Poland Responds to Russian Sabotage Campaign with Consulate Closure

Executive Summary:

• Poland announced on May 12 that it will close Russia’s consulate in Krakow after attributing the May 2024 Warsaw shopping center fire to Russian security services, as one of only seven North Atlantic Treaty Organization (NATO) countries to shut down Russian consulates. 
• Moscow and its proxies continue staging covert operations in Poland, with at least two apparent abductions in recent months, despite Poland’s extensive diplomatic and civilian restrictions on Russia and Belarus.
• Russian hybrid warfare increasingly utilizes local criminals in influence operations designed to tarnish the Ukrainian image in the West, even when physical outcomes are limited. 

On May 12, Polish Foreign Minister Radosław Sikorski announced that Poland would close Russia’s consulate in Krakow within 30 days and expel three Russian diplomats. These decisions followed the Polish government’s attribution of a May 2024 arson attack in Warsaw’s Marywilska 44 shopping center to Russian security organizations (X/@sikorskiradek; TASS, May 12). The previous day, Polish Prime Minister Donald Tusk stated, “The activities were coordinated by a person residing in Russia. Some of the perpetrators are already in custody, the rest have been identified and are wanted” (X/@donaldtusk, May 11). 

A joint statement by the Polish Minister of Justice-Prosecutor General, Adam Bodnar, and Minister Coordinator of Secret Services, Tomasz Siemoniak, credited the Mazovian Branch of the National Prosecutor’s Office for Organized Crime and Corruption, the Warsaw Police Headquarters, the Internal Security Agency (ABW, Agencja Bezpieczeństwa Wewnętrznego), and their Lithuanian counterparts with an investigation that interviewed over 70 witnesses and 530 victims of the attack (Website of the Republic of Poland, May 11). The attack closed more than 1,400 businesses.

The shuttering of the Russian consulate in Krakow leaves only its consulate in Gdańsk and embassy in Warsaw. Poland recently shut down the Russian consulate in Poznań, citing cyberattacks, intelligence activities, and attempted acts of sabotage in Wrocław (Notes from Poland, October 22, 2024). Russia responded by closing Poland’s consulate in Saint Petersburg and is threatening to close Poland’s remaining consular missions in Irkutsk and Kaliningrad (X/@tassagency_en, May 12). Poland’s countermeasure is one of Europe’s most significant responses to Russian covert actions on the continent. Among North Atlantic Treaty Organization (NATO) countries, Czechia, Estonia, Latvia, Lithuania (all in 2022), Germany (in 2023), and the United States (in 2017 and 2018) have shut down Russian consulates, while the United Kingdom and Netherlands closed other diplomatic properties. Poland has also barred Russian citizens from entry for economic, sporting, tourist, or cultural purposes since September 2022, even if entering with a Schengen visa (Straż Graniczna, July 19, 2024).

The Polish government’s decisive response demonstrates a Europe-wide trend of directly attributing physical and cyber acts of sabotage to Russia over the last year. In April 2024, Czechia’s Security Information Service (BIS) confirmed that Unit 29155 of Russia’s Main Directorate of the General Staff of the Armed Forces (GRU) military intelligence agency attacked two ammunition depots in 2014 (Bezpečnostní Informační Služba, April 29, 2024). In April, French authorities publicly condemned the GRU for the first time, citing a 2015 cyberattack on the TV5 Monde television channel, the hacking of  French President Emmanuel Macron supporters’ emails during his 2017 campaign, and cyberattacks on sporting bodies involved in the 2024 Paris Olympic Games (Le Monde, April 29). The French government, however, has not attributed the 2024 sabotage of French National Railways (SNCF) during the Games to Russia (Le Journal du Dimanche, July 26, 2024). Director General Ken McCallum of the United Kingdom’s MI5 described the GRU as being “on a sustained mission to generate mayhem on British and European streets” (Security Service MI5, October 8, 2024). In April, British police arrested a Romanian man in Birmingham, allegedly involved in setting a fire at a DHL warehouse on behalf of Russia (The Guardian, April 9). 

Russia and Belarus have continued covert actions against Poland despite their lowered diplomatic footprint since the beginning of Russia’s full-scale invasion of Ukraine in February 2022, which resulted in a wave of diplomatic expulsions across the West. Russian and Belarusian intelligence services have facilitated an artificial migration crisis on the Polish-Belarusian border since July 2021 (see EDM, August 15, 2023). This manufactured crisis spiked again in 2024, which saw 30,090 attempted border crossings from Belarus (Notes from Poland, January 10). In 2024, Tusk described the situation, saying, “What we’re dealing with there isn’t a spontaneous or accidental arrival of refugees or escapees, but rather an organized, large-scale Russian-Belarusian operation, transporting thousands of people,” sourced from countries such as Afghanistan, Iran, Iraq, Somalia, and Syria, where Poland does not have cooperation agreements (The Eastern Frontier Initiative, October 17, 2024).  May 28 marked the anniversary of the death of a Polish soldier who was stabbed by a migrant while trying to prevent a group from illegally crossing the border from Belarus (Notes from Poland, June 6, 2024). 

The recent disappearance of Belarusian dissidents from Poland has further raised the profile of Russian and Belarusian covert operations within Polish borders. Exiled Belarusian activist Anzhalika Melnikaŭa and her two daughters disappeared from Krakow in March, and former Belarusian prisoner Pavel Belyutin vanished from Poland in April (Polskie Radio, March 29; Belsat, April 24). Belarusian state media triumphantly announced Belyutin and another dissident’s “repatriation” on May 6 (Belsat, May 6). Belarusian President Alyaksandr Lukashenka’s regime crushing mass pro-democracy protests in 2020 spurred a wave of emigration, establishing Poland and Lithuania as major hubs for the Belarusian opposition in exile (see EDM, April 23, October 2, 2024, February 3). Warsaw, for example, hosts the headquarters of the Association of Security Forces of Belarus (BYPOL), an association of former Belarusian law enforcement and security officers with underground ties to the country, and NEXTA, a Telegram channel that played a major role in the 2020 protests (The Record, June 19, 2024; Telegram/nexta_tv, accessed May 29). Vilnius hosts Sviatlana Tskikhanouskaya’s Office, the Belarusian opposition leader and 2020 president-elect (The Record, June 19, 2024). 

These cases demonstrate the evolution of Russia and Belarus’s covert war against the West. Russia and Belarus are aggressively and successfully targeting dissidents in Poland, one of the North Atlantic Treaty Organization (NATO) governments most hostile to Russia, despite limited diplomatic presence and near-blanket bans on Russian citizens. These limitations have drawn Russian security services toward co-opting local and third-country nationals, especially Ukrainians and Belarusians, to conduct less professionalized covert actions at a lower cost. This pattern is seen in the string of 2024 arson attacks in Poland and Lithuania (LRT, March 17; Notes from Poland, May 12; see EDM, May 10; see Jamestown Perspectives, May 27). [1] Other cases that point to Russian security forces hiring non-Russian citizens include a DHL bombing plot in Germany and an arson attack on a Ukrainian-owned business in London (BBC, October 25, 2024; ZDF Heute, November 26, 2024). 

The United Kingdom is investigating the possibility of Russian involvement in the case of one Romanian and two Ukrainian men arrested in May for three counts of arson in locations tied to Prime Minister Keir Starmer (Financial Times, May 23). On the same week of one arrest, Germany and Switzerland arrested three Ukrainian nationals suspected of preparing explosive packages destined for Ukraine “on behalf of Russian state agencies” (Deutsche Welle, May 14). Even though these attempts have limited tangible effects, they have propaganda value for Russia when portrayed as “Ukrainian” attacks without acknowledging Russia’s role (Vesti.ru, May 14; StopFake, May 18). The expansive “hired criminal” phase of Russian hybrid warfare allows Moscow to sow discord regardless of the mission’s physical outcome, with criminals likely to remain attractive partners for the West’s strategic adversaries.

Note: 

[1] See Poland on the Frontlines Against Russia’s Shadow War by Anjou Kang Stryker and Janusz Bugajski for a comprehensive public data set of Russia’s espionage operations in Poland.