As a campaign of Russian sabotage sweeps across Europe, Estonia is seeing a shift in what targets Moscow chooses to go after, the Baltic nation’s counterintelligence chief told Foreign Policy in an interview on Wednesday.
“Initially, these attacks were more against symbolic objects,” said Margo Palloson, who has served as the director-general of the Estonian Internal Security Service since 2023. Those attacks included vandalizing Estonian opinion-makers’ cars, burning Ukrainian flags, and carrying out an arson attack on a Ukrainian restaurant.
As a campaign of Russian sabotage sweeps across Europe, Estonia is seeing a shift in what targets Moscow chooses to go after, the Baltic nation’s counterintelligence chief told Foreign Policy in an interview on Wednesday.
“Initially, these attacks were more against symbolic objects,” said Margo Palloson, who has served as the director-general of the Estonian Internal Security Service since 2023. Those attacks included vandalizing Estonian opinion-makers’ cars, burning Ukrainian flags, and carrying out an arson attack on a Ukrainian restaurant.
An August attack by Russian-directed saboteurs on Estonian robotics firm Milrem, which supplies Ukraine’s military forces, marked a new phase, he said. “Now the game has changed a little bit—we assess the purpose clearly was to disrupt, restrict, or cancel all the supplies” to Ukraine. Reuters reported this week that Russia has targeted defense firms in Denmark, another strong supporter of Ukraine. And then there was the attempted explosive attack in early August on a plane in Germany by Russian intelligence operatives.
The attacks have emerged as a new Kremlin strategy as Ukraine stymies or even pushes back Russia on the battlefield. Danish officials separately said Russia was likely to increase the number of sabotage and other attacks on Europe in the coming months.
These operations increasingly use explosives, Palloson noted, raising the level of danger to civilians. European Union ambassadors recently met to discuss the possibility of a mass-casualty event caused by sabotage or other forms of state-sponsored violence, Politico reported Wednesday.
To combat the threat, Estonia’s government is liaising with the country’s defense sector, including giving companies advice on physical security, Palloson said.
Estonia is also stopping espionage at the border. Since 2025, Estonia has arrested 20 people who traveled to Russia and were then recruited by Russian intelligence, Palloson said. These would-be spies were not in military or intelligence but rather were civilians whom Russia could have later instructed to take jobs useful for intelligence purposes within Estonia, he added.
Russia’s increasing use of criminal groups and amateurs, including Ukrainians recruited through social media, complicates the process for tracking potential saboteurs and spies. Using these networks can obscure Russia’s connection, with as many as seven layers of intermediaries between the saboteur and Russia, Palloson said.
Ukrainians refugees used by Russia, meanwhile, may not even know they’re working for the Kremlin and in some cases may believe they’re working for Ukraine’s own internal security service, he added. Ukraine is much more rarely accused of sabotage in Europe, but Ukrainian military personnel were reportedly behind a 2022 attack on the Nord Stream pipelines, which carried Russian gas to Germany.
The use of criminal groups is also adding a commercial dimension to the attacks, with some criminal groups proposing new operations to Russia as a method of generating revenue, Palloson said. “Some groups who commit these attacks realize that this is also an option to earn good money,” he said.
For now, Palloson said he felt comfortable with Estonia’s response to the new wave of saboteur tactics as well as the legal framework at his disposal. However, frustration is growing in some European countries, which he did not name, about the powers available to counterintelligence staff.
“I have heard from some European colleagues that they feel they don’t have the right legal tools to handle this,” he said. The United Kingdom first arrested and then later released seven individuals suspected of being linked to an Iranian plot targeting a U.S. airbase in England in September.
Despite the attacks, Palloson said he saw no signs that Russian sabotage was weakening support for Ukraine. “[Support] is still very high and higher every day. In Estonian society, there is no fear or panic,” he said.
The nightmare scenario for Estonia, of course, would be a Russian invasion. In the lead-up to Russia’s invasion of Ukraine in 2022, Russian security services worked hard to lay the groundwork for an easy takeover, sending in assassination squads ahead of time and bribing Ukrainian officials so that they would offer little resistance.
Estonia’s military and intelligence services see little sign of Russia preparing a similar attack on Estonia. Nevertheless, the country is learning from Ukraine’s experience, Palloson said.
“All [intelligence] services in Europe are trying to study how to protect their societies against intelligence activity, influence activity, and sabotage.”
