When Poland announced this week that an explosion damaged a railway track leading to Ukraine, Prime Minister Donald Tusk was quick to declare it was an unprecedented act of sabotage designed to cause catastrophe.
In the hours that followed, Polish authorities said the two suspects behind the explosions were Ukrainian citizens backed by Russian intelligence, and that they had escaped by fleeing to Belarus.
In response, Warsaw announced it was closing Russia's last operating consulate in the country, located in the northern city of Gdansk, and that it would deploy up to 10,000 troops to protect critical infrastructure in Poland.
It was a quick response from a country that shares a more than 500-kilometre-long border with Ukraine, and has acutely felt the effects of Russia’s invasion spilling over its border — like in September, when around 20 Russian drones crossed into Polish airspace.
Across Europe, officials are grappling with how to deal with what some have described as an escalating Russian shadow war designed to disrupt and intimidate Ukrainian allies without triggering a more serious response.
"I think some countries are taking very strong stances, like Poland, but on the whole, I think [responding] is where we are falling short,” said Bart Schuurman, a professor of terrorism and political violence at Leiden University in the Netherlands.
“We’re falling short because these things are continuing to happen.”
Russia denies claimsMoscow, which views the West as directly involved in the war in Ukraine, denied being behind the railway explosion in Poland.
Dmitry Peskov, a spokesman for the Kremlin, labelled Warsaw's claims as “Russophobia.” Peskov went on to say it was “noteworthy” that “once again” citizens of Ukraine are being questioned for sabotaging critical infrastructure.
It was a clear reference to the continuing investigation into the 2022 explosion involving the Nord Stream pipeline, which carried Russian gas to Europe. Germany has accused a former Ukrainian military officer as being involved.
While Russia frequently tries to bat away accusations as baseless finger-pointing, Western authorities believe Russian intelligence services are behind a slew of sabotage operations across Europe.
Experts say in many cases, individuals were recruited on social media to carry out the attacks, as many Russian agents and diplomatic staff were evicted from their foreign postings in the wake of Moscow’s full-scale invasion of Ukraine in 2022.
Bart Schuurman, a professor of terrorism and political violence, has studied what he calls the alarming trend of Russia's hybrid warfare. (Arash Nikkhah/Studio Arash )Pattern of attacksSchuurman has created a database tracking various incidents believed to be linked to Russian agents. He has catalogued cases of arson, targeted violence, vandalism and sabotage.
He only included events in his records if Western authorities directly accused Russia of being involved, if an incident was part of a clear pattern or if there was substantial reporting implicating Russian intelligence.
Schuurman says an integral part of these operations is that they are supposed to be deniable.
“Even if the links to Russia are … quite obvious or quite clear in some cases, there is never really a smoking gun, or very seldomly there is one,” he said. “It is plausible deniability, which makes it a very powerful instrument of Russian foreign policy, because it kind of shields them against retaliation."
In some cases, suspects end up in court, but it would likely take months, if not years, to reach a significant conclusion.
In October, a British court sentenced five men to years in prison for their role in an arson attack on a London warehouse that contained satellite communication devices destined for Ukraine. During sentencing, the judge said the plot was organized on behalf of Russia’s Wagner paramilitary group and part of a widespread sabotage campaign.
The Associated Press has documented at least 25 arson or explosives plots across Europe that Western officials have linked to Russia since Feb. 24, 2022, when Moscow launched its invasion of Ukraine.
Schuurman says a clear motivation for the attacks is to try and undermine public support for Ukraine. But he believes there is also an element of signalling: Moscow prodding Europe to remind leaders of its reach and capabilities.
WATCH | NATO launches surveillance mission in response to Russian drones:NATO is on the lookout for airspace threats over eastern Europe as suspicious drone sightings continue to shut down airports. For The National, CBC’s Briar Stewart gets a closer look at the Operation Eastern Sentry mission and what it's watching for in the skiesSoviet-era strategyA new report from the Center for European Policy Analysis said Moscow’s shadow war is driven by a Soviet-era mentality, where Russia believes it is locked in an existential confrontation with the West and that anyone can be a target.
Through their analysis, report authors Sam Greene, Andrei Soldatov and Irina Borogdan concluded that Russia’s intelligence services were engaged in “nominally covert operations to produce overt intimidation,” with the goal of agitating the West and chipping away at support for Ukraine.
Schuurman says the range of incidents vary in severity, from simple vandalism to what he calls state-sponsored terrorism.
Besides the Polish railway track explosion, he says the alleged attempt to send explosive devices through delivery companies DHL and DPD in 2024 was among the most serious plots.
Last month, Lithuania charged 15 people with terrorism offences, alleging they worked as part of a Russian plan to detonate parcels in Poland, the U.K. and Germany. Lithuanian investigators previously said the plot was part of a dry run aimed at sabotaging flights to the U.S. and Canada.
Poland and Romania also announced in October that they had arrested three other individuals, accusing them of planning to send explosive parcels to Ukraine.
Kaja Kallas, the E.U.’s foreign policy chief, has called Russia’s actions increasingly brazen, saying these threats can’t be the new normal. But experts say Europe’s response has been inconsistent and fragmented.
An Estonian patrol ship takes part in the NATO mission Baltic Sentry, which was launched after underwater power and internet cables were severed. Some Western officials said it was an act of sabotage. (Briar Stewart/CBC)More monitoring, but fragmented responseAfter a number of power and internet underwater cables were severed in the Baltic Sea last winter, NATO stepped up maritime patrols. The Western military alliance also stepped up aerial surveillance after about 20 Russian drones crossed into Poland in September, with a number of them crashing.
What has been absent, experts argue, is a unified signal toward Moscow.
“There is not yet a single NATO-EU political framework that treats drones, rail sabotage and other operations as one campaign with one shared playbook,” said Charlie Edwards, a senior fellow for strategy and national security at the International Institute for Strategic Studies. “This needs to happen urgently.”
Edwards, who authored a report looking at sabotage operations against Europe’s critical infrastructure, said countries need to boost their defences around energy sites and transport hubs, and said NATO has to have a clear, agreed-upon threshold around how to respond.
Schuurman says the promise of “a realistic deterrent” is missing from all of the discussions, which he says is not surprising given the challenge of confronting Russia without further escalating the tension.
“What would Europe do if Russia brought down a plane with those DHL packages?" Schuurman asked. "I think they would be in a really, really tough spot.”