Danish intelligence issues public warning

The Danish Security and Intelligence Service (PET) disclosed that Russian intelligence agencies are preparing sabotage operations against Denmark's defense sector. Emil Græsholm, the head of counterintelligence at PET, stated in an interview with the daily newspaper Berlingske that concrete plans were uncovered targeting companies supplying military equipment to Ukraine. The intelligence agency determined that the operational preparations were sufficiently advanced to warrant a direct public alert to businesses and private citizens. According to Danish counterintelligence, Moscow aims to disrupt specific military deliveries bound for Ukrainian forces while seeking to deter Denmark from expanding its domestic defense capacity. Græsholm described the strategic objective behind the operations to Berlingske.

“The main goal is to stop concrete deliveries for Ukrainian defense. At the same time, it is about intimidating us so that we stop supporting the Ukrainians and do not develop our own defense potential.”

Recruitment methods and surveillance tactics

Investigators found that Russian intelligence operatives have attempted to recruit ordinary Danish citizens to conduct preliminary surveillance and reconnaissance tasks. These recruitment efforts occurred primarily through social media networks and online gaming platforms. Recruits, who often do not realize they are assisting Moscow, are tasked with recording videos or taking photographs of sensitive industrial facilities and critical infrastructure. Græsholm noted that the collected visual material serves as the operational baseline for potential physical attacks, including arson. The counterintelligence chief explained to Berlingske why public vigilance regarding these low-profile approaches is necessary.

“We speak about these methods because they do not have to look like in a spy movie.”

Expert analysis and European security context

Danish security analysts assessed the intelligence disclosure as a response to expanding physical threats across the continent. Flemming Splidsboel, an analyst at the Danish Institute for International Studies, told Danish Radio that the explicit mention of sabotage indicates threats such as cutting cables, toppling antennas, or physical attacks on individuals. Splidsboel also deduced from the public statements that intelligence services likely hold specific names of individuals contacted by Russian operatives. Jacob Kaarsbo, a former chief analyst at the Danish Defence Intelligence Service (FE), told broadcaster DR that going public demonstrates to Moscow that Danish authorities are tracking its covert operations. The Danish alert coincides with a broader pattern of unexplained fires and explosions at defense-linked facilities in Poland, Estonia, Bulgaria, and heightened surveillance in Italy, as well as an attempted drone attack at Leipzig/Halle airport in Germany.

Industry countermeasures and Russian denial

PET called on Danish defense manufacturers to enforce immediate security upgrades across their facilities and supply networks. Græsholm informed television network TV2 that many companies across the domestic defense industry are already actively putting protective measures in place. While PET noted in 2024 that Denmark faced elevated risks due to its support for Kyiv, officials indicated that the current planning shows an increased readiness by Russian agencies to carry out physical attacks. Moscow has consistently denied involvement in hybrid warfare and sabotage operations across European territory.