Russia’s Would-Be Assassins Still Stalk Europe’s Streets

Natalia Arno returned to her hotel in Prague in early May to find that the door to her room had been left ajar and a sickly sweet smell filled the air. A Russian democracy activist who was forced into exile in 2012, Arno is no stranger to surveillance, so she immediately checked the room for listening devices before heading out to a meeting. 

The next morning, shortly before dawn, she awoke with a searing pain in her mouth. Fearing she was on the brink of a dental emergency, Arno—president of the Free Russia Foundation—quickly packed and booked a flight back to the United States the same morning.

As the plane soared over the Atlantic, something strange began to happen. “The pain started to wander all around my body,” she said. It was under her armpits, then it was in her eyes, her chest, her ears, her stomach. A terrifying numbness began to spread down her spine. 

“If I had even the slightest suspicion that it was a poisoning, I would have stayed in Prague and gone to the clinic there,” Arno said. The FBI is investigating the suspected poisoning, Arno said, but she has yet to receive an answer as to what caused her sudden illness. In Germany, a second Kremlin critic, Russian journalist Elena Kostyuchenko, also fell ill after a suspected poisoning last October. Prosecutors in Berlin are investigating the incident as an attempted murder. 

Russian spies have had their wings clipped in the wake of the country’s full-scale invasion of Ukraine in early 2022. Over 400 Russian intelligence agents operating under diplomatic cover at the country’s embassies were expelled from Europe as part of an unprecedented and coordinated effort intended to hamper Moscow’s malign activities on the continent. The head of Britain’s domestic counterintelligence agency (MI5), Ken McCallum, described it as “the most significant strategic blow against the Russian intelligence services in recent European history.”

What are still operational, as the suspected poisonings of Arno and Kostyuchenko suggest, are Russian kill teams, dispatched to liquidate state enemies. Or try to.

Russia’s resident spies—who are stationed at embassies under official cover—are largely drawn from the country’s foreign intelligence service, the SVR. They would principally be focused on the lengthy process of recruitment—cultivating assets in European governments and institutions—and handling existing moles. The wet work, as assassinations are referred to in the slang of the Russian intelligence services, has typically been run by military intelligence, the GRU, operating deep under cover. 

“What the expulsions really degrade is the Russian ability to recruit, not the Russian ability to kill,” former CIA officer Marc Polymeropoulos said. 

High-stakes operations such as assassination attempts, coup attempts, and sabotage have been traced by investigative journalists to the elite GRU unit 29155, trained in the dirtiest tricks from sabotage to poisonings. Operatives from the unit were exposed by the investigative group Bellingcat as being behind the Novichok poisoning of former Russian spy Sergei Skripal in Salisbury, England. The officers involved flew into the U.K. for just two days to carry out the attempted assassination, though they claim to have found time to see the famed cathedral.

Unit 29155 was dealt a substantial blow in recent years as journalists discovered they had been traveling on passports with similar numbers, making them easy to identify in databases of leaked flight records. “Because the Russians don’t know how many were exposed, they have to assume that a whole generation was exposed,” said Christo Grozev, head of Russia investigations at Bellingcat. 

But the ouster of hundreds of Russian spies operating under official cover has not been without impact. It has forced Moscow to rely more heavily on its sleeper agents for observation and information-gathering operations, Grozev said. “When you lose the coordination centers, the embassies, then these sleepers feel a bit naked. They have to reinvent tradecraft, and they get burned much easier,” he said. That, plus an increased effort on the part of European intelligence agencies, has seen suspected sleeper agents working for Russia exposed in the United Kingdom, Greece, Norway, Albania, the Netherlands, Germany, and Sweden since the invasion of Ukraine last year.

Russian spies have long operated with a freer hand in Europe than in the United States. “We’ve been complaining about the Europeans—about a lack of action against the Russians—forever,” Polymeropoulos said. 

Basing intelligence operatives out of an embassy is nothing new—most countries take advantage of their diplomatic presence in this way, to the full knowledge of the host nation. 

While European leaders were well aware that Russian embassies were dens of spies, it was a political calculus to leave them be. That has changed since the invasion of Ukraine.

In Germany, long a playground for Russian intelligence, the government has belatedly placed new emphasis on tackling Moscow’s spies, said Stefan Meister, an expert on Russia with the German Council on Foreign Relations, who noted that it wouldn’t happen overnight. “Germany is so late in building up intelligence to counter Russian activities in Germany. This is not something you build up in a couple of weeks or months.”

The expulsions and increased scrutiny have also forced Moscow to change its tactics. In its annual report, Lithuania’s intelligence service noted that the intensity of Russia’s human intelligence operations had waned since the expulsions, but that Europe would remain a prime target. “[W]e are almost certain that Russian intelligence devoid of capabilities to operate under diplomatic cover will search for opportunities to exploit other intelligence gathering methods: cyber, non-traditional cover, online operations,” the agency said in a statement to Foreign Policy. 

In a bid to stymie the flow of Western weapons through Poland into Ukraine, Moscow attempted to recruit cash-strapped Ukrainian refugees via the social messaging app Telegram to conduct surveillance, with plans to carry out arson attacks and an assassination, the Washington Post reported. “This is completely new,” Grozev said of the change in tactics. He also noted that Russian intelligence had begun outsourcing surveillance activities to organized crime groups in Europe.

This could lead to more Russian intelligence activity being exposed, Grozev said, but also more collateral damage. “When you outsource to nonprofessionals, to organized crime, they make their own calls,” he said.