Present danger, prevention, counterintelligence, and implications for the United States
Key Judgments
Russian intelligence services are still actively recruiting agents in the West. All intelligence services recruit. The danger is that Moscow has shifted from classical espionage toward a cheaper, more deniable, more socially corrosive model of human intelligence collection, coercion, sabotage preparation, and influence operations embedded inside Western civilian life.
This estimate judges with high confidence that Russian services are adapting to the loss of traditional diplomatic cover in Europe by using refugees, criminals, online intermediaries, ideological sympathizers, financially stressed civilians, minors, and diaspora vulnerabilities as substitutes for professional case officers.
Norway is now a useful warning case, not an isolated anomaly. The Norwegian Police Security Service 2026 threat assessment warns that Russian intelligence and security services are trying to recruit Ukrainian refugees in Norway to provide information or carry out unlawful activity, including through pressure connected to relatives or property in Russian occupied areas of Ukraine.
Reuters reported that Norway expects increased Russian espionage in 2026, especially in the Arctic, against military targets, allied exercises, energy infrastructure, and Norwegian support to Ukraine.
The operational pattern is not subtle. Russia is treating the West as a theater of continuous conflict below the threshold of declared war.
The method is not one big spectacular act.
It is a thousand small cuts:
Photographing a base
Mapping a port
Identifying a cable landing station
Watching an arms shipment
Flying a drone near a logistics hub
Amplifying a divisive narrative
Pushing a vulnerable refugee into a compromising first act.
German authorities call some of these recruits disposable agents: low level, untrained people recruited through social media, messaging apps, or intermediaries to carry out espionage, sabotage, arson, vandalism, surveillance, propaganda tasks, or reconnaissance for small payments and often without understanding the sponsor.
For Western counterintelligence, the implication is clear. The front line is no longer only inside embassies, military installations, classified networks, defense contractors, or intelligence services. It is also in refugee support offices, schools, ports, repair yards, social media feeds, Telegram channels, university labs, trucking companies, shipping brokers, energy substations, and the informal economies where desperate people look for money, status, revenge, protection, or belonging.
For the United States, the European pattern should be treated as warning intelligence.
The FBI identifies hostile intelligence threats as including espionage, foreign influence operations, transnational repression, sanctions evasion, and illegal procurement of sensitive technology. The ODNI 2026 Annual Threat Assessment warns that adversary cyber operations include espionage and pre positioning for possible attacks against U.S. networks and critical infrastructure.
The Strategic Frame
The question is what the new recruitment pattern signals about Russian strategy after the Ukraine invasion.
Before 2022, Moscow relied heavily on a familiar mix of embassy based officers under diplomatic cover, illegals, cyber units, oligarchic networks, organized crime relationships, front organizations, energy leverage, kompromat, and influence operations.
That architecture did not disappear.
But the mass expulsion of Russian diplomats from Europe after the full scale invasion sharply reduced Moscow ability to operate through traditional stations. Western security services also became more aggressive in watching Russian facilities, freezing assets, disrupting procurement networks, and exposing cyber and influence operations.
Russians Target MICE: Money, Ideology, Coercion/Compromise, Ego/Excitement
Russia responded as Russian services usually do: by improvising, decentralizing, and pushing risk down to weaker people. This is not operational genius. It is imperial habit applied to modern technology. The Kremlin treats human beings at the edge of its power as usable material.
Ukrainian refugees are useful because many have family under occupation, property in occupied territory, unresolved status, financial strain, emotional trauma, language connections, and legitimate access to communities, aid systems, transport corridors, and public spaces that a Russian diplomat can no longer approach safely.
This creates a counterintelligence problem that is morally and operationally difficult. The intended targets of Russian pressure are often victims before they are suspects. A Ukrainian refugee approached by a Russian service may be threatened, manipulated, blackmailed, or deceived. A serious Western response therefore has to protect the individual while defeating the hostile service. Criminalization alone will fail. Compassion without vigilance will also fail.
What PST Is Really Warning About
The PST warning on Ukrainians in Norway matters because Norway is not a random target. It is a NATO member, a major energy supplier to Europe, a key observer of Russia northern military posture, a gateway to the High North, and a state with growing allied presence after the war in Ukraine.
Its geography puts it near Russia Northern Fleet and strategic bastion around the Kola Peninsula. Its infrastructure matters to European gas security. Its territory and waters matter to NATO reinforcement, surveillance, undersea awareness, and Arctic competition.
PST is not describing an ordinary espionage problem. It is describing an adaptive Russian method after loss of operating space.
The 2026 PST assessment notes concern that Russian intelligence and security services are trying to recruit Ukrainians in Norway for information or unlawful acts, with pressure linked to family members or property in Russian occupied areas.
Norwegian reporting by VG described a case in southern Norway in which Russian services allegedly had detailed knowledge of a Ukrainian person background and applied pressure for tasks related to Norwegian defense and emergency preparedness.
That last detail is important.
Defense and emergency preparedness are not only secrets. They are systems. Moscow wants to know how Western societies mobilize, communicate, supply, reinforce, repair, evacuate, respond, and reassure. Russian services are not merely looking for one classified document.
They are mapping the nervous system of allied resilience.
Why Russia Has the Hubris to Recruit Ukrainians After Its Atrocities
On the surface, Russian recruitment of Ukrainians after years of atrocities appears absurd. Why would Ukrainians cooperate with the state that invaded, shelled, occupied, tortured, deported children, destroyed cities, and tried to erase Ukrainian sovereignty?
The answer is that Russian services do not need admiration. They need leverage:
The Russian security tradition is less sentimental than Western observers often imagine. It assumes fear, not consent, can produce cooperation. It assumes people under pressure can be broken into small compromises. It assumes moral disgust can be overwhelmed by concern for a mother in occupied territory, an apartment deed in Mariupol, a brother at a checkpoint, a child needing documentation, or the need for cash after displacement.
The recruitment pathway is often not a dramatic first meeting with a spy.
It can begin as a message from someone who appears friendly, helpful, patriotic, or commercially harmless.
Then comes the small task:
Take a photo
Confirm a location
Attend a meeting
Forward a name
Watch a shipment
Identify a Ukrainian activist
Translate a message
Post a narrative.
Once the target complies, the service has the first hook. The act may be minor, but the psychology changes. The handler can imply exposure, shame, legal risk, or harm to family. A one time favor becomes pressure.
The hubris comes from four Russian assumptions:
1. First, Moscow assumes the West is morally constrained and slow.
2. Second, it assumes diaspora communities are too large and too politically sensitive for intensive monitoring.
3. Third, it assumes Western societies will hesitate to discuss recruitment risks for fear of stigmatizing refugees.
4. Fourth, it assumes Russia can use victims of its war as instruments of the same war and still deny responsibility.
That is not merely intelligence work. It is the continuation of atrocity by administrative means. The same logic that treats Ukrainian territory as recoverable imperial space treats Ukrainian people abroad as exploitable imperial residue.
The Wider European Pattern
Norway is one piece of a larger European pattern. German authorities warned in 2025 that Russian intelligence services were using social media and intermediaries to recruit low level or disposable agents for espionage and sabotage.
The Federal Criminal Police Office, working with Germany domestic, foreign, and military intelligence services, warned that recruits may conduct crimes for small payments and may not know who ordered the task or why. Investigations cited in public reporting have involved arson, property damage, drone activity, and unauthorized surveillance.
Germany later summoned the Russian ambassador over what it described as increased hybrid threats, including sabotage, espionage, cyberattacks, and election interference. Reuters and the Associated Press reported that German officials linked some hostile activity to GRU connected APT28, also known as Fancy Bear, and to influence campaigns using deepfakes, fake journalism, fabricated evidence, and pseudo media platforms.
The Center for Strategic and International Studies has described Russia campaign as a shadow war against the West, assessing that Russian sabotage and subversion attacks in Europe nearly tripled from 2023 to 2024 after quadrupling from 2022 to 2023.
The International Institute for Strategic Studies likewise assessed that public reporting showed dozens of sabotage, espionage, and vandalism incidents against NATO related infrastructure in early 2025, including plots against logistics networks and suspected sabotage against telecommunications infrastructure.
These data points should not be read as separate scandals.
They are the outline of a doctrine.
Moscow is probing Western response thresholds. It wants to impose costs for supporting Ukraine without triggering an Article 5 military response. It wants to keep Western societies anxious, divided, legally overloaded, and politically distracted. It wants police and intelligence services chasing many small fires instead of one visible front.
Russian Recruitment Compared With MI6 and the BND
All serious intelligence services recruit human sources. MI6 recruits. The BND recruits. The CIA recruits. Human intelligence remains necessary because satellites, cyber collection, open source analysis, and signals intelligence cannot fully reveal intent, fear, factional struggle, corruption, private doubt, battlefield morale, or leadership psychology.
The difference lies in target set, method, legal framework, and political purpose. MI6 public messaging since the Ukraine war has openly encouraged Russians with access to secrets and a conscience to contact British intelligence. In 2025, MI6 launched a dark web portal, Silent Courier, to allow potential informants to contact the service securely from Russia and elsewhere.
Reuters reported that the system was designed to receive secret information from people in Russia and around the world.
The Chief of SIS, Blaise Metreweli, said in her first public speech that Russia was operating in the grey zone below the threshold of war and warned of sabotage, cyberattacks, drones, disinformation, and coercive activity directed at Europe in the official SIS speech.
That is espionage, but it is not the same as recruiting refugees by threatening family members in occupied territory or using low paid amateurs to commit sabotage while hiding the sponsor. Western services recruit foreign nationals to obtain intelligence against adversary governments.
They also operate under domestic law, parliamentary oversight, ministerial authorization, judicial constraints in some areas, and political accountability when operations go wrong. Those controls are imperfect, but they are real.
The BND, as Germany foreign intelligence service, also collects abroad against hostile state threats. But Germany public response to Russian disposable agents has been defensive and civic: warn the population, identify recruitment methods, protect citizens from being used, and impose criminal consequences for espionage or sabotage. German authorities are not telling refugees to threaten relatives in Russia. They are warning people not to become cutouts for a hostile service.
There is no moral equivalence between intelligence recruitment aimed at exposing an aggressive state war machine and coercive recruitment aimed at exploiting war victims to attack the societies protecting them.
The West should be candid that it conducts espionage.
But candor should not become false symmetry. The relevant comparison is not whether both sides recruit. The relevant comparison is whether recruitment is directed at government secrets and lawful national defense objectives, or at coercion, sabotage, intimidation, and the weaponization of displaced civilian communities.
Prevention: What Western Societies Must Do
Prevention has to begin before the first criminal act. The central insight is that Russian recruitment operates through vulnerability. Western governments therefore need a prevention model that combines counterintelligence, community protection, public education, digital safety, and rapid reporting:
First, refugee communities should be treated as partners, not suspect populations. Ukrainian community leaders, churches, veterans groups, schools, aid organizations, employment centers, and local police should receive clear, multilingual briefings on recruitment indicators: unsolicited online approaches, requests for photos of military or logistics sites, offers of easy money, pressure to identify activists, inquiries about emergency preparedness, threats concerning family in occupied areas, and demands to use encrypted channels.
Second, reporting channels must be trusted and low friction. A refugee approached by a Russian service should not fear immediate deportation, shame, or automatic prosecution if they report early. Western governments need safe contact pathways, including hotlines and community liaison officers, that distinguish between the coerced target and the committed hostile actor.
Third, Western states should normalize public counterintelligence education. Germany disposable agent campaign is the right concept. The message should be simple: if someone online offers money to photograph, damage, track, threaten, or post material about military, transport, energy, communications, or political targets, you may be interacting with a foreign intelligence service. Report it before you are used.
Fourth, the private sector must be brought inside the warning system. Ports, railroads, trucking firms, logistics warehouses, energy companies, data centers, telecom providers, cloud providers, defense contractors, satellite firms, and universities need suspicious approach protocols. The pattern may look small at first: repeated photography, drone flights, odd delivery inquiries, fake maintenance questions, unusual job offers, contractor probing, or social media scraping of employees.
Fifth, digital platforms must be treated as recruitment terrain. Telegram, WhatsApp, TikTok, Facebook, Instagram, gaming chats, gig work platforms, and cryptocurrency payment channels can all be used to identify, test, pay, and discard low level agents. Western governments do not need censorship to respond. They need lawful data preservation, platform reporting partnerships, pattern detection, and rapid deconfliction across police and intelligence agencies.
Counterintelligence: The Operational Shift Required
Traditional counterintelligence looks for case officers, dead drops, clandestine meetings, encrypted communications, unexplained money, classified access, and foreign travel. That remains necessary. But the Russian model now requires a second lens: mass low level operationalization.
Counterintelligence services should assume that many Russian approaches will be clumsy, cheap, and plausibly deniable. The absence of a professional case officer should no longer lower suspicion. A Russian tasked cutout may be a criminal intermediary, a compromised refugee, a social media persona, a small businessman, a student, a radicalized online actor, or a person who thinks he is working for a private client.
The analytic unit of concern is no longer only the recruited agent. It is the tasking chain:
Who posted the request?
Who paid?
What platform was used?
What target category recurs?
What geography repeats?
Which incidents appear unrelated but share timing, payment method, wording, target type, or operational purpose?
This is where modern counterintelligence must fuse police work, financial intelligence, cyber forensics, open source intelligence, platform cooperation, and classic human source operations.
Western governments also need faster cross border warning:
A drone over a Norwegian port
A Telegram recruitment pitch in Germany
An arson in Poland
A logistics inquiry in the Netherlands
A false story about Ukrainian refugees in France may belong to the same pressure campaign.
If each country treats its incident as local, Moscow wins by fragmentation.
Implications for America
The United States should read the European pattern as rehearsal, not theater.
The FBI states that hostile intelligence services threaten the United States through:
Espionage
Foreign influence operations
Transnational repression
Sanctions evasion, and illegal procurement of sensitive technology.
The ODNI 2026 Annual Threat Assessment warns that foreign intelligence threats include cyber espionage and pre positioning for possible attacks against U.S. networks and critical infrastructure. The FBI has also described its post invasion effort to identify and mitigate threats to U.S. critical infrastructure in classified and unclassified settings.
America has four exposed seams:
The first is the defense industrial base. U.S. defense companies, ammunition plants, logistics hubs, ports, rail corridors, and suppliers supporting Ukraine are obvious collection and disruption targets. U.S. intelligence officials have already warned defense companies supporting Ukraine to increase security because Russian sabotage activity in Europe demonstrates intent and capability.
The second is infrastructure. Russia does not need to destroy the United States to create strategic effect. It can target confidence. A disruption at a port, a rail node, a transformer yard, a fiber route, a cloud region, a satellite uplink, or a payment system during a crisis could produce political shock, market anxiety, and public pressure out of proportion to the physical damage.
The third is social division. Russia does not have to invent American polarization. It can harvest it. A recruitment approach may be ideological, but it may also be commercial or criminal. The operational goal is the same: turn Americans or people living in America into low cost amplifiers, scouts, vandals, intimidators, or unwitting collection assets.
The fourth is diaspora coercion. Ukrainians, Russians, Belarusians, Central Asians, Caucasus communities, and other Russian speaking populations in the United States may face pressure through relatives, travel, property, immigration status, business exposure, or online harassment. The answer is not suspicion of these communities. The answer is protection and trusted reporting.
The American prevention model should therefore be federal, state, local, tribal, private sector, and community based.
It should involve:
FBI field offices
Joint Terrorism Task Forces where appropriate
State fusion centers
Local police Port authorities
Emergency managers
Critical infrastructure operators
School systems, universities
Refugee organizations
Diaspora leaders.
The message should be disciplined and non inflammatory: foreign services are trying to exploit vulnerable people and open societies. Early reporting protects individuals and protects the country.
The Strategic Warning
Russia recruitment of Ukrainians in Norway is a small story only if viewed as a police matter. Viewed strategically, it is a warning about the next phase of the confrontation between Russia and the West.
Moscow is not seeking only secrets. It is seeking access, friction, doubt, intimidation, delay, and deniability. It wants the West to become more suspicious, less cohesive, slower to support Ukraine, less confident in its institutions, and more afraid of hidden enemies inside civilian life.
The Kremlin has learned that it cannot defeat NATO directly at acceptable cost. So it is testing whether it can weaken NATO indirectly at tolerable risk.
The best Western answer is not panic.
It is professional counterintelligence married to civic resilience.
That means protecting refugees while warning them:
It means hardening infrastructure without militarizing society.
It means exposing Russian methods without feeding xenophobia.
It means treating small incidents as possible indicators of a larger campaign.
It means understanding that deterrence in this contest is not only missiles, tanks, and sanctions.
It is also the capacity of a democratic society to detect coercion early, protect the vulnerable, and deny hostile services the human terrain they need.
If Russia can recruit the victims of its own war to operate inside the societies sheltering them, then the West is facing more than espionage. It is facing the weaponization of trauma.
The warning from Norway should be taken seriously now, before the same model is normalized across Europe and imported into the American homeland.
Russia has been recruiting spies in the West since at least 1808, during the Napoleonic Wars. As you rightly observed, it is very innovative in its techniques. Using trauma as a weapon is alarming. In any case, the West often does the same or worse sometimes. There's a narrative issue here.
Operative Krasnov Trump ordered dismantling of counter-Russian intelligence law enforcement, to help Russian spies operate freely across America.