Estonia demonstrates how all European countries must handle Russian sabotage
It’s not like in the movies. European publics need to better understand the reality of recruitment by foreign intelligence services. That means being as transparent as possible when more cases are uncovered.
Estonia’s internal security service, known as KAPO, has publicly attributed an arson attack in August on local defence company Milrem to Russia’s security services.
In the process, they’ve demonstrated how all European countries can up their game on this collective threat that - despite the impression you might get from some media reporting - definitely does not just affect Estonia or the Baltics.
Attribution of the Milrem Arson Attack to Russian Security Services pic.twitter.com/OwZq9CQwdf
— Kaitsepolitseiamet (@kaitsepolitsei) September 29, 2026
It’s always been a pan-European challenge
A study published in 2022 by Sweden’s Defence Research Agency did find that Estonia accounted for a whopping HALF of all publicly recorded espionage convictions in Europe between 2010 and 2021, while the three Baltic countries together accounted for almost two thirds.
However, they explained that the Baltics also have a keen understanding of the threat and there a lot of good reasons to think they are particularly effective at counter-intelligence.
That includes “…new and effective legislation, strong ability to identify and convict spies, and the political will of Baltic and Polish leaders to prosecute and publicise them, rather than sweep them under the rug.”
They are critical of the wider European response, explaining that “anecdotal evidence suggests that archaic legislation, political considerations, and lack of trust from other European intelligence agencies, may all occasionally have hampered the [counter-intelligence] response [elsewhere].
Most alarming is the fact that “Belgian legislation makes it particularly challenging to prosecute espionage cases, in spite of the allegedly large threat in Brussels.”
Unlike elsewhere, for example, those accused of espionage can bargain an agreement, which has been key to settling all 20 espionage trials in Estonia since 2007.
“Hence, the geographical concentration of cases should not be interpreted to mean that the Baltic countries and Poland are by far the most highly prioritised collection targets for Russian and other services.”
That is especially true now, as Russia seeks to escalate its so-called hybrid attacks across Europe.
As stated by KAPO, “the modus operandi of the Milrem attack is consistent with other acts of sabotage carried out in Europe on behalf of Russia”.
Estonia’s response
In its statement, KAPO confirmed the suspects are in custody and under investigation as part of ongoing criminal proceedings.
The statement clearly attributes the attack to Russia, explains the motive “to undermine support for Ukraine among European allies and to support Russia’s ongoing military aggression against Ukraine”, and adds the context that all European countries face increased attacks of this nature.
“KAPO and its partners have identified and apprehended more than 20 individuals involved in kinetic attacks carried out on behalf of Russian security services,” it says.
“Individuals recruited for such operations may be misled or manipulated and may be given false or fabricated justifications for their actions in an effort to conceal the involvement of the Russian state,” explained KAPO.
The wider response from Estonian officials was swift. Foreign Minister Margus Tsahkna outlined how attacks of this nature only increase support for Ukraine, while messages of support quickly came in from allies.
Russia’s attempts to divide, intimidate and sow confusion will fail.
— Margus Tsahkna (@Tsahkna) September 29, 2026
Every act of sabotage only strengthens Allied resolve, increases pressure on Russia and reinforces support for Ukraine.
We will continue to expose, deter and respond. No stone will be left unturned. https://t.co/JfdSbAUGi1
Sunlight is the best disinfectant
Most countries have long assumed by default that you have to keep any spying issues on the down low. That is clearly outdated.
Estonia not only pursues criminal convictions, but proudly publicises them. Repentant recruits willingly give media interviews from custody even, like this great feature by Michael Weiss in the Atlantic on the case of Deniss Metsavas.
It means other potential recruits aren’t just aware of the consequences. They are aware of the tactics that could be used to groom and exploit them.
It’s not like in the movies. Some suave guy in a trench coat is not going to ask you openly to betray your country.
In reality, you might just think you’ve managed to get a bit of easy work. You usually wouldn’t know it was for an adversary of your country. It starts small, usually with very pointless tasks, and builds incrementally. This is classic grooming. They want you to feel “in too deep” before you ever make a conscious choice about it.
In the case of Metsavas, for example, he was relieved that his first task was so incredibly easy and only involved providing information that could easily be found on Wikipedia. Instead of reporting it, he just passed the information to his handlers thinking no harm could be done with something so basic.
But his handlers weren’t interested in that information they asked for. They just wanted to make him feel there was no turning back before then asking him to do more serious stuff. The boiling frog analogy comes to mind.
How many people across Europe understand that tactic? How many politicians, journalists, and others in particularly vulnerable roles could recognise attempts to compromise them? It’s way, way too low.
The difficulty of tackling any kind of scam is the widespread perception that it would be so obvious that it could only happen to other people. When we think of spy recruitment through Bond films, we make ourselves more vulnerable to the reality of it.
That’s why the transparency is now so important, especially as the adversary increasingly shifts from espionage to sabotage, and acts in increasingly desperate, haphazard ways.
As for those being recruited, no one should ever feel they are in too deep nor that help isn’t available. KAPO tells people clearly: Come talk to us before we come talk to you.
Other countries must now adopt this full approach. Fortune favours the prepared, as the European Correspondent reports from Estonia this week.
Ben Bathke
As with Narva, this again shows that a lot of concern for Estonia and the Baltics is not as useful as learning from their approach while recognising this affects all countries.
