LONDON — As British detectives studied the grainy CCTV video of the burning warehouse, there was at first little reason to think they were looking at a covert Russian intelligence operation.
The March 2024 video from the Cromwell Industrial Estate in east London showed two masked men pouring gasoline outside the warehouse door, setting it ablaze with a burning rag, and then fleeing into the night.
The fact that the storage facility belonged to a Ukrainian logistics company that was shipping humanitarian aid and Starlink satellite internet dishes to Ukraine did not initially raise any alarms.
But 10 days later when a warehouse belonging to the same company was set on fire in Spain’s capital Madrid, detectives realized it was much bigger than a simple case of arson.
The investigation and the prosecution that followed would shed light on what Western officials have warned is a dangerous Russian tactic: hiring local criminals to carry out acts of sabotage across Europe.
“It’s a relatively new thing to see criminal proxies used on behalf of foreign states,” Cmdr. Dominic Murphy, the head of the counter-terrorism unit at London’s Metropolitan Police, told British broadcaster Sky News, NBC News’ international partner, in July. “We have seen this trend developing over the last year or two, and I’m sure we’ll continue to see it develop over the next year or so.”
Over the last year, NATO governments have accused Russian intelligence agencies of remotely recruiting criminals and using them to sow chaos.
The exact number of attacks is difficult to quantify. The allegations range from Britain to Estonia to the Czech Republic to Poland — where, authorities say, Russia paid a group to burn down the country’s biggest shopping mall in May 2024.
Moscow denies all allegations of sabotage, including in the case in London. “Russia has never engaged in sabotage activities against the United Kingdom and has no intention of doing so,” the Russian Embassy in the United Kingdom said in a statement.
Calvin Bailey, a British member of Parliament who sits on the Defense Select Committee, said the London attack fit a pattern in which Russian operatives used encrypted apps and cryptocurrency to hire criminals as they tried to mask their own involvement.
“They’re incentivized by money but the use of Telegram and bitcoin creates plausible deniability and allows the Russians to keep their distance,” Bailey said in a recent interview. “It hides the trail, be that a money trail or any of the connections.”
According to British prosecutors the trail that led to the warehouse burning in east London began in March 2024, when a 21-year-old British drug dealer named Dylan Earl initiated communications with an anonymous account on Telegram with the usernames “Privet Bot” and “Lucky Strike.”
The account was run by an operative with the Wagner Group, the Russian mercenary group that fought in Syria and Ukraine before it launched a short-lived mutiny against Russian President Vladimir Putin in June 2023 but has now been brought to heel by the Kremlin.
Earl expressed interest in joining Wagner as a gun-for-hire, saying, “I need a fresh start” after his life of small-time crime in the U.K, according to documents released by prosecutors.
But the Russian handler said Wagner had a different use for him: carrying out operations in Europe.
Over the course of hundreds of messages, the Russian handler offered the young British criminal both money and ideological encouragement to burn down the warehouse, which could net him roughly $8,000.
“I’ll make you rich. And grant you things no one else can. Citizenships. Passports. Everything,” the Russian handler said in a message posted on the Privet Bot account. In another, the handler said, “You are our dagger in Europe.”
Earl was also encouraged to embrace a clandestine lifestyle by watching the FX show “The Americans” about KGB spies operating undercover in the United States.
“Look how they describe Russia. But you see U.K. and USA,” the handler wrote. “Homeless everywhere. Drugs etc. It is fearmongering bro. They want people scared.”
Earl knew he was dealing with a Wagner operative but did not back down.
Within weeks of their initial messages, Earl had recruited a group of young accomplices to carry out the warehouse attack. According to prosecutors, only one of them — Jake Reeves, 23 — understood that they were starting the fire on Russian orders.
Neither Earl nor Reeves was present when the fire was started by Nii Kojo Mensah, 23, Jakeem Rose, 21, and Ugnius Asmena, 23, all of whom were convicted of aggravated arson. Instead, they watched a livestream of the blaze on FaceTime provided by Asmena.
The men who actually started the fire believed it was merely a criminal act — Earl never told them they were acting on Russian orders.
British detectives stepped up the hunt after they realized they were most likely dealing with a Russian state-sponsored operation targeting the Ukrainian business. They arrested Earl in early April and after they accessed his phone, quickly established his connection to the Wagner group.
Earl and Reeves both pleaded guilty to aggravated arson and offenses under British national security laws.
There is no suggestion that they were linked to other attacks across Europe or the groups carrying them out.
“This case is a clear example of an organization linked to the Russian state using ‘proxies’ — in this case British men — to carry out very serious criminal activity in this country on their behalf,” Murphy, the Met counterterrorism head, said in a statement after the verdict.
The suspected Russian-backed criminal attacks across Europe are usually unsophisticated intelligence operations. Many of the plots, like the one in London, involve arson.
In June, a Colombian man was imprisoned for eight years in the Czech Republic after he was convicted of setting fire to buses in Prague. Like Earl, he was also given orders by a Russian handler over the Telegram messaging app and told to record himself setting the fire, according to Czech authorities.
That type of attack is relatively low-risk for Russia, compared with sending its own professional agents into an increasingly hostile Europe.
But there is some evidence that the Russian operative handling Earl had higher ambitions for his group of British gangsters-for-hire.
British police said that at the time of their arrest they had already begun surveillance operations for their next plot: kidnapping a Russian dissident named Yevgeny Chichvarkin and setting fire to his Michelin-starred Hide restaurant in one of London’s most expensive neighborhoods.
