Russian hostile activity costs the UK at least £2 billion annually, according to a recent report by Scottish MP Graeme Downie, who has called on the government to measure what these actions cost Britain. But this figure is just the baseline. In reality, a profound shift in Moscow’s approach to sabotage means the true cost is set to climb higher.

While Russia still draws on its cold war target lists, ranging from critical transit nodes and military sites; to energy and communication infrastructure; it has traded highly trained operatives for cheap technology and expendable recruits. The switch to a quantity-over-quality model presents a much more volatile threat.

This model borrows from the logic of distributed computing. It uses networks of cheap, unreliable parts where individual breakdowns are expected yet the overall system still gets the job done.

By generating a high volume of low-cost operations that often fail at the individual level, Moscow still achieves its objectives of causing outsized psychological disruption and steadily exhausting western security services.

This operational transformation surged after Russia’s full-scale invasion of Ukraine in 2022. Within months, over 400 Russian intelligence officers operating under diplomatic cover were expelled across Europe. This number has since climbed to more than 700.

The mass purge was expected to cripple Russia’s spy networks. But it instead accelerated Moscow’s pivot towards what research I carried out with colleagues in 2024 defined as “gig-economy” operatives.

In place of declared “diplomats” well known to local counterintelligence officers, operations have been outsourced to disposable proxies recruited for a pittance. These people are often unaware of who their handlers are or their mission’s real goals.

This new campaign brings to life former CIA chief James Woolsey’s 1993 description of the post-cold war security landscape as a “jungle of venomous snakes”.

Gig-economy operatives

Recruited on messaging apps and paid in cryptocurrency, gig-economy operatives have been tasked with arson and other property damage, beatings, kidnappings and assassinations. This includes assassination plots on US soil in a stark breach of cold war conventions.

While many of these plots have been amateurish, the intent behind them and their potential damage is real. Blurring the lines between theatrics and physical damage, the campaigns have included mock coffins placed beneath the Eiffel Tower and graffiti designed to stoke antisemitic tensions across Paris.

Arson targets have ranged from a warehouse in London storing aid for Ukraine to an Ikea store in Lithuania and a paint factory in Poland. Western intelligence also narrowly averted catastrophe in 2025 when incendiary devices planted on DHL cargo planes caught fire in freight depots on the ground rather than mid-flight.

Beyond commercial property, Moscow’s campaign has targeted critical infrastructure. At sea, the playbook has escalated from plausible deniability to overt military posturing. Since 2023, Russian-linked commercial vessels flagged from China to the Cook Islands have repeatedly severed power and data cables by dragging their anchors across the seabed.

The Russian authorities have backed this with hard power. This has ranged from scrambling fighter jets to deter Estonian authorities from approaching a suspected vessel in 2025, to deploying intelligence ships and submarines close to western lines.

A parallel escalation has unfolded in the air. Operations began with electronic interference and drone surveillance disrupting commercial aviation, as well as probing European military bases and transport hubs to test air defences and map blind spots and vulnerabilities.

They have since graduated to overt airspace violations by Russian military aircraft and missiles, while armed drones have repeatedly crashed or detonated in Polish, Latvian and Moldovan territory.

This pattern crossed from deniable sabotage into a direct physical attack in August 2026 when an explosives-laden drone crashed into the wing of a parked Ukrainian cargo plane at Leipzig/Halle Airport in Germany. The device failed to detonate, averting a major explosion on an aircraft that had previously transported military ammunition.

The incident exposed not only Moscow’s escalatory ambitions, but also the sharp decline in professionalism within Russian intelligence. Rather than the elite officers cold war doctrine called for, the Russian intelligence handler relied on amateur recruits, who botched the job.

Yet for Moscow, operational failures are almost as useful as successes. A botched strike still generates media panic, exhausts European security services and projects a menacing shadow far beyond Russia’s real capabilities.

Moscow’s cyber campaigns

The same logic underpins the Kremlin’s cyber campaigns, where merely threatening critical infrastructure is often enough to achieve intimidation. Cyberattacks on a Norwegian dam and a Swedish heating plant, both in 2025, caused negligible physical damage. But they generated alarming headlines and have had psychological effects.

Also in 2025, a cyberattack on a major Polish power and heating plant threatened to cut heat to half a million people during winter. Even though blackouts were avoided, the destructive potential was impossible to ignore.

In cyber operations, as in physical sabotage, the perpetrators range from opportunistic proxies like the pro-Russian hackers in Sweden to elite hacking units directed by Russian intelligence in Poland.

Across domains, Russia has turned unpredictability and disruption into its strategic weapon of choice. Using expendable, poorly trained proxies directed remotely by state handlers consistently achieves psychological disruption while narrowly averting casualties through operational failure.

However, relying on Russian incompetence to protect European lives cannot hold. As the old maxim goes: hope is not a strategy.