“It is a disaster”, says Bruno Kahl, Head of the German Intelligence Service (BND), about one of these cases, where a much-trusted BND officer now stands accused of having handed information to the Russians.

The conflict between Russia and the west, gaining in intensity after Russia’s aggression against Ukraine in 2014 and even more so after Russia’s full-scale invasion in 2022, has only increased the Russian demand for everything intelligence. The appetite in Moscow for insights into the political thinking and decision-making in the west as this relates, for instance, to sanctions against Russia and military support for Ukraine, is now much greater than before 2014. The same is true for the need to mobilise and recruit various assets. And it is also true for the need to think creatively and cynically about how to achieve a rapidly increasing catalogue of desired effects.

The term “intelligence” is traditionally viewed as a type of knowledge, organisation, and activity. At its core, the Russian intelligence community produces knowledge, through cyber espionage targeting the communications systems of state institutions or the recruitment of individuals to supply classified information on military affairs or advanced technologies. The purpose is to reduce the level of uncertainty relating to the future, thereby preparing decision-makers to respond or to allow Russian industries to achieve breakthroughs by illegally copying the work of others.

However, it is usually not so much the knowledge production as the character of the wider Russian intelligence organisation and the activities pursued by it that demands our attention. To counteract, we need to understand the unconventional nature of both, which inevitably entails confronting dilemmas relating to our interests and the set-up of our free and open societies.

A Seamless Intelligence Web

The Russian intelligence community is usually associated with its main organisations such as the Federal Security Service (FSB), the Military Intelligence Service (GU, previously the GRU), and the Foreign Intelligence Service (SVR) — listed here in order of importance. However, the approach of the Russian intelligence community is very comprehensive, meaning that it is much wider than institutional designations and organigrams would otherwise suggest. The approach may, in fact, be so comprehensive and the contours of the Russian intelligence organisations, therefore, so blurred as to make it highly problematic to focus too one-sidedly on the main organisations. Centres of gravity do exist within the wider intelligence community, exercising both formal and real leadership and setting directions with little or no consultation and external involvement, but it is instructive to view it as a seamless web of actors. These actors, found at the levels of both organisations and individuals, are all employed in support of the overall goals identified in the Kremlin.

Rossotrudnichestvo provides an example at the level of organisations. Self-defined as an agency with the mission “to strengthen Russia’s humanitarian influence in the world,” its internationally deployed staff act simultaneously as organisers of literature readings and piano concerts and recruiters and influence agents. “Never let an intelligence opportunity go to waste” seems to be the undeclared motto behind the comprehensive thinking, which has led Rossotrudnichestvo staff to reach out to attendees, when hosting events at a local Russia House, and to students, when visiting universities. The European Union in 2022 placed Rossotrudnichestvo on the sanctions list for doing exactly that — intelligence work under the much more innocuous cover of promoting culture. It operates under the instruction of and in close liaison with intelligence officers posing as diplomatic staff at the local Russian embassies.

The level of individuals is represented by Russian citizens, current or former, living in the west. Hugely controversial, the issue is very real and needs to be addressed. One should understand just how problematic it is to cast such a large and diverse group as a monolith and that the overwhelming majority of these Russian citizens do not in any way represent nodes in a seamless intelligence web. However, many western states have had recent experiences of espionage conducted by Russian citizens, residing there on a (semi-) permanent basis, on behalf of the main Russian intelligence organisations.

An individual’s rationale for engaging in such illegal activities will vary, and it will be somewhere on a continuum ranging from the purely ideological to the purely material. Most of the cases known remain somewhat shrouded in mystery, making it difficult to assess what has really happened. To illustrate, in 2020, the Danish Security Service (PET) arrested a Russian citizen, Alexey Nikiforov, living and working in Denmark. He was later convicted of espionage, sentenced to a prison term, and deported. Nikiforov operated under the instructions of an intelligence officer and handler at the Russian embassy in Copenhagen. It was to this individual that Nikiforov handed over sensitive information from the Green Tech company, which had offered him a position after his doctoral studies at the Technical University of Denmark. For his efforts, Nikiforov was paid in cash by his handler, but he was also active at the Russia House, playing the balalaika in a small band with other Russians, and socialised with openly pro-Kremlin individuals in the Russian expat community in Denmark. It is unknown to which extent he was driven by ideology and/or by material interests.

A material interest includes avoiding harm, to oneself or to close ones. One of the most remarkable aspects of the community of Russian citizens living in the west is the near-total absence within this community of any kind of opposition to the war in Ukraine. This silence stands in stark contrast to the loud condemnation of the war — a genocidal war of aggression filled with atrocities — often expressed by the surrounding society as a whole and by other sub-segments across this society. The community of Russian citizens living in the west has generally remained passive. This fact, undoubtedly, is explained partly by the approval of the war (including its nature) and partly by fear of the consequences of expressing opposition to the war (for oneself or relatives in Russia). Both are reasons for concern from a counter-intelligence perspective as they may relatively easily lead to increased recruitment, either on a voluntary basis or through the use of threats. The continued radicalisation of the Putinist regime suggests that the authorities will be willing to go even further to force Russian citizens living in the west to support Russian intelligence interests.

Pigeons walking in front of the Russian Foreign Ministry in April 2024. EPA/Scanpix

Three Domains

This wider Russian intelligence community conducts activities across three domains: physical, cyber, and cognitive. Starting with the latter, (dis-) information operations against western societies have become routine and are executed on a large scale every single day. All three main agencies engage in this, but so do supposedly “independent” organisations and individuals. It is an aggressive form of manipulation directed at various target populations. This is not new — Soviet intelligence also tried to manipulate public opinion in the west. Yet, the scale, speed, and, potentially, the level of penetration and effect have changed dramatically. Russian officials now brazenly announce that Russia interferes in elections in western states.

Next is the cyber domain where, again, all three main agencies are active. Their activities range from cyber espionage to highly destructive cyber operations designed to create data havoc and systems breakdowns. Russian cyber actors are routinely called out by western authorities — while individuals are put on sanctions lists and indicted — but their cyber activities continue unabated. The west has largely failed to deter the Russian agencies, which take full advantage of the attribution problem and outsource operations so that they are said to be unconnected to the Russian state.

Finally, the physical domain. The threat is well-known — as it explains why we have been guarding the perimeters of certain facilities for decades — but has gained a new urgency. From railway cables over to antennas and seabed pipelines, the list of critical infrastructure is almost endless in light of the increase in tensions between Russia and the west, as well as the Russian interest in causing disruptions. The new urgency stems from the fact that the cyber domain — a relatively new and rapidly growing one — also has a physical component. In April 2024, the German authorities arrested two Russian-German men, who have reportedly identified, in coordination with a Russian intelligence officer, military and industrial targets for sabotage. Our focus on the cognitive and cyber domains has probably led us to neglect, to some extent, the physical domain, where disruptions may be achieved at a relatively low cost and a catalogue of Russian intelligence’s targets is easy to compile.

Dilemmas

The development is fraught with dilemmas, which threaten to become more acute and of which I will just mention three. The first and very immediate dilemma relates to the expulsion of Russian spies disguised as diplomatic staff. A conservative estimate would hold that two-thirds of Russian embassy staff in western states are members of the Russian intelligence community. Given the comprehensive thinking within the Russian system, all diplomatic staff operating outside the gates of the embassy compounds may, in fact, be performing intelligence activities. The costs of their expulsion are felt at the western diplomatic missions in Russia. These states wish to maintain a presence there — at least to be able to support their own citizens. The relatively uncompromising expulsion of Russian intelligence staff from the west, following Russia’s full-scale invasion of Ukraine in 2022, has led many western embassies in Moscow to reduce their work to a bare minimum as personnel have been forced to leave. This obviously harms their interests.

The second dilemma relates to the Russian citizens living in western states. The 2017 Intelligence Law of China famously required its citizens to support their country’s intelligence efforts — a stipulation that raised concerns about “everyday espionage” conducted by Chinese citizens both in China and abroad. The Russian authorities have not (yet) passed a similar law, but there is good reason to believe that they have moved quite close to it. The continued radicalisation of the regime — with its aggressive talk of “patriots” and “traitors” — will easily lead to a situation where Russian citizens in the west will find themselves under pressure from the authorities to support the state’s intelligence efforts. This is likely to encourage western governments to introduce a more scrupulous vetting of Russian nationals before allowing them into critical sectors in, for instance, academia or industry.

The final dilemma concerns prioritisation. What to prioritise given the scope and nature of Russian intelligence activities across the three domains? We are far beyond intelligence as a type of knowledge, produced by traditional spies, in our dealings with the wider Russian intelligence community. A keyword for a very diverse range of intelligence activities is “destruction” — in the cognitive, cyber, and physical domains. And it is carried out by a very diverse range of actors in a seamless web. It is a monumental challenge, which will require dedicated work and careful prioritisation on the part of western counterintelligence as long as the current conflict between Russia and the west continues.

This article was written for the Lennart Meri Conference special issue of ICDS Diplomaatia magazine. Views expressed in ICDS publications are those of the author(s).

Hamas monitored political activity, online posts, and apparently even love lives. Palestinians were stuck between an Israeli blockade and a repressive security force.

The Hamas leader Yahya Sinwar has for years overseen a secret police force in Gaza that conducted surveillance on everyday Palestinians and built files on young people, journalists and those who questioned the government, according to intelligence officials and a trove of internal documents reviewed by The New York Times.

The unit, known as the General Security Service, relied on a network of Gaza informants, some of whom reported their own neighbors to the police. People landed in security files for attending protests or publicly criticizing Hamas. In some cases, the records suggest that the authorities followed people to determine if they were carrying on romantic relationships outside marriage.

Hamas has long run an oppressive system of governance in Gaza, and many Palestinians there know that security officials watch them closely. But a 62-slide presentation on the activities of the General Security Service, delivered only weeks before the Oct. 7 attack on Israel, reveals the degree to which the largely unknown unit penetrated the lives of Palestinians.

The documents show that Hamas leaders, despite claiming to represent the people of Gaza, would not tolerate even a whiff of dissent. Security officials trailed journalists and people they suspected of immoral behavior. Agents got criticism removed from social media and discussed ways to defame political adversaries. Political protests were viewed as threats to be undermined.

Everyday Gazans were stuck — behind the wall of Israel’s crippling blockade and under the thumb and constant watch of a security force. That dilemma continues today, with the added threat of Israeli ground troops and airstrikes.

“We’re facing bombardment by the occupation and thuggery by the local authorities,” Ehab Fasfous, a journalist in the Gaza Strip who appeared in the files of the General Security Service, said in a phone interview from Gaza.

Mr. Fasfous, 51, is labeled in one report as among “the major haters of the Hamas movement.”

The documents were provided to The Times by officials in Israel’s military intelligence directorate, who said they had been seized in raids in Gaza.

Reporters then interviewed people who were named in the files. Those people recounted key events, confirmed biographical information and, in Mr. Fasfous’s case, described interactions with the authorities that aligned with the secret files. The documents reviewed by The Times include seven intelligence files ranging from October 2016 to August 2023. The military intelligence directorate said it was aware of files containing information on at least 10,000 Palestinians in Gaza.

The General Security Service is formally part of the Hamas political party but functions like part of the government. One Palestinian individual familiar with the inner workings of Hamas, who spoke on the condition of anonymity because of the sensitivity of the matter, confirmed that the service was one of three powerful internal security bodies in Gaza. The others were Military Intelligence, which typically focuses on Israel, and the Internal Security Service, an arm of the Interior Ministry.

Basem Naim, a spokesman for Hamas, said the people responsible for the General Security Service were unreachable during the war.

With monthly expenses of $120,000 before the war with Israel, the unit comprised 856 people, records show. Of those, more than 160 were paid to spread Hamas propaganda and launch online attacks against opponents at home and abroad. The status of the unit today is unknown because Israel has dealt a significant blow to Hamas’s military and governing abilities.

The Israeli intelligence authorities believe that Mr. Sinwar directly oversaw the General Security Service, according to three Israeli intelligence officials, who spoke on the condition of anonymity because they were not authorized to discuss the matter publicly. They said the slide show was prepared for Mr. Sinwar personally, though they did not say how they knew that.

The presentation said that the General Security Service works to protect Hamas’s people, property and information, and to support its leadership’s decision-making.

Some slides focused on the personal security of Hamas leaders. Others discussed ways to stamp out protests, including the “We Want to Live” demonstrations last year that criticized power shortages and the cost of living. Security officials also tracked operatives from Palestinian Islamic Jihad, an ideologically aligned militant group that often partners with Hamas.

Some tactics, like amplifying Hamas’s own message, appeared to be routine politicking. In other instances, officials suggested using intelligence to undermine opponents and distort their reputations, though the files were vague about how that was to be done.

“Undertaking a number of offensive and defensive media campaigns to confuse and influence adversaries by using private and exclusive information,” the document read.

Security officers stopped Mr. Fasfous on his way to a protest last August, seized his phone and ordered him to leave, a report says. Mr. Fasfous confirmed that two plainclothes officers had approached him. The authorities searched his recent calls, and wrote that he was communicating with “suspicious people” in Israel.

“We advise that closing in on him is necessary because he’s a negative person who is full of hatred, and only brings forth the Strip’s shortcomings,” the document said.

The most frustrating thing, Mr. Fasfous said, was that the officers used his phone to send flirtatious messages to a colleague. “They wanted to pin a moral violation on me,” he said.

The report does not include that detail but does describe ways to “deal with” Mr. Fasfous. “Defame him,” the report said.

“If you’re not with them, you become an atheist, an infidel and a sinner,” Mr. Fasfous said. He acknowledged supporting protests and criticizing Hamas online, but said the people he was in touch with in Israel were Palestinians who owned food and clothing companies. He said he helped run their social media accounts.

The General Security Service’s goals are similar to those of security services in countries like Syria that have used secret units to quell dissent. The files of the General Security Service, though, mention tactics like censorship, intimidation and surveillance rather than physical violence.

“This General Security Service is just like the Stasi of East Germany,” said Michael Milshtein, a former Israeli military intelligence officer specializing in Palestinian affairs. “You always have an eye on the street.”

Palestinians in Gaza live in fear and hesitate to express dissent, analysts said.

“There are a lot of people practicing self-censorship,” said Mkhaimar Abusada, a professor of political science from Gaza City. “They just don’t want problems with the Hamas government.”

That view clashes with the most strident comments of Israel’s leaders, like President Isaac Herzog, who blamed Gazans for not toppling Hamas before the Oct. 7 attacks.

“There’s an entire nation that is responsible,” he said. “This rhetoric about civilians were not aware, not involved, it’s absolutely not true. They could have risen up.”

The General Security Service, the files show, also tried to enforce a conservative social order.

In December 2017, for example, the authorities investigated a tip that a woman was acting immorally with a man who owned a clothing shop. A security report noted that she visited the shop for an hour on one day, then more than two hours the next. The report presented no evidence of wrongdoing, but proposed that “relevant parties” address the matter.

An October 2016 report described young men and women performing unspecified “immoral acts” at a Palestine Liberation Organization office in Khan Younis at night. Hamas sees the Palestine Liberation Organization as a compromised entity, whose leader too often favors Israeli interests. The report offered no evidence of misdeeds but recommended summoning a man who claimed to be in possession of videos and pictures.

The files also show that Hamas was suspicious of foreign organizations and journalists.

When Monique van Hoogstraten, a Dutch reporter, visited a protest encampment along the border with Israel in April 2018, the authorities noted the most banal of details. They noted the make and model of her car and her license plate number. They said she took pictures of children and tried to interview an elderly woman Ms. van Hoogstraten confirmed the reporting trip in an interview with The Times.

The file recommended further “reconnaissance” on journalists.

None of the files reviewed by The Times were dated after the start of the war. But Mr. Fasfous said the government remained interested in him.

Early in the war, he said he took images of security forces hitting people who fought over spots in line outside a bakery. The authorities confiscated his camera.

Mr. Fasfous complained to a government official in Khan Younis, who told him to stop reporting and “destabilizing the internal front,” Mr. Fasfous recalled.

“I told him I was reporting on the truth and that the truth won’t hurt him, but that fell on deaf ears,” he said. “We can’t have a life here as long as these criminals remain in control.”