Romania’s intelligence service says it has prevented a Russian-coordinated sabotage operation targeting military and strategic infrastructure used by Nato allies, including bases, communications centres and Ukrainian transport aircraft.
The Romanian Intelligence Service (SRI) said on 8 September 2026 that a Russian citizen living in Romania had been detained after an investigation conducted with the country’s interior and defence ministries, prosecutors and partner intelligence services. The service said the operation was coordinated by Russia. Its statement said the suspect had been under surveillance since February as part of an investigation into an attempted act of sabotage.
Investigators documented the photographing and filming of strategic sites, including communications centres, national military bases used by Nato allies, and the headquarters of institutions responsible for defence, public order and national security. Critical infrastructure was also targeted for reconnaissance, according to the SRI.
A network of targets across Romania
The investigation was carried out by the SRI in cooperation with Romania’s Directorate for Investigating Organised Crime and Terrorism, known as DIICOT, the interior ministry, the defence ministry and intelligence services from partner countries. The authorities’ work, Romanian officials said, allowed the threat to be neutralised before a sabotage operation was carried out.
The Russian national is alleged to have gathered secret information and systematically recorded military facilities between February and July 2026. The areas identified in the investigation included Bucharest and the counties of Cluj, Constanța, Călărași and Ilfov. His activity involved tracking the movement of personnel and military equipment, as well as the operation of multinational Nato bases.
The breadth of the locations and subjects under observation points to an effort to assess the alliance’s defensive capacity and prepare the ground for possible provocations or attacks behind Nato’s forward infrastructure. Romania is a member of the alliance and hosts facilities used by allied forces, making the security of its military and communications network significant beyond its national borders.
Ukrainian aircraft among the surveillance targets
A separate focus of the suspected agent’s activity was the movement of Ukrainian Antonov transport aircraft in Romania. The investigation’s findings raise the possibility that Russian intelligence was seeking to identify and threaten logistical routes used to support Ukraine, according to the assessment accompanying the case.
The aircraft surveillance places the alleged operation within the wider contest over the movement of defence assistance to Ukraine. Information gathered around military bases, communications infrastructure and transport activity could provide a foundation for hybrid sabotage aimed at disrupting those routes, rather than a conventional attack on the battlefield.
Investigators also established that the suspect received instructions from Russian handlers through encrypted messaging services. The operation was therefore presented not as isolated photography by an individual, but as a planned intelligence and sabotage effort directed by Russian services and carried out through a civilian resident abroad.
Pressure on Europe’s counter-intelligence defences
The case adds to concerns over Russian intelligence and sabotage activity in the rear areas of European countries. Using civilians, including Russian citizens living outside the country, enables Moscow to conduct reconnaissance and disruptive operations while reducing the exposure of career intelligence officers, the assessment said.
Organising such activity on the territory of a sovereign state is a serious breach of Romanian criminal law and of the fundamental principles governing relations between states. The targeting of strategic civilian and military infrastructure also creates a direct danger for the wider European Union and threatens the stability of Nato’s collective security system.
Romania’s response demonstrates the value of cooperation between domestic security bodies, prosecutors, defence institutions and foreign partners. But the repeated appearance of similar cases means that European Union and Nato countries face pressure to strengthen counter-intelligence measures, improve the exchange of operational information and ensure that those involved in sabotage are held accountable.
The immediate threat in this case was stopped through surveillance, investigation and detention. The unresolved question is whether European security services can consistently identify such operations early enough when Russian intelligence continues to rely on local civilian intermediaries and encrypted communications.
How should Nato countries balance tighter counter-intelligence controls with the need to protect civil liberties and ordinary residents?
