Pre-Sabotage Phase
Why arrests outside a Danish defense plant are not a case of espionage, but target acquisition for kinetic sabotage – exposing how Moscow uses local proxies to probe NATO's pain tolerance
On October 19, 2026, Danish police and the national intelligence service (PET) intercepted two men photographing the perimeter of a defense enterprise in Nørresundby. By the next day, they were sitting in a courtroom facing charges under Section 108 of the Penal Code: assisting foreign intelligence.
According to local reporting from DR, the suspects are reportedly Russian-speaking Ukrainians – a detail that further highlights the tactics of Russian intelligence, whether as a cover story of Ukrainian operatives or the recruitment of local proxies, though the underlying reality remains unchanged: Moscow is behind it all.
To an outside observer, this might look like a routine case of traditional espionage. However, it is not – the incident in North Jutland represents something far more dangerous: the logistical preamble to physical sabotage.
The proxy methodology
The quality of evidence in this case is high, and the operational signature is unmistakable. The arrests transition a theoretical intelligence assessment into an active crime scene.
Just one month prior, in September, PET issued a specific, public warning regarding a new Russian operational model: Moscow’s intelligence services were actively recruiting local proxies across Denmark and Europe to scout defense enterprises and critical infrastructure.
The Nørresundby incident is the exact execution of this blueprint. The methodology is clinical and compartmentalized: recruit low-level operatives remotely, task them with mapping the physical vulnerabilities of a target locally, and hand that intelligence over to a separate cell to execute the sabotage subsequently.
The two men arrested, along with their unidentified accomplices, were operating exactly within this first phase.
Target acquisition, not espionage
It is critical to distinguish between the intent of these operatives and classic industrial espionage.
When a hostile state wants to steal proprietary military technology, blueprints, or production schedules, it hacks the manufacturer’s servers or bribes senior engineers.
But when a hostile state pays local proxies to photograph physical perimeters, guard rotations, security cameras, and loading docks, it isn`t looking for intellectual property – yet, for the weakest point in the fence.
It`s calculating the optimal entry point for arsonists, or the exact coordinates for a localized explosive device. This is target acquisition for a kinetic strike.
Probing for the next war
This arrest must not be viewed as an isolated security breach, but as an exposed nerve of a continent-wide Russian campaign against European defense production.
As we explicitly warned in our previous analysis, Russia's next war, the Kremlin is systematically utilizing acts of hybrid sabotage across Europe to probe NATO’s pain tolerance. Moscow is mapping exactly how much infrastructure it can burn down – and how many supply chains it can disrupt – before the Alliance moves beyond diplomatic condemnations and treats these acts as Article 5 violations.
The targets are highly specific: facilities tied to the support and arming of Ukraine. So, by disrupting these plants, Russia achieves a dual objective: degrading the logistical lifeline to Kyiv, and testing the internal security apparatus of NATO member states on their own soil.
The swift action by Danish counterintelligence in Nørresundby successfully interrupted the cycle before the match was lit. But the incident serves as a glaring warning to the rest of the continent.
The Russian sabotage network is not dormant, because it is actively acquiring targets.
European capitals must recognize that local recruits with cameras outside defense plants are not just spies – they are the forward observers for a hybrid war that has already crossed NATO's borders.