Russian spy games in Poland are legion--and dangerous

Spy games have almost become the norm.

In the first days of October the international media once again focused not only on drones, but also on Russia’s shadow fleet—but with the new twist being that a shadow-fleet tanker, the Boracay, had been used as a drone platform to “attack” various European cities a la an ongoing hybrid war against the Nato countries of Europe.

Two Chinese nationals, the captain and second captain of the tanker were reported to have been charged, following the boarding of the ship by French soldiers on Oct. 2. That arrest provoked the predictable outrage and anger among various leaders of the EU, and concurrently Polish Prime Minister Donald Tusk also referred to an “incident” near the port of Szczecin, adding that “these are Russian vessels, and in fact, we have new incidents in our region and in the Baltic Sea every week, almost every day."

Even so, the term—or maybe in fact due to said (and very predictable) outrage, the term “hybrid war” seems to have lost its true meaning—the very definition of the phrase underlying that these actually are acts of war, and that they are exceedingly dangerous.

As Poland’s leadership and security services well know—but we’ll get to that in a moment.

For first I should point out that even in Poland the general public seems to have become rather inured to shadow-fleet and drone episodes—and, surprisingly, following the drone incursion into Poland (where likely the real number of drones sent across the border was 21), the world’s attention span remains… short.

But at least the Poles (and Baltic statesmen) are trying, which can be seen with a closer look first at Tusk’s response to the Boracay and to the “incident” in Szczecin—but also at the shocking level of Russian-backed subterfuge that does indicate that, yes, “escalation” is already here.

“The attack or provocation involving drones was the most spectacular as far as the Polish side is concerned,” said Tusk on Oct. 2. “But in reality, we also have similar provocations every day on our border with Belarus.”

Lest there be any doubt, Tusk also stated that the war in Ukraine is “our war” while pointing out the additional near-constant provocations on the border of Poland and Belarus.

Those statements prompted a varied response in Poland. The on-line buzz ranged from expected anger directed at Russia to those questioning Tusk and wondering if “big talk” would not draw Poland into outright war. Personally, I have heard much the same. I known individuals in Eastern Poland who were both rattled by the infamous Russian drone incursion but also by the recent Zapad exercises in Belarus—and these Poles keep a backpack stuffed and ready in case the worst becomes reality. Others decry the forever reality of business perturbations, criticize Ukrainian President Volodymyr Zelenskyy and point to alleged local crime committed by Ukrainian gangs.

Yet somewhat oddly, both sides appear still tend to believe that “war is not yet upon us.”

And maybe—comparatively speaking--this is true. Ukrainians I know who have faced--and who actually are facing--real war (daily drone and missile bombardment, for example) may be hopeful for European support, but there has been a collective eye roll when it comes to the EU describing spy flights over ports as an “attack.”

(And don’t bring up the photo of a Nato F-35 with a “kill sticker” now pasted near the cockpit—for that was a drone. One drone shot down by an F35. Maybe one is better than none, but… yes, that eye roll is probably deserved. There are both Ukrainian and foreign fighters who have brought down drones with… shotguns. (And in fact, one of the most frightening stories I have ever heard was that of a soldier who, pursued by a drone, “shot it down” while it was coming in through the window of a shattered house. The blast left him and other soldiers deaf for a week—and even then they were forced to hustle for new cover, as it was assumed that the Russian operator had seen them (literally the whites of their eyes) and thus identified their position. Not saying a shotgun is better than an F35… but maybe the kill sticker is a bit much. )

But back to the point: it still appears that both sides criticizing the Tusk statement are missing the boat. For drones are only indicative. Far more damning are actual GRU-backed sabotage activities, which threaten or which have actually caused real damage and risk to life and limb in the EU.

This was brought home by an Oct. 2 piece published in Gazeta Wyborcza that revealed that the Polish Internal Security Service (ABW) had apprehended Wladyslaw G., who, working for Russian intelligence, was transporting explosives hidden in cans of corn, as well as drone parts and SIM cards—and possibly distributing them to a wider network in Poland, Lithuania and Germany.

In short, Russia planned “acts of terror” in a coordinated operation meant to do real damage—and this was no abstract conspiracy-- with Wyborcza reporting the cans of explosives in a cemetery in Lithuania.

No doubt Tusk, not to mention Polish Foreign Minister Radoslaw Sikorski, well understand the implications there. No longer can Russian actions in the EU be brushed off (not that they should have been) as “targeted assassinations or attempts to kill Russian defectors” a la that of Alexei Navalny, Sergei Skripal and Alexander Litvienienko (and lest we forget, GRU actually detonated ammunition dumps in the Czech Republic and Bulgaria beginning in 2014), but well-documented effort to map, cripple and target Polish infrastructure is now underway.

Yet if there are still doubts, keep in mind that Ukrainian, Belarussian and yes, Polish conspirators were nabbed while mapping and monitoring Polish railways three years ago (with at least two of those detained somehow managing to escape post-conviction but prior to a prison sentence). Then there are the cases that seem to have completely fallen under the radar, including a mysteriously detached train wagon in Silesia in early September on the Katowice-Katowice Ligota railway line that not only bogged down the railway lines, but was only avoided—along with a major disaster—by a skilled train conductor combined with lighter rail traffic at the time of the incident.

Yet there have also been alleged attempts to poison water supply, mysterious  cases of arson with the perpetrators and motives remaining “unknown” and what appears to be low-level recruitment of often poverty-stricken refugees or disillusioned youth of various nationalities.

But let’s bring the matter home, as a quick glance at the official list of ongoing Polish investigations going back only to 2024 government press releases should be enough to sober up even the most biased of sceptics (and yes, I did choose the word “sober” with intent).

Below is that list, as sourced from Polish National Prosecutor press releases.

• January 9, 2024 – the National Prosecutor’s Office noted the arrest of a female Belarusian citizen (Daria A.) as part of an investigation supervised by the Masovian Branch of the Department for Organized Crime and Corruption of the National Prosecutor's Office in Warsaw. The release noted that officers of the Internal Security Agency (ABW) actually detained the subject on Dec. 20, 2023. The investigation revealed that the woman was conducting espionage activities on behalf of the Belarusian secret service, and that she had been providing information to this service about members of the Belarusian diaspora and organizations of Belarusian and Polish nationality residing in Poland. Prosecutors at the time noted that the woman was facing 10 years in prison.
• February 6, 2024 –The Masovian Branch of the Department for Organized Crime and Corruption of the National Prosecutor's Office in Warsaw filed an indictment with the District Court in Warsaw against Janusz N., who was charged with espionage on behalf of the Russian Federation's secret services. Prosecutors determined that the accused had been conducting activities for the Russian Federation, which he intensified after his associate was detained on espionage charges. Janusz N., at the request of individuals working for Russian intelligence, established contacts with Polish and foreign politicians, including those working in the European Parliament, and engaged them in propaganda, disinformation, and political provocation activities. He received cash payments for the tasks performed. At the time he was detained he was noted to be facing up to 15 years in prison. Also, on March 28, 2024 – Prosecutors announced that on the previous day prosecutors conducted raids and seized EUR 48,500 and USD 36,000, with these amounts allegedly earmarked for pro-Russian activities in an investigation linked to Janusz
• May 29, 2024 - The Lower Silesian Branch of the Department for Organized Crime and Corruption, as well as ABW officers, detained three individuals in an investigation into activities for foreign intelligence agencies. Among the detainees included one Polish citizen and two Belarusian citizens. All were said to potentially face life in prison.
• May 12, 2024 – The market hall at 44 Marywilska Street in Warsaw burned, prompting an investigation by the Masovian Division of the National Prosecutor's Office, which within weeks had broadened to consultations with experts, the use of state-of-the-art methods and equipment such as drones and 3D scanners, and interviews conducted with some 200 persons. The fire was believed to have been started by arsonists paid by Russian agents.
• August 8, 2024 – The Podlaskie Branch of the State Security Committee (PZ PK) filed an indictment with the District Court in Białystok against Belarussian citizen Artsiom K., accusing him of unsuccessfully attempting to commit the crime of declaring readiness to act for a foreign intelligence agency.
• Sept. 7, 2024--ABW officers arrested a Belarusian citizen suspected of attempting to set fire to a facility located in Gdańsk.
• Sept. Oc13, 2024—Prosecutors working on behalf of the Lower Silesian Branch of the Department for Organized Crime and Corruption in Wrocław charged the suspect with participation in an international organized criminal group and committing acts of sabotage or terrorist offenses at the request of a foreign intelligence agency (Article 258 § 1 of the Criminal Code in conjunction with Article 130 § 7 of the Criminal Code). In short, this was arson yet again, and it goes back to January and May 2024 arrests of citizens from Poland, Ukraine, and Belarus – who were preparing to set arson at buildings in Wrocław and who also committed arson at buildings in Gdańsk, Gdynia, and Marki. The charges against the suspects carried a penalty of life imprisonment.
• Oct. 16—Ukrainian citizen Oleksander D. was convicted of incitement to espionage and was given two years and eight months in prison for “inciting a Polish citizen to participate in foreign intelligence activities against the Republic of Poland. Noteworthy is that he was also charged with making criminal threats against the same individual (Article 190 § 1 of the Penal Code).
• Oct. 10, 2024 - Serhiy S. was sentenced to three years' imprisonment for operating within an organized crime group and with undertaking sabotage activities in Wrocław (consisting of setting fire to buildings).
• Oct. 10, 2024—Warsaw prosecutors announced an investigation into foreign intelligence activities in Poland and other European Union member states through acts of sabotage involving damage to industrial facilities and critical infrastructure such as airports, aircraft, and vehicles, as well as arson through self-igniting courier parcels. This investigation was initiated on August 5, 2024, based on information obtained by the Internal Security Agency and was also being conducted in cooperation with the Civil Aviation Authority. Four individuals were charged and taken into custody, with prosecutors noting that the individuals sent parcels containing camouflaged explosives and dangerous materials via courier companies to European Union countries and the United Kingdom. These parcels spontaneously ignited or detonated during land and air transport. The group also aimed to test the transfer channel for these parcels, which were ultimately intended to be sent to the United States and Canada.
• Dec. 5, 2024—Prosecutors from the Lower Silesian branch of the Internal Security Agency (ABW) arrested Olgierd L. in Gdańsk, with the suspect charged with participation in an organized group aimed “at committing various crimes, particularly against health and life.” These included the setting of a restaurant on fire, arms trafficking, inciting the causing of serious bodily harm to another person, and inciting the assault of another person. Noteworthy was that during the investigation, it was also determined that other suspects linked to Olgierd L., in addition to sabotage crimes for the benefit of foreign intelligence agencies, also committed "typically criminal" crimes (assaults, arms trafficking, drug trafficking).
• January 10, 2025 - conviction of Laken P. (see below)
• January 2025 , the District Court in Warsaw, after reviewing the indictment filed by the Masovian Branch of the Polish Armed Forces (PZ PK), sentenced 18-year-old Canadian citizen Laken P. for the crime of participating in Russian intelligence activities against the Republic of Poland. Laken P. was charged with participating in Russian intelligence activities against the Republic of Poland by providing information to Russian intelligence services about the military potential of the Republic of Poland and persons serving in the Polish Armed Forces (Article 130 § 1 of the Penal Code). The charge covers the period from April 2024 to May 23, 2024. During the investigation, it was determined that Laken P. was recruited by an agent of the Russian Federal Security Service (FSB) and in May 2024, he traveled to Poland via Denmark to carry out activities ordered by the person in charge, including reconnaissance of military bases and establishing contact with Polish Army soldiers. Laken P. maintained contact with the person in charge via Telegram, and received payment for the tasks performed in cryptocurrencies. He also used a telephone and SIM cards for communication, which were seized and examined in the case.
• May 20, 2025—Masovian Branch of the Department for Organized Crime and Corruption in Warsaw prosecutors filed an indictment with the District Court in Warsaw against Paweł K., accused of declaring his readiness to act for a foreign intelligence service against the Republic of Poland (Article 130 § 3 of the Penal Code). Paweł K. was detained on April 17, 2024, in Poland. According to ABW findings, Paweł K. declared his readiness to act for the military intelligence service of the Russian Federation and established contacts with citizens of the Russian Federation who were directly involved in the war in Ukraine. His duties included gathering and disseminating information regarding the security of the Rzeszów-Jasionka Airport. These activities were intended to aid in the planning by Russian intelligence services of a possible assassination attempt on the life of a foreign head of state, i.e., President of Ukraine Volodymyr Zelenskyy. The subject faces eight years' imprisonment.
• March 12, 2025 – Belarussian citizen Stepan K. was charged with setting fire to a large construction store in Warsaw in April 2024, causing losses of PLN 3.5 mln. It was determined that the suspect was acting on behalf of Russian Federation's intelligence service. The investigation determined that on April 13, 2024, Stepan K. spilled a flammable liquid in the above-mentioned supermarket and left devices capable of remotely starting a fire. On the night of April 13-14, 2024, the device was activated, causing a fire. It was also determined that Stepan K. recorded his actions on his phone to document the act of sabotage. Some of this footage was subsequently published on Russian propaganda websites.
• May 12, 2025 –Two Ukrainian citizens, Daniil B. and Oleksander V., were charged with cooperating with other arsonists during the Marywilska 44 shopping center fire. The fire determined to have been committed by members of an organized criminal group acting on behalf of the Russian Federation's intelligence services. The group's goal was to set fires to large-scale buildings in European Union member states. This group was also deemed responsible for the arson attack on the IKEA store in Vilnius on May 9, 2024. In the Polish case, Danil B. took orders from Oleksander V., confirmed to be residing in the Russian Federation, to go to the vicinity of the Marywilska 44 shopping center in Warsaw and record the fire and the firefighting and rescue operations. The order specified the specific time on the night of May 12, 2024, during which the fire would break out. Oleksandr V. ordered Daniil B. to send him the recorded video to document the execution of the task and publish it on Russian propaganda websites. Daniil B. fully completed the assigned task.
• June 11, 2025 –The Masovian Branch of the Department for Organized Crime and Corruption of the National Prosecutor's Office in Warsaw charged Wiktor Z., a Polish citizen, with providing information to the intelligence services of the Russian Federation that could be harmful to the Republic of Poland. The subject was accused of “declaring his willingness to act for the intelligence services of the Russian Federation and conducting activities for it by collecting and transmitting information concerning […] the operation of facilities crucial to the defense of the Republic of Poland […]. These activities were to be undertaken from February 28, 2024, to April 30, 2025, in Bydgoszcz and abroad.
• July 29, 2025 – The Lublin Branch of the Department of Organized Crime and Corruption of the National Prosecutor's Office in Lublin stated it was investigating a citizen of the Republic of Colombia (Andres D. L. C. D. L. H.), suspected of setting fire to two construction warehouses in Warsaw and Radom in May 2024. It also established that on June 2, 2024, the suspect traveled from Poland to the Czech Republic, where on June 6, 2024, he set fire to buses at a bus depot in Prague. On June 8, 2024, he was arrested and remanded in custody in the Czech Republic. In June 2025, he was sentenced by a Czech court to eight years in prison for setting fire to a bus depot in Prague and planning to set fire to a shopping mall. He is currently serving a prison sentence in the Czech Republic. The investigation was said to have proven that the person commissioning, directly supervising, and financing the activities undertaken in Poland and the Czech Republic was an individual associated with the Russian Federation's secret services. Moreover, similar arson attacks had occurred in the Czech Republic, Lithuania, and Romania, and all incidents may have been inspired by the same individuals.
• August 13, 2025 – Prosecutors indicted six individuals over an “exploding parcel” operation, with Ukrainian citizen Kristina S., being the first named individual charged. Kristina S. was actually indicted first back on August 11, 2024. At that time prosecutors working for the Silesian Branch of the Department for Organized Crime and Corruption of the National Prosecutor's Office in Katowice filed an indictment with the District Court in Piotrków Trybunalski against Ukrainian citizen Kristina S., who was charged with participating in a group attempting to ship a parcel containing explosive devices and materials in the form of nitroglycol, as well as hidden military-grade electrical fuses. The parcel was discovered secured in a courier company's warehouse in Lodz. According to the investigation, Kristina S. was at that time said to have committed the crime together with a Ukrainian citizen and two citizens of the Russian Federation. Noteworthy is that a chemical expert from the Internal Security Agency's Forensic Research Office stated that, if the parcel had exploded, it would have been powerful enough to have caused significant damage to critical infrastructure by puncturing sensitive fuel tanks, building ceilings, or strong steel structures.
• August 18, 2025 – Lublin ABW officers announced that they had obtained evidence indicating that 27-year-old Belarusian citizen Vitaliy S., in July 2025, conducted surveillance on a warehouse facility located in the Lublin Voivodeship, filming and photographing the site and then passing this material on to representatives of a foreign intelligence agency. The agency said that the subject was detained on August 13, 2025, The statement read that the subject was preparing to commit arson, and that he eventually admitted guilt.

This seems like a lot—because it is. Important is that this list is actually incomplete, as, for example, the Polish press also noted the July 30 arrest of a “foreign intelligence officer working for an Asian state formed after the collapse of the Soviet Union,” who was arrested in Bydgoszcz by the ABW. The subject was noted as being a “career spy” who allegedly used a diplomatic cover in a European country to conduct espionage activities targeting Poland’s national security and allied military structures. He is now facing up to 30 years in prison.

Moreover, on Sept. 8, 2025, ABW, officers detained Belarusian citizen Uladzislau N., who was alleged to have conducted intelligence activities in Poland and Hungary, with the arrest coming as the the result of a lengthy operation conducted by the ABW in cooperation with Czech, Hungarian, Romanian, and Moldovan services. And on Sept. 9, at the request of the ABW, the Polish Ministry of Foreign Affairs withdrew diplomatic accreditation and requested that a diplomat from the Belarusian Embassy in Warsaw leave Poland.

Then there are the “little things”—such as the unknown purchasers of Polish SIM cards sued in the Russian drone incursion. And there are the bizarro twists and turns, such as the case of four Russian spies, nabbed in Poland, who have now requested asylum in order not to be deported back to the mother land.

And how much is missed? How many plotters are still on the loose, ready to burn down warehouses, derail trains or worse. This is hard to say, but a safe guess is that… nobody knows.

Only there can be no doubt. Russia, albeit mostly through badly paid amateurs, is waging war against Poland, the Baltics… literally anywhere that could be deemed a soft target.

Or in other words, politics aside and naysayers be damned, there has been no exaggeration here. Polish Primer Minister Donald Tusk is right.

Preston Smith is a licensed investigator based in Gdansk, Poland. He can be reached at query@cddi.pl.

Photo: Visualation of drones in Polish airspace on Sept. 9-10. ППО радар - monitorwar; mon1tor_ua, CC BY 4.0 <https://creativecommons.org/licenses/by/4.0>, via Wikimedia Commons