In Portugal, a 23-year-old man has been charged with espionage and attempting to sell stolen information from NATO military computer equipment to the Russian Embassy in Lisbon. The incident occurred during what was described as “the world’s largest exercise dedicated to experimentation with unmanned systems — REP (MUS) 2025,” according to a statement by Portugal’s Prosecutor General’s Office. Nearly 300 people took part in the conference, the majority of whom were military personnel.
The data theft took place during the conference held from 3 to 7 February 2025 at the Naval Base School in Alfeite, Almada. The event was dedicated to experimentation with unmanned systems and brought together participants primarily from NATO member states’ armed forces. Particularly indicative is the involvement of an individual with a criminal background in carrying out the theft.
- Suspect: 23-year-old male (name not publicly disclosed)
- Country: Portugal
- Charges:
- Espionage
- Attempted sale of classified information
- Target of Sale: Russian Embassy in Lisbon
- Victims: NATO military personnel and NATO-linked technical assets
- Event: REP (MUS) 2025 – NATO unmanned systems experimentation exercise
- Official Source: Prosecutor General’s Office of Portugal
Event-Specific Figures
- Conference / Exercise Name: REP (MUS) 2025
- Type: NATO-linked multinational experimentation event on unmanned systems
- Dates: 3–7 February 2025 (5 days)
- Location:
- Naval Base School, Alfeite,
- Almada, Greater Lisbon area
- Participants:
- ≈300 attendees
- Majority: Active-duty military personnel
- Countries: Predominantly NATO member states
Nature of the Compromised Assets
- Stolen items:
- Military laptops
- Portable electronic devices (gadgets)
- Ownership: NATO military personnel
- Likely data types involved(based on prosecutorial framing, not full disclosure):
- Technical documentation
- Software environments
- Configuration data
- Experimentation results related to UAV / unmanned systems
Exact classification level and data volume have not been publicly released.
Operational Characteristics of the Case
- Method of Access:
- Physical theft during a high-density multinational military event
- Profile of the Suspect:
- Individual with a documented criminal background
- Operational Pattern:
- Attempted direct contact with a Russian diplomatic mission
- No evidence (so far) of long-term embedding or formal intelligence training
This strongly aligns with the “low-cost, high-deniability” recruitment model used by Russian intelligence services since 2022.
Strategic Significance (Analytical Facts)
- Focus Area:
- Unmanned Aerial Systems (UAS / UAVs)
- Counter-UAV technologies
- Defense-industrial experimentation data
- Why this matters:
- UAV superiority is a decisive factor in the war against Ukraine
- NATO experimentation data offers cost-free R&D shortcuts
- Enables Russia to:
- Improve electronic warfare countermeasures
- Adapt Western UAV design logic
- Bypass sanctions-restricted research pathways
Diplomatic & Counterintelligence Dimension
- The case explicitly confirms prosecutorial concern that:
- Russian diplomatic facilities function as intelligence coordination hubs
- Embassies are used for:
- Initial agent contact
- Data handover
- Tasking of non-professional operatives
This is consistent with EU-wide counterintelligence assessments since 2022.
What Is Not Publicly Known (As of Now)
- Exact NATO systems or programs affected;
- Volume of data extracted;
- Whether the suspect acted alone or had intermediaries;
- Whether data transfer was completed or intercepted beforehand.
This case demonstrates that NATO exercises inside the EU remain high-value intelligence targets, and that Russia increasingly relies on expendable, criminally connected actors rather than traditional intelligence officers to penetrate them. The combination of open scientific-military events, portable digital infrastructure, and foreign diplomatic access points continues to create exploitable vulnerabilities across Europe.
This incident fits into Russia’s broader strategy of employing “disposable” agents drawn from criminal circles and marginalized segments of society to collect intelligence and conduct sabotage against Europe’s critical infrastructure. For the theft of classified data, Russia recruits individuals with criminal histories and other socially marginalized actors, using them as expendable tools. This approach allows Russian intelligence services to shift full responsibility for such operations onto the executors themselves.
The case involving the theft of computers and gadgets belonging to NATO military personnel in Portugal demonstrates that Russian intelligence services are actively seeking confidential information related to the Alliance’s unmanned systems and technological developments. Such information is intended for use in Russia’s own weapons development programs and for potential application in the war against Ukraine, as well as in hybrid operations targeting NATO countries.
For Russian intelligence agencies, any technically sensitive and confidential information related to cutting-edge technological developments in the UAV and defense-industrial sectors is a priority. This makes every EU country a potential target for similar Kremlin intelligence operations.
Russia uses stolen information on unmanned systems to develop counter-UAV capabilities or to improve its existing systems, thereby circumventing imposed sanctions restrictions.
The attempt to sell the stolen data to the Russian Embassy in Lisbon once again demonstrates that Russian diplomatic missions operate as “intelligence hubs” under diplomatic cover. Russian embassies remain key centers for managing agent networks, which necessitates enhanced monitoring of their activities, a reduction of their presence, and closer scrutiny of individuals who may be involved in the collection of critically important information.
Policy Recommendations for EU and NATO Counterintelligence Authorities
1) Harden Security for NATO-Linked Conferences and Experiments
- Treat “innovation” events as operational environments: apply NATO-grade force protection and counterintelligence (CI) planning to any conference/exercise involving sensitive UAS/UAV, EW, ISR, or defense-industrial topics—even when branded as “experimentation” or “research.”
- Tiered accreditation: separate attendance into clearance tiers (public / restricted / classified sessions) with physical and digital segregation of rooms, networks, and devices.
- Controlled device policy: require government-furnished, managed devices (GFE) for participants in restricted sessions; prohibit personal laptops/USB media; enforce on-site scanning and port controls.
2) Reduce “Portable Data” Exposure
- Zero-trust data handling: assume compromise of any device brought into high-risk venues. Use ephemeral access, short-lived credentials, and “need-to-know” data rooms.
- No local storage by default: mandate that sensitive materials be accessed via secure virtual desktops or hardened portals with copy/download disabled where feasible.
- Rapid remote-wipe + auditing: require MDM across all devices used at events, with remote wipe, geofencing, and immutable logging.
3) Strengthen Venue and Perimeter Controls
- Anti-theft and tamper defenses: secure storage lockers, controlled charging stations, CCTV coverage of device areas, and “no unattended equipment” enforcement.
- Counter-surveillance (TSCM-lite): pre-event sweeps for unauthorized access points and covert recording devices; monitor for suspicious behavior around briefing rooms, networking gear, and device storage.
- Access integrity: background-checked security staff; strict visitor logs; controlled contractor access; two-person rule for handling sensitive equipment.
4) Target the “Disposable Agent” Recruitment Model
- Proactive policing–CI fusion: create standing mechanisms that connect CI services with law enforcement on patterns involving:
- theft of military devices,
- attempts to contact foreign missions,
- criminal networks offering “quick cash” for data/gear.
- Behavioral indicators training: train event staff and unit representatives to detect recruitment and tasking signals (unusual interest in badges, devices, schedules, logistics routes, or “who has what laptop” questions).
- Fast-track debriefing: implement immediate reporting channels and rapid debriefs for any loss, suspicious approach, or attempted purchase of “tech files.”
5) Tighten Diplomatic-Mission Risk Management (Within Legal Bounds)
- Risk-based monitoring: intensify surveillance and counterintelligence scrutiny of foreign diplomatic personnel credibly linked to intelligence activity, consistent with host-country law and Vienna Convention obligations.
- Persona non grata (PNG) readiness: develop pre-agreed EU playbooks for coordinated diplomatic responses (including PNG decisions) when evidence indicates embassies function as intelligence hubs.
- Contact reporting: require uniformed personnel, MoD contractors, and event organizers to file mandatory reports of unsolicited contacts, especially those involving money, devices, or technical info.
6) Standardize “Exercise Security Baselines” Across NATO and the EU
- Common minimum standards: NATO and EU should publish a joint baseline for:
- event classification rules,
- device policies,
- contractor vetting,
- incident response timelines,
- post-event forensics and reporting.
- Red-team every major event: include CI red teams that simulate theft, social engineering, and recruitment attempts—then implement corrective actions.
7) Incident Response That Treats Device Theft as a Security Breach
- Immediate containment: revoke credentials, rotate keys/certificates, invalidate tokens, and assume data exposure.
- Forensic triage: standardized playbook for imaging, telemetry review, and compromise assessment across all affected systems.
- Alliance-wide notification: establish a rapid NATO/EU reporting pathway so affected member states can quickly assess downstream risks.
8) Contractor, Vendor, and Research-Partner Controls
- Supply-chain screening: vet vendors and third-party researchers with access to restricted sessions, networks, or device handling.
- Least-privilege access for partners: partners get only what they need, for only as long as they need it, with auditable access logs.
- Secure collaboration tooling: discourage ad hoc file-sharing apps; mandate approved platforms with encryption, access control, and data-loss prevention.
9) Strategic Communications and Deterrence
- Public attribution when legally possible: transparent, evidence-based statements increase deterrence and reduce repeat attempts.
- Legal follow-through: prioritize prosecution of attempted sales and espionage facilitation; pursue asset seizures where applicable.
- Sanctions support: when actors are tied to foreign intelligence tasking networks, consider targeted sanctions on facilitators and front entities.
10) Metrics and Continuous Improvement
- Track and report:
- number of security incidents per event,
- time-to-revoke credentials after loss,
- compliance rates with device rules,
- number of suspicious-contact reports,
- outcomes of red-team findings and remediation.
2. Why NATO “Innovation Events” Are Prime Intelligence Targets
The REP (MUS) 2025 conference represents a perfect intelligence opportunity from a Russian perspective:
- Concentration of multinational military personnel
- Presence of prototype systems, experimental software, and test data
- Relaxed security norms due to the event’s research and experimentation framing
- Heavy reliance on portable digital devices
- High information density over a short period
Unlike classified operational briefings, such events often sit in a grey zone between civilian research and military secrecy, creating exploitable ambiguities in security enforcement. Russian intelligence has demonstrated a clear understanding that pre-deployment experimentation data can be as valuable—if not more so—than finalized weapons specifications.
3. Strategic Value of UAV and Counter-UAV Intelligence for Russia
The prioritization of unmanned systems is not incidental. The war against Ukraine has decisively demonstrated that:
- UAVs are now central to battlefield awareness
- Counter-UAV systems shape airspace denial at tactical and operational levels
- Iterative design improvements offer disproportionate battlefield advantages
For Russia, access to NATO experimentation data provides three strategic benefits:
- R&D Acceleration
Bypassing years of trial-and-error by observing NATO testing methodologies, system failures, and optimization logic. - Sanctions Circumvention
Replicating or adapting Western design concepts without accessing restricted components or formal cooperation channels. - Operational Countermeasures
Tailoring electronic warfare, air defense, and deception techniques specifically against NATO-developed systems—well before their mass deployment.
4. The “Disposable Agent” Model: Intelligence Efficiency at Scale
The suspect’s criminal background is not an anomaly; it is central to the operational design.
Using individuals with criminal histories offers Russia several advantages:
- Plausible deniability: No formal link to Russian services
- Low financial cost: Small payments relative to intelligence value
- Psychological leverage: Debt, legal vulnerability, or greed
- Operational disposability: Arrests do not compromise networks
This mirrors similar Russian practices observed in:
- sabotage operations against European infrastructure,
- arson attacks linked to foreign intelligence tasking,
- logistics theft related to military aid to Ukraine.
The Portugal case thus fits into a broader hybrid warfare ecosystem, where intelligence collection, sabotage, and influence operations increasingly overlap.
5. Russian Diplomatic Missions as Operational Hubs
The attempted sale of stolen data to the Russian Embassy in Lisbon reinforces a long-standing counterintelligence assessment: Russian diplomatic missions continue to function as multi-purpose intelligence platforms.
Embassies provide:
- Secure communications infrastructure;
- Legal protections and diplomatic immunity;
- Safe initial contact points for non-professional agents.
- Plausible civilian interaction space
Crucially, the embassy’s role here was not complex intelligence handling, but transactional validation—confirming value, authenticity, and payment mechanisms. This underscores that Russia does not require sophisticated tradecraft when Western security environments remain permissive.
6. Systemic Vulnerabilities Exposed
This case exposes several structural weaknesses across the EU and NATO:
- Under-securitization of research-focused military events
- Fragmented counterintelligence standards across member states
- Insufficient monitoring of device theft as a national security incident
- Gaps between law enforcement and intelligence coordination
- Overreliance on participant compliance rather than enforced controls
Most critically, it highlights a flawed assumption: that espionage primarily occurs through elite, state-level actors, rather than criminal proxies operating in plain sight.
7. Implications for NATO and EU Security Posture
If unaddressed, this model enables Russia to:
- Systematically harvest NATO technological advances
- Neutralize future capability advantages before deployment
- Conduct “pre-countermeasures” planning
- Undermine alliance cohesion through asymmetric intelligence gains
Every EU member state hosting multinational military events—particularly those involving UAVs, AI, EW, or cyber systems—should now be considered a potential front line in Russian intelligence collection.
8. Strategic Assessment
The Lisbon espionage case is best understood not as a failure of Portuguese security, but as a warning signal for the entire Alliance. Russia has adapted faster than Western counterintelligence architectures, exploiting openness, decentralization, and the civilian-military overlap inherent in modern defense innovation.
Unless NATO and the EU recalibrate their approach—treating innovation environments as contested intelligence spaces—similar incidents will not only recur, but escalate in scale and sophistication.
Why Russian Intelligence Turns to Criminals for Confidential Information
Risk Transfer and Plausible Deniability
By using criminals and socially marginal actors, Russian intelligence services—primarily the GRU, SVR, and FSB—externalize operational risk.
- Arrests expose individuals, not intelligence officers.
- Criminals have no formal or provable link to the Russian state;
- Diplomatic fallout is minimized or avoided entirely.
This allows Moscow to continue intelligence collection below the threshold of political retaliation.
Collapse of the Traditional Intelligence Model in Europe
Since 2022, EU and NATO states have:
- expelled hundreds of Russian diplomats,
- dismantled long-standing intelligence networks,
- placed Russian embassies under intensified surveillance.
As a result, classic HUMINT tradecraft became costly and fragile. Criminal proxies solve this problem:
- they require no diplomatic cover,
- no long-term placement,
- no ideological commitment.
They are operationally disposable.
Cost–Benefit Superiority
From Moscow’s perspective, criminal recruitment is extremely cost-effective:
- Low payments (often thousands, not millions)
- No pensions, training pipelines, or extraction planning
- High-value returns when targeting digital devices
A stolen laptop from a NATO officer may contain:
- configuration files,
- software environments,
- test results,
- internal communications.
The intelligence value can exceed that of a recruited officer—at a fraction of the cost.
Alignment with Russia’s Hybrid Warfare Doctrine
Modern Russian strategy deliberately blurs the boundary between crime, intelligence, and warfare.
Criminals are used because they:
- operate in civilian space,
- blend into urban environments,
- exploit legal and social grey zones,
- create ambiguity between espionage and ordinary crime.
This mirrors Russian use of:
- criminal hackers,
- smuggling networks,
- proxy sabotage cells,
- “patriotic” cybercriminal groups.
In hybrid warfare, ambiguity is a weapon.
Access Advantage in Open Societies
EU and NATO states are structurally vulnerable because they:
- host open conferences and innovation events,
- allow broad civilian–military interaction,
- protect privacy and due process,
- separate policing from intelligence more strictly than Russia.
Criminals exploit:
- trust-based environments,
- relaxed security at research-focused events,
- widespread use of portable devices.
Russian intelligence exploits Western openness without reciprocating it.
Criminals Are Ideal for “One-Time” Intelligence Tasks
Russia increasingly prioritizes transactional intelligence collection rather than long-term penetration.
Criminals are ideal for:
- device theft,
- quick data extraction,
- courier-style delivery,
- attempted data sales via embassies or cutouts.
No ideological loyalty is needed—only opportunity and incentive.
7. Legal and Psychological Shielding for the State
If exposed, Moscow can credibly claim:
- “This was ordinary crime”
- “The individual acted independently”
- “No evidence of state involvement”
This strategy exploits the high evidentiary threshold Western states require to formally accuse a government of espionage.
Russian intelligence uses criminals because they offer:
- maximum deniability
- minimum cost
- low political risk
- high intelligence yield
- scalability across Europe
This is not a sign of weakness. It is a successful adaptation to a hostile counterintelligence environment.
For NATO and the EU, the implication is stark:
If espionage is expected to look like espionage, it will be missed.
Modern Russian intelligence increasingly looks like crime, not spying—until the damage is already done.
What “the model” looks like in the real world
Across the cases below, you repeatedly see:
- young / economically vulnerable recruits or people with criminal histories;
- remote tasking (often online), small or none-payments (cash/crypto/in-kind);
- simple tactics (arson, device theft, courier “test parcels”) with high strategic payoff
- deniability (actors look like common criminals, not intelligence officers)
Chatham House and IISS both describe this as a shift toward freelancers / a “gig-economy” sabotage approach where the operational barrier is intentionally kept low.
Case map (2022–2025)
| Year | Country | Incident type | Proxy/criminal indicators | Target / strategic purpose |
| 2024 | Lithuania | Arson attack on IKEA in Vilnius | Teen/young perpetrator; prosecutors said acted in interests of Russian structures; payment promise reported as €10,000 + a BMW | Symbolic + strategic intimidation; pressure on pro-Ukraine states |
| 2023–2024 | Poland + Baltics | Organized arson/sabotage group | Described as an organized criminal group operating across borders | Destabilization; intimidation; hybrid pressure on Ukraine-supporting states |
| May 2024 | Poland | Sabotage/arson planning (incl. attempt vs US-owned paint factory) | Court described criminal ring; suspect said he received online orders + money | Critical industry disruption; signal vulnerability |
| 2024 | Poland | Arrests over alleged Russian sabotage plot | PM Tusk explicitly referenced recruitment from criminal circles; allegations include beatings/arson/attempted arson | Broad destabilization in region |
| 2024 (reported) | UK (London) | Warehouse arson | Young recruit; alleged remote recruitment via networks linked to Wagner/GRU/FSB framing | Sabotage + intimidation; chaos effects |
| 2025 (reported) | Germany / Switzerland (and wider Europe) | Parcel-bomb / incendiary courier plot | Suspects accused of acting on behalf of Russian actors; use of GPS-tracked test parcelsindicates tasking discipline but low-level executors | Disruption of logistics/transport; scalable deniable attacks |
| 2025 (investigations) | Baltics / Poland / broader EU | Courier parcels sabotage network (investigative reporting) | Reported coordinator with criminal past, forged documents; recruitment via Telegram; “disposable agents” framing | Cross-border, scalable sabotage |
Context anchor (scale claim): AP reporting on the Lithuania IKEA case notes investigators linking it to a broader pattern and cites “approximately 80 incidents recorded since 2022” (as reported by AP, reflecting investigators’ framing).
What the cross-case pattern tells you
Moscow is optimizing for scale + deniability, not elegance
Most acts are simple (fire, theft, courier items), but strategically potent—because they create fear, cost, and uncertainty at low expense. IISS notes many attacks involve minimal technical sophistication, consistent with this approach.
The “criminal proxy” method is especially effective in open environments
Events, shopping centers, warehouses, logistics chains—these are civilian spaces where policing thresholds and attribution standards make it harder to respond quickly and politically.
Embassies and cutouts become “validation nodes”
Even when diplomatic officers aren’t the hands-on perpetrators, diplomatic infrastructure can function as contact/validation/payment nodes—while the risky parts are offloaded to expendable actors (your Portugal case fits this logic).
Implications for your Portugal case
Portugal’s incident looks like a HUMINT-light, device-centered variant of the same ecosystem:
- low-skill collection (theft),
- high-value target (UAS experimentation data),
- attempt to monetize/transfer via a Russian diplomatic mission.
That is the same “low-cost/high-deniability” principle seen in arson and courier plots—just aimed at confidential technical data instead of physical disruption.
Cold War Precedents: Limited and Instrumental Use
During the Cold War, intelligence services occasionally used criminals or irregular actors, but never as a dominant collection model.
a) Soviet Practice (KGB Era)
The KGB did use criminals in narrow contexts:
- Smugglers for covert logistics;
- Black-market intermediaries for currency, documents, or technology;
- Criminals under coercion inside the USSR (gulag leverage).
However:
- Criminals were subordinate tools, not autonomous collectors;
- Sensitive intelligence tasks remained officer-led;
- The KGB feared loss of control and contamination;
Criminals were considered unreliable and ideologically unsafe.
b) Western Intelligence (CIA / MI6)
Western services also used criminals—but defensively and tactically:
- Mafia cooperation in Italy (anti-communist operations);
- Smuggling networks for agent exfiltration;
- Occasional use of underworld contacts for access.
But:
- Criminals were never tasked with strategic intelligence collection;
- They were not used against core military secrets;
- There was strict compartmentalization.
c) East Germany (Stasi): The Closest Parallel
The Stasi came closest to modern practices:
- Extensive use of informal collaborators (IMs)
- Exploitation of compromised individuals
- Blackmail-based recruitment
Still:
- IMs were deeply controlled
- The Stasi prioritized long-term penetration, not one-off theft
- Operations were bureaucratically managed, not freelance
Why Cold War Intelligence Avoided Criminal Proxies
Across blocs, there were shared constraints:
a) High Political Cost of Exposure
- Espionage incidents could trigger:
- Diplomatic crises
- Escalation between nuclear powers
- States wanted tight command and attribution control
b) Intelligence as a Prestige Profession
- Intelligence officers were:
- Highly trained;
- Ideologically vetted;
- Career-based;
- Criminal outsourcing was seen as undisciplined and dangerous.
c) Pre-Digital Environment
- Intelligence required:
- Long-term placement;
- Physical access;
- Technical expertise;
- A random thief could not extract meaningful intelligence value.
What Changed After the Cold War — and Especially After 2022
Modern Russia is operating in a fundamentally different environment.
a) Digitalization of Secrets
Today:
- A stolen laptop = years of R&D;
- USB drives, credentials, cloud access carry strategic value;
- No deep training is required to steal containers of intelligence.
This makes criminal theft operationally sufficient.
b) Sanctions and Diplomatic Attrition
Since 2022:
- Hundreds of Russian diplomats expelled
- Traditional networks dismantled
- Embassies under surveillance
Result:
Officer-led HUMINT is costly and risky
Criminal proxies restore reach without rebuilding networks.
c) Hybrid Warfare Doctrine
Modern Russian doctrine intentionally fuses:
- Intelligence;
- Crime;
- Sabotage;
- Influence operations.
This was not true during the Cold War, when lines were rigid.
The Key Difference: Then vs Now
| Dimension | Cold War | Today (Russia) |
| Criminal use | Exceptional | Systemic |
| Role of criminals | Auxiliary | Primary executors |
| Control | Tight | Loose / disposable |
| Deniability | Secondary | Central |
| Targeting | Peripheral | Core military & tech |
| Escalation concern | High | Managed via ambiguity |
Strategic Interpretation
What Russia is doing now is not a revival of Cold War practice.
It is a post–Cold War mutation driven by:
- digital intelligence containers,
- sanctions pressure,
- degraded traditional networks,
- and a willingness to accept chaos at the margins.
In Cold War logic:
Criminals were a liability.
In modern Russian logic:
Criminals are a feature.
While intelligence services during the Cold War occasionally exploited criminal actors, such practices were peripheral and tightly controlled. Contemporary Russian intelligence operations represent a qualitative break with that tradition. The systematic use of criminals as disposable intelligence collectors reflects a strategic recalibration rather than historical continuity—one enabled by digitalization, sanctions-induced constraints, and a hybrid warfare doctrine that deliberately blurs the line between espionage and crime.
