Russian Intelligence Operations in Britain

The 2020 Russia Report — What Parliament Actually Found

On 21 July 2020, the Intelligence and Security Committee of Parliament published its long-awaited report examining Russian activities affecting the United Kingdom and the response of British intelligence and security agencies.

The investigation considered Russian espionage, cyber operations, political influence, financial networks and potential interference in British democratic processes.

Its findings raised serious concerns about Britain's preparedness to recognise and counter foreign interference.

Russian Influence Within Britain

The Committee concluded that Russian influence had become deeply embedded within parts of British society, particularly through financial relationships, wealthy Russian individuals and connections to political and commercial institutions.

London's financial and professional services sectors were identified as important channels through which Russian wealth and influence had become established.

The report warned that successive governments had underestimated the implications of these relationships and the challenges they presented to national security.

However, the existence of Russian financial interests or political connections does not, by itself, establish criminal activity or participation in intelligence operations.

The 2016 Brexit Referendum

One of the report's most consequential findings concerned the British government's response to possible Russian interference in the 2016 referendum on membership of the European Union.

The Committee examined publicly available research identifying pro-Brexit and anti-EU messaging from Russian state media, alongside suspected automated social media activity.

However, the investigation found that British intelligence agencies had not conducted the comprehensive assessment necessary to establish the full extent of potential Russian interference.

The Committee criticised the limited intelligence evidence initially supplied to its investigation and questioned why the possibility of foreign interference had not received greater attention.

Importantly, the Russia Report did not establish that Russia changed the outcome of the Brexit referendum. Nor did it conclude that no interference had occurred.

Instead, it highlighted the absence of a sufficiently thorough investigation into whether Russia had attempted to influence the democratic process.

The Committee distinguished between establishing whether interference was attempted and determining whether such interference affected the referendum result.

Intelligence Oversight and Government Responsibility

The report also identified weaknesses in the coordination of Britain's response to hostile state activity.

Responsibility for addressing different aspects of the Russian threat was distributed across multiple intelligence agencies, government departments and regulatory authorities.

The Committee questioned whether these arrangements provided sufficiently clear responsibility for identifying and responding to threats against democratic institutions.

It recommended stronger coordination, clearer accountability and improvements to the legal framework governing hostile state activity.

The Government's Response

The British government acknowledged Russia as a serious national security threat but disputed aspects of the Committee's criticism.

In its July 2020 response, the government maintained that it had seen no evidence of successful Russian interference in the Brexit referendum.

However, the Committee's central concern was that the absence of demonstrated success could not substitute for a comprehensive assessment of whether interference had been attempted.

The distinction remains important when interpreting the report.

Why the Report Matters

The Russia Report represents a significant parliamentary examination of foreign influence, intelligence oversight and democratic security in the United Kingdom.

Its importance extends beyond the 2016 referendum. It raised broader questions about Britain's ability to identify hostile intelligence activities, investigate foreign interference and protect democratic institutions.

The report also provides an essential historical reference for examining subsequent Russian operations affecting Britain, including cyberattacks, espionage investigations and national security measures introduced after Russia's full-scale invasion of Ukraine in 2022.

Russian Espionage & Covert Operations on British Soil

Russian intelligence operations within the United Kingdom have included activities extending beyond conventional espionage. British investigations have identified assassinations, attempted assassinations, cyber operations and covert activities attributed to Russian state intelligence organisations.

Two particularly significant incidents were the 2006 poisoning of former Russian intelligence officer Alexander Litvinenko in London and the 2018 Salisbury nerve-agent attack targeting Sergei Skripal and his daughter Yulia.

Both incidents resulted in major British investigations that established important findings about Russian intelligence activities on UK territory.

The Assassination of Alexander Litvinenko — 2006

Alexander Litvinenko, a former officer of Russia's Federal Security Service (FSB), died in London on 23 November 2006 after being poisoned with radioactive polonium-210.

A British public inquiry, chaired by Sir Robert Owen, published its findings in January 2016.

The inquiry concluded that Litvinenko had been deliberately poisoned by Andrey Lugovoy and Dmitry Kovtun, who had met him at a London hotel.

It found a strong probability that the operation had been directed by the FSB and concluded that the assassination was probably approved by Nikolai Patrushev, then head of the FSB, and Russian President Vladimir Putin.

These were findings of an independent public inquiry, rather than criminal convictions of those identified.

The case demonstrated the potential consequences of foreign intelligence operations taking place within Britain, including the use of hazardous radioactive material in a public environment.

The Salisbury Nerve-Agent Attack — 2018

On 4 March 2018, former Russian military intelligence officer Sergei Skripal and his daughter Yulia were poisoned in Salisbury, Wiltshire, using a nerve agent belonging to the Novichok family.

Both survived following extensive medical treatment.

British authorities attributed the attack to officers of Russia's military intelligence agency, commonly known as the GRU.

The incident subsequently resulted in the death of British citizen Dawn Sturgess, who was exposed to Novichok contained in a discarded perfume bottle.

The poisoning prompted a major criminal investigation, international diplomatic measures and heightened concerns about Russian intelligence activity in Britain.

The Dawn Sturgess Inquiry — Findings Published in 2025

On 4 December 2025, the independent Dawn Sturgess Inquiry published its final report examining the circumstances surrounding her death.

The inquiry concluded beyond reasonable doubt that GRU officers had carried out the attempted assassination of Sergei Skripal.

It also concluded that the operation had been authorised at the highest level of the Russian state, with President Putin personally responsible for authorising the operation.

The inquiry found that the Russian operatives and those directing them bore responsibility for the circumstances leading to Dawn Sturgess's death.

These findings strengthened the documented evidence connecting the Salisbury operation to Russian military intelligence and senior Russian state leadership.

Russia has denied responsibility for the poisoning.

Russian Military Intelligence and Cyber Operations

The GRU has also been linked by British authorities to cyber operations, information warfare and activities targeting government institutions, communications networks and other strategic interests.

In July 2025, the British government sanctioned three GRU units and 18 military intelligence officers, citing their involvement in malicious cyber operations and other hostile activities.

The measures included officers associated with earlier cyber targeting of Yulia Skripal and operations affecting Ukraine and European security.

In July 2026, Britain and the European Union announced coordinated sanctions against Russian cyber networks, reflecting increased cooperation in responding to state-sponsored cyber threats.

These developments illustrate how modern intelligence operations combine conventional espionage with cyber capabilities, information manipulation and activities extending across national borders.

Implications for British National Security

The Litvinenko and Salisbury cases provide documented examples of the dangers posed by hostile intelligence operations within the United Kingdom.

They also demonstrate the importance of intelligence cooperation, forensic investigation, counter-espionage capabilities and effective oversight.

Modern Russian operations present additional challenges because intelligence collection, cyberattacks, disinformation and covert activities can be conducted simultaneously, sometimes involving intermediaries or criminal networks.

For Britain, the central security concern is protecting its population, democratic institutions, critical infrastructure and national sovereignty while maintaining effective cooperation with European and international partners.

Russian Cyber Operations, Political Interference & Hybrid Warfare (2022–2026)

Russia's full-scale invasion of Ukraine in February 2022 marked a significant escalation in the security challenges facing Britain and its European allies.

Alongside conventional military operations, Russian intelligence agencies have employed cyber espionage, disruptive malware, information operations and covert networks to pursue strategic objectives.

These activities form part of what is commonly described as hybrid warfare: the combination of military and non-military methods, including cyberattacks, sabotage, political interference and information manipulation.

For the United Kingdom, the concern extends beyond direct attacks on British institutions. Russian operations targeting European infrastructure, NATO members and countries supporting Ukraine can also threaten British security interests.

Russian Military Intelligence and Cyber Operations

The UK's July 2026 assessment identified three Russian military intelligence units associated with significant cyber and hybrid operations.

GRU Unit 26165 — APT28

Associated with sophisticated cyber espionage, intelligence gathering and hack-and-leak operations targeting governments, political institutions and organisations across Europe, including Britain.

GRU Unit 74455 — Sandworm

Associated with destructive cyber operations targeting critical infrastructure, industrial systems and strategic organisations. The group has been linked to major cyberattacks affecting Ukraine and other countries.

GRU Unit 29155

Associated with covert and disruptive operations, including cyber activities targeting Ukraine and European security interests. British authorities have also identified relationships between Russian intelligence officers and cybercriminal networks.

These identifications are based on government intelligence assessments and publicly disclosed technical evidence. Not every operation attributed to these groups has been independently established through judicial proceedings.

Cyber Threats to British Infrastructure

On 19 January 2026, the National Cyber Security Centre (NCSC), part of GCHQ, warned that Russian-aligned hacktivist groups continued targeting British organisations.

Local authorities and operators of critical national infrastructure were specifically identified as potential targets.

Such groups have used denial-of-service attacks to disrupt websites and online services. Although these operations do not necessarily involve the destruction of physical infrastructure, they can interfere with essential public services.

In June 2026, the NCSC reported that it had managed more than 200 cyber incidents affecting Britain's critical national infrastructure and its supporting organisations during the year to May.

Approximately three-quarters were believed to be linked to hostile state actors.

This figure concerned hostile states collectively and should not be interpreted as evidence that Russia was responsible for all these incidents.

Political Interference and Information Operations

Russian intelligence activity has also involved attempts to influence political discussion, obtain sensitive political information and manipulate public narratives.

Cyber espionage can support these objectives by accessing confidential communications, identifying political relationships or obtaining material that may subsequently be released or exploited.

Information operations may involve state-controlled media, covert online networks, misleading narratives or coordinated efforts to undermine confidence in institutions.

The UK's assessments have identified Russian intelligence involvement in influence activities extending beyond Europe, including campaigns intended to undermine support for Ukraine.

However, identifying an influence campaign does not automatically establish that it successfully changed public opinion, government policy or an electoral result.

Such claims require separate evidence.

Russian Cyber Operations Against Ukraine and European Allies

British authorities have attributed several major cyber operations affecting Ukraine to Russian military intelligence.

These include the destructive WhisperGate malware campaign in 2022 and earlier attacks targeting Ukraine's electricity infrastructure.

In July 2026, the United Kingdom and European Union announced coordinated sanctions against individuals and organisations associated with Russian cyber and hybrid operations.

The measures also accompanied a joint attribution of an attempted cyberattack against Poland's electricity infrastructure to Russia's FSB Centre 16.

According to the British government, the unsuccessful attack could have disrupted electricity supplies to approximately 500,000 people.

Although the incident occurred outside Britain, it demonstrates the potential consequences of hostile cyber operations against the infrastructure of European security partners.

MI5's October 2026 National Security Assessment

On 13 October 2026, MI5 Director General Sir Ken McCallum delivered his annual assessment of threats facing the United Kingdom.

He reported that MI5's state-threat caseload had quadrupled over the preceding decade and that the organisation was devoting more resources to countering state threats than during the Cold War.

The assessment highlighted the growing importance of protecting Britain's infrastructure, businesses, public institutions and communities from espionage, sabotage, coercion and cyber operations.

McCallum also announced the establishment of an AI Threat Assessment Centre, bringing together expertise from multiple British organisations to assess emerging risks associated with artificial intelligence.

These developments reflect a broader transformation in Britain's national security environment, where hostile intelligence activities increasingly intersect with digital technology, economic infrastructure and everyday civilian life.

The assessment addressed multiple state threats and should not be interpreted as attributing the entire increase in MI5's workload to Russia.

Implications for Britain and European Security

The expansion of cyber and hybrid operations has reinforced the importance of cooperation between British intelligence agencies, European governments, NATO partners and cybersecurity organisations.

Britain's security depends not only on protecting domestic infrastructure but also on the resilience of international communications, energy networks, defence supply chains and allied institutions.

Russian intelligence operations therefore present challenges extending beyond conventional espionage.

The principal concern is the ability of hostile actors to combine intelligence collection, cyber disruption, covert influence and sabotage in ways that threaten national security without necessarily involving direct military confrontation.

Understanding these activities requires continued examination of verified incidents, official intelligence assessments and the effectiveness of Britain's countermeasures.

Britain's Response to Russian Intelligence Threats (2022–2026)

The United Kingdom has introduced significant legislative, diplomatic and security measures to counter Russian intelligence operations, foreign interference and threats to national security.

Following Russia's full-scale invasion of Ukraine in February 2022, Britain expanded sanctions, strengthened cooperation with European allies and introduced additional measures to identify and disrupt hostile state activity.

These responses address espionage, cyber operations, covert influence, suspected sabotage and the protection of British democratic institutions.

The National Security Act 2023

The National Security Act 2023 introduced new criminal offences and investigative powers intended to modernise Britain's response to foreign intelligence threats.

The legislation addresses activities including espionage, obtaining or disclosing protected information, sabotage and foreign interference.

It also strengthened the legal framework available to police and security agencies investigating activities undertaken on behalf of foreign powers.

The legislation is not limited to Russia. It applies more broadly to hostile activities connected to foreign states.

Expulsion of Russian Intelligence Personnel — 2024

On 8 May 2024, the British government announced measures targeting suspected Russian intelligence operations within the United Kingdom.

These included the expulsion of Russia's defence attaché, whom British authorities identified as an undeclared military intelligence officer.

The government also removed diplomatic premises status from several Russian-owned properties, including Seacox Heath in Sussex and premises in Highgate, London, which it believed had been used for intelligence purposes.

The measures were intended to restrict Russia's ability to conduct intelligence gathering and other covert activities on British territory.

Foreign Influence Registration Scheme — 2025

On 1 July 2025, the United Kingdom introduced the Foreign Influence Registration Scheme (FIRS), established under the National Security Act 2023.

The scheme requires registration of certain activities undertaken at the direction of foreign governments or specified foreign state-controlled organisations.

Russia was placed on the scheme's enhanced tier, alongside Iran.

This imposes additional registration requirements on individuals and organisations undertaking relevant activities in Britain at the direction of specified Russian state bodies, subject to statutory exemptions.

Failure to comply with applicable requirements can result in criminal penalties.

The scheme is designed to increase transparency and help authorities identify covert or potentially harmful foreign-directed activity. Registration itself does not establish wrongdoing or espionage.

Further National Security Legislation — 2026

On 8 July 2026, the National Security (State Threats) Act received Royal Assent.

The legislation builds upon the 2023 framework and introduces further measures intended to strengthen Britain's response to foreign state threats.

The government's stated concerns include espionage, sabotage, cyber operations, political interference and assassination attempts.

These measures reflect the continuing evolution of Britain's counter-intelligence legislation in response to changing threats.

Sanctions Against Russian Intelligence Networks

Britain has imposed sanctions against Russian intelligence officers, military intelligence units and organisations associated with hostile cyber operations.

By July 2026, British measures included sanctions against three GRU units: 29155, 26165 and 74455.

The government has attributed various cyber espionage, disruptive and covert operations to these organisations.

Sanctions can include asset freezes and travel restrictions, depending on the designation, and are intended to constrain the activities of individuals and organisations identified as supporting hostile operations.

Separately, Britain has maintained wider sanctions targeting Russia's financial, energy and military sectors in response to its invasion of Ukraine.

On 8 October 2026, the British government announced further sanctions targeting 38 individuals and entities associated with Russian oil transportation, military production and sanctions circumvention.

These economic measures form part of Britain's broader response to Russia, although they should be distinguished from sanctions specifically targeting intelligence operations.

Cooperation With European Allies

Britain continues to cooperate with European governments, NATO members and international security organisations in identifying and responding to Russian intelligence threats.

This cooperation includes intelligence sharing, coordinated sanctions, cyber threat attribution, protection of infrastructure and measures against suspected sabotage.

Joint UK–EU action against Russian cyber networks in July 2026 demonstrated the importance of cooperation extending beyond Britain's bilateral relationship with the United States.

European security cooperation is particularly relevant to Britain because threats against neighbouring countries can affect shared communications, energy supplies, transport infrastructure and military readiness.

Contemporary Counter-Espionage Investigations

In October 2026, a Royal Navy intelligence specialist appeared in court accused of offences under the National Security Act 2023.

Prosecutors alleged that he had attempted to disclose protected military information to Russia.

The case illustrates the application of Britain's modern counter-espionage legislation to alleged threats involving sensitive military information.

As of 14 October 2026, the proceedings remained ongoing. The allegations had not been established through a criminal conviction.

Assessing Britain's Response

Britain's response to Russian intelligence threats now combines legislation, diplomatic restrictions, criminal investigations, sanctions, cybersecurity measures and international intelligence cooperation.

These measures demonstrate an increasingly coordinated approach to countering foreign state activity.

However, the introduction of new powers or sanctions does not, by itself, establish their effectiveness.

Assessing their success requires examining subsequent intelligence findings, prosecutions, disrupted operations, independent oversight and the continuing scale of hostile activity.

For the United Kingdom, the principal objective remains protecting national security, democratic institutions, critical infrastructure and the public while ensuring that intelligence and security powers remain subject to appropriate legal scrutiny and accountability.

Overall Assessment & Future Developments

The evidence examined throughout this research demonstrates that Russian intelligence operations have presented significant and continuing challenges to British national security.

The Litvinenko and Salisbury investigations established findings concerning Russian state involvement in lethal and potentially lethal operations on British territory. Parliamentary investigations, government intelligence assessments and cybersecurity reporting have also documented concerns involving espionage, political interference, cyber operations and threats to critical infrastructure.

The 2020 Russia Report exposed weaknesses in Britain's historical response to foreign interference, particularly the absence of a comprehensive assessment of potential Russian activity surrounding the 2016 Brexit referendum. It did not establish that interference changed the referendum result.

Since Russia's full-scale invasion of Ukraine in 2022, Britain has strengthened its counter-espionage legislation, expanded sanctions and increased cooperation with European security partners.

Nevertheless, important questions remain about the effectiveness of these measures, the scale of undisclosed intelligence activity and the continuing vulnerability of British institutions and infrastructure.

Developments to Monitor

Future updates to this research will examine significant new findings from MI5, MI6, GCHQ and parliamentary intelligence investigations, alongside espionage prosecutions, Russian cyber operations, suspected sabotage and developments affecting British and European security.

Particular attention will be given to independently verified evidence, official investigative outcomes and changes to Britain's national security arrangements.

The main issue is not simply the existence of foreign intelligence threats, but Britain's ability to identify, investigate and counter them while maintaining democratic accountability and the rule of law.

References & Further Reading

The Litvinenko Inquiry (2016)
Report into the Death of Alexander Litvinenko. 21 January 2016.
https://www.gov.uk/government/publications/the-litvinenko-inquiry-report-into-the-death-of-alexander-litvinenko

Intelligence and Security Committee of Parliament (2020)
Russia. HC 632. 21 July 2020.
https://isc.independent.gov.uk/wp-content/uploads/2021/01/20200721_HC632_CCS001_CCS1019402408-001_ISC_Russia_Report_Web_Accessible.pdf

UK Government (2020)
Government Response to the Intelligence and Security Committee Russia Report. 21 July 2020.
https://www.gov.uk/government/publications/government-response-to-intelligence-and-security-committee-russia-report

UK Government (2023)
National Security Act 2023 — Legislation and Guidance.
https://www.gov.uk/government/collections/the-national-security-bill

National Cyber Security Centre (2023)
UK and Allies Expose Russian Intelligence Services for Cyber Campaign of Attempted Political Interference. 7 December 2023.
https://www.ncsc.gov.uk/sites/default/files/2026-04/UK-and-allies-expose-Russian-intelligence-services-for-cyber-campaign-of-attempted-political-interference.pdf

UK Government (2024)
UK Joins Partners in Condemnation of Malicious Cyber Activity by Russian Intelligence Services. 3 May 2024.
https://www.gov.uk/government/news/united-kingdom-joins-partners-in-condemnation-of-malicious-cyber-activity-by-russian-intelligence-services-uk-government-statement

UK Government (2024)
UK to Expel Undeclared Russian Spy in Response to Growing Threat. 8 May 2024.
https://www.gov.uk/government/news/uk-to-expel-undeclared-russian-spy-in-response-to-growing-threat

National Cyber Security Centre (2024)
UK and Allies Uncover Russian Military Unit Carrying Out Cyber Attacks and Digital Sabotage. 5 September 2024.
https://www.ncsc.gov.uk/news/uk-allies-uncover-russian-military-carrying-out-cyber-attacks-digital-sabotage

UK Government (2025)
Russia to Be Placed on Foreign Influence Registration Scheme. 1 April 2025.
https://www.gov.uk/government/news/russia-to-be-placed-on-foreign-influence-registration-scheme

UK Government (2025)
UK Launches Foreign Influence Registration Scheme. 1 July 2025.
https://www.gov.uk/government/news/uk-launches-foreign-influence-registration-scheme

Foreign, Commonwealth & Development Office (2025–2026)
Profile: GRU Cyber and Hybrid Threat Operations. Published 18 July 2025; updated 13 July 2026.
https://www.gov.uk/government/publications/profile-gru-cyber-and-hybrid-threat-operations

The Dawn Sturgess Inquiry (2025–2026)
Report into the Death of Dawn Sturgess. Published 4 December 2025; corrected January 2026.
https://www.gov.uk/government/publications/dawn-sturgess-inquiry-report

UK Government (2026)
UK and EU Strike Russian Cyber Networks with New Sanctions. July 2026.
https://www.gov.uk/government/news/uk-and-eu-strike-russian-cyber-networks-with-new-sanctions

MI5 — The Security Service (2026)
MI5 Director General Delivers Annual Threat Update. 13 October 2026.
https://www.mi5.gov.uk/mi5-director-general-delivers-annual-threat-update