Romania’s domestic intelligence service, the SRI, announced on October 26 that it had identified what it described as a network carrying out acts of sabotage on Romanian territory, and said the network formed part of a broader campaign of sabotage operations that it attributes to the Russian Federation across Europe. The announcement is one of the most pointed public statements a Romanian security institution has made about hostile activity on its soil since the start of the war in Ukraine, and it deserves to be read carefully, with the documented facts kept separate from the assessments and allegations that accompany them.

According to the service, the central episode under investigation is a fire that broke out on September 14 at the Carfil industrial platform in Brașov, in central Romania, a site located near facilities linked to the state defence company ROMARM. The authorities say the fire is being treated not as an accident but as a deliberate act, and that it is being examined as one element of a coordinated effort to strike at Romania’s defence industrial base.

The investigation is being conducted jointly by several Romanian institutions, including the SRI, the organised crime and terrorism directorate DIICOT, the Ministry of National Defence, the defence general directorate for intelligence DGIA, and the Ministry of Internal Affairs. Prosecutors say three people are under investigation in connection with the case, two of them citizens of Belarus and one a citizen of Ukraine. Two suspects were reported to have been detained in Germany, with Romanian and German authorities cooperating on the matter.

The SRI has described a recruitment model that it says is characteristic of the wider campaign. In its account, coordinators based in Russia recruit, largely online, citizens of former Soviet states who are present in the European Union, offer them payment, and direct them to carry out tasks without formal training and often without full knowledge of the larger operation they are said to be serving. The service says the targets of this broader campaign across Europe have included state and privately owned arms factories, military and industrial sites, international military facilities, and locations used to train Ukrainian forces.

The Romanian authorities also pointed to a separate case earlier this autumn, in which a Russian citizen was investigated on suspicion of photographing NATO-linked sites and Ukrainian Antonov aircraft, presenting it as part of the same pattern of intelligence-gathering and preparatory activity. Following the announcement, officials said security measures and patrols around sensitive sites had been increased.

The core of the SRI’s statement is an attribution: the claim that these acts were coordinated by the Russian state. That attribution is an intelligence and prosecutorial assessment. It is not, at this stage, a conclusion reached by a court, and it should be understood as such. The people named as suspects have not been convicted of anything, and under Romanian and European law they are entitled to the presumption of innocence. A search, a detention, or a prosecutor’s theory is not a verdict.

This distinction is not a technicality. Intelligence services across Europe have, over the past two years, publicly attributed a series of fires, derailments and other incidents to Russian-directed sabotage, and in a number of cases arrests and prosecutions have followed. In late 2025, Poland attributed damage to a section of railway line to sabotage, and several European governments have made similar claims. At the same time, attribution in such cases is inherently difficult: the recruitment model that intelligence agencies themselves describe, in which low-level operatives are hired remotely and kept ignorant of who ultimately directs them, is one that can make a definitive chain of command hard to prove in open court. Both things can be true at once. There can be a real and documented pattern of hostile activity, and there can also be a genuine evidentiary gap between an individual act and the state said to stand behind it.

Russia has consistently denied involvement in sabotage operations in Europe, and has rejected such accusations as unproven. That denial is part of the record, as is the fact that it has been offered in response to a growing number of specific allegations from multiple governments.

Romania occupies a particular position in this story. It shares a long border with Ukraine, hosts NATO infrastructure, and has become an important logistical corridor for the movement of goods, including grain, out of Ukraine. Its defence industry, including the state holding ROMARM, has taken on greater prominence as European governments have expanded military production. A campaign aimed specifically at arms manufacturing and at sites connected to the training or supplying of Ukrainian forces would, if confirmed, fit a strategic logic that European security officials have described repeatedly: the disruption of the supply chain sustaining Ukraine’s war effort, carried out below the threshold of open conflict.

That strategic reading is also why caution is warranted in the other direction. The language of hybrid warfare can expand to absorb incidents that later prove to have mundane explanations, and the political climate surrounding the war creates an incentive to interpret ambiguous events through the most alarming available frame. The responsible position is neither to dismiss the SRI’s account because it cannot yet be independently verified, nor to treat it as settled because it comes from a state institution. It is to report what the authorities have said, to note what they say they have found, and to wait for the evidence to be tested.

The case now moves through the ordinary machinery of a criminal investigation, with the added complication that it spans at least two jurisdictions and touches on matters of national security that may never be fully disclosed. DIICOT will have to establish, with admissible evidence and before a court, who did what, on whose instruction, and with what intent. The intelligence assessment that Russia coordinated the network may or may not be something that can be demonstrated to a judicial standard, and the two questions, what happened and who ordered it, may be answered with different degrees of certainty.

For now, what can be stated plainly is narrower than the headline. A fire occurred at a defence-linked industrial site in Brașov in September. Romanian authorities are treating it as deliberate. Three people are under investigation, two of them detained abroad. And the country’s intelligence service has placed the episode within what it describes as a Russian-coordinated sabotage campaign across Europe, an assessment Moscow denies and which the courts have yet to examine. How those threads are eventually resolved will matter not only for the individuals accused, but for how clearly Romania, and its allies, can show the public the difference between what they suspect and what they can prove.

By I. Constantin