Crimintern: How the Kremlin uses Russia’s criminal networks in Europe

Publication cover


  • Over the past 20 years, the role of Russian organised crime in Europe has shifted considerably. Today, Russian criminals operate less on the street and more in the shadows: as allies, facilitators and suppliers for local European gangs and continent-wide criminal networks.
  • The Russian state is highly criminalised, and the interpenetration of the criminal ‘underworld’ and the political ‘upperworld’ has led the regime to use criminals from time to time as instruments of its rule.
  • Russian-based organised crime groups in Europe have been used for a variety of purposes, including as sources of ‘black cash’, to launch cyber attacks, to wield political influence, to traffic people and goods, and even to carry out targeted assassinations on behalf of the Kremlin.
  • European states and institutions need to consider RBOC a security as much as a criminal problem, and adopt measures to combat it, including concentrating on targeting their assets, sharing information between security and law-enforcement agencies, and accepting the need to devote political and economic capital to the challenge.

Policy recommendations

  • Create a common European approach to combat money-laundering.
  • Build cooperative relationships between intelligence agencies and vulnerable local communities.
  • Foster increased exchange between national intelligence agencies and police forces.
  • Provide for better inclusion of the European Union Intelligence and Situation Centre in all activities.
  • Leverage diplomatic ties where possible.
  • Increase budgetary support.


“We have the best of both worlds: From Russia we have strength and safety, and in Europe we have wealth and comfort.”

Retired (he says) Russian criminal, 2016[1]

Today, Russian-based organised crime (RBOC) is responsible for around one-third of the heroin on Europe’s streets, a significant amount of non-European people trafficking, as well as most illegal weapons imports.[2] It is a powerful and pervasive force on the European continent. However, it takes different forms in different countries and largely works with – indeed, often behind – indigenous European gangs. European policing is behind the curve when it comes to fighting Russian-based organised crime, as its understanding of these gangs is outdated. Police are looking for the kinds of street-level ‘invader’ or ‘colonist’ gangs seen in the 1990s, rather than peering behind the curtain of indigenous organised crime groups to reveal their Russian connections.

What makes RBOC a particularly serious and timely challenge is the growing evidence of connections between such criminal networks and the Kremlin’s state security apparatus, notably the Foreign Intelligence Service (SVR), military intelligence (GRU), and the Federal Security Service (FSB).[3] Organised crime groups have already been used by the Kremlin as instruments of intelligence activity and political influence and are likely to become an even greater problem as Russian’s campaign to undermine Western unity and effectiveness continues. It is crucial that European countries and the European Union as a whole develop sharper and more effective responses to the threat.

‘Mafia superpower’ interrupted

In the 1990s, Boris Yeltsin expressed his concern – perhaps tinged with a perverse sense of pride – that Russia was becoming a “superpower of crime”.[4] Following the fall of the Soviet Union, the old-school tattooed mobsters of the so-called vorovskoi mir (“thieves’ world”) and their vor v zakone (‘thief in law”) leaders were succeeded by a new generation of avtoritety (“authorities”): hybrid gangster-businessmen who were able to enthusiastically take advantage of the crash privatisation, legal anomie, and state incapacity that characterised Yeltsin’s era. One former police officer, who had been a senior commander in Moscow at the time, stated that, “these were days when we knew the bandits had not just money and firepower on their side, but they had a better krysha (literally “roof”, referring to political protection in Russian slang) and we just had to accept that.”[5] Drive-by shootings and car bombings were almost routine and gangsters openly flaunted their wealth and impunity. There was a very real fear that the country could become, on the one hand, a failed state, and on the other, a very successful criminal enterprise.

However emaciated and abused the state seemed to have become during this period, its bones and sinews survived. The 1990s saw organised crime metastasise and evolve. By the end of the decade, a series of violent local, regional, and even national turf wars to establish territorial boundaries and hierarchies were coming to an end. The wealthiest avtoritety and their not-quite-so-criminal but much wealthier oligarch counterparts had used the ‘time of troubles’ to seize control of markets and assets, and were now looking for stability and security to exploit and enjoy these successes. Finally, some small groups within the military and security structures, motivated by both nationalist and their own personal and institutional interests, were agitating for a revival of Russian state power and an end to the disorder.

Vertical criminal integration

Even before Vladimir Putin was made acting president in 1999 and confirmed as Yeltsin’s successor in 2000, the gang wars were declining. Many criminals at the time feared that Putin was serious in his tough law-and-order rhetoric, but it soon became clear that he was simply offering (imposing) a new social contract with the underworld. Word went out that gangsters could continue to be gangsters without fearing the kind of systematic crack-down they had feared – but only so long as they understood that the state was the biggest gang in town and they did nothing to directly challenge it. The underworld complied. Indiscriminate street violence was replaced by targeted assassinations; tattoos were out, and Italian suits were in; the new generation gangster-businessmen had successfully domesticated the old-school criminals.

This was not just a process of setting new boundaries for the criminals; it also led to a restructuring of connections between the underworld and the ‘upperworld’, to the benefit of the latter. Connections between these groups and the state security apparatus grew, and the two became closer to each other. The result was not simply institutionalisation of corruption and further blurring of the boundaries between licit and illicit; but the emergence of a conditional understanding that Russia now had a ‘nationalised underworld’. In short, when the state wanted something from the criminals, they were expected to comply. During the Second Chechen War (1999-2009), for example, Moscow was able to persuade Chechen gangsters not to support their rebel compatriots on pain of retribution, and some years later during the 2011 State Duma elections there were clear indications that criminal gangs were being used to get out the vote and disrupt opposition campaigns.

During Putin’s most recent presidency, Russia has entered a new phase of national mobilisation. The Kremlin clearly considers itself threatened by − and in a kind of war with − the West. One of Russia’s tactics for waging this war is using organised crime as an instrument of statecraft abroad.

From conquistadors to merchant-adventurers

In the 1990s, RBOC groups came to Europe as would-be conquerors. For a time, it looked as if they were unstoppable. Prague became home to representatives of all the main RBOC networks, such as Solntsevo, Tambovskaya, and the Chechens, as well as mobster banker Semen Mogilevich. Russian and Chechen gangs fought each other for supremacy over the Baltic underworld. During the ‘bloody autumn’ of 1994, Estonia alone saw about 100 murders connected with the struggle for dominance. From the nightclubs of Budapest to the finance houses of London, apocryphal tales and official reports alike began to warn of a coming age of Russian gangster dominance. RBOC even emerged in France, Germany, and beyond. But it wasn’t to last. The explosion of apparent RBOC activity owed more to a combination of surprise, media hype, and desperation within RBOC groups to internationalise, than anything else. The process of expansion was ultimately unsustainable. Many groups were eliminated or forced back to Russia, Ukraine, and other eastern states by indigenous gangs and law-enforcement agencies who mobilised against the new threat, sometimes in cahoots with each other.

So when RBOC returned in the 2000s and 2010s it was largely in the shadows, as brokers and facilitators. Some, especially those of Georgian and North Caucasus origin, continue to operate at street level, such as the Moscow-connected Georgian Kutaisi ‘clan’, which was targeted in 2013 by coordinated arrests in Italy, the Czech Republic, France, Hungary, Lithuania, and Portugal. But such groups are a minority today. Most operate on a more strategic level, offering access to their resources and networks. These groups offer everything from Afghan heroin and Russian methamphetamines, to cybercriminal expertise, and investment of dirty money. The Russian gang that was broken in the Portuguese Operation Matrioskas, for example, invested dirty money into struggling European football clubs to launder proceeds from crimes at home and to run and rig illegal betting operations in Portugal, Austria, Estonia, Germany, Latvia, Moldova, and the United Kingdom. On this basis, RBOC groups have built a network of allies and contacts spanning Europe (and beyond). Not only do they exacerbate existing organised crime problems in European cities – as even quite low-level gangs now have access to high-order criminal capabilities – but they are also able to operate in areas where there are no or few Russians on the ground.

One of the challenges to understanding these groups, their activities outside Russia, and how Moscow employs them, is knowing what to call them. What makes this type of organised crime unique is how it is instrumentalised by the Russian security apparatus. As such, the novel concept of ‘Russian-based organised crime’ may be the most useful term for capturing the essence of this relationship between criminal groups and the state. This term is defined by the connection of criminals to Russia and its state apparatus above and beyond anything else. RBOC’s crucial feature is that its members, while operating abroad, have a strong stake in Russia, regardless of their official nationality, residence, or ethnicity. This means the Kremlin has leverage over them. As a Western counter-intelligence officer inelegantly but evocatively put it, “so long as his balls were in Moscow, the Russians could always squeeze.”[6]

Networks and outposts

Criminals from Russia and other Eurasian nations are active across Europe, as individuals, members of groups, and as part of multi-ethnic underworld enterprises. Modern organised crime, at least at its higher levels, is characterised not so much by clearly-defined groups with their own names,  strict hierarchies, and cultural identities – like the Sicilian Cosa Nostra – but by networks of criminal groups and individuals, connected, sometimes tenuously and temporarily, through mutual interests and shared underworld enterprises. Indeed, even the traditional Italian mafia organisations are increasingly diffuse, being reshaped by the realities, pressures and opportunities of the post-industrial world. If anything, RBOC groups were ahead of the curve, with major Russian-based combines outgrowing their early territorial and even ethnic roots as early as the 1990s.

RBOC groups mainly operate from behind or alongside the kind of street gangs that maintain specific territories and conduct the majority of smaller-scale crimes in European capitals. They are best understood as criminal service providers in continental and, indeed, global markets, and RBOC’s networks are often fluid, interpenetrating, and obscure. It is thus not possible to provide a meaningful summary of ‘key gangs’ and formal ‘turfs’, however satisfying the exercise may be. Instead, they are distributed across the continent according to where the money is. They broadly place themselves where there are similar ethnic communities, where the routes and supply chains of illicit goods and service are, or where they have strong business and political relationships or alliances.


The tendency of Russian organised crime to operate within the legal economy and indeed, behind legitimate facades, as well as the natural tendency of like to congregate with like (and hide within the crowd) has meant that places where Russian and other Eurasian communities cluster are prime locations for RBOC. From Spain’s Costa del Sol to Cyprus, or the Russophone population of Riga, a particular concentration of expatriate Russians, Georgians, or other such nationalities, necessarily creates an environment conducive to (their) criminal activities − just as is the case for mafiosi in New York’s Little Italy or triads in ‘Chinatowns’ around the world.

Among Cyprus’s 35,000-40,000 Russian-speaking population, for example, are a substantial number of Pontian Russians of Greek descent. Having grown up in the USSR and emigrated since its collapse, some are not only involved directly in RBOC but act as a bridge between RBOC groups and the Greek underworld. Indeed, because of this connection – and the perceived weakness of local law enforcement – RBOC has flourished there. In the late 2000s, for example, the two rival Moscow-based Georgian and Caucasus crime networks established their own presences there; Tariel ‘Taro’ Oniani in Athens, and Aslan ‘Ded Khasan’ in Thessaloniki. In December 2010, some 50-60 RBOC kingpins met in Greece, their largest gathering outside Russia for years, in an abortive effort to resolve this feud between the two groups.[7] Cyprus has become a particular hub for RBOC money-laundering operations because more than 25 percent of bank deposits and around 37 percent of foreign investments come from Russia. This has been facilitated by the close links between the island’s financial sector and that of the UK, its former administrator. Despite the fact that Cyprus’s 2013 financial bailout was jeopardised by the presence of dirty Russian money in its system, this connection continues.

Routes and supply chains

An RBOC presence is much more likely to form along the routes used for illicit commerce, especially at nodes where shipments have to be carried onwards, such as ports, or at final destinations, such as big cities, where wholesale consignments are broken down into smaller loads for re-sale. Indeed, RBOC has emerged as a key wholesale supplier of a variety of physical commodities for the street gangs of Europe. Around one-third of Afghan heroin now reaches the continent via the so-called ‘northern route’ that runs through Russia and there are flows of counterfeit goods, such as untaxed cigarettes, smuggled migrants and trafficked sex- and labour-slaves, from Russia and China into Europe. Further to this, there are reverse flows: money moved into Russia to launder it in a financial system not known for its probity, stolen goods, and even European foodstuffs and luxuries under sanction. These items are largely smuggled via Poland and Lithuania and then Belarus.[9] 

Along the border between Finland and Russia crime is highly organised. Russian companies control the lion’s share of heavy goods traffic, as well as forwarding and transhipment companies in Finland, especially in Helsinki, Kotka, and Hamina. These often simultaneously operate as front organisations for the smuggling of illegal goods, including drugs. However, Finland is not a target in itself so much as a gateway to the rest of Europe. The border is also used for smuggling illicit goods into Russia, either by land or through cargo shipping connections between St Petersburg and Nordic and Baltic posts – especially Stockholm and Riga.[10] Stockholm port is a notorious maritime smuggling link with St. Petersburg, and the city’s primary organised crime group  – Tambovskaya – has a long-standing presence there, and Berlin is a key hub for both drug and people smuggling. Such clustering or RBOC is most striking where there is also an expatriate community within which to operate.

Map of Russian-based organised crime (RBOC) and its routes into Europe

Alliances and relationships

Political affiliations and business ties – whether underworld or upperworld – can also facilitate the spread and entrenchment of RBOC. In Bulgaria, for example, the density of Russian business connections (it has been suggested that almost a quarter of the country’s GDP is directly or indirectly linked to Russia)[11] and the consequent heft of the Russian community in local politics, has also helped RBOC groups to penetrate the country.

In countries like Hungary, on the other hand, RBOC has receded. From the mid-2000s its presence began to diminish, not least following a series of high-profile arrests of its alleged local allies, such as László ‘Vizo’ Vizoviczki, who is now under house arrest after paying the highest bail in Hungarian history: 250 million HUF or €820,000. There is now growing concern among European intelligence circles, though, that just as the Orbán government is tipping towards Moscow, a new wave of legitimate investment in Hungary will be mirrored by renewed criminal ties and funds from RBOC.

The existence of alliances and relationships doesn’t always guarantee the effective penetration of RBOC. While RBOC groups have extensive commercial dealings with Italian organised crime groups, they have largely been unable to make serious inroads into the country. This is due to a combination of relatively powerful and deeply experienced police and security structures, along with existing gangs that are unwilling to surrender local markets. Furthermore, the Italians – like the Turkish heroin trafficking organisations with whom they also cooperate – are strong enough, and sufficiently disinclined to jeopardise their political cover, to engage in activities that would trespass into the security realm. As one Italian police officer put it, referring to the Calabrian ‘Ndràngheta, “they will deal with the Russians, but not do them any favours.”[12]

The gangster-spook nexus

It was perhaps inevitable that an especially strong connection between the security agencies and organised crime would arise in Russia. This is nothing new. For a start, from the tsarist Okhrana to the various Soviet agencies, the political police looked to the underworld for sources and recruits. The prevailing culture of Russian officialdom – in which political authority is there to be monetised – combined with the powers and impunity of the security apparatus, led to endemic corruption. On the whole, officers from the security and intelligence services did not join gangs or even necessarily form them, even though there were a few so-called ‘werewolves in epaulettes’. Rather, they usually conspired with organised crime networks or provided services for money − primarily protection or information.

However, Putin’s Russia is also very much an ‘adhocracy’. Institutions and formal positions, whether one is a civil servant or not, matter very little. What matters is how useful one is to the state. As a result, any individual or structure may be called-upon as and when the need arises. The blurring of social and functional boundaries in this way has also, inevitably, blurred the legal ones. Just as the Soviet state frequently used criminals and agents as instruments, whether controlling political prisoners in the Gulags or compromising foreigners, so Putin has continued the tradition and also put them to use. A quintessential example is Viktor Bout, a man whose career spanned the worlds of crime, business, and intelligence work − and often all three at the same time. An intelligence officer, probably from the GRU (military intelligence),[13] he set up an air freight business specialising in shipping to dangerous destinations. Alongside delivering aid, he was also implicated in sanctions busting and arms dealing, periodically as an apparent agent of the Russian state. It is unclear whether his offer to sell 700 Russian Igla surface-to-air missiles to Colombian FARC narco-rebels was on Moscow’s behalf (although the volume of the missiles he could acquire suggests so), but his example illustrates the smooth and often imperceptible transition between official and non-official roles.

Weaponising the underworld

With coy understatement, the Czech Security Information Service noted in its 2011 Annual Report, that “Contacts of officers of Russian intelligence services with persons whose past is associated with Russian-language organized criminal structures and their activities in the Czech Republic are somewhat disturbing.”[14] Given that modern Russia is a state in which every aspect of society is considered open to being co-opted by the regime, it was inevitable that this co-optation would also extend to the use of RBOC by the intelligence agencies. RBOC actors take on a variety of roles, all of which can be expanded on and developed with regrettable ease.

Cybercrime and cyber-espionage

Although there is evidence that Russian security agencies are increasingly developing their own in-house hacking capabilities, Moscow still depends, to a considerable extent, on recruiting cybercriminals, or simply calling on them from time to time, in return for their continued freedom. Setting aside the recent activities of the groups known as APT28 (also known as ‘Fancy Bear’, and associated with the GRU) and APT29 (‘Cosy Bear,’ believed to be part of the FSB), there have been several other recent attacks that look like the work of freelance cybercriminals tasked by Moscow, such as the 2010 hack of the NASDAQ’s central systems. These actors also provide ‘surge capacity’ for major operations such as the DDOS attacks on Estonia in 2007 and Georgia in 2008 – which overwhelmed and crashed destination websites and servers by flooding them with traffic − as well as  ongoing cyber disruption in Ukraine. The opportunities for using cyber attacks and espionage is growing at a rate faster than the intelligence services are developing capacity. This means that the scope for mercenary hacker operations could increase in the near future, as it is much easier for the intelligence services to ‘outsource’ these activities.

Black cash

In September 2014, Estonian Kapo (Security Police) officer Eston Kohver was about to meet an informant, when an FSB snatch squad crossed the border with Russia and forcibly abducted him. He was convicted on trumped-up espionage charges and subsequently traded for a Russian agent. The primary reason for the brazen raid appears not have been the exchange, nor even a chance to warn Estonia of Russia’s capacity and willingness to intrude, so much as to derail Kohver’s ongoing investigation into illegal cross-border cigarette trafficking. The evidence suggests that the FSB was facilitating the  smuggling activity through an RBOC group in return for a cut of the profits. This was not for the enrichment of the officers concerned, but to raise operational funds for active political measures in Europe that had no Russian ‘fingerprints’ on them. RBOC’s vulnerability to Moscow’s pressure, the advantages to be gained from cooperation, and the considerable assets the criminals hold, make them useful sources of chernaya kassa (‘black accountʼ funds), which can be used for mischief abroad more easily than directly moving funds out of Russia.

Agents of influence

The continued presence in Russia of powerful RBOC financier Semen Mogilevich – who was arrested in 2008 but controversially released the following year – not only illustrates organised crime’s capacity to generate and move money around for the purpose of attaining intelligence, it also suggests that it can provide agents of influence for Moscow. After all, senior RBOC figures are often far removed from street-level criminality and instead operate as investors and brokers within legitimate and illegitimate economies. Mogilevich, who was added to the FBI’s ‘Top Ten Most Wanted Fugitives’ list in 2009, was reported in 2014 to own 30 percent of Sweden’s Misen Energy AB through Nell Kingston Holdings, leading to the suspension of trading of the company’s shares, pending an investigation.[15] Often, such material interests go unnoticed, hidden as they are behind a complex web of front companies in jurisdictions around the world. Such investments provide structures within which to place agents under non-official cover (such as Evgeny Buryakov, the SVR officer arrested in New York in 2015, who notionally worked at Russia’s Vneshekonombank), but also provides political and financial influence.

Ghosting borders

Professionals adept at moving people and goods across borders are valuable to intelligence operations. In 2010, for example, the Russian agent known as Christopher Metsos, the most able of the deep-cover spies in the USA, was unmasked in the FBI-led Operation Ghost Stories, alongside nine other Russian agents. He was possibly the ring’s coordinator, and after being unmasked, fled to Cyprus. He was arrested but then released on bail, at which point he promptly disappeared despite US and other nations’ efforts to keep him under surveillance. Several US counter-intelligence officers expressed the opinion that RBOC people-traffickers deployed their knowledge and connections to covertly send Metsos back to Russia or into another jurisdiction where regular foreign intelligence officers could finalise his return. In light of the rise of Russian-linked paramilitary groups such as the Hungarian National Front, and the agitators that took part in the Moscow-backed attempted coup in Montenegro in 2016, the capacity of RBOC specifically to smuggle weapons and military equipment must be of particular use to the Kremlin.[16]

Assassination for hire

Russian state security agencies are occasionally empowered and expected to eliminate those considered threats to the homeland, whether defectors such as Alexander Litvinenko (murdered in London in 2006) or supporters of Chechen and other North Caucasus militants. Several of the latter have been assassinated in Istanbul and also Vienna.[17] While some of these murders appear to be the handiwork of government assassins, others seem to have been subcontracted to RBOC, especially groups from the North Caucasus themselves or with links to Chechnya. For example, Nadim Ayupov, one of the killers of three alleged Chechen terrorists in Istanbul, was a member of a Moscow-based organised crime group, which had, until then, specialised in car theft.[18] The Turkish authorities believe them to have been engaged by the FSB.[19]

The Lubyanka street irregulars

Even with its networks and generous budgets back up to Cold War levels, Russia’s intelligence agencies can always do with more helping hands. Behind every intelligence operation there is often a great deal of minor but useful leg-work, best conducted by people who won’t trigger the attention of local counter-intelligence agencies. This kind of unskilled support can and has been farmed out to RBOC actors who likely do not even know for whom they are working. In Germany, for example, it has been suggested that RBOC groups have conducted simple surveillance, and been used to deliver or collect materials or messages (such as by leaving markings on a particular post box or the like).[20] Likewise, some purchases of property close to Finnish military facilities by Russian nationals, highlighted by Supo (the Finnish Security Intelligence Service) as a potential security risk, appear to have been made by RBOC figures, potentially at Moscow’s behest. The scope for RBOC to represent an auxiliary wing of the Russian intelligence services, carrying out mundane legal (or legal-ish) activities in support of its operations, is arguably evident.


EU member states and the EU’s institutions all express and demonstrate an awareness of the need to address the challenge of organised and transnational crime, and documents such as the Council of Europe Action Plan on Combating Transnational Organised Crime (2016-2020), represent useful foundations for further action, as do the activities of agencies such as Europol and Eurojust.[21] In part, RBOC will best be fought – and the implementation of its security and covert actions mitigated – by simply strengthening the fight against organised and transnational crime in general. However, there are also specific and nuanced challenges posed by RBOC that deserve special attention.

Follow the money

Unless crime is paying, criminals aren’t playing. One of the ways in which RBOC can assist Russian active measures is by providing sources of ‘black cash’. As a result, it becomes doubly important to target the capacity of RBOC structures to launder, move, and cache their funds. This feeds into a wider concern about the continuing failure of Western countries to establish truly effective and cooperative institutions able to demonstrate the ultimate beneficiaries of corporate structures and to track money flows. This is exacerbated by a general shift towards ‘risk-based’ anti-money laundering regimes that put increased emphasis on the risk awareness and management expertise of those within reporting entities. In February 2017, the three European Supervisory Authorities – the European Banking Authority, the European Insurance and Occupational Pensions Authority, and the European Securities and Markets Authority − issued a joint Opinion to the European Commission warning that the EU’s defences against money-laundering by criminal and terrorist organisations were in danger of actually becoming less robust because of the lack of a common European approach and lacking awareness and skills (and sometimes, by implication, inclination) on the part of the financial sector to play its role.[22] Countries where money from Russia has a significant presence in their financial sectors need to address this all the more assiduously. This is especially the case for countries such as Latvia and Cyprus, which have already acquired a reputation for being the favoured money-laundering hubs for RBOC.

Doors and corners

Given the propensity for RBOC to establish itself at trafficking nodes and in expatriate communities, these locations need to be considered priority areas for security and law enforcement efforts. This does not mean demonising the expatriate communities themselves, quite the opposite; law enforcement should cultivate them more assiduously as allies and sources. In the main, RBOC is regarded by local communities neutrally at best, and slightly negatively at worst, especially for the stigma it brings to communities. Efforts to recruit officers, agents, and sources within these communities started in the ‘wild’ 1990s but have, to a large extent, been neglected ever since, especially after jihadist terrorism became the priority. The drive to build cooperative relationships between locals and intelligence officers in these communities needs to be reinvigorated. The experiences of countries such as Latvia and Estonia, which have had particular success in these endeavours, are worthy of study by others. There is, however, one other specific place in which involuntary communities have arisen that could give rise to the next generation of RBOC: Europe’s prisons. Holger Münch, the director of the Federal Criminal Police Office of Germany, has noted that up to 10 percent of inmates in German prisons are Russian speakers, and that the prison provides “great potential for recruitment”.[23] While most of these Russian speakers are convicted of minor offences, they may graduate to more serious organised crime upon release. Just as prison populations are being monitored for potential jihadist radicalisation, they should also be monitored to prevent recruitment into RBOC networks.

Cultivate communities

The corollary of the previous point is to develop close and productive relationships with legitimate expatriate communities (generally small-scale) in which RBOC operates. This is something that should be done both at the level of community policing and also through the recruitment of informants from local communities. Although many RBOC figures are willing to spend money and sometimes even political capital to present an image of themselves as patrons of their communities, in practice, they are often a political liability – landing law-abiding expatriates and migrants with the image of gangsters – or even outright predators. Every effort must be made to avoid driving the expatriate communities into RBOC’s arms by clumsy stereotyping and heavy-handed policing.

Make spooks talk to cops

There is already considerable expertise within the law-enforcement and intelligence communities on RBOC and Russian intelligence operations. There are also initiatives, from Europol-brokered workshops to bilateral intelligence-sharing relations, to allow ideas, experience, and tactical information to be shared. There is a weakness, though, in the transfer of information from the intelligence and security agencies, to the police. To an extent, this is inevitable, given the police’s need to maintain source protection and their differing priorities: law enforcement agencies essentially want to take criminals to trial, whereas intelligence services may be more interested in monitoring or using them. Nonetheless, given the evidence of growing connections between Russian intelligence agencies and criminals, a commensurate improvement in mutual collaboration between European intelligence and police is a must.

Look at the bigger picture

Police services are primarily tasked with keeping the streets safe. From their perspective, whether a gang is made up of Russians who have made the leap to becoming ‘locals’, RBOC, or native criminals, is less important than the immediate harm they do to society. Ironically, RBOC is rarely a high priority, given that such groups are less likely to be operating directly at street level. Rather, they are simply facilitating the gangs whose activities most directly impact society. The temptation is for over-worked and under-resourced police officers to leave them for another day. Furthermore, while some police agencies such as France’s Office central de lutte contre le crime organisé (OCLCO) have dedicated Russian/Eurasian crime units, others do not even maintain specific records of the levels of ethnic Russian crime, let alone RBOC operations, sometimes to avoid the appearance of profiling. This inevitably makes it harder to assess the threat. Successive annual reports from Poland’s Central Bureau of Investigation Police (CBSP) have shown that the number of Russian-speaking groups is falling steadily, for example, from seven in 2010, and six in 2013, to just two in 2015. On the other hand, conversations with Russian police suggest that they see a growing connection between ethnic Polish gangs and Russian and affiliated Belarusian suppliers. As such, the RBOC threat cannot just be measured by the physical presence of Russian gangs. It must fall on domestic security services to pay closer attention to the presence and nature of Russian connections, and argue the case for targeting RBOC more diligently.

Bring it to Brussels

The challenge presented by RBOC, while often manifesting itself at a local and national level, is also one that represents a systemic problem for Europe as a whole.

Europol and Eurojust can both play a valuable role in spreading best practices and supplementing Interpol as an intelligence brokerage, although more analytical resources will be needed for them to concentrate on this specific issue. The existing structure of Europol, which is focused on thematic issues, can coexist with a cross-departmental committee looking specifically at RBOC and drawing especially on the European Serious Organised Crime Centre and the Strategic and Financial Intelligence department of Horizontal Operational Services.

The interconnected threats of organised crime, subversion, and Russian intelligence operations also need to be taken more seriously within EU structures. While the European Union Intelligence and Situation Centre (INTCEN) − the European External Action Service’s intelligence analysis centre − is mandated to provide support on issues across the security spectrum, the very fact that it has not been granted access to Europol and similar databases from the very beginning, underscores the extent to which organised crime issues have not been considered a primary concern. This must change, given the potential for RBOC to be used by Moscow. INTCEN could represent a useful connector between Europe’s security and law-enforcement agencies.

Manage Moscow

Law enforcement cooperation has been an inevitable casualty of the worsening relationship between Russia and the West, and the potential for the use of RBOC as an intelligence tool makes such activity far more difficult. Nonetheless, there are those within the Russian police and judiciary who want to do their jobs, and there are also RBOC groups with limited political cover inside Russia. Efforts to maintain and expand cooperation with Russian counterparts must continue. While high-level diplomacy is unlikely to lead to anything more than empty declarations in the immediate future, every effort should be made to encourage renewed ‘cop-to-cop’ contact, especially at a local level. This may be more productive in areas where there is a common interest, such as along the Russian-Finnish border or around Kaliningrad. However uncomfortable, it will also require Western countries to be forward-leaning in their willingness to share information with Russian law enforcement, despite the very real risk of leakage because of corruption or links between criminals and Moscow.

Spend the money

None of this will be cheap. Specialised police intelligence units, proper visa screening, more financial intelligence analysis, tougher due diligence, and a less tolerant attitude towards shell companies, all have a direct cost on the public purse, or an indirect one through adding costs to companies or forcing them to turn away business. This is, however, part of the cost, not just of business, but of war – and Russia’s political campaign to divide and dismantle the EU and the European consensus does, in its own way, count as a different, non-kinetic, form of war. Successfully resisting it will demand strong willpower and resources.

A note on sources

By definition, this report addresses issues involving sensitive, covert, and often illegal matters. Therefore, over and above direct quotes that are footnoted, many of the assertions and examples used have been drawn partially or wholly from off-the-record conversations with officials, and in a few cases, with criminals from Europe and Russia. Of course, it is always hard to accept all such information at face value, but wherever possible it was also corroborated by other sources.

About the author

Mark Galeotti is a senior researcher at the Institute of International Relations Prague and coordinator of its Centre for European Security. A widely-published specialist on Russian security issues – from political-military affairs to the murkier understrata of crime and intelligence services – he has taught, researched, and written in his native United Kingdom, the United States, and Russia. Educated at Cambridge University and the London School of Economics, he has been head of the History Department at Keele University, professor of Global Affairs at New York University, a visiting faculty member at Rutgers-Newark, MGIMO (Russia), and at Charles University (Czech Republic). He now lives in Prague, where he is also director of the consultancy Mayak Intelligence.


The author would like to thank Gabriela Anderson, Bernát Jozsa, Peter Marzalik, and Henri Vanhanen for their assistance with this paper, as well as interlocutors in Russia and elsewhere who prefer not to be named.

[1]  Conversation with former Russian criminal, Moscow, 2016.

[2]  Heroin data from conversations with Europol analyst, January 2016; human trafficking from Eurostat and Interpol analyses. Both the human trafficking and firearms figures explicitly exclude trafficking within Europe, although some RBOC groups are also involved in these businesses.

[3]  For a detailed analysis of these agencies and their aims and activities, see Mark Galeotti, “Putin’s Hydra: Inside Russia’s intelligence services”, the European Council on Foreign Relations, 11 May 2016, available at

[4]  ‘Yeltsin: Russia a “Superpower of Crime,”’ Associated Press, 7 June 1994.

[5]  Conversation with former Moscow police officer, Moscow, 2014.

[6]  Conversation with counter-intelligence officer, European location, 2016.

[7]  Воры в законе» вновь готовятся к битве (“Vory v zakone” vnovʼ gotovyatsya k bitveʼ), Rosbalt, 17 May 2011, available at

[9]  Mark Galeotti, “Tough Times for Tough People: Crime and Russia’s Economic Crisisˮ, RFE/RL, June 2015, printed in English on the Henry Jackson Society website, available at

[10]  “Afghan heroin into Europe and European methamphetamines into Russia”, Suomen Uutiset, 7 April 2015, available at

[11]  Heather Conley, James Mina, Ruslan Stefanov, and Martin Vladimirov, “The Kremlin Playbook: Understanding Russian Influence in Central and Eastern Europe”, CSIS, 2016, available at

[12]  Email communication with former Italian police officer, 2015.

[13]  There is a certain amount of debate as to which service he worked for, but it seems most likely that he came from the GRU because of his career trajectory, beginning with his graduation from the Soviet Military Institute of Foreign Languages (one of the main incubators of GRU recruits), through to his time in relatively ‘hot’ zones such as Angola and Afghanistan.

[14]  “Annual Report of the Security Information Service of the Czech Republic for 2011”, Intelligence Service of the Czech Republic, 2011, p. 10, available at

[15]  “Russian mafia behind the Swedish gas purchase”, Expressen, 26 June 2014, available at; and Graham Stack, “Sweden freezes shares of shadowy Ukrainian gas producer Misen Energy”, Business New Europe, 1 Julyt 2014, available at

[16]  Andrew Higgins, “Intent on Unsettling E.U., Russia Taps Foot Soldiers From the Fringe,” the New York Times, 24 December 2016, available at; Natalia Zaba and Dusica Tomovic, “Montenegro Coup Suspect ‘Was Russian Spy in Poland’”, Balkan Insight, 21 February 2017 available at–02-21-2017.

[17]  “Have Russian hitmen been killing with impunity in Turkey?”, BBC, 13 December 2016, available at; and “Murder in Vienna Leads Investigators to Chechen President”, Der Spiegel, 23 June 2010, available at

[18]  “Have Russian hitmen been killing with impunity in Turkey?,” BBC, 13 December 2016, available at

[19]  Burcu Purtul Uçar, “Chechens killed in Istanbul in the name of Russian intel, prosecutor claims,” Hurriyet Daily News, 19 February 2014, available at

[20]  Interview with counter-intelligence officer, European location.

[21]  “Council of Europe Action Plan on Combating Transnational Organised Crime (2016-2020), Council of Europe, 2 March 2016, available at

[22]  “Joint Opinion on the risks of money laundering and terrorist financing affecting the Union’s financial sector”, European Banking Authority, 20 February 2017, available at

[23]  “German Federal Police warn of Russian mafia spreading in Germany,” Deutsche Welle, 10 July 2016, available at

The European Council on Foreign Relations does not take collective positions. ECFR publications only represent the views of their individual authors.

Subscribe to our weekly newsletter

We will store your email address and gather analytics on how you interact with our mailings. You can unsubscribe or opt-out at any time. Find out more in our privacy notice.