Citizens Are First in Line Against Russia’s Sabotage in CEE

Clear legal obligations and public awareness campaigns will embolden citizens to report suspicious activities.

How to build an effective system of cooperation between authorities and citizens in reporting suspicious activities? The EU governments should:

• Raise awareness of the nature and scope of grey-zone activities
• Inspire civic engagement through targeted channels and messaging
• Actively utilise and proliferate technologies that power the reporting

The urgency is now clear

On 20 July 2026 Lithuania’s Defence Minister Robertas Kaunas publicly warned that Poland and the Baltic states may become Russia’s ‘nearest target’ for escalation due to Moscow’s failure over Ukraine. The minister’s words supported an intelligence assessment earlier cited by President Gitanas Nausėda.

In recent weeks, multiple news outlets have warned that Russia may seek to test NATO’s resolve through limited kinetic actions against NATO’s eastern flank, while remaining below the threshold that would trigger a collective response under Article 5 of the Treaty. The warnings have included scenarios, like drone and missile-related provocations, false flag operations, as well as border incursions.

Since 2014, Poland and the Baltic states have invested heavily in preparing for potential Russian grey zone aggression. Yet the scale and diversity of such activities observed across Europe in recent years illustrate that public security and military services alone can no longer effectively monitor and identify every suspicious act that may undermine democratic resilience and threaten national security. As a result, the wider civilian society needs to play a more active role.

Grey zone attacks in Europe

Until 2022 Russia relied heavily on intelligence operatives working under diplomatic cover – officially posted in embassies, consulates, and trade missions – to conduct espionage, sabotage, and other forms of malign grey zone activity across Europe. Following the full-scale invasion of Ukraine, many European countries have ousted such ‘diplomats’. According to the Foreign Intelligence Service of Ukraine, by October 2025 up to 700 Russian operatives had been expelled, including 58 from Poland alone.

Deprived of this traditional infrastructure, Moscow has since adapted its operational playbook and has turned to recruiting local actors to carry out grey-zone activities across the continent. At least 151 grey zone incidents linked to Russia have been confirmed between February 2022 and February 2026, with 31 of them occurring in Poland.

In November 2025, Railway explosions southeast of Warsaw placed the lives of nearly 500 people at risk. A year earlier, a parcel bomb plot which was carried out by a locally recruited proxy who dispatched four incendiary packages came close to triggering a major aviation disaster.

Clearly, the threat is not abstract. Critical infrastructure facilities are particularly vulnerable to kinetic activities that fall short of direct aggression. This demands a whole-of-society approach built on civil-military cooperation.

Given the scale of grey zone incidents in CEE, it is worth assessing how civilian populations are able to recognise and report such activities, as well as the extent to which citizens feel responsible for contributing to public security.

Awareness and willingness to report grey zone activities

According to a survey conducted by the University of Latvia, a substantial portion of respondents across the Baltic capitals believe they already personally contribute to national security. Agreement with the statement that individuals are doing enough to keep their country safe reached 53 per cent in Vilnius, 65 per cent in Riga, and 72 per cent in Tallinn. Awareness levels also appear relatively high, with roughly two-thirds of the residents in the Baltic capitals reporting that they understand what constitutes critical infrastructure. Similarly, large majorities – 78 per cent of respondents in Riga, 80 per cent in Tallinn, and 92 per cent in Vilnius – would consider photographing, filming, or observing critical infrastructure or a military facility as suspicious activity.

However, willingness to report such activities reveals notable demographic divides. In Riga, for instance, 76 per cent of Latvian respondents view drawing pro-Russia or anti-NATO graffiti as suspicious activity that should be reported, while only 35 per cent of Russian respondents share this assessment. Gender disparities are also evident: in Tallinn, 77 per cent of men report understanding what critical infrastructure facilities are, compared to just 55 per cent of women. These disparities across demographic groups highlight the need for targeted and evidence-based policy responses.

Source: University of Latvia

Legal obligation or public awareness?

So, what is the most appropriate way to engage citizens in reporting suspicious activities? Should governments adopt a more coercive approach – similar to legal obligations requiring individuals to report witnessed crimes? This was the guiding question of the legal foresight prepared within the Resilient Futures Fellowship programme 2026.

The brief emphasises the importance of fostering a strong sense of moral responsibility, combined with significantly improved public awareness of activities that may carry serious implications for national security. In this approach, citizens are not treated merely as passive observers bound by legal duty, but as active participants in safeguarding democratic resilience.

Download the full brief

An effective framework would therefore combine clear reporting channels with practical, behaviour-based guidance. It would strengthen internal reporting obligations for providers of critical services, invest in employee training, and ensure the availability of confidential reporting options. Crucially, authorities must also close the feedback loop – demonstrating that reports are taken seriously, handled professionally and genuinely contribute to security outcomes.

This translates into several concrete steps:

1. The governments must raise public awareness about the evolving and complex nature of the threat landscape. Citizens cannot report what they do not recognise, and grey-zone activities are becoming ever more sophisticated.
2. Authorities should actively encourage civic engagement through targeted information campaigns, drawing on models such as ‘see something, say something’.
3. User-friendly and trustworthy technological solutions should be developed to enable both open and anonymous reporting, incorporate safeguards against abuse, including malicious or false submissions, and ensure that reporters receive timely and meaningful feedback.

Featured illustration uses content elements by Wikimedia Commons / Kusurija, bne IntelliNews, Aleksander Kaasik.

• Baltic Sea
• Baltics
• CEE
• Central and Eastern Europe
• Civil Society
• Defence
• Estonia
• Hybrid Warfare
• Latvia
• Lithuania
• Poland
• Security