Summary

  • Guardian special correspondent Shaun Walker placed Europe’s documented Russian sabotage pattern within KGB “special period” doctrine, licensing a “liminal” war-status frame that bridges intelligence warnings and constrained policy response.
  • The briefing catalogued sabotage incidents across at least eight European jurisdictions — fires at defense facilities in Italy, Bulgaria, Estonia and Slovakia, an explosives-laden drone at Leipzig airport, an Ikea arson in Lithuania, coffins inscribed with “French soldiers in Ukraine” left under the Eiffel Tower, and the June jailing of two Russian-linked arsonists who targeted property connected to former prime minister Sir Keir Starmer.
  • Intelligence chiefs from the Czech Republic, Latvia and Sweden broke protocol by speaking on the record, a departure Walker characterized as suggesting the intelligence community’s preference for public warning ahead of a possible Russian test of NATO resolve within “months, not years.”
  • Walker’s “careful path” posture depends on frame-imports from Baltic chronic-rather-than-acute preferences and reported US President Donald Trump dismissals of NATO concerns, balancing alarmism against complacency.
  • The briefing surfaces a sabotage-to-domestic-politics feedback loop in which Russian operations seed anxiety, European defense spending rises, populist-right parties including the AfD gain ground, and Russian-sympathetic leadership enters coalition calculations.

On 22 September 2026, the Guardian published a Tuesday briefing in which special correspondent Shaun Walker, drawing on KGB archival material consulted during research for his book “The Illegals,” compared documented Russian sabotage across at least eight European jurisdictions to the Soviet “special period” doctrine — a stage between peaceful coexistence and war characterized by plans for relentless sabotage. The briefing paired Walker’s doctrinal comparison with on-the-record interviews from intelligence chiefs of the Czech Republic, Latvia and Sweden, one of whom suggested a Russian test of NATO resolve could come within “months, not years,” and with a catalog of incidents that includes fires at defense facilities supplying Ukraine, an explosives-laden drone next to a Ukrainian cargo plane at Leipzig airport, an Ikea arson in Lithuania, coffins inscribed with the words “French soldiers in Ukraine” left under the Eiffel Tower, and the jailing of two Russian-linked arsonists who targeted property connected to Sir Keir Starmer. The Guardian characterized the pattern as “designed to seed chaos and anxiety among Ukraine’s allies while making it difficult to prove conclusively Russian involvement” and reported it has “developed since Russia’s full-scale invasion of Ukraine four and a half years ago.” The analytical claim Walker constructs is that the evidence package sits below the NATO Article 5 threshold but above the “grey zone,” and that the framing dispute — “hybrid war,” “grey zone,” “the special period,” or simply “war” — itself conditions what countermeasures European governments can credibly mount.

The framing dispute: hybrid war, grey zone, special period, war

Walker observed that some EU politicians are “getting irritated with the term ‘hybrid war’” because direct attacks on defense facilities, drones at airports and arson at retail outlets “amount to more than ‘grey zone’ activity.” The Guardian described the question of whether Europe is “at war” as “liminal.” The dispute is not merely lexical; per the briefing’s reporting, it conditions what countermeasures are proportionate. Asked whether Europe is already at war, Walker answered “no” and elaborated: “There is a clear campaign from Russia, using methods that are not military, but are pretty aggressive. Some people may consider them as being something close to a war. It’s clearly absolutely nothing like the war in Ukraine.”

The “special period” framing functions in the briefing as a documented authority citation — KGB archival material consulted during Walker’s research — deployed in a structural role: licensing the careful-path posture across intelligence, sabotage and policy registers. Each component is qualified or attributed. Walker qualifies the intelligence warnings: “One thing you always have to bear in mind when reporting on intelligence is that — because the way spy agencies gain information usually remains secret — you often don’t know if a source is talking about a very specific intercept of a plan that’s almost certainly going to happen, or if it’s less concrete chatter that analysts have put together.” His assessment is that current concerns are not at the level seen in early 2022, when American intelligence repeatedly warned Russia was preparing to invade Ukraine and had hard evidence of the Kremlin’s plans. The sabotage incidents are attributed to authorities rather than to demonstrated Russian causation in most entries; the policy consequences are presented as constraint-set rather than as outcome. The briefing’s coherence depends on framing choices rather than on evidence-coherence choices — per the briefing’s own evidentiary base, the same incidents could license a more alarmist reading if the frame-import changed. Walker’s “special period” analogy is itself an act of framing — drawing a doctrinal lineage between Soviet sabotage planning and the documented pattern of fires, drones and arson the Guardian catalogued.

Who benefits: the operational chain and the actors it serves

The operational sequence the briefing documents runs: KGB “special period” doctrine → online recruitment of local foot soldiers by Kremlin security services → distributed sabotage execution across at least eight European jurisdictions → public attribution by European governments → three-register policy response (diplomatic-economic, intelligence-symbolic, rhetorical). Bottlenecks at each handoff are visible in the briefing: the gap between Soviet-era doctrine and current Russian practice is characterized rather than documented by continuity; the Schengen free-movement zone is surfaced by “one suspect in the Leipzig case reportedly entered Europe using an Italian tourist visa”; attribution speed has improved — “European governments have become faster at publicly identifying Russian involvement” — but prevention effectiveness is not described; public attribution depends on intelligence-community willingness to release classified findings under criteria the briefing does not name.

The actor network is anchored by a single principal — the Kremlin — and connected through operational channels (online recruitment, financial flows, visa-enabled movement) to distributed execution nodes across Italy, Bulgaria, Estonia, Slovakia, Germany, Denmark (where authorities warned Russia is recruiting Danish citizens to sabotage defense firms with ties to Ukraine), Lithuania, France and the United Kingdom. NATO and the EU function as institutional response hubs; national governments are distributed enforcement nodes. In network-topology terms, the structure is a star configuration with a single strategic hub and multiple spoke execution nodes, though the online-recruitment model introduces a peer-to-peer overlay between recruiter and recruit that sits outside the hub-and-spoke diagram.

The policy response spans three registers: diplomatic-economic — the EU has expanded its sanctions blacklist to include Russian banks and energy companies, as well as entities in the United Arab Emirates, Thailand and China that help Moscow evade Western restrictions; EU nations have shown willingness to crack down on Russia’s “shadow fleet” of ships carrying oil and supplies through the Baltic and North seas; intelligence-symbolic — Germany’s response to Leipzig included the expulsion of “more than 150 Russian diplomats” and pledged tighter border controls for Russian travelers; and rhetorical — the “liminal” framing itself. While vocal critics argue these diplomatic and economic measures don’t go far enough, others worry that even more decisive responses would risk “dragging the bloc into military escalation.” The sabotage network intersects with adjacent domains: European immigration and visa policy (the Italian-tourist-visa exception); the European energy economy (the shadow-fleet enforcement discussion and the sanctions extension to UAE, Thailand and China entities); domestic electoral politics in Germany, France and the United Kingdom (the AfD, Le Pen and the Starmer-targeted arson cases); and online platform governance (recruitment of “local foot soldiers online” and the March Rycroft review’s finding that online disinformation from hostile foreign states including Russia was “warping political discourse”). Each cross-link is a domain where the sabotage campaign produces secondary effects outside its operational targets.

What happens next: the feedback loop and the framing paradox

The briefing surfaces a sabotage-to-domestic-politics feedback loop in which Russian operations seed anxiety, European defense spending rises, populist-right parties gain ground, and Russian-sympathetic leadership enters coalition calculations. Walker told the briefing that “If they choose to spend on defence rather than social issues, those social issues get worse and voters move to the populist right, the AfD in Germany or Le Pen in France, then you end up with leaders who are very sympathetic to Russia in power.” The Guardian reported that the Kremlin welcomed the AfD’s gains in German state polls — including a 38% Mecklenburg-Western Pomerania result that Chancellor Friedrich Merz, who has vowed to stay in office despite heavy losses in two state elections he characterized as a “disaster,” — while Die Linke, described by the Guardian as “leftwing,” won Berlin. The AfD is described by the Guardian as having “anti-immigration” and “Kremlin-friendly” positions.

A second loop surfaced in the briefing is the Baltic framing paradox: Estonian, Latvian and Lithuanian officials, who for decades pressed Western Europe to take the threat seriously, now find the rhetorical position has flipped — “Baltic states prefer western Europe to see it as a chronic rather than an acute problem.” The Guardian reported that the Baltic states “remain among the strongest voices for tangible responses to Russian aggression” but are “concerned about the impact of a narrative of ‘tanks rolling into Estonia, Latvia and Lithuania,’ which … is of course partly the point of concerted Russian psyops.” The briefing notes that the vast majority of Russia’s military capability is tied up in Ukraine. The framing that warns of Russian aggression serves Russian information objectives; the warning is itself the operation. Estonian Foreign Ministry Secretary General Jonatan Vseviov reinforced this position by cautioning against “panic” on social media.

A third non-obvious connection surfaces in the on-the-record interview as communication act. The intelligence chiefs’ willingness to be named broke what Walker characterized as the standard expectation: “Normally I go into these interviews assuming that we’re going to talk off the record.” Polish Prime Minister Donald Tusk told his parliament days before the briefing that intelligence assessments suggested Russia might launch an attack using drones or missiles on NATO territory in the coming months; French President Emmanuel Macron has summoned party leaders for an emergency meeting on similar warnings. The Guardian characterized the intelligence chiefs’ warnings as the “starkest warnings yet” from European intelligence officers. The relationship between intelligence agencies and publics is itself part of the strategic picture, not merely a channel for it.

The trajectory the briefing leaves open

If the handoff friction zones persist and the topology retains its star-with-overlay structure, the most likely medium-term trajectory drawn from the briefing’s own evidence is that the sabotage pattern continues below the NATO Article 5 threshold while the domestic electoral feedback loop deepens — a chronic crisis of attribution, jurisdiction and political will rather than a single acute test of resolve. Walker summarized what he characterized as a Russian strategy: “What Russia is working to is that they know even the most hawkish people in Nato countries would really like to avoid having a direct conflict.” Like Europe, the briefing reported, Russia does not want direct confrontation with the West, but “their risk appetite is increasing.”

The briefing appeared as the UN General Assembly opened in New York, with European leaders, the Guardian noted, “seeking a united front and wary of interventions from US President Donald Trump,” who has previously dismissed concerns that Russia would strike a Baltic country or other NATO member state to test the alliance’s resolve and has repeatedly criticized the alliance. The Guardian reported that “the Kremlin welcomed the AfD’s gains in German state polls the previous day” and that Putin was described as consolidating his grip on power in tightly controlled Russian elections. Whether Europe’s response rises to the pattern the briefing describes — or whether the pattern outruns the response — is the analytical question the briefing leaves open.

Analytical techniques used in this piece

This analysis applies the methods below. Each links to a short, plain-English explainer you can read and reuse.

Argument Audit
A full structural audit of an argument’s premises, inferences, and load-bearing assumptions.
Process Mapping
Lays out a process end to end — steps, hand-offs, and bottlenecks.
Relationship Mapping
Extracts the network of ties among people, institutions, and entities.
BATNA
Your best alternative to a negotiated deal — the walk-away that sets your leverage (Fisher & Ury).