned home. The bartering of  a Russian hitman for two innocent Americans isn’t just an unpleasant form of moral equivalence; it is a way to ensure that the Kremlin’s war on the West can carry on without fear of serious consequence or retaliation.

The good news is that Unit 29155 operatives have been unmasked and cannot travel to Europe. The bad news is that the GRU, and Unit 29155 in particular, has resorted to adaptive methods of carrying out the same species of state terrorist attacks, largely following the playbook of non-state actors such as ISIS. 

Since Russia’s full-scale invasion of Ukraine, the GRU has been resorting to remote-controlled active measures, relying on Western natives – mainly thugs and riff raff and petty criminals – to do what trained professionals used to. The danger here is that, unlike trained professionals who at least know how to build and detonate bombs, amateurs are prone to screw-ups that could lead to more bystanders getting hurt or killed. Known targets of these proxy operations include arson attacks on a big shopping mall in Warsaw, an IKEA warehouse in Vilnius, a museum in Riga, a bus depot in Prague, an industrial estate in east London, and a metals factory in Berlin. The last two sites seemed to be directly linked to Ukrainian security assistance. Moreover, according to the Wall Street Journal, the CEO of Rheinmetall, Armin Papperger, Germany’s leading arms supplier, was targeted for assassination by the Russian government, no doubt owing to Germany’s outsize military aid to Kyiv.

I have examined court documents from Estonia and Latvia demonstrating how these networks are built and tasked in the Baltic states. The GRU uses intermediaries, such as recruiter-agents, who find European locals on the Russian messaging app Telegram and  compensate in cryptocurrency. A Latvian network, consisting entirely of young Latvian men, some with rap sheets, was recruited to vandalize the NATO Cooperative Cyber Defence Center of Excellence in Tallinn, Estonia, making it seem as if a Russian gang of cyber criminals known as “Killnet” had penetrated its computer systems. One Latvian, aged 18, was even instructed to travel to Kyiv and throw a Molotov cocktail into the ventilation shaft of an unnamed military facility. This was in January 2022, a month before Russian tanks rolled across the border headed for the Ukrainian capital. 

In France, Russia’s intelligence organs have recruited foreigners for a host of kinetic operations. They have suborned Moldovans to spray-paint Stars of David on buildings in an effort to stoke fears of anti-Semitism following Hamas’ October 7 atrocities and the resulting Israeli invasion of Gaza. Bulgarians, Ukrainians and Germans have traveled to Paris to lay coffins draped with the tricolor near the Eiffel Tower in protest of French President Emmanuel Macron’s mooted policy of possibly sending French troops to Ukraine. One Russian-Ukrainian national nearly blew himself up in a hotel near Charles de Gaulle airport, constructing a homemade explosive for purposes that remain unpublicized. 

Russian sleepers in Europe have also been activated. 

This summer, French authorities arrested a Russian-born chef, trained at Le Cordon Bleu in Paris, and sometime Russian TV dating show star, Kirill Griaznov. An FSB illegal, Griaznov was planning acts of sabotage during the Paris Olympics. He revealed his intent to make the French “have an opening ceremony like no other” in drunken table talk at dinner with a Bulgarian neighbor. 

As ominous and disturbing as these trends are, they are by no means new and even predate the Cold War. 

The GRU has been trying to overthrow democratically elected governments and blow things up more or less since its inception by order of Vladimir Lenin in 1918. In 1923, for instance, Soviet military intelligence and the Communist International famously tried to mount an insurrection in Hamburg using members of the German Communist Party. The whole thing ended in farce and calamity, but one of the dividends of failure, according to Walter Krivitsky, a defector from Soviet intelligence, was that it created a toughened cadre of native-born assets in the most industrialized nation in Europe. These evolved into groups dedicated to Zersetzung, or “decomposition,” advanced forms of psychological warfare later employed by the Stasi, and “T-units,” armed cells that attacked Reichswehr and German political institutions. (The “t” stood for terrorism.) This was the incubator of the first generation of saboteurs and assassins recruited and controlled by Moscow. Their goal then was as it is now: to paralyze and demoralize democratically elected governments with the ultimate aim of putting an end to those governments. 

Little has changed in Russian tradecraft since the 1920s, save for the ideological motivation and technological capability of its manifold spies and agents.