The UK Government is preparing to fast-track legislation aimed at banning state-backed organizations and prosecuting individuals who support them, in a move to curb escalating sabotage linked to Russian intelligence. The proposed laws would treat these groups similarly to currently proscribed terrorist organizations.

This initiative responds to a growing number of attacks carried out by individuals acting as “proxies” for Russian intelligence services, which officials describe as an unpredictable and broad threat to national security. Since Russia’s invasion of Ukraine in 2022, British authorities have observed a rise in sabotage targeting logistics firms, public transport, and companies assisting Ukraine, with the intent of sowing instability and political discord.

One notable incident involved a neck massage pillow that caught fire inside a postal warehouse near Birmingham in July 2024. Investigations later revealed it was part of a Russian military intelligence operation to send self-igniting devices disguised as everyday items across Europe. Similar devices triggered fires in Germany and Poland but caused no casualties. A group currently on trial in Lithuania is accused of dispatching these incendiary items. Eurojust, the EU agency for criminal justice cooperation, reported that the suspects were recruited and directed by Russia’s GRU intelligence through encrypted messaging platforms, with payments frequently made in cryptocurrencies.

The tactics used in the pillow plot mirror those behind a March 2024 arson attack on a warehouse in east London containing satellite equipment destined for Ukraine’s war effort. Dylan Earl, a 21-year-old British citizen and former drug dealer, was identified as the ringleader. Earl allegedly collaborated with Russian intelligence operatives affiliated with the banned Wagner Group and employed acquaintances to carry out attacks. Authorities revealed Earl also attempted to recruit individuals for attacks on warehouses in Spain and the Czech Republic. A judge described the group as young men willing to betray their country for financial gain.

Beyond sabotage, proxies have been involved in traditional espionage activities. In May 2025, six Bulgarian citizens, including leader Orlin Roussev, were jailed for participating in a Russian spy ring based in a Norfolk guest house laden with surveillance equipment. The group targeted investigative journalists, political dissidents in the UK, a US military facility in Germany, and a Russian fugitive in Montenegro. The intricate personal relationships among members highlighted the complex nature of these spy operations.

Since the 2018 expulsion of numerous Russian diplomats following the Salisbury poisoning, intelligence services say Russia increasingly relies on proxies recruited via social media and instructed through encrypted channels, often compensated in cryptocurrencies. MI5 Director General Ken McCallum noted in his annual threat assessment that while many of these proxy operations fail due to amateurish execution, they represent a persistent challenge.

Counter-terrorism officials emphasize that those acting as proxies come from diverse backgrounds and motivations, ranging from ideological alignment to financial incentive, with some unaware of their handlers’ true identities. Senior national counter-terrorism coordinator Vicki Evans stated that proxies have no fixed profile and may include individuals on the fringes of criminality or those believing they are providing legitimate services.

Existing national security laws introduced in 2023 allow for prosecution based on evidence that individuals “ought reasonably to know” they are aiding foreign intelligence services. Jonathan Hall KC, the Independent Reviewer of State Threats Legislation, described these provisions as helpful tools for addressing proxy activities.

A Home Office spokesperson confirmed the government’s plans to introduce new proscription-style powers shortly, aimed at enhancing the legal framework to disrupt hostile foreign state activities, including those carried out by proxies.