The Digital Frontier of Sabotage: The Rise of the 'Spy Gig Economy' in Europe

European security landscapes are undergoing a dangerous transformation as hostile foreign intelligence services shift away from traditional espionage toward a more fragmented, digital-first approach. According to a recent analysis by Tom Field, a researcher at the International Institute for Strategic Studies (IISS), there is a rapid proliferation of what can be described as a "spy gig economy." In this new paradigm, state actors are bypassing professional intelligence officers in favor of remotely recruited proxies to conduct sabotage, arson, and repression across the continent.

This shift is primarily driven by the shrinking operational space for traditional spies. In recent years, European governments have aggressively purged their territories of illegal intelligence operatives and expelled hundreds of diplomats suspected of espionage, particularly from Russia. As the political cost and risk of deploying trained officers have surged, hostile states have turned to the internet to find cheap, expendable alternatives. The ubiquity of encrypted messaging platforms like Telegram has streamlined this process, allowing handlers to recruit agents from thousands of miles away without ever meeting them in person.

The profiles of these recruits are strikingly non-professional, ranging from opportunistic criminal gangs to vulnerable teenagers. The IISS highlights a disturbing trend where the line between organized crime and state-sponsored sabotage is blurring. For example, in the United Kingdom, two men were recently imprisoned for arson attacks targeting properties and vehicles linked to former Prime Minister Keir Starmer; investigations revealed they were recruited via Telegram by an individual tied to Moscow. Similarly, between 2022 and 2024, British authorities investigated at least 20 plots orchestrated by Iran that utilized local criminals as proxies.

The scale of this phenomenon is perhaps most evident in Ukraine, where the conflict has created a fertile breeding ground for proxy operations. Reports indicate that over 1,100 individuals were accused of carrying out terrorist or sabotage acts for Russia between 2022 and 2024, with approximately 20% of them being minors. Meanwhile, China has been noted for using similar proxy networks to facilitate transnational repression and engage in commercial espionage.

From the perspective of the recruiting state, the "gig economy" model offers several strategic advantages. Most notably, it provides a layer of plausible deniability. If an amateur agent is captured, the sponsoring government can easily distance itself from the operation. Furthermore, the financial cost is minimal, and the state avoids the loss of highly trained intelligence personnel.

However, this reliance on amateurs introduces a volatile element of unpredictability. Unlike professional spies, these proxies lack formal training and often operate with reckless abandon. The IISS points to a case in Sweden where a teenager recruited by the Islamic Companion Movement (IMCR) on behalf of Iran attempted an assassination but ended up killing the wrong person due to sheer incompetence. There are also emerging signs that these agents are "sub-contracting" their assigned tasks to other third parties, further distancing the operation from the original handler's control.

This lack of command and control creates a high risk of unintended escalation. If a reckless proxy carries out an attack that results in mass casualties or significant diplomatic fallout, it could trigger a geopolitical crisis that the sponsoring state did not originally intend. Tom Field likens these disposable agents to "cheap suicide drones"—tools that are easily deployed and discarded, but which leave the target nations facing a daunting challenge in how to sustainably neutralize a threat that is both decentralized and digitally driven.