Russia Recruits Telegram Saboteurs

It begins with a message that looks more like a casual earner than espionage. Take a photograph of a building. Check a route into a site. Turn up at a protest. Send proof, get paid. If the person follows through, the next request becomes a little more serious.

Security services in Poland, Germany and France have now arrested or indicted people pulled into that kind of pipeline. These are not trained agents in the old Cold War sense. They are ordinary people recruited online for small, separated tasks, often without seeing the wider operation. For European states, including Ireland, the difficulty is that the first act can look like nuisance, activism or petty crime until several files in different countries start to form the same picture.

Photograph first, escalate later

Poland's ABW, the domestic security agency, has put the clearest public evidence on record. Prosecutors described the arrest of a Pole and a Belarusian who photographed sites important to state security on instructions from a Telegram moderator. The case was classified as "diversion directed against Poland" (Interia). Interior Minister Tomasz Siemoniak said recruitment of this kind had operated in Warsaw, Wrocław, Kraków, Zakopane and Bydgoszcz (RMF24, Radio Alex).

Another operation paid people to attend demonstrations that appeared to have sprung up among Ukrainian refugees. The purpose was to turn corruption scandals and Ukrainian internal disputes into pressure points in Poland, where support for Kyiv has been politically central but not cost-free.

Polish experts have started calling the recruits "disposable agents", people brought in through money, pressure or manipulation (Rzeczpospolita). The phrase is blunt, but it captures the method. The first job tests obedience and access. Only later does the handler find out whether the recruit can be pushed towards something more dangerous.

Same playbook across borders

Germany's BfV, the domestic intelligence service, described much the same model in its 2025 annual report: Russian services using Telegram to recruit helpers for photography, infrastructure observation and early-stage sabotage (BR). The value of the method is ambiguity. An incident may be state-directed, ordinary crime or simply an accident, and the difference is not always visible at the start.

German courts have already dealt with part of that pattern. Three men were convicted for spying on rail lines connected to support for Ukraine (DW, ZEIT).

France has produced the sharpest single case. Near Toulouse, a Belarusian man was indicted on 5 June after technicians at Delair, a drone manufacturer, caught him filming drone tests. Investigators from the DGSI, France's domestic intelligence agency, found a 55-second video on his phone that had been sent to a Russian number (Le Monde).

Le Monde also reported that a Molotov-cocktail attack hit the same factory days earlier. Investigators have not publicly established a link between the detained man and that arson. The reconnaissance evidence is strong. The full chain, from Russian tasking to filming to an attack by the same person, has not been proven.

Who owns the problem

Latvia's VDD, the state security service, has warned that young people are increasingly being recruited through TikTok, Discord, Telegram and gaming platforms such as Roblox (Baltija.eu). The recruitment surface is spreading faster than the authority to police it.

Under EU treaty law, national security remains the responsibility of each member state (TEU Article 4). National services investigate. National prosecutors charge. Europol can connect police intelligence across borders (Europol). Eurojust can bring prosecutors into the same room, while its SIRIUS project helps them secure the Telegram chats and account data on which these cases often depend (Eurojust SIRIUS).

But coordination is not command. No EU body can take a counter-sabotage case from first detection through to prosecution. That matters because the pattern is European before the law can treat it that way.

There is a platform gap as well. Telegram is not on the Commission's list of Very Large Online Platforms under the Digital Services Act, the EU's content-governance law, so it avoids the extra systemic-risk oversight imposed on the largest platforms (Commission VLOP list). A channel used for recruitment therefore sits outside the part of the regulatory system built for coordinated online harm.

For Ireland, the lesson is not that every odd photograph near a port or data centre is espionage. It is that sabotage now starts in places that look small and deniable. A recruiter can operate across Europe while every legal response begins in a local file. Recognition still depends on someone joining the photograph of a rail yard, taken by a person who thought they were making easy money, to the Telegram chat that ordered it.