The New Espionage Landscape in Europe: From Insider Leaks to Civilian Spies
A new European study of convicted spies reveals a sharp evolution in how foreign intelligence services recruit and operate across the continent. Traditional insiders are now joined by ordinary citizens, digital recruits, and one-time agents.
Espionage in Europe is no longer confined to embassies, intelligence officers, or Cold War archetypes. It has become more fragmented, more accessible, and in many cases, harder to detect.
A recent study by the Swedish Defence Research Agency analyzing espionage convictions across Europe between 2008 and 2024 identifies a shift toward a broader and more complex human intelligence landscape. The report is based on 70 convicted individuals across 20 countries and highlights a structural transformation in how foreign states conduct intelligence operations on European soil.
At the center of this shift is a widening recruitment base. While nearly half of the cases still involve traditional insiders with access to classified information, a growing share consists of individuals with no formal connection to state secrets. These include civilians tasked with photographing infrastructure, observing troop movements, or collecting open-source data that can be aggregated into actionable intelligence.
This expansion reflects a strategic adaptation. Intelligence services are no longer solely dependent on penetrating ministries or defense institutions. Instead, they are leveraging mobility, digital connectivity, and decentralized networks across the European Union.
The data suggests that geography matters. The highest number of convictions was recorded in Estonia, followed by Germany, with a broader concentration across the Baltic states. Western European countries reported significantly fewer cases, though this likely reflects differences in detection and legal frameworks rather than the absence of activity.
Russia emerges as the primary instigating actor, linked to the majority of identified cases, followed at a distance by China, Iran, and Turkey. According to the report, this aligns with broader intelligence assessments across NATO, where Russian services continue to prioritize operational and tactical intelligence collection in Europe following the war in Ukraine.
What has changed most is not necessarily who is targeted, but how.
Recruitment increasingly blends traditional tradecraft with digital methods. Social media platforms, professional networks, and encrypted communication channels are now integrated into intelligence workflows. In some cases, recruitment resembles gig economy dynamics, where individuals are tasked with small, compartmentalized activities without full awareness of the broader operation.
The study identifies ten distinct types of spies, expanding beyond the classic insider model. These range from ideologically motivated actors and financially driven operatives to so-called disposable agents used for single missions. This diversification reduces operational risk for sponsoring states while complicating counterintelligence efforts.
Motivation remains consistent with established frameworks. Financial incentives dominate, with more than half of the individuals receiving compensation. Other drivers include ideological alignment, personal grievances, and coercion, including blackmail. The report notes that motivations often overlap, reflecting a combination of personal vulnerability and opportunity.
Operational methods also show continuity alongside change. Photography remains one of the most common techniques, alongside document copying and data transfers via digital and physical means. Communication between agents and handlers ranges from face-to-face meetings to encrypted messaging and dead-drop techniques, indicating a hybrid model combining analog and digital tradecraft.
For European defense planners, the implications are structural.
Espionage is increasingly embedded in civilian environments, supply chains, and emerging technology sectors. Targets extend beyond military secrets to include critical infrastructure, research institutions, and industrial capabilities. This broad targeting scope reflects the growing importance of economic and technological intelligence in state competition.
The report underscores that conviction data represents only a fraction of actual activity. Espionage remains a low-visibility threat, with many cases undetected or unresolved. As a result, the observed trends likely underestimate the scale of foreign intelligence operations in Europe.
For NATO and EU member states, this evolving threat environment places greater emphasis on counterintelligence integration, public-private cooperation, and resilience across non-traditional sectors.
The contemporary espionage landscape is no longer defined by isolated breaches. It is shaped by networks, adaptability, and scale—an environment where the distinction between insider and outsider is increasingly blurred.
