Instrumentalised Migration and Russia’s ‘Disposable Agents’

Europe’s latest migration emergency is unfolding in Ceuta. In late July, around 60,000 people, most of them Moroccans, crossed into the small Spanish territory in the largest surge in its recent history. The influx overwhelmed local services, prompted a Spanish military deployment and rapidly developed into a wider European political controversy.

The immediate causes remain contested. Spanish and Moroccan officials have pointed to smuggling networks and misleading social media claims about a recent Spanish court ruling. Analysts have also questioned whether Moroccan authorities initially turned a blind eye to the crossings, although claims that the latest surge was deliberately orchestrated remain unsubstantiated.

There is insufficient evidence to describe the latest events in Ceuta as an act of state-directed instrumentalised migration. Yet the crisis demonstrates how rapidly a concentrated migration flow can become a major political issue for the EU: it has overwhelmed border and reception systems, forced difficult legal and humanitarian choices, and generated consequences beyond the state directly affected./span>

Italy’s temporary reintroduction of checks on arrivals from Spain illustrates how pressure at one external border can lead to internal controls and strain the principle of border-free travel. This wider disruption explains why migration can provide such a powerful lever for malign actors. A state able to facilitate or direct a sudden movement of people can not only burden frontline authorities, but also provoke disputes between European governments and strain solidarity among member states.

Russia and Belarus have repeatedly sought to exploit precisely this vulnerability. On Russia’s northern borders in 2015–16, at the EU’s frontier with Belarus in 2021, and on the Russian–Finnish border in 2023–24, migration flows were facilitated and directed in ways intended to impose political, administrative and economic costs while keeping the sponsoring state at a distance.

Instrumentalised migration should not, however, be viewed as an isolated border tactic. It shares an operational architecture with Russia’s growing use of ‘disposable agents’ to conduct sabotage and disruption: state direction or enablement at a distance, reliance on civilian or criminal intermediaries and the deliberate preservation of ambiguity.

Europe has a classification problem. A sudden migration flow is treated as a border-management and asylum emergency. A warehouse fire is investigated as arson. The surveillance of a military facility is handled as espionage or suspicious criminal activity. Each categorisation is administratively logical. Taken together, however, they can conceal a broader campaign of below-the-threshold coercion.

Russia benefits from this fragmentation. The International Centre for Counter-Terrorism has identified 151 publicly known cases between February 2022 and February 2026, although the true number is likely to be higher. Examined individually, these incidents may appear to be discrete criminal or security matters. Viewed alongside other deniable methods of coercion, they reveal a broader strategy of imposing cumulative costs without provoking a conventional response.

Instrumentalised migration and sabotage by so-called ‘disposable agents’ are materially different methods. They can involve different actors, institutions and immediate objectives. Not every border incident or act of criminal disruption should therefore be assumed to form part of a centrally directed Russian campaign.

What connects the two is their operational architecture. Both allow coercion to be organised at a distance, outsourced through civilian or criminal intermediaries and conducted with sufficient ambiguity to complicate attribution and deter a decisive response. Both impose costs on European states while keeping the apparent scale of each individual incident below the threshold that would normally produce a coordinated security response.

The weakness Russia is exploiting is therefore not only Europe’s open borders, polarised migration politics or vulnerable infrastructure. It is Europe’s habit of dividing security into separate institutional categories while Moscow increasingly operates across them.

Instrumentalised Migration as a Tool of Coercion

Instrumentalised migration is not simply irregular movement across a border. It is the deliberate manipulation of migratory routes by a state or state-aligned actors to impose political, administrative or economic pressure on another state.

The distinction is important. Migrants do not become security threats simply by seeking entry or asylum. The coercive act lies in a government’s deliberate exploitation of vulnerable people: facilitating their movement, directing them towards particular borders, controlling their access to crossing points and using the resulting humanitarian emergency to pressure the target state.

The attraction of the method lies in the dilemma it creates. European governments are required to maintain border security, while protecting access to asylum and complying with the principle of non-refoulement. An adversarial state can exploit these commitments by helping to create a sudden concentration of arrivals and leaving the target government to bear the political, legal and financial consequences.

Russia tested an early version of this model on its northern borders in 2015–16. Around 7,000 third-country nationals travelled through Russia towards Norway and Finland during the Syrian refugee crisis. Their movement was facilitated by a combination of official tolerance, intervention by the Russian Federal Security Service, and criminal involvement and commercial networks.

Migrants were directed towards the heavily controlled Murmansk region and the Norwegian border. Commercial facilitators exploited a legal loophole that allowed travellers to cross the Storskog checkpoint by bicycle. Similar movements later appeared at Finnish crossings.

The episode was revealing not only because the movement occurred, but because of how abruptly it ended. After Norway moved towards discussions with Moscow, the number of crossings at Storskog fell from 314 to zero in one week. The speed of the decline strongly suggested that Russian authorities retained control over the conditions enabling the flow.

Belarus subsequently demonstrated how the model could be expanded. In 2021, following the disputed presidential election, European sanctions and increasing pressure on Alexander Lukashenko’s government, Belarus facilitated the movement of thousands of people from the Middle East and Africa towards Poland, Lithuania and Latvia.

State-linked travel agencies marketed routes into the EU, while criminal networks transported migrants towards the frontier. Belarusian security personnel reportedly assisted people in reaching and attempting to breach the border. According to an EU report, 90% of migrants who crossed illegally into Poland during the period held Russian student or tourist visas, indicating possible Russian facilitation.

The campaign imposed substantial practical costs. Poland deployed approximately 15,000 troops to support its border guards, while the affected states spent additional resources on border infrastructure, security deployments, asylum processing and accommodation.

Its political impact was equally significant. Poland and its neighbours were forced to navigate a deliberately constructed conflict between humanitarian obligations and border control. Criticism of pushbacks and securitised border policies deepened divisions between European institutions, human-rights organisations and national governments. At the same time, the crisis supplied material for anti-migrant and anti-EU political narratives.

The operation should not be reduced to a Russian proxy campaign. Lukashenko had his own reasons to retaliate against European sanctions and support for the Belarusian opposition. Nevertheless, the episode showed how state institutions, travel companies, criminal facilitators and information operations could be combined to impose pressure while leaving migrants as the visible face of a crisis they did not create.

Russia returned to the method on Finland’s border in 2023–24. Following Finland’s restrictions on Russian travel after the full-scale invasion of Ukraine, growing numbers of third-country nationals began arriving at Finnish crossings without the documentation normally required for entry.

The increase accelerated in November 2023, when approximately 800 people arrived, compared with around 900 during the preceding three months combined. Russian border officials allowed migrants without the necessary documents to reach the frontier, while reports indicated that security officials and smuggling networks helped direct people towards Finnish crossing points. Authorities in the Murmansk region reportedly transported migrants from closed crossings to those that remained open.

Finland responded by closing crossings and reinforcing its border. Yet this case also exposed the limits of instrumentalised migration. Rather than generating a sustained division over migration policy, the operation was rapidly interpreted in Finland as part of the wider Russian security threat. It arguably strengthened, rather than weakened, Finnish political resistance to Moscow.

This matters because imposing costs is not the same as achieving strategic success. Instrumentalised migration is most politically effective when the target state continues to debate whether it is facing an organic humanitarian emergency or an organised act of coercion. Once the activity is broadly recognised as hostile state action, its capacity to divide society may diminish.

Cumulative Logic of Disposable Agents

The same preference for distance, intermediaries and deniability is visible in Russia’s growing use of ‘disposable agents’.

These individuals differ from traditional intelligence officers. They are not necessarily trained operatives, Russian citizens or ideological supporters of the Kremlin. Recruits can include criminal associates, migrants, Russian-speaking European residents, people facing financial difficulties or individuals responding to offers of apparently straightforward paid work on Telegram and other platforms.

They may be asked to photograph military facilities, follow particular individuals, vandalise monuments, damage railway infrastructure, set fire to warehouses or attack businesses connected to Ukraine. Payment is frequently made in cryptocurrency.

Operations can also be compartmentalised. One individual may conduct surveillance, another acquire materials, a third carry out an attack and a fourth amplify its effects online. Some participants may know that they are committing an offence without understanding who commissioned it. Others may have little knowledge of how their activity fits within a wider operation.

For Russian intelligence services, the advantages are considerable. Disposable agents are cheap, replaceable and often already able to move freely within Europe. Handlers can recruit and direct them remotely, reducing the need to deploy trained intelligence officers abroad. Compartmentalisation also limits the damage caused when an individual recruit is arrested.

Most importantly, the model complicates attribution. An arson attack may initially appear to be insurance fraud, organised crime or opportunistic vandalism. Surveillance of a military facility may be attributed to an individual acting alone. An attack on a mosque, synagogue or monument may appear to be the work of a domestic extremist. Even when investigators establish a connection to Russian intelligence, the limited physical consequences of a single act may make a conventional or military response appear disproportionate.

The geographical spread and selection of targets indicate that the incidents cannot all be understood as unrelated criminality. Poland appears to have been the most frequently targeted European country, followed by France, Lithuania, Germany, the UK and Estonia. Fires and attacks have repeatedly affected facilities associated with Ukraine, companies supporting the Ukrainian war effort and symbols of Ukrainian solidarity.

Other operations appear designed less to damage a strategically important target than to aggravate existing social tensions. Attacks against Jewish sites, mosques and other minority communities can be used to provoke suspicion, retaliation and political polarisation. The immediate physical damage may be limited; the intended effect is social and psychological.

The strategic value therefore lies in accumulation. One warehouse fire, vandalised monument or surveillance operation is unlikely to change European policy. Repeated incidents across multiple countries can still consume investigative resources, raise the cost of supporting Ukraine and create uncertainty about where the next attack will occur.

This is where the comparison with instrumentalised migration becomes useful. Russia has not simply replaced one tactic with another, and there is no reason to assume that the same officials or command structures manage both. What they share is a method of coercion that shifts the practical burden onto the target. In an engineered border crisis, European authorities must deploy personnel, process arrivals, construct infrastructure and defend their actions legally and politically. In a disposable-agent operation, European police and intelligence services must identify recruits, reconstruct remote networks and determine whether an apparently local crime has a foreign sponsor.

In both cases, Russia can impose disproportionate costs without exposing large numbers of its own personnel or crossing an obvious military red line.

Europe’s Institutional Blind Spot

European governments are not necessarily failing to recognise individual acts of Russian aggression. The deeper problem is that the institutions responding to them may see only part of a wider pattern.

Migration pressure, criminal disruption, intelligence activity and infrastructure protection are handled by different agencies and legal frameworks. These distinctions are operationally necessary, but they can make it harder to identify hostile activity that deliberately crosses institutional boundaries.

Russia benefits when each incident is examined principally within the category in which it first appears. A border agency may recognise that unusual movements are being facilitated without access to the wider intelligence picture. Police may arrest an arsonist without connecting the recruitment method or financing to similar cases elsewhere, while an intelligence service may attribute an operation to Russia but struggle to demonstrate whether it forms part of a sufficiently coherent campaign to justify a wider response.

The implication is not that every migrant should be viewed as a security risk or every act of vandalism treated as an act of war. Such an approach would intensify precisely the political divisions these operations are intended to exploit. Migrants used within an instrumentalised movement remain vulnerable people, not the authors of the coercive strategy.

Instead, these cases suggest that European assessments should focus more consistently on the networks and enabling systems connecting individual incidents. In disposable-agent operations, this includes recruitment channels, cryptocurrency payments, remote handlers and the intermediaries used to obtain materials or conduct surveillance. In instrumentalised migration, it may include state-linked travel agencies, transport providers, smuggling networks and officials controlling access to border regions.

This shifts attention from the visible actor at the end of the chain towards those organising, financing and facilitating the activity. Arresting an individual recruit or stopping a group at the border may disrupt an immediate incident. It does not necessarily address the infrastructure that allows similar operations to be repeated elsewhere.

Greater coordination across border agencies, police forces, financial investigators, intelligence services and infrastructure operators would therefore help European states determine whether apparently isolated events share recruitment methods, financing, targets or information activity. The relevant unit of analysis may increasingly need to be the network or campaign, rather than the individual offence or border crossing.

Russia does not need to defeat European armed forces to weaken European security. It can instead exhaust administrative capacity, increase the cost of supporting Ukraine, exploit political divisions and generate insecurity through repeated acts that remain individually ambiguous.

The central question is therefore not whether any one border incident, warehouse fire or surveillance operation is serious enough to constitute an act of war. It is whether European states can recognise a strategy designed to ensure that no single incident ever appears serious enough to demand a decisive response.

Below the threshold of war is not an empty space between peace and conflict. Russia is treating it as an operational environment. Europe must become better at recognising the campaigns taking place within it.

© RUSI, 2026.

The views expressed in this Commentary are the author's, and do not represent those of RUSI or any other institution.

For terms of use, see Website Terms and Conditions of Use.

Have an idea for a Commentary you'd like to write for us? Send a short pitch to commentaries@rusi.org and we'll get back to you if it fits into our research interests. View full guidelines for contributors.