The revelations that the GRU – Russian military intelligence – was behind the blast at a Czech arms depot in October 2014 that killed two people has sparked a major diplomatic row between Prague and Moscow.
But it has also raised questions about what the GRU is capable of, whether it can be deterred and what other operations it may have already undertaken.
The mission of Unit 29155 of the GRU is sabotage, subversion and assassination, European intelligence services believe.
Following the Salisbury poisoning in the UK in 2018, security services across Europe have been methodically working to trace its actions, following the movements of the 20 or so officers who undertake clandestine missions abroad.
This has shone new light on events, like the poisoning of a Bulgarian arms dealer in 2015 as well as the Czech explosion.
The unit was also linked to an attempted coup in Montenegro in 2016 aimed at preventing the country aligning with Nato. Alleged agents were convicted in court (in their absence).
French security services established that the unit used a region in the Alps as a forward base of operations for travel to other countries. It has also been linked to the offering of bounty payments to the Taliban for attacks on US forces in Afghanistan, although last week US officials said they had only low-to-moderate confidence about this.
What lies behind this pattern of activity?
Most of the events discovered so far date from after 2014. That year, particularly with the Ukraine crisis, seems to be the point at which the Kremlin began to see itself as in conflict with the West – a conflict fought below the threshold of traditional war and using “grey zone” methods.
These ranged from newer online disinformation operations and cyber hacking directed at the West (including the US 2016 election) by some units of the GRU, but also the unleashing of Unit 29155 to undertake more traditional covert action.
Some ask whether the revelations from the Czech Republic suggest a sloppiness in the unit’s work – for instance the way two men used the same cover identities (Petrov and Boshirov) for that operation and Salisbury. The investigative set Bellingcat has also traced the way GRU operatives sometimes used sequential passport numbers which could be easily linked together.
But it has still taken nearly seven years for the Czech case to come to light and just because a team is occasionally sloppy does not mean it is not also dangerous – with two people killed in the Czech Republic and one local woman, Dawn Sturgess, killed near Salisbury by discarded nerve agent.
And there may still be more to expose. There are other events – including deaths and explosions – which may be re-evaluated in the light of new evidence and linked to the unit as the travel patterns of the members of the unit are analysed.
What has been crucial is that since Salisbury more and more countries have been willing to work together to share information and confront Moscow – finding safety in numbers and increasingly outraged by what they see as Russia’s aggressive tactics.
It has not just been the UK and the US, but others as well – with Eastern European countries like Poland, the Czech Republic and Bulgaria all taking recent action against Russian spies.
But will the exposure serve to deter Russia and the GRU?
That may be hard given the way the Kremlin sees the world. Russia has denied all the allegations, saying they are absurd and far-fetched, and it does not appear to be worried by any embarrassment that results.
But the hope is that exposure of spies and their operations will at least make it harder for them to operate. For instance, the two men accused of involvement in Salisbury and the Czech explosion are unlikely to be able to travel outside of Russia since their identities have been made public.
Others may be trained to take their place though, and few believe that Moscow is likely to rein in its spies.