In the Autumn of 2024, a far right group appeared online calling itself Direct Action. It adopted many of the tropes common to the extremist fringe, obsessing over migration, celebrating Tommy Robinson, accusing mainstream politicians of treason and fomenting violent attacks against Muslims and mosques.
Around the same time, a young Ukrainian man in the UK, Roman Lavrynovych, took money in return for carrying out tasks for Direct Action. Lavrynovych and his Romanian associate Stanislav Carpiuc would put up posters – but they also carried out arson attacks against properties belonging to Keir Starmer, and took photos of the aftermath.
These men carried out their tasks in exchange for small sums of money and a promise of a Russian passport. They never got those passports – but that particular offer should have been a clue that something was amiss. Because, for all that Direct Action seemed to share its messaging and worldviews with Tommy Robinson, the group was not British in any way. It had been set up by Russian operatives, most likely, as we learned from an excellent BBC investigation, by Russian intelligence.
There’s a temptation to look at this story as a slightly pathetic episode: Ukrainians in Britain who should have known a lot better being gulled into marginal actions that had no real impact.
But this feels like complacency. The inescapable fact is that Russia paid for people to set fire to the prime minister’s house. That is a serious escalation: the act of a country that has decided it’s at war with us, even if we like to pretend we’re not at war with them.
Suggested Reading
Ukraine is 3D-printing its way to victory
And if you’re still unconvinced of the gravity of these plots, consider the example of an attempted attack carried out in August against a Ukrainian cargo plane on the tarmac at Leipzig airport. A drone packed with explosives hit the plane’s wing but failed to detonate. The drone had been piloted by Andrei Karshakou, variously described as a “proxy” or “disposable” agent from Belarus, with a criminal past. Karshakou was working for Oleg Levushkin, a Russian national with close links to the GRU military intelligence service.
The Antonov transporter was loaded with 25,000 litres of jet fuel at the time. Had it caught fire and exploded it could easily have created a mass-casualty event and destroyed a substantial part of Leipzig’s airport. These two failed operations had the potential to be very serious. They are also emblematic of a new type of warfare: the gig-economy saboteur.
On September 27, five British men from the London area were arrested in the Gloucestershire village of Fairford. Their objective remains a mystery: they were near an air base used by the Americans in its strikes against Iran, but reportedly didn’t appear to have any explosives or other suspicious devices with them. It remains hard to understand what they were planning to do.
Furthermore, one of the men himself had called the police, not the obvious actions of an undercover saboteur. On the other hand, prime minister Andy Burnham stated that there were “strong indications Iran played a part,” in whatever this particular escapade proves to be.
This would not be the first time that Iran has used “rent-a-spies”: as far back as October 2021, Iran’s Revolutionary Guard Corps (IRGC) attempted to stage the assassination of former US national security adviser John Bolton by hiring a (non-Iranian) hitman online. This operation failed, as many such gig-economy jobs appear to have done. So why are rogue states such as Russia and Iran resorting to this rent-a-spy method, when it appears to be largely unsuccessful?
The primary reason is that it has become far harder for hostile states to use their own, professionally trained operatives to carry out these attacks. If we take the Russian example, from 2018-22, hundreds of Russian intelligence officers operating out of embassies across Europe were expelled in a series of coordinated actions.
In a similar timeframe, Russian illegals – officers operating in deep-cover roles with no overt connection to the Russian state – were also disrupted in a variety of locations. This trend is not limited to Russia: a Chinese spy was arrested in Brussels in 2018 and this appears since then to have proved a significant deterrent to similar operations by the Chinese in the west.
As diplomatic relations have descended into the deep freeze, Iran has a very limited official footprint in the west, with tiny numbers of diplomats represented in its various embassies. So whether you are Iran, Russia or China, it is increasingly the case that you have no choice but to source your operatives from the market as contractors rather than from within your own ranks.
While recent events point to some of the limitations of these gig-economy operatives, there are still numerous advantages: it is very easy to target and recruit people online. It also requires far fewer resources than having a full team of state operatives on the ground, needing cover arrangements, logistics, special communications and other resources.
Suggested Reading
China’s new Arctic spy game
Outsourcing is also largely deniable. The men arrested in Fairford appear to be of mixed ethnicities and are all Britons. Proving a link from such people to the Islamic Republic of Iran may be very difficult. Similarly, in the case of the arson attacks on Starmer’s house, the legal case against them never made a formal link to Russia. It is impossible to prove this in a court of law, even if that link seemed obvious when laid out in a BBC report.
The arsonists appear not to have known who their paymaster actually was. For intelligence agencies, tracking these operations, arranged and contracted in encrypted chat rooms and dark web forums, is incredibly difficult.
Perhaps the most troubling thing about this new model is that gig-economy operatives are expendable and therefore far more dangerous. Iran and Russia won’t care if someone they hire is arrested or messes up. And the assassin-for-hire is often a dangerously inexperienced idiot-for-hire.
In a world where assassinations are carried out by state agents, those operatives may, counterintuitively, care about the reputational aspects of their work, because they are committed representatives of their country. They would want to be sure of a target before they acted, knowing that killing the wrong person would discredit their cause.
On the other hand, a gig-economy assassin only cares about the money they’re being paid for the hit, and the evidence suggests that these people are often vulnerable and naive young people with little understanding of the consequences of their actions.
In February 2025, Atilla Azimov, a 20-year-old gun for hire, killed a young student in Stockholm. His victim, Murad Abdelkader, was the wrong man. No doubt the Iranian paymasters of this operation were disappointed, but the long-term implications for Iran of the failure were limited.
So, while we are a long way from knowing the full story of what happened in Fairford, what these young men were supposed to be doing and the extent to which they were fully cognisant of their paymasters, what we do know is that this new form of outsourced operation is highly dangerous, very difficult to track and only set to increase.
In response, the US moved its bombers from the base at Fairford – is this evidence of the plot having already succeeded at some level? Even if not, with the onslaught of attacks carried out by these “spooks-for-hire”, one day, one of them will succeed. A plane may be destroyed and people will die – or perhaps a senior public figure or politician will be assassinated. If Russian or Iranian involvement were suspected in an outrage of that kind against the west, it could trigger an international crisis. Russia and Iran seem happy to continue this upward escalation. Are we prepared for the impact?
