Sweden’s SÄPO Reports that Russia is Evolving Sabotage Tactics

Executive Summary:

• Sweden’s Security Service warns of an alarming shift in Russian espionage tactics, involving the recruitment of individuals suffering from substance addiction  for sabotage missions as part of a broader hybrid warfare strategy targeting Sweden and Europe.
• Sweden’s recent accession to the North Atlantic Treaty Organization (NATO) has intensified Russian intelligence activities, with Russia increasing the dissemination of disinformation, cyberattacks, and covert operations.
• Russia continues to rely on “legitimate” espionage channels such as embassy personnel and religious institutions in Sweden while targeting potential assets through social media as expendable agents.

Sweden’s Security Service (Säkerhetspolisen, SÄPO) reported in March that Russia is implementing a new espionage tactic. Russian intelligence is seeking prospective recruits suffering with substance addiction to carry out sabotage attacks in Sweden, with the police consequently being urged to heighten surveillance. The drug addicts are reportedly being sought because of their low social status and subsequent effective invisibility, a valued quality in espionage operatives  (TV4 Nyheterna, March 17). SÄPO issued a press statement, provided in part below, as Russia seeks to further its covert espionage activities:

Foreign powers are using security-threatening activities and hybrid activities to destabilize Sweden and Europe. This involves illegal intelligence activities, influence, cyberattacks, theft of technology and knowledge, mapping, and threats against opponents. The Security Service can also note an increased Russian risk appetite with threats of sabotage also in Sweden (Säkerhetspolisen, March 11).  

SÄPO previously reported that Iran uses criminal networks in Sweden to carry out various types of violent acts (Säkerhetspolisen, May 30, 2024). Moscow’s use of individuals suffering from substance addiction as tools for espionage demonstrates its heightened focus on “hybrid warfare” tactics, the incorporation of a “range of different modes of warfare,” against Europe (Hoffman, December 2007).

Sweden joined the North Atlantic Treaty Organization (NATO) on March 7, 2024 (NATO, March 7, 2024). Public opinion in both Sweden and Finland was firmly against joining NATO before Russia’s full-scale invasion of Ukraine in 2022. After Russia’s full-scale invasion, support for NATO membership subsequently surged. In 2023, a year before Sweden acceded to NATO, SÄPO warned that Russia was intensifying its intelligence activities against Sweden and could use both sabotage and violent extremists to destabilize the country. On January 10, 2023, during the national Folk och försvar (“People and Defense”) conference in Sälen, SÄPO head Charlotte von Essen told participants that Russian intelligence activities as well as other security-threatening activities would increase, with Russia using disinformation, cyberattacks, sabotage, and violent extremists. Von Essen observed that Sweden’s NATO application was a motivating factor for Russia. This in turn  had led Russia to consider Sweden as part of the defense alliance even before it officially joined, and, therefore, implied that Sweden is a viable target for Russian hybrid warfare (Tidningen näringlisvet, January 10, 2023).

Russia’s espionage efforts against Sweden have a long history beyond seeking to recruit individuals addicted to substances. Von Essen cautioned that Russian intelligence had even apparently infiltrated SÄPO (Tidningen näringlisvet, January 10, 2023). In 2021, Peyman Kia, one of two brothers of Iranian origin charged with spying for Russia, had held positions at both SÄPO and Militära underrättelse- och säkerhetstjänsten (Military Intelligence and Security Service, MUST). The crimes the brothers are suspected of were allegedly committed between 2011 and 2021. Peyman Kia and his brother Kayyam were arrested on suspicion of aggravated espionage by SÄPO in September 2021 (Aftonbladet, November 11, 2021). At the time of his arrest, Peyman was a high-ranking security manager at the Swedish National Food Agency and had previously worked at SÄPO and MUST (Aftonbladet, November 11, 2021). While at MUST, Kia had worked within its most secret known intelligence organization in Sweden, Kontoret för särskild inhämtning (Office for Special Collection, KSI). His brother Kayyam was arrested in November 2021 (Aftonbladet, November 11, 2021). On January 19, 2023, the Kia brothers were convicted of sharing top-secret information from the Security Service and the Armed Forces with Russia. Peyman was sentenced to life in prison, and Kayyam was sentenced to nine years and ten months (Aftonbladet, January 19, 2023).

Russia’s hybrid warfare tactics regularly rely on  the use of “expendable” agents, individuals who are used for single missions. These agents are recruited and provided instructions mainly via social media platforms. They are then used to carry out a range of  sabotage and influence operations in Europe on behalf of Russia (Säkerhetspolisen, 2023–2024; TV4 Nyheterna, January 25). These agents’ subsequent fate is of little interest to Moscow, as their singular missions deny them knowledge of the specific breadth and depth of Russian intelligence efforts.

Russian intelligence operatives in Sweden span multiple Russian institutions. SÄPO estimates that approximately 30 percent of the Russian embassy staff at Gjörwellsgatan 31 in Stockholm are intelligence officers, whose duties include recruiting and handling agents (Expressen AB, January 14). Additionally, SÄPO has determined that the Russian Orthodox Church in Sweden is a second “legitimate” asset used by Moscow to carry out intelligence gathering, influence or other security-threatening activities (Expressen AB, February 22, 2024).

Sweden’s security challenges with Russia are part of a larger NATO defense issue. Poland and the Baltic states have reported cases similar to Sweden’s in which adversaries conduct security-threatening activities and hybrid warfare (Re:Baltica, July 10, 2024; Notes from Poland, April 9). This includes illegal intelligence activities, influence, cyberattacks, theft of technology and knowledge, mapping, and threats against opponents ( Raporty Specjalne, October 26, 2020).

SÄPO continues to monitor Russian espionage activities in Sweden, noting in its annual intelligence report:

Sweden’s entry into NATO makes us safer, but may also mean a changed and strengthened intelligence interest from Russia in particular. … Russia remains the defining threat to Sweden. Russian security-threatening activities conducted against Sweden risk threatening several protection values with a bearing on national security, not least those linked to Sweden’s territorial integrity and political sovereignty. Developments since Russia’s invasion of Ukraine also show a more risk-averse Russia that, in its actions, accepts risks to life and health to a greater extent. An important part of Russia’s security-threatening activities against the West is hybrid activity aimed at destabilizing, misleading, creating unrest, and shifting focus (Säkerhetspolisen, 2024–2025).

Sweden’s accession to NATO produced a decisive powershift in the Baltic region. The country abandoned its 212-year-old neutrality policy, in place since the Napoleonic wars convulsed Europe, effectively turning the Baltic Sea into a NATO lake. Sweden takes its alliance responsibilities seriously and marked the first anniversary of its accession to NATO by deploying JAS 39 Gripen fighter jets to Poland as a contribution to NATO’s Enhanced Air Policing mission (UK Defence Journal, March 29).

Unable to confront Sweden directly on the battlefield, Moscow appears to be pursuing a termite-like intelligence and sabotage “hybrid war” to confront NATO’s newest member by exploiting the country’s most socially vulnerable individuals. Despite SÄPO’s successes up to now, future challenges to combat Russian espionage operations remain and will undoubtedly intensify.