Romania: seven months of photographs, and no attack to show for it
On 8 September the Romanian Intelligence Service (Serviciul Roman de Informatii, SRI) announced that it had disrupted what it called a sabotage operation coordinated by the Russian Federation. A Russian citizen living in Romania is alleged to have spent February to July 2026 photographing and filming military bases used by NATO allies, communications centres, defence and public-order headquarters, critical infrastructure, and Ukrainian Antonov cargo aircraft while they were on Romanian soil.
Romanian reporting names him as Ivan Kutsenko, 40. He was detained on 8 September and the Bucharest Court of Appeal ordered thirty days' preventive arrest on a charge of attempted acts of sabotage. The SRI's own statement announced no arrest at all; that came from the prosecutors.
↓ Download one-page brief (PDF)February 2026 - the SRI opens on him
The service begins monitoring a Russian citizen resident in Romania over what it describes as possible preparation for acts of sabotage.
February to July 2026 - the collection runs
On the DIICOT account he identifies, watches and records targets under the direct coordination of a person contacted through encrypted messaging services, and sends the product on.
The target list widens
Communications centres, NATO-allied military bases, the headquarters of defence and public-order institutions, critical national infrastructure, and Ukrainian Antonov cargo aircraft on Romanian soil.
8 September 2026 - detention and disclosure
He is held for 24 hours and the SRI publishes the disruption. The statement describes the operation but announces no arrest.
The court orders thirty days
DIICOT presents him to the Bucharest Court of Appeal, which grants preventive arrest for thirty days on a charge of attempted acts of sabotage.
Romania
The SRI says it disrupted comparable cases in both years. Those cases are referenced in the statement rather than detailed.
Leipzig/Halle, Germany
An explosive-laden drone placed beside a Ukrainian Antonov. Attributed by the German government to Russia on 1 September. Reported by Scorpius as Leipzig/Halle.
Lublin and Skarzysko, Poland
Fires at two drone plants, one opened under the article covering assistance to a foreign intelligence service. Reported by Scorpius as the Polish drone-plant fires.
Munich, Germany
Incendiary devices at a defence manufacturer, two foreign nationals detained, political background assumed and attribution open. Reported by Scorpius as Munich.
Romania
Reconnaissance tasking disrupted and charged. The SRI attributes coordination to the Russian Federation.
These are different acts under different jurisdictions and only two of them carry a state attribution. What they share is a method of employment: somebody local, cheap and expendable, directed remotely, doing the part of the job that requires a body on the ground. The Romanian case is the earliest phase of that cycle to be made public, and it is the phase where a target owner can still do something about it.
The SRI announced an operation; the prosecutors announced a case
The service's statement described the tasking, the targets and the attribution, and said nothing about an arrest - one outlet noted that absence explicitly on the day. The name, the age, the counties, the seven-month window and the thirty-day detention all come from DIICOT and the court. Read the two together or the story is either an unnamed threat or an ordinary criminal case, and it is neither.
Reconnaissance is the part of the cycle that is visible and defendable
A man photographing a base over seven months is doing something a security guard, a gate clerk or a neighbour can see. The device that arrives afterwards is not. The practical value of this disclosure to a site owner is not the attribution; it is the confirmation that the surveillance phase is long, patient and conducted from outside the fence.
The attribution is the SRI's, and the coordinator is not named
The service says the pattern matches networks coordinated by entities of the Russian Federation. It is likely that this tasking was run by a Russian service, given the target set, the SRI's stated pattern match and the run of comparable European cases. That is a judgement on a published assessment and a charge sheet, not on a named officer or a recovered handler, and it should not be stated more strongly than that.
The vulnerable-category line is an admission about recruitment, not a slur
The SRI says Russia keeps recruiting from vulnerable categories. In protective terms that describes who is available to be approached near your site - contractors, the recently unemployed, people in debt, people with family under pressure elsewhere. It is the same population that supplied the proxies in Poland and, on the open question, in Munich.
Where this goes
It is highly likely that further tasking of this kind against Romanian and eastern-flank logistics is already running, given that this one took seven months to bring to a charge. It is a realistic possibility that the case produces further arrests or names the intermediary. It is unlikely that the imagery already sent is recovered or rendered useless.
The SRI says the subject was photographing Ukrainian Antonov cargo aircraft while they were on Romanian soil. Five weeks earlier a drone carrying an explosive charge was found beside a parked Antonov at Leipzig/Halle. Nobody has connected those two events and this report does not. What is worth saying plainly is that the same airframes are being photographed in one country and attacked in another, and operators who handle them should be planning on that basis rather than on the strength of a link nobody has made.
- Your surveillance-detection window is months, not minutes. Seven months of collection ran here before it was brought to a charge. A reporting route for repeated, unexplained photography is worth more than any single alert.
- Log the outside of the fence. Everything alleged here was done from public ground with a camera. Parking, vantage points, footpaths and the laybys that overlook your gate are the places the record needs to exist.
- Brief the people who see the pattern. Gate staff, contractors and neighbours notice a returning vehicle long before a system does. Give them a number and make it clear that being wrong is wanted.
- Treat visiting aircraft and cargoes as the target, not just the site. The named interest here was aircraft present temporarily. Protective posture that is fixed to the estate misses a threat that is keyed to what is parked on it this week.
- Know who near you is recruitable. The SRI's own phrase is vulnerable categories. Contractor churn, agency staff and short-term labour around a site are where that approach lands, and a welfare route is a protective control.
- Do not wait for attribution to act. Nothing a site owner needs to do here depends on knowing which service ran it. The controls are the same whoever the coordinator was.
- https://sofiaglobe.com/2026/09/08/romanias-intelligence-service-foils-attempted-sabotage-operation-coordinated-by-russia/
- https://www.antena3.ro/actualitate/operatiune-de-sabotaj-coordonata-de-rusia-in-romania-sri-un-rus-a-fotografiat-baze-militare-nato-si-aeronava-ucraineana-antonov-802473.html
- https://www.digi24.ro/stiri/actualitate/sri-a-retinut-un-spion-rus-pe-teritoriul-romaniei-in-colaborare-cu-diicot-mai-dcco-mapn-dgia-ce-plan-avea-barbatul-3939595
- https://www.mediafax.ro/justitie/cetateanul-rus-care-a-fotografiat-baze-militare-strategice-din-romania-a-fost-arestat-preventiv-pentru-30-de-zile-23803911
- https://www.b1tv.ro/eveniment/breaking-news-operatiune-ruseasca-de-sabotaj-dejucata-in-romania-un-cetatean-rus-filma-baze-militare-infrastructuri-critice-si-avioane-ucrainene-1727962.html
Compiled from open-source reporting for professional security discussion. This is a protective-security lessons-learned assessment, not an operational account. The subject has been charged with attempted acts of sabotage and has not been tried; he is entitled to a fair trial and nothing here should be read as a finding against him. His name and age appear in Romanian reporting and in the prosecutors' account; the SRI's own statement named nobody and announced no arrest. The attribution of coordination to entities of the Russian Federation is the SRI's, stated as a pattern match; no Russian officer, unit or service has been named publicly, and Russia has not commented. The counties named come from DIICOT; individual sites have not been published and the map plots county seats, not targets. No connection between this case and the Leipzig/Halle drone has been established by any authority.