Czech, Latvian and Swedish intelligence chiefs warn Russia may intensify sabotage in Europe in coming months

Senior European intelligence officials have warned that Russia may step up sabotage operations in Europe in the coming months, shifting from broader attempts to sow panic to more targeted attacks on infrastructure linked to support for Ukraine. In interviews with The Guardian, the heads of the Czech, Latvian and Swedish services outlined scenarios that include limited incursions, false-flag provocations and large-scale influence operations aimed at pressuring Western governments to dial back support for Kyiv.

Michal Koudelka, head of the Czech Security and Information Service (BIS), said Moscow could attempt a limited incursion into the territory of a NATO member that borders Russia. Koudelka also flagged provocations conducted under the flag of another country and wide-ranging “influence operations” as possible elements of an intensified campaign. He stressed that such actions could materialize within months rather than years and emphasised that Western governments are taking measures to reduce the likelihood of such scenarios.

The head of Latvia’s State Security Service, Normunds Mežviets, struck a more cautious tone. Mežviets said there are signs Russia is preparing for "more decisive actions" in Europe, but Latvian intelligence does not see firm evidence of an imminent attack. He also noted it remains unclear whether Moscow has concrete operational plans or whether the primary goal is to spread fear and uncertainty through Western societies.

Thomas Nilsson, director of Sweden’s Military Intelligence and Security Service, warned that Russian sabotage activity is becoming more dangerous. Nilsson pointed to the recent armed drone incident at Leipzig airport, which German authorities have blamed on Russian intelligence, as a potential turning point. He said such operations carry the risk of causing civilian casualties or inflicting serious damage on critical infrastructure.

All three officials noted an apparent tactical shift in the alleged Russian campaign. Where earlier acts of sabotage or arson may have been intended mainly to create alarm and distraction, intelligence services now see a growing tendency to select concrete targets tied to Ukraine support. Identified potential targets include railway infrastructure, logistics hubs and defence-industry plants — assets that, if damaged or disrupted, could impede deliveries, manufacturing and the broader logistical chains that sustain Ukraine’s military effort.

Koudelka described the pattern as an “escalation to de-escalation” strategy: Moscow is prepared to increase pressure to such a degree that European governments might be compelled to reduce their support for Ukraine. He also warned that the campaign’s cumulative impact would strain security services, because what previously might have been treated as an isolated fire or accident now has to be investigated as a possible act of sabotage.

The intelligence chiefs’ assessments underline growing concern in European capitals about asymmetric and deniable forms of aggression below the threshold of open war. Officials say they are reinforcing protective measures, increasing scrutiny of infrastructure incidents and coordinating more closely with partners to detect and deter covert operations. The warnings also raise political questions about resilience and how far Western democracies are prepared to sustain material and political backing for Ukraine in the face of intensified external pressure.

The officials made their remarks in the context of ongoing tensions between Russia and the West since the full-scale invasion of Ukraine in 2022. While none of the intelligence leaders named a specific country as the likely site of a limited incursion, their public statements are intended to alert governments and civilian authorities that contingency planning and heightened vigilance are necessary. German authorities’ attribution of the Leipzig airport drone incident to Russian services has been cited by the Swedish head as an example of the kinds of operations that could mark a dangerous escalation.

Western intelligence services, law-enforcement agencies and infrastructure operators are now confronting the dual imperatives of protecting critical assets and maintaining public confidence without overreacting to incidents that may be ambiguous by design. The chiefs’ warnings reinforce the message that even incidents that superficially resemble accidents or isolated criminal acts must be assessed within a broader strategic context as potential elements of an orchestrated campaign.