Russia’s recruitment of immigrants to carry out spying and sabotage is a new threat to Poland

Keep our news free from ads and paywalls by making a donation to support our work!

Notes from Poland is run by a small editorial team and is published by an independent, non-profit foundation that is funded through donations from our readers. We cannot do what we do without your support.

By Adam Lelonek

On 24 February, the third anniversary of Russia’s full-scale invasion of Ukraine, Polish TV station TVN broadcast an unprecedented investigation showing how Russia’s intelligence services are recruiting civilians – often immigrants and refugees from Ukraine and Belarus – to carry out hostile acts in Poland.

The report revealed how Moscow uses the Telegram online messaging service to offer foreign nationals payment in return for conducting surveillance, sabotage, diversion and information operations on Polish soil. Notably, these are not trained agents but low-skilled, low-paid individuals.

The TVN investigation was based on previously unseen court files connected with the convictions of 16 foreign nationals (13 Ukrainians, two Belarusians and one Russian), who were sentenced to between one and six years in prison for carrying out espionage in Poland on behalf of Russia.

However, those are not the first or only cases of their kind. In February, another Ukrainian man was convicted for preparing to carry out acts of sabotage in Poland. In March, a Belarusian man was charged for his alleged role in setting fire to a DIY store in Warsaw on Russian orders.

Adam Lelonek, an expert on information manipulation and hybrid threats, explains why Russia is recruiting low-skilled foreign nationals to carry out operations, what the Polish government is doing in response, and how this all fits into the bigger picture of hybrid threats against Poland.

A new type of threat to liberal democracies

The aforementioned activities form part of a new set of “hybrid threats” carried out by authoritarian actors and their proxies and targeted at democratic countries across the globe. The European Centre of Excellence for Countering Hybrid Threats defines these as actions “conducted by state or non-state actors, whose goal is to undermine or harm a target by combining overt and covert military and non-military means”.

The Washington Summit Declaration issued by NATO members in July 2024 mentioned the following examples from the Russian hybrid toolbox: sabotage, acts of violence, provocations at allied borders, instrumentalisation of irregular migration, malicious cyber activities, electronic interference, disinformation campaigns and malign political influence, as well as economic coercion.

These activities are also known as the “grey zone” – they are below the threshold of a “hot war”. They aim to escalate a situation – in this case, the disruption of normal functioning in liberal democracies – by acting within the limits of their targets’ will to respond directly, much like the misbehaving child that tests the boundaries of its parents.

Hybrid threats can focus on the tangible and physical environment (infrastructure, legal frameworks, democratic systems, information spaces and the cyber domain, as well as communication, administration or security systems) but can also aim to influence the cognitive and psychological spheres (beliefs, values, religions, ideologies, political preferences or dislikes) sometimes by manipulating the target country’s historical conditions (e.g. by stirring tensions in Poland connected with the Volhynia massacres).

When made aware of them, the public usually perceives hybrid threats as an alternative to direct military activities. That makes them easier to digest or even ignore, as it can appear that those initiating them do not want an open war – there are still red lines that they have not crossed. Such an understanding is, however, a misconception because hybrid threats are often closely linked to kinetic war.

By collecting data (e.g. on individuals and communities, legal loopholes or other systemic, cyber or information vulnerabilities), recruiting assets (either aware or unaware of their role), or achieving gains through cyber intrusions (e.g. leaving dormant malware across different systems or networks), a toolbox is built that can be wielded before, during or after a full-scale military conflict.

Hybrid threats are particularly dangerous because the use of proxies and online identities makes it difficult to attribute who is responsible for them, they are cost effective, and their target may be unaware that it is being attacked, given that the actions do not resemble conventional espionage.

For example, the painting of anti-government and anti-NATO graffiti revealed by the TVN investigation was not immediately obvious as an act of espionage conducted by a foreign state – Polish nationals with no connection to Russian intelligence services might also choose to paint similar messages.

It cost Moscow just $7 per slogan, while helping to escalate anti-government sentiment in Poland, thus increasing political polarisation and potentially interfering with the Polish electoral process.

The advantages of recruiting low-skilled civilians

The recruitment of regular civilians is far cheaper than conventional espionage – the recruits are not trained – and conducted outside formal bureaucratic frameworks and constraints, giving Russia greater deniability.

Such recruits also act as “cannon fodder”, without any inside knowledge about the true goals or intentions of their supervisors. They are expendable tools who, if captured, are no great loss to the Russian intelligence services and can give limited information to the Polish authorities.

Untrained civilians may lack the skills to work professionally and effectively – in the case referenced by the TVN report, some of the individuals were identified and arrested on the basis of evidence they left behind at a crime scene. However, their possible arrest and conviction can still serve a propaganda purpose for Russia.

Given that Poland has welcomed war refugees from Ukraine and political dissidents from Belarus, it is in Moscow’s interests to emphasise – for example, on social media – that Ukrainians and Belarusians are, in fact, attacking Poland. This could help to provoke social unrest and directly influence political decisions, such as limiting support for Ukrainian refugees and reducing or blocking the transit of humanitarian and military aid for Ukraine.

According to Vincent V. Severski, a former officer in the Polish security services, in around 95% of cases, recruits are motivated by money. Given that the minimum wage in Poland is 30.50 zloty (€7.10) per hour and that recruits are working at a rate of, for example, 7 dollars (27 zloty) per graffiti, it seems clear that many of them are in a difficult financial situation. Even in cases where the reward is thousands of dollars, the risk involved – if discovered, a prison sentence – does not seem worth the money.

Such individuals are likely to have struggled to find work in Poland and in some cases may lack the will to integrate or participate in Polish society. Their recruitment via Russian-language Telegram channels also suggests that they spend time in areas of the internet under Moscow’s sphere of influence and may be more exposed to Russian propaganda and narratives.

That increases the appeal of “easy” money being offered in a language that the potential recruit is either fluent in or more familiar with than Polish. One might question the moral standards of an individual who carries out acts of vandalism and sabotage in exchange for money; in some cases, they might simply lack common sense and awareness.

To date, only a handful of court cases concerning low-skilled civilians have been reported publicly in Poland. However, Przemysław Nowak, a spokesperson for the national prosecutor’s office, told TVN in February that the country is “currently investigating 27 espionage cases”. It can thus be assumed that there are other networks or structures, possibly with different objectives and modes of operation.

Evidently, Russia is testing Poland’s vulnerabilities, defences and responses, all the while using hybrid threats to encourage an atmosphere of fear and distrust of the state, its representatives and allies, as well as democratic and decision-making processes that influence everyday life.

Possible future hybrid threats

Although the vast majority of foreigners living in Poland are law-abiding citizens – police statistics indicate that around 5% of all suspected criminals in 2024 were foreigners – some sectors may be vulnerable to hybrid threats owing to the nature of their workforce.

According to Statistics Poland, a state agency, Ukrainians (70%) are the largest group of foreign workers in Poland, followed by Belarusians (10%) and Georgians (3%). Citizens of those countries and other former Soviet states are strongly represented in the transportation, construction, logistics and public sectors.

Owing to their countries’ recent history, they are likely to speak or understand Russian and may continue to receive news and other information from the Russian-language internet, including Telegram. If Russia could recruit such individuals who already work in Poland, Moscow would be able to expose the country to more serious hybrid threats.

These could include gaining access to military facilities or governmental buildings by recruiting employees of building companies carrying out construction or renovations. Professional drivers could be recruited and used to cause traffic and other disruption. IT and public sector workers could be used to access computer systems and obtain sensitive data.

The question remains to what extent such foreign workers are susceptible to recruitment by the Russian security services, given that money alone is unlikely to be a motivation for those with stable employment.

The Polish government’s response

In response to the growing proliferation of hybrid threats, Poland amended its criminal code in August 2023 to increase prison sentences for those convicted of espionage. In some cases, the maximum penalty is now life imprisonment.

It is still unclear whether those new penalties are deterring low-income people, foreigners or otherwise, from carrying out hostile activities. Nonetheless, that amendment reflects a change in the mindset and approach of the Polish political class and ruling elites, who now appear to be aware of the severe consequences of hybrid threats.

Simultaneously, there are growing efforts to train state institution personnel, both in central and local government, as well as to prepare different action plans and responses to hybrid threats. There is also a stronger component of involvement and collaboration between the state, private sector and civil society organisations.

The details of such programmes are largely confidential; however, one example includes the regional prosecutor’s office in Kraków last year conducting training concerning terrorist, hybrid and cyberspace threats.

There are, however, some issues with the Polish response. Civil defence and crisis management are still not fully regulated legally, nor do they function efficiently. The terminology used in documents – such as “disinformation” or “sabotage” in the criminal code or “hybrid threat” in other key legal regulations – is also not clearly defined, hindering understanding and effective implementation.

The changes in sentencing were not properly explained or justified to the public, or even to lawmakers in some cases, and some have also suggested that increasing the minimum sentencing guidelines limits judicial discretion too severely.

According to Ukrainian activists and NGOs, refugees and migrants from Ukraine, upon arriving in Poland, do not receive updated and comprehensive information on Poland’s security approach or policies, including the potential dangers emerging from hybrid threats and the punishments for carrying out hostile actions against the Polish state.

Despite moving in the right direction, there is still a lot to improve, especially in terms of informing society, state administration and different professional groups, like journalists or security experts, about at least some of the government’s motives, plans and general assessment of the situation, as well as explaining the goals of hostile actors, and the means they are using to achieve them.

A resilient society, first and foremost, needs to be a well-informed society that understands the threats it faces and trusts the state.

The other important response is creating deterrents that limit the risk of escalation to a full-scale war or reduce political will to engage in hostile activities, by imposing severe costs for hybrid operations. That could include freezing the financial assets of citizens of hostile states or expelling their diplomats.

The primary idea behind hybrid activities is that they are cost-effective and bring concrete benefits for the aggressor. The more resilient the society, administration and legal and systemic frameworks are, the less benefits there are for the hostile actors.

Notes from Poland is run by a small editorial team and published by an independent, non-profit foundation that is funded through donations from our readers. We cannot do what we do without your support.

Main image credit: kremlin.ru/Wikimedia Commons (under CC BY 4.0)

Adam Lelonek is an expert on information warfare and hybrid threats. He holds a PhD in political science and has previously worked at the International Republican Institute’s Beacon Project and lectured at the Maria Curie-Skłodowska University in Lublin. He is the co-founder and former president of the Center for Propaganda and Disinformation Analysis in Poland.