Russia is running a sabotage war across Europe. Europe is answering it one arrest warrant at a time.

On Thursday, Germany's federal prosecutors arrested a Ukrainian man in Brandenburg named, under German privacy rules, only as Vadym Y. According to the prosecutors' statement, he had been in contact with a Russian intelligence service through a go-between since at least July 2025. He is accused of collecting information on the production of armoured vehicles, ammunition and explosives, and on personnel and military sites guarding NATO's eastern flank. Some of it was public. For the rest, prosecutors say, he pumped people in the European arms industry.

Friedrich Merz called the arrest a "success". Then, to his credit, he added the sentence that matters. "Let us not delude ourselves," the chancellor said, according to the BBC. "The activities of Russian intelligence services in Germany remain at a consistently high level."

He is right. And that is precisely the problem. Europe has become very good at catching the foot soldiers of Russia's shadow war, and remarkably bad at making the war cost anything.

The opening shot

This week the Wall Street Journal reported that US intelligence agencies now see the failed drone attack at Leipzig/Halle Airport as one of the opening shots of a stepped-up Russian campaign of sabotage against NATO countries. The sources, European officials briefed on the findings, say Vladimir Putin ordered it personally. The motive, as those officials described it, was frustration in Moscow this summer that neither the front line nor talks with Washington had forced Ukraine into the concessions Putin wanted.

The Leipzig details are not subtle. On 4 August, a drone struck the wing of a Ukrainian cargo aircraft at the airport and fell onto the tarmac with a tin can of explosives strapped beneath it. Politico, reporting with the Axel Springer investigative network, says the bomb failed to go off. A US intelligence source told ABC News the triggering mechanism had been disconnected. Leipzig is one of Europe's big cargo hubs, used by the US military and allies to move arms to Ukraine. US officials counted 18 drone incidents disrupting traffic there since January.

Since then, the pattern has filled in. The BBC listed a run of fires at defence sites in August: a warehouse of the Bulgarian arms maker EMCO, the drone maker Milrem Robotics in Tallinn, plants in Poland, and a foiled arson plot against a Ukrainian-owned drone factory in Slovakia. In September, two Bulgarians were arrested in Munich for allegedly throwing incendiaries at the defence firm Rohde & Schwarz. According to the WSJ's sources, Poland, Lithuania and Bulgaria have since reported sabotage at Starlink stations.

Sanctioned, and still in business

Here is the detail that should embarrass every European foreign ministry. Western intelligence agencies, according to the WSJ's report as relayed by LIGA.net, link Leipzig to Colonel Denis Smolyaninov of the GRU, Russia's military intelligence. Lithuania's State Security Department describes him as the head of the GRU's Ukraine department and links him to covert sabotage campaigns run in Europe over Telegram.

Colonel Smolyaninov is already under EU and UK sanctions for exactly this kind of work.

That is the European method in a single file. We identify the officer. We freeze assets he is unlikely to keep in Europe. We ban him from travel he was never going to make. And then, according to Western intelligence, he does it again at one of Germany's biggest airports.

The Kremlin, meanwhile, simply denies everything. The Russian embassy in Berlin told Politico it rejected "the baseless allegations concerning Russia's purported involvement in the alleged 'drone incident' at Leipzig Airport." Putin, according to the BBC, has accused Germany of planting evidence.

A police file is not a strategy

The arrests are real work, and German investigators deserve credit for them. But look at the shape of Europe's response. It runs on criminal law: warrants, investigating judges, pre-trial detention, trials years from now. Each case is handled as an isolated crime in an isolated country. The targets are the hired hands, often, as the BBC notes, cheap "gig economy" recruits picked up online and paid in cash.

Moscow does not see it that way. A senior NATO official told Politico that "from the Kremlin's point of view, the best option available to them seems to be to intensify the hybrid campaign they are waging against the West." For Russia this is one campaign, centrally run, aimed at one political goal: making Europeans afraid enough to stop arming Ukraine. Europe is answering a strategy with case numbers.

There is a domestic lesson too, and it is not comfortable. On 6 October, the same federal prosecutors arrested August Hanning, who ran Germany's foreign intelligence service, the BND, from 1998 to 2005. He is suspected of treasonous espionage and other offences. Prosecutors allege that a former BND chief of staff passed him about 2,000 documents over the years in return for payment. They have not said which foreign services were involved, and Hanning is entitled to the presumption of innocence. But a country whose former spy chief is in pre-trial detention should not pretend its security culture is in fine shape.

Make it cost

What would a serious answer look like? Not panic, and not escalation for its own sake. It would start with one shared, public attribution for each operation, issued jointly by the capitals hit, instead of a drip of national statements a month apart. It would make the price political and collective: expulsions of intelligence officers under diplomatic cover in every member state at once, not one capital at a time. It would make cutting off the GRU's logistics a priority. Politico's sources say the Leipzig explosives came into Germany via Bulgaria and Serbia, hidden in long-haul lorries. That is a border and customs problem the Union actually has tools for.

And it would accept Merz's own warning at face value. "We will likely see more such cases in the coming months and years," he said in Montenegro on Thursday. If the chancellor expects more, Europe should stop treating each one as a surprise.

Putin's saboteurs have already hit an airport, arms factories and satellite ground stations. Europe keeps winning the arrests and losing the argument.