Listen to the article
By Andre Pienaar
A landmark Swedish counter intelligence study maps the largest open-source dataset of espionage convictions in Europe, exposing Russia’s aggression, the evolution of spy typologies, and the alarming silence from some Western capitals.
In January 2026, Sweden’s Defence Research Agency (FOI) published what may be the most comprehensive empirical study of espionage in Europe to date. Commissioned by three of Sweden’s principal intelligence agencies, the Security Service (Säkerhetspolisen), the National Defence Radio Establishment (FRA), and the Military Intelligence and Security Service (MUST), the report analyses 70 individuals convicted of espionage across 20 European countries between 2008 and 2024. Its findings are both a granular intelligence product and a strategic warning.
The counter-intelligence implications for NATO, EU member states, and the broader security community are significant. This is an empirical map of how hostile adversaries, principally Russia but also China, Iran, and Turkey, are recruiting European citizens to betray their countries, and what conviction data reveals about gaps in Europe’s collective defence.
Russia: The defining threat
The dataset leaves little room for ambiguity. Of the 70 convicted spies, 47 were working for Russia, a full two-thirds of the total. China accounted for six cases, Iran for three, and Belarus for two. NATO ally Turkey accounted for three further cases. In the remaining eight cases, involving North Macedonian nationals, the instigating state could not be identified from open sources.
Among Russian intelligence services, the GRU (Main Intelligence Directorate) was the most prolific recruiter, responsible for seventeen cases. The FSB (Federal Security Service) followed with fourteen, and the SVR (Foreign Intelligence Service) with six. The dominance of the GRU is notable. As Russia’s military intelligence arm, its prominence suggests that Russia’s espionage priorities in Europe are heavily oriented towards military, defence, NATO-related targets, and hybrid warfare.
The study’s authors note that this overrepresentation may partly reflect heightened European vigilance towards Russian activity since the annexation of Crimea in 2014 and the full-scale invasion of Ukraine in 2022. However, they conclude: “The mere fact that there are so many cases to discover shows the breadth of Russian activities in Europe. It is not a stretch to conclude that, in terms of espionage, Russia is the defining threat in Europe today.”
The geography of convictions and the silence
The geographical distribution of convictions is as revealing for what it shows as for what it conceals. Estonia leads with nineteen convictions, followed by Germany and North Macedonia with eight each, Lithuania with seven, and Latvia with six. Three cases were identified in each of Greece and Sweden. The remaining countries, including Austria, Belgium, Denmark, France, Italy, Hungary, the Netherlands, Poland, Portugal, Romania, Slovakia, Spain, and the United Kingdom, each recorded one or two cases.
Thirteen of the thirty-three EU and NATO member states surveyed produced no espionage convictions during the observed period. The study identifies Ireland and the Czech Republic as particularly striking examples. The authors note, with evident scepticism, that it “seems very unlikely that Belgium, the centre of European Union administration and politics, has only had two cases of espionage”.
This disparity, the authors argue, reveals more about how European states respond to espionage, the adequacy of their legal frameworks, political will to prosecute, and the balance between judicial and diplomatic remedies, than about the actual scale of intelligence activity. As they observe, quoting Sherlock Holmes: “It is not the noise that should concern us, but the silence.”
Ten typologies of the modern spy
Perhaps the study’s most significant analytical contribution is its taxonomy of spy types. The previous FOI study identified five typologies. The current research expands this to ten, reflecting the diversification of intelligence recruitment and the erosion of the traditional boundary between insider and outsider threats.
The ten types are:
- The Traditional Insider, with legitimate access to classified information within military or intelligence organisations.
- The Ideologist, motivated by political belief or residual loyalty to Russia or the Soviet project.
- The Observer, recruited to photograph or monitor military installations, often via social media platforms such as Telegram.
- The Disposable, a low-value asset used for one-off missions, sometimes without full awareness of the crime being committed.
- The Intermediary, a logistics facilitator acting as a runner between handler and spy.
- The Multi-criminal, engaged in both espionage and related activities such as sabotage or influence operations.
- The Specialist, a non-military expert whose professional skills grant access to sensitive information.
- The Mobile Spy, exploiting EU freedom of movement and Schengen borders to operate across multiple jurisdictions.
- The Connected Agent, recruited through diaspora, cultural, or religious networks, and espionage rings composed of coordinated operatives.
- These categories are explicitly non-exclusive. An Observer may also be a Mobile Spy; a Disposable may be embedded in a criminal network; an Insider may simultaneously be an Ideologist.
The taxonomy’s value lies in capturing the growing complexity of recruitment profiles and alerting counter-intelligence professionals to emerging combinations.
The data challenges the traditional fixation on insiders with top-secret clearance. Only about half of the 70 convicted individuals were traditional insiders. A large proportion were non-insiders with no formal access to classified material, recruited to photograph buildings, military equipment, or troop movements. Seventy-two per cent were civilian employees rather than military personnel. The mean age at conviction was 48, ranging from 21 to 82. Almost all were male; only four were women, three of whom were married to a co-convicted spouse.
MICE still works but the toolbox is expanding
The classic MICE model, Money, Ideology, Coercion, Ego, remains the most reliable framework for understanding why individuals agree to spy. The study finds robust evidence for each component. More than half of those convicted, 41 out of 70, received financial compensation, though payment does not necessarily indicate primary financial motivation. Small initial sums are sometimes used as leverage for later blackmail.
Ideology remains a powerful driver, particularly in the Baltic states, where individuals with residual loyalty to Russia or the Soviet era were convicted of politically motivated espionage. Eighteen per cent displayed divided loyalties, and 41 per cent had some connection to the instigating country. Coercion appears in several cases, notably in Estonia, where young men involved in cross-border smuggling were blackmailed by the FSB into intelligence work. Ego and discontentment, including perceived career slights, inflated self-regard, boredom, or thrill-seeking, recur throughout the dataset.
What has changed is not the motivational foundation but the recruitment mechanism. Classic methods persist, including gradual relationship-building, honeytraps, and embassy-based cultivation. Alongside these, social media platforms such as Telegram, TikTok, Discord, and Facebook are now used for recruitment and communication. The study identifies cases where Russian propaganda on TikTok appears to have prompted individuals to volunteer intelligence. Online gaming platforms and darknet forums serve as additional channels for recruitment, networking, and exchange of classified material.
The data also suggests a rise in disposable agents since 2021: individuals recruited rapidly through digital channels, used briefly, and then discarded. This trend may have accelerated during the COVID-19 pandemic, when physical meetings were restricted.
What they are looking for
The study confirms Russia as an intelligence omnivore. Targets span military information, NATO capabilities, troop deployments, weapons systems, operational plans, defence infrastructure, political intelligence, sanctions, EU migration policy, energy infrastructure, and identities of potential recruits.
The energy dimension is particularly significant. The report links Russian interest in energy systems to hybrid warfare strategy, noting that sabotage of energy, transport, and communications infrastructure serves both military and political objectives, from disrupting supply to undermining democratic decision-making. Sweden and Finland’s NATO accession in 2023 and 2024 is expected to intensify Russian intelligence activity in the Nordic region.
A striking finding concerns collection of seemingly innocuous information. Publicly available data may be used to verify intelligence, build agent relationships through low-risk tasking, or gauge public sentiment before potential military action. Several convicted individuals were surprised their information was considered sensitive, highlighting that intelligence value is defined by the collector, not the source.
The convergence with organised crime
Nine of the 70 convicted individuals had committed other crimes, including smuggling, trafficking, and sabotage. In several Baltic cases, smugglers were coerced into intelligence work by Russian services leveraging criminal exposure.
The authors warn this convergence may deepen. Criminal networks provide clandestine infrastructure, cross-border logistics, and a pool of recruitable individuals. The May 2025 conviction of six Bulgarian nationals in the United Kingdom for spying on behalf of Russia may indicate expanded use of mobile spy networks drawn from criminal or diaspora communities.
Implications for European security
The study carries several implications.
First, Europe’s legal infrastructure is uneven and often inadequate. The absence of convictions in major capitals cannot credibly reflect absence of espionage. Belgium, hosting EU and NATO institutions, has produced only two convictions in seventeen years. The United Kingdom has struggled to prosecute suspected Chinese spies. Swedish prosecutors described a post-2017 evidentiary approach allowing prosecution without exposing sensitive sources, which other states may adopt.
Second, the insider threat has diversified. Non-insider spy types, observers, disposables, mobile spies, and connected agents, require broader counter-intelligence focus. Civilians with specialist infrastructure knowledge are increasingly represented. EU freedom of movement enables cross-border recruitment, complicating national responses.
Third, energy infrastructure is a primary intelligence target, reinforcing the need for integrated security models linking intelligence risk to operational resilience.
Fourth, digital recruitment lowers barriers to entry. Social media and encrypted platforms enable scalable targeting, while disposable agents create a distributed and harder-to-detect threat.
This study represents rare empirically grounded, open-source intelligence research at national level. Its dataset reflects only a fraction of espionage activity, yet the patterns are clear.
Russia’s intelligence apparatus operates across Europe with breadth and persistence. The threat has diversified beyond military insiders and embassy officers to include ordinary citizens recruited online, criminal networks co-opted for intelligence, and mobile operatives exploiting open borders. Motivations remain constant, money, ideology, coercion, and ego, but methods have evolved rapidly.
For Europe’s security establishment, the message is clear. The Cold War toolbox never closed; it has been supplemented. In a continent where some strategically significant states have convicted nobody, the question is not whether espionage is occurring, but how much remains undetected.
Andre Pienaar is CEO and Founder of C5 Capital, a specialist investment firm focused on energy security. The views expressed are his own.
Source Report: Elveborg Lindskog, E., Lioufas, A. and Wagman Kåring, A. (2026) Spies Among Us: Espionage in Europe — A study on convicted spies in Europe 2008–2024. FOI-R–5866–SE. Stockholm: Totalförsvarets forskningsinstitut (FOI).
