Allied Intelligence — 2026-09-16

Poland Opens 107 Espionage Cases in 20 Months as Russian Sabotage and Recruitment Tempo Holds Steady

BLUFPoland's espionage caseload is unlikely to exceed 2025 levels by end of 2026, yet the sustained tempo confirms Russian intelligence continues replenishing operatives faster than arrests can deter recruitment.

Poland's National Prosecutor's Office opened 67 criminal cases under Article 130 of the Criminal Code, covering espionage and activity on behalf of a foreign intelligence service, during 2025, and added at least 40 more in the first eight months of 2026, spokesperson Przemysław Nowak told RBC-Ukraine 1. RBC-Ukraine reported that a straight-line extrapolation puts 2026's total near 60 cases, roughly matching last year's pace 12. Prosecutors said a significant share of the docket involves sabotage preparation, remote recruitment, and collection on military facilities, and noted the published figures cover only the National Prosecutor's Office's highest-complexity cases, excluding district-level prosecutions 12. RBC-Ukraine described the underlying recruitment model as decentralized and deniable: coordinators reach operatives through anonymous Telegram channels and encrypted platforms, assign arson or explosives targets, and pay only in cryptocurrency after receiving video proof of the act, insulating handlers from exposure 1. Euromaidan Press cited recent Polish law-enforcement action against two Russian citizens, one accused of planning to mail an explosive device via courier, as part of this broader pattern of recruiting low-cost operatives for arson and disruption 2.

Analysis
A 2026 total meeting or exceeding 2025's 67 Article 130 filings by year-end is unlikely; the current run rate points to roughly 60, a plateau rather than an acceleration, though prosecutors' data still show sabotage preparation, remote recruitment, and reconnaissance of military facilities dominating the docket, indicating Russian handlers keep replacing expended operatives even as arrests mount. Cases excluded from the district-level count mean operational tempo against the Rzeszów logistics corridor likely runs higher than headline figures show. We hold moderate confidence in this judgment, reflecting a single primary source's internally consistent arithmetic with no corroborating counterintelligence reporting. The rising count may instead reflect expanded Polish detection capacity rather than genuine recruitment growth, a distinction that determines whether a shortfall toward 60 lets Warsaw treat current counterintelligence staffing as adequate, or whether reaching 67 pushes NATO planners toward expanded rail-corridor security funding.

3 sources