It's still early on this Saturday 1is June. The French capital has just woken up, but there is already activity near the Eiffel Tower. They're not tourists, though. A white van goes back and forth along the Quai Jacques-Chirac. Inside, Mahmud H. (name changed) and two other men. Parking is prohibited on this multi-lane street which passes right in front of the Eiffel Tower. However, the three men absolutely want to stay in the area with their vehicle, they have a mission to accomplish.
The van ends up stopping right in front of the Eiffel Tower, despite the parking ban. Mahmud H. and the others get out and place their cargo on the sidewalk: five coffins, each covered with a French flag, as for a national funeral, and bearing the inscription “French soldiers of Ukraine”. As if they were French people who fell on the field of honor in Ukraine. The images of the operation will subsequently make the rounds on Russian messaging service Telegram.
Police officers observed the scene – their account is in a police report that we were able to consult – but the men and the vehicle disappear before they can intervene. This strange operation sows excitement among the Parisian police. The Olympic Games are coming soon, the country fears attacks. Police are searching for the vehicle and the men. She quickly found the vehicle and its driver, a 39-year-old Bulgarian. Mahmud H., a 25-year-old Berliner of Palestinian origins, and a 16-year-old Ukrainian were arrested in the afternoon as they were preparing to take a FlixBus to Berlin.
All three are taken into custody, their cell phones examined. The police are quickly convinced that they have come across three representatives of a new type of spy in the pay of the Russian secret services. A type of spy that all security bodies in Western Europe have been facing for some time. There is in fact nothing orthodox about these agents: they are amateurs not trained in intelligence, poorly paid and assembled more or less arbitrarily.
Single-use spies
On the night before the coffin operation, the driver had come from Sofia in the vehicle rented in Bulgaria. The other two men came from Berlin. None of the three was known to German or French security services. Mahmud H. later told us that he had participated in the operation to protest the war in Ukraine, but this is unlikely. The three men are unemployed. According to the investigation, they did not know who their sponsor was or what he was targeting with this operation. For them, money was all that mattered.
Men like them are a nightmare for the security services: they have never appeared on their radars, are not politically active and certainly not known as spies. Previously, the security services knew Russian diplomats who were only ostensibly cultural attachés or embassy collaborators and in fact worked for the secret services. Many of them have been expelled from most European Union countries [UE]and the Kremlin has clearly found new ways to recruit agents.
The confidential conversations we had with members of the secret services of several countries give an image of this new method of recruitment. Russia now finds its saboteurs on Telegram, Instagram or TikTok. Its secret services are looking on the Internet for young, enthusiastic people who are not yet “on the right track”, to use the words of a member of the German security services.
Known cases allow us to define a model. Things always start small: you want to win 5 dollars [4,60 euros] in cryptocurrency? What if you made a tag? Could you take a photo of such a place for 100 euros? The first mission accomplished, others follow, better paid and more risky. And if someone like Mahmud H. gets caught, the sponsors hardly suffer. The German intelligence services therefore speak of low level agents [“agents de bas niveau”] or from single use agents [“agents à usage unique”].
Disinformation and fires
These disposable agents led by Russia have been operating in Western Europe for months. They constitute one of the elements of the hybrid war that Vladimir Putin is waging against the West. They spray red hands on the Holocaust memorial in Paris, they brandish signs against NATO or the Ukrainian struggle in demonstrations that have nothing to do with it, or they place fake coffins.
Like Putin's army of trolls on social networks, these auxiliaries are recruited to leave their messages on the streets of the West. These operations seem insignificant, but their accumulation has an effect. They spread disinformation, sow doubt, the feeling that something is wrong. And these are not the only missions for which these auxiliaries are called upon.
Andrés Alfonso de la Hoz de la Cruz is 26 years old and comes from Ciénaga, a town in northern Colombia. After school and military service, he began working in agriculture and a quarry, but clearly dreams of a better future. One day, while on a Telegram group devoted to potential jobs abroad, a Russian asked him if he wanted to work in Europe. The man is ready to finance his trip. De la Hoz agrees, he goes to Spain, then to Poland.
The Russian shows up again. He asks him to photograph a Polish arms factory for 5,000 zlotys, approximately 1,100 euros. The young Colombian complies. His handling officer tells him that he has passed the test and immediately gives him his next mission: he must go to Prague and set fire to buses parked on a site. The Russian intermediary tells him that the owner of the vehicles wants to defraud his insurance. The remuneration is 3,000 dollars [environ 2 800 euros]. What De la Hoz doesn't know is that the site is actually a bus depot for the DPP, Prague's local public transport network.
On the night of July 7 to 8, the Colombian entered the scene and set fire to two buses before being discovered by a security service employee. She manages to put out the fire, he manages to escape. The police issued a search notice and quickly found him. De la Hoz has since been imprisoned in the Czech Republic, facing conviction for terrorism and up to twenty years in prison. The investigation showed that another man had previously been recruited by Russians to photograph the depot – probably to prepare for the attack.
A well-oiled operating procedure
Sergejs Hodonovic found himself in court in Riga, Latvia. According to the trial documents, this young Latvian had also been lured by small jobs on Telegram. The first took him to Tallinn, Estonia. With another young man, he must tag the inscription “Killnet hacked you” [“Killnet vous a hackés”] on a wall. Killnet is the name of a group of Russian hackers, but the phrase means nothing to young people. They don't know that the wall is part of NATO's cyber defense center in Tallinn. Nor that the center is at the same time the target of an attack by Russian cyber troops. The next mission is to spy on the Latvian Air Force airfield in Lielvarde. But this time, Hodonovic gets caught.
The Latvian authorities manage to identify its sponsor. It is a young Latvian, who declares during his interrogation that, at the request of a certain “Alexander”, searched for and recruited people like Sergejs Hodonovic on the Internet, then gave them missions. For each successful mission, he received a commission, 200 euros for photos of the military airfield, for example. The only condition: the disposable agents must not be Russian nationals. He understood that he was working for the Russian services. The missions he assigned included starting fires. And there have been a few in Europe.
Late last year, for example, a paint factory burned down in Wroclaw, Poland. Polish authorities arrested a young Ukrainian in January whom they accuse of having been paid by Russian secret services for the attack. In March, a Ukrainian company's warehouse burned down in north-east London. Five Britons are under investigation for arson. They would have acted for the Russian secret services.
In May, a fire broke out at a factory of the arms manufacturer [allemand] Diehl. The matter has not yet been clarified, but the American intelligence service has clues pointing to an attack sponsored by Russia. German security services neither confirm nor deny. However, “it is now almost unimportant”, according to them, because the effect is already excellent from the point of view of Russian propaganda: investigators, intelligence services, the media and the population are speculating on the possibility of a Russian origin, and this is exactly what Russia is looking for – sow doubt in Western society.
“Divide society”
According to a member of the German security services, the Russians are testing how far they can go with their disposable agents.
“It’s a strategy that could go much further.”
Several signs point in this direction. Latest case: the sending of incendiary bombs by plane. So far the consequences haven't been too serious, but these nice packages were obviously set to explode in mid-air. Several of these bombs have been discovered, including two in Germany. One set fire to a container in the DHL logistics center at Leipzig airport. A suspect has been arrested in Lithuania, he is suspected of having acted for the Russians.
In 2015, the coordinator of the German government's secret services set up a working group bringing together the homeland security services and the intelligence services to deal with the hybrid war led by Russia. In 2016, the group presented a “common situation picture” confidential which shed light on Moscow's propaganda, disinformation and psychological operations. The services already judged at the time that Russia considered itself “in open conflict with the Western world”. She tried to “reinforcing divergences within the EU” and of “divide German society”.
Things are clearer today, and Western security services are cooperating more and more closely to combat this challenge. In Germany, a working group called “Hybrid” and composed of members of various security bodies meets once a week in the basement of the intelligence services to review possible new cases.
And there are very many of them, according to the participants. The mass of operations suspected of having been sponsored by Russia already poses a problem, because it consumes considerable resources within the police and intelligence services. And the authorities are far from seeing everything despite their efforts.
For example, they only learned of the existence of Mahmud H. when we questioned them. Its sponsor, whom the French police were able to identify, was not known in Germany either. Expelled by France, Mahmud H. is back in Berlin. It's not easy to find. His family says they don't know where he is. We repeatedly try to message and call him. He sometimes answers the phone, but he doesn't want to talk about his business anymore. He only adds one thing: after the Paris operation, he already had another mission, he had to go to Prague.
Related News :