Russia Uses Cameras to Track NATO Arms

A cheap security camera fixed to the wall of a European warehouse, still using the password it left the factory with, was quietly taken over by Russian state hackers and folded into a surveillance network watching weapons shipments to Ukraine. The owner may never know it happened. Dutch intelligence services said earlier this month that IP cameras across NATO countries had been compromised along military logistics routes (AIVD, DW).

That small image says a lot about the war now being fought around Ukraine. European governments are no longer treating Russian cyber operations against civilian infrastructure as isolated shocks. They are describing them as a constant condition.

Finnish authorities have a word for it: "arkipäivää", everyday life, something that now sits in the background (Yle). NATO used similar language on 13 July when it condemned Russia's "persistent malicious cyber activities" (NATO). This is not a single breach to be investigated, cleaned up and closed. It is a standing operation that European states have to live with and resist.

Copying every key in the building

The old picture of a cyberattack was a burglary: someone gets in, takes what they came for, and leaves. What European agencies are now describing is closer to someone copying every key in the building, learning when the guards change shift, mapping delivery routes and occasionally setting off the alarm to see who responds.

The way in is often embarrassingly ordinary: an old router, a weak password, a device nobody has updated for years. Finland's intelligence service, Supo, says Russia's FSB 16th Centre uses exactly those openings to spy on energy and defence companies (Supo). There is no need for exotic tools when neglected equipment will do the work.

The strategic problem begins after the first entry. Attackers steal login credentials, which are effectively copied keys, and use them to move from one system to another: from the front desk to the storage room, then towards the control room. They watch internal communications, learn how an organisation works and keep access open for months or years. Espionage maps the terrain. Floods of junk traffic that knock websites offline create noise. Destructive malware can sit quietly until someone decides escalation is useful (ENISA).

Different countries, same campaign

Each country sees the threat through its own exposure. In Finland, it is a story about the edge of the network: energy companies and critical sectors being targeted for long-term spying. Foreign Minister Valtonen condemned the activity and summoned Russia's ambassador (MTV Uutiset).

In Poland, it is a logistics story. As one of the main transit routes for support to Ukraine, Poland faces cyber operations alongside physical sabotage. Foreign Minister Sikorski said there was credible intelligence that Russia was planning further actions, listing arson, railway attacks and infrastructure reconnaissance in the same breath as digital intrusions (RMF24, Rzeczpospolita).

Those accounts do not contradict each other. They describe different surfaces of the same campaign: steal access, watch networks, map dependencies, disrupt selectively and raise the cost for states supporting Ukraine.

There is one caution. Some of these warnings rest on classified intelligence that governments cannot publish. Attribution here is an official assessment, not courtroom evidence available for public inspection. The Polish foreign ministry cited an EU position linking destructive operations to the FSB 16th Centre (WP). That is plausible and institutionally backed, but it cannot be fully audited from the outside.

Laws are ready, routers are not

Europe's legal response has moved quickly. The basic idea behind the two main instruments, the NIS2 Directive and the Cyber Resilience Act, is to push responsibility upwards: away from the overworked IT desk and towards company boards and device manufacturers (NIS2 Directive).

NIS2 makes senior management legally accountable for cybersecurity and tightens incident reporting across more sectors. The Cyber Resilience Act goes straight at the camera and router problem, requiring manufacturers to ship products with proper security defaults rather than factory passwords (EUR-Lex CRA).

The difficulty is the gap between law and wiring. A directive cannot instantly patch every old router or replace every default password. NIS2 transposition is still uneven across member states. The architecture is sensible. The work on the ground is unfinished.

For European citizens, including in an Ireland that is not in NATO but is deeply exposed through the EU, trade, data centres and undersea connections, the shift is as much mental as technical. Cybersecurity is no longer the clean-up operation after a spectacular breach. It is infrastructure maintenance: constant detection, patching, supplier oversight and incident response.

That is less dramatic than a single headline attack, but much harder to sustain. The next test for Europe will not be whether the right laws exist on paper. It will be whether old cameras, unpatched routers and undertrained company boards have changed before Russia decides to use the access it has already built.