This article examines how recent Russian-linked sabotage and disruption in Poland became governance problems under conditions of attribution uncertainty, contested legal classification, and public–private infrastructure exposure. It asks how Polish authorities publicly interpreted, legally framed, and institutionally managed these incidents, and what they revealed about public–private resilience. The study uses qualitative content analysis within a focused comparative case-study design. It examines four Polish cases: the Marywilska 44 shopping-centre fire, the explosive parcel plot, the Warsaw–Lublin railway sabotage case, and the September 2025 drone-incursion and airport-disruption cluster. Open-source official statements, prosecutorial releases, legal materials, parliamentary sources, and public reporting were coded across three analytical dimensions: attribution, legal and institutional response, and public–private resilience. The cases show a shift from isolated-incident framing towards a broader campaign logic in which sabotage and disruption are treated as cumulative, networked, and strategically meaningful. Attribution developed unevenly across cases, while criminal-law responses were supplemented by diplomatic signalling, international investigation, protective mobilisation, airspace defence, and allied coordination. The cases also show that commercially ordinary systems can become strategically exposed when they support logistics, mobility, public confidence, continuity, or deterrence. Russian-linked sabotage operations create a governance problem because attribution, legal classification, and operational adaptation often move at different speeds. Public–private resilience therefore requires clearer reporting channels, baseline protective expectations, continuity planning, information-sharing mechanisms, and more explicit allocation of risk and responsibility between public authorities and private operators.
Hybrid warfare is not a new form of conflict, but Russia’s war against Ukraine has renewed attention to how states combine military, intelligence, cyber, informational, economic, legal, and deniable instruments, including active measures, proxy use, sabotage, and other forms of pressure below the threshold of open war (
disruption may therefore operate as instruments of grey-zone pressure when they impose costs, test resilience, or signal capability while preserving a degree of deniability (
This study examines how Russian-linked sabotage and disruption in Poland become governance problems when attribution is politically and evidentially sensitive, legal classification is contested, and strategically exposed infrastructure is partly owned, operated, or secured by private actors. These incidents do not fit neatly into a single category, such as ordinary crime, terrorism, espionage, sabotage, hostile intelligence activity, or armed attack. As a result, public authorities must interpret, classify, communicate, and respond before attribution is complete, while private and commercially operated systems may bear security burdens for which ordinary business-risk models are poorly suited. This creates a governance problem at the intersection of attribution, lawfare, legal resilience, and public–private infrastructure security (
Poland is a particularly important case for examining this problem. Since Russia’s full-scale invasion of Ukraine in 2022, Poland has functioned as a frontline North Atlantic Treaty Organisation (NATO) state and a major logistical corridor for support moving towards Ukraine (
Recent incidents in Poland illustrate the difficulty of separating ordinary criminality from state-linked coercion under the conditions of uncertainty. Polish authorities and public reporting have linked the Marywilska 44 shopping-centre fire to suspected Russian-directed arson after an initial period of more cautious public attribution (National Prosecutor’s Office, 2025;
These incidents became publicly legible as security problems before certainty was complete. The article does not attempt to prove clandestine command responsibility beyond the public record, rather it analyses how Polish authorities publicly interpreted, legally framed, and institutionally managed recent Russian-linked sabotage and disruption affecting economically and strategically significant infrastructure. This matters because political attribution, legal attribution, public communication, protective action, and private-sector resilience can develop on different timelines and under different evidentiary thresholds. This timing mismatch is the practical governance dilemma on which the article focuses (
The existing literature provides important foundations for analysing these incidents. Recent holistic work has already examined Russian hybrid warfare, active measures, cyber espionage, cyber warfare, critical infrastructure, and societal resilience in an integrated way, including
This study builds on this literature through a focused empirical comparison of the following four connected Polish cases: the Marywilska 44 shopping-centre fire in Warsaw, the explosive parcel plot, the Warsaw–Lublin railway sabotage case, and the September 2025 drone-incursion and airport-disruption cluster. These cases vary in target type, operational form, and degree of public attribution, but they illuminate the same broader problem: how Russian-linked sabotage and disruption affecting economically and strategically significant infrastructure are interpreted and managed under conditions of uncertainty (
To answer these questions, the article compares the mentioned four cases through the following three analytical dimensions: attribution, legal and institutional response, and public–private resilience. This approach allows the study to trace how responsibility was publicly suggested or asserted, how legal and security mechanisms were activated under uncertainty, and how disruption exposed vulnerabilities, costs, and coordination burdens for private or commercially operated systems.
The study asks the following question: How have Polish authorities publicly interpreted, legally framed, and institutionally managed recent Russian-linked sabotage and disruption incidents affecting economically and strategically significant infrastructure? Two subsidiary questions guide the analysis. Firstly, how has attribution developed across cases with different levels of uncertainty and evidentiary maturity? Secondly, what do these cases suggest about strengths and limits of public–private resilience when commercially ordinary systems become strategically consequential?
The article makes three contributions. These contributions are primarily empirical, analytical, and practical rather than claims of theoretical novelty. Empirically, it brings together four recent Polish cases that are usually discussed separately and compares them through a common analytical framework. Analytically, it argues that attribution, legal response, and resilience burdens do not move at the same speed, and that this misalignment is itself part of the governance problem created by Russian sabotage operations conducted within a broader hybrid warfare environment (
Hybrid warfare is best understood in this article as a flexible repertoire of coercive activity below the threshold of open war, rather than as a wholly new form of conflict (
The concept remains contested. Hybrid warfare can describe military, paramilitary, intelligence, cyber, informational, legal, economic, and deniable activity, but its breadth can also weaken analytical precision (
Ambiguity is central to this repertoire. Hybrid and grey-zone operations often seek to complicate attribution, delay response, and create disagreement over whether an incident should be treated as crime, espionage, sabotage, terrorism, hostile intelligence activity, or armed attack (
Attribution is therefore not a single act. Technical attribution concerns how an incident occurred and what operational methods, devices, networks, or vulnerabilities were involved. Legal attribution concerns the evidentiary basis for assigning responsibility in criminal or judicial processes. Political attribution concerns public or diplomatic communication about responsibility, often under conditions in which intelligence cannot be disclosed completely (
This is especially relevant to Russian-linked sabotage because proxy use, cut-outs, informal intermediaries, online recruitment, and task fragmentation can separate immediate perpetrators from sponsoring or directing institutions (
Legal resilience provides a second foundation for the analysis.
The literature on lawfare reinforces this point. Drawing on
Attribution and signalling also raise problems of responsible disclosure. Authorities may need to inform affected operators, warn the public, or expose hostile activity without compromising intelligence sources, ongoing investigations, or judicial proceedings. False-flag possibilities further complicate this problem because hostile actors may seek not only to deny involvement but also to manipulate the evidentiary environment or provoke misdirected responses (
Infrastructure scholarship adds the third dimension. Recent work emphasises that infrastructure vulnerability should be understood systemically rather than asset by asset (
The public–private dimension is central to this problem. Many exposed systems are not owned, operated, insured, secured, or maintained solely by the state. Shopping centres, warehouses, logistics firms, parcel networks, rail contractors, airports, insurers, and private security providers may all become involved in prevention, detection, reporting, continuity planning, or recovery after hostile disruption (
For this study, public–private resilience refers to the capacity of state institutions and private or commercially operated systems to share information, absorb disruption, allocate risk, maintain continuity, and adapt security practices when ordinary infrastructure becomes strategically exposed. The private dimension includes ownership, operational cost, duty of care, insurance exposure, security preparedness, incident reporting, business continuity, and cooperation with public authorities (
Poland brings these issues together. It is not unique in facing Russian-linked sabotage or grey-zone pressure, but it is a high-value case because of its role as a frontline NATO state and logistical corridor for Ukraine (
These literatures already provide a substantial theoretical foundation, including holistic work on Russian hybrid warfare, cyber warfare, critical infrastructure, and resilience (
The article’s contribution follows from this empirical focus rather than from a claim that the underlying theoretical problems have been neglected altogether. Hybrid warfare scholarship explains ambiguity, deniability, proxy use, and sub-threshold coercion. Legal scholarship explains how grey-zone activity tests attribution rules and legal categories. Infrastructure-resilience scholarship explains why public authorities depend on private and semi-private actors to manage risk and continuity. What remains especially valuable is case-based analysis of how these issues develop together in concrete sabotage cases affecting commercially ordinary but strategically consequential systems. This article addresses that gap by comparing four Polish incidents across three analytical dimensions: attribution, legal and institutional response, and public–private resilience.
The first dimension, attribution, examines how responsibility was publicly suggested, qualified, or asserted. The second dimension, that is legal and institutional response, examines how authorities used criminal-law, intelligence, diplomatic, mobilisation, and international-coordination mechanisms. The third dimension, public–private resilience, examines how incidents exposed vulnerabilities, costs, coordination demands, and preparedness gaps for private or commercially operated systems. Together, these dimensions allow the article to analyse Russian sabotage operations not as isolated criminal episodes but as governance problems at the intersection of hybrid warfare, lawfare, legal resilience, and infrastructure security.
This study uses qualitative content analysis within a focused comparative case-study design to examine how Polish authorities publicly interpreted, legally framed, and institutionally managed recent Russian-linked sabotage and disruption affecting economically and strategically significant infrastructure. The method is appropriate because the article examines public institutional meaning-making rather than attempting to prove non-public operational direction beyond the public record. It traces how incidents were described, attributed, classified, and acted upon while facts remained incomplete.
The study examines four Polish cases: the Marywilska 44 shopping-centre fire in Warsaw, the explosive parcel plot, the Warsaw–Lublin railway sabotage case, and the September 2025 drone-incursion and airport-disruption cluster. These cases were selected because they vary in target type, operational form, and degree of public attribution while addressing the same broader problem: Russian-linked sabotage and disruption affecting strategically significant infrastructure in Poland. The comparison is analytical rather than statistical; the cases are treated as related instances in a common strategic setting, not as identical events or proof of a single operational chain.
The source base consists of forty-eight open-source documents, including official statements, prosecutorial releases, legal texts, parliamentary materials, and selected public reporting. These materials were selected through criterion-based sampling. Documents were included if they met at least one of the three criteria: they addressed one of the four cases directly, documented a formal institutional response, or provided legal, policy, or operational context necessary to interpret the state’s public handling of the incident. The corpus was determined by analytical relevance and comparative coverage rather than statistical representativeness, and sources were added until the main public institutional statements, legal framings, and response measures across the four cases were captured without substantial repetition (
The document was the unit of collection. The unit of analysis was the relevant passage within each document. A passage was coded when it addressed one or more of the study’s three analytical dimensions: attribution, legal and institutional response, or public–private resilience. Incident characteristics, including kinetic action, reconnaissance, and resilience testing, were also recorded as descriptive context. Attribution codes captured whether responsibility was publicly ambiguous, cautiously suggested, or directly linked to Russian or hostile-state activity. Legal and institutional-response codes captured criminal-law framing, diplomatic action, international coordination, and protective mobilisation. Public–private resilience codes captured infrastructure vulnerability, coordination demands, precautionary or operational costs, and possible proxy or disposable-agent patterns.
The coding framework combined deductive and inductive elements. Deductively, the coding followed four analytical lenses: incident characteristics, attribution, legal and institutional response, and public–private resilience. Inductively, the analysis remained open to recurring themes not fully specified in advance, including foreign intelligence involvement, deterrence, institutional adaptation, resilience testing, precautionary cost, and possible disposable-agent patterns (
Coding proceeded in two stages. Firstly, the documents were read closely and tagged according to the four main analytical lenses. Secondly, coded segments were compared across cases to identify recurring patterns, meaningful contrasts, and areas in which attribution, legal framing, or resilience burdens diverged. The analysis focused on the presence and relative salience rather than on raw frequency. Descriptive code counts were used as heuristic aids to comparison, not as measures of effect size, causal weight, or formal statistical association. The interpretive weight of the findings therefore comes from how the underlying documents framed each incident.
This study has four limitations. Firstly, it relies on open-source material and therefore cannot access classified intelligence, sealed case files, or internal deliberations. Secondly, public statements may reflect strategic communication as well as evidentiary assessments, especially in cases involving foreign-state attribution. Thirdly, the cases differ in timing, maturity, and operational form, which limit any effort to treat them as directly equivalent. Finally, the descriptive distributions presented later are not inferential statistics and should not be read as a proof of causal weight by themselves (
The qualitative content analysis suggests that the four Polish cases should not be read as isolated security episodes. They differ in target type, operational form, and evidentiary maturity but share a common governance problem: each required Polish authorities to interpret disruption under conditions of uncertainty while deciding whether the incident should be treated as ordinary criminality, foreign-linked sabotage, infrastructure vulnerability, or a wider security challenge. Across the cases, official and public framing increasingly connected discrete incidents to a broader pattern of Russian-linked pressure on infrastructure, public security, and state resilience, while attribution and response remained conditioned by evidentiary, diplomatic, and operational costs (
Cross-case summary of incident and attribution patterns.
| Case | Dominant incident pattern | Attribution pattern | Main analytical result |
|---|---|---|---|
| Marywilska 44 fire | Kinetic destruction | Delayed shift from cautious suspicion to direct public attribution | Commercial infrastructure becomes explicitly securitised. |
| Parcel plot | Kinetic disruption with a networked logistics dimension | Networked attribution emphasising handlers, proxies, and cross-border coordination | Logistics systems emerge as transnational hybrid vulnerabilities. |
| Warsaw–Lublin rail sabotage | Kinetic disruption to transport infrastructure | More direct strategic attribution | Rail infrastructure is framed as both economic and strategic. |
| Drone/airport-disruption cluster | Testing and reconnaissance rather than destruction | Security framing under continued evidentiary and escalation-management caution | Airspace incidents are framed as resilience and deterrence challenges. |
Note. The coding framework combines deductive categories derived from the study’s four analytical lenses with inductive attention to emergent patterns in the source base (
The first pattern concerns attribution. Attribution developed unevenly across the four cases. Marywilska provides the clearest example of movement from cautious suspicion to direct public attribution. Initial reporting described Prime Minister Donald Tusk as saying that the Russian-related “threads” being examined were “quite probable” (
The explosive parcel plot followed a different pattern. Rather than moving from one ambiguous claim to one later direct claim, the case was framed through a distributed operational chain.
The Warsaw–Lublin railway case moved more directly in strategic framing. Polish authorities described the incidents as sabotage affecting railway infrastructure and emphasised the likelihood of foreign-service involvement (
The second pattern concerns legal and institutional response. Criminal-law investigation remained central, especially in the the Marywilska, parcel, and railway cases, but prosecution was not the only relevant pathway. Once incidents were linked publicly to Russian services, foreign intelligence direction, transnational logistics, or airspace violation, their institutional meaning extended beyond ordinary criminal investigation. The Marywilska case combined criminal-law framing with later diplomatic and strategic significance (National Prosecutor’s Office, 2025;
The drone cluster activated a different institutional pathway. Rather than centring on ordinary criminal prosecution, the response emphasised airspace defence, allied coordination, public communication, and NATO consultation rather than ordinary criminal prosecution (NATO, 2025a, 2025b;
The third pattern concerns public–private resilience. The cases show how civilian or commercial systems can become strategically exposed because of their location within wider networks of mobility, supply, public confidence, and deterrence. Marywilska involved a shopping centre, tenants, workers, insurers, and commercial owners, but once publicly linked to Russian-directed arson, it became more than a private or local loss. It became an example of how civilian–commercial infrastructure could be targeted or exploited within a wider hostile campaign (National Prosecutor’s Office, 2025;
The parcel plot provides the clearest example of private-sector exposure. The suspected devices moved through logistics systems that depend on private operators, cross-border movement, sorting facilities, transport schedules, cargo interfaces, and cross-border movement. Limited incendiary devices could therefore create wider costs through inspection, delay, screening, insurance concerns, and reputational risk across logistics networks (
The Warsaw–Lublin railway case shows a different version of public–private exposure. Rail infrastructure is more visibly strategic than a shopping centre or parcel chain but its operation still depends on multiple public, commercial, technical, and contractor relationships. Disruption to a rail corridor can affect passengers, freight, infrastructure managers, security services, and cross-border support routes. The case therefore supports a systems-based view of resilience in which a single disruption may create cascading operational and security effects (
Three findings follow from the cross-case comparison. Firstly, public framing moved from isolated-incident logic towards campaign logic. The cases were not identical and the evidence differed across them, but public discourse increasingly treated fires, logistics disruption, railway sabotage, and drone incursions as part of a wider pattern of Russian-linked pressure against Poland and other European states (
Secondly, attribution, legal classification, and operational response did not move at the same speed. Public attribution hardened unevenly. Criminal-law tools remained central in some cases, while diplomacy, international investigation, protective mobilisation, airspace defence, and NATO-linked consultation became more important in others. The uneven tempo was not simply the result of ambiguity; it also reflected the evidentiary, diplomatic, alliance-management, and resource costs attached to naming, classifying, and responding to suspected state-linked sabotage. This supports the legal-resilience argument that grey-zone incidents may remain formally domestic in a legal procedure while becoming functionally international in security significance (
Thirdly, resilience pressures were greatest where infrastructure appeared ordinary in administrative terms but strategic in systemic effect. A shopping centre, parcel network, railway line, airport, or logistics node did not need to be a military site to become security significant. These systems became targets, conduits, witnesses, or cost-bearers because they sat within networks that connect commerce, mobility, deterrence, and alliance support.
Overall, the results support the article’s central claim: Russian-linked sabotage and disruption in Poland should be analysed not only as a problem of attribution or criminal investigation but as a public–private governance problem under conditions of uncertainty. The descriptive code distributions, reported in the Appendix (
The findings suggest that recent Russian-linked sabotage and disruption in Poland are best understood not as isolated incidents but as governance problems produced by Russian active measures, attribution costs, institutional seams, lawfare, and infrastructure interdependence (
The first implication concerns attribution. The Polish cases show that attribution in sabotage settings is not a single legal or political act. It develops across technical, legal, intelligence, diplomatic, and public-communication domains. Marywilska case illustrates delayed movement from suspicion to direct attribution. The parcel plot shows how attribution can be distributed across handlers, intermediaries, logistics systems, and international investigative bodies. The rail case shows faster securitisation of infrastructure disruption. The drone cluster shows how attribution may be tied to deterrence and allied consultation even when public evidence remains incomplete. Political attribution is often a strategic choice as well as an evidentiary judgement, because naming Russia publicly may impose diplomatic costs, invite hostile counter-signalling, and require allied coordination. This supports the broader literature’s view that hybrid threats are difficult to detect and attribute, but it also adds an empirical point: different forms of attribution may coexist rather than resolve into one definitive public statement (
The second implication concerns Russian intelligence practice and proxy use. The parcel case is particularly important because it points towards a transnational operational pattern involving recruitment, task division, logistics exploitation, and suspected links to Russian military intelligence (
The third implication is transnationality. Russian-linked sabotage in Poland cannot be understood only through domestic criminal law or national infrastructure protection. The parcel plot moved through cross-border logistics systems and required Eurojust coordination. Drone incursions involved NATO-linked airspace defence and allied consultation. Rail and logistics vulnerabilities matter because Poland is part of a broader corridor supporting Ukraine and European security. These cases therefore show that sabotage may be legally domestic at the point of investigation but operationally and strategically international in its causes, pathways, and consequences (
The fourth implication concerns legal resilience. Criminal law remains necessary because sabotage produces concrete harms, perpetrators, evidence, and prosecutorial pathways. Yet criminal law alone cannot capture the whole governance problem when incidents also involve foreign intelligence links, diplomatic consequences, alliance reassurance, infrastructure protection, and public–private coordination. The Polish cases show that legal resilience requires neither underreaction nor overclassification. Treating sabotage only as ordinary crime may miss its strategic function. Treating every ambiguous incident as an act of war may exceed the available evidence and create escalation risks. Lawfare is central to this problem because hostile actors can exploit legal thresholds, evidentiary uncertainty, attribution standards, and classification disputes as part of the conflict environment. The difficult task is to preserve legal credibility while allowing protective and diplomatic responses to proceed before certainty is complete (
This creates a related problem of signalling. In this article, signalling refers to public, diplomatic, legal, or military communication intended to convey resolve, reassurance, attribution, or deterrence to multiple audiences. Those audiences include domestic publics, private operators, allies, adversaries, and potential perpetrators. The Polish cases suggest that signalling is not separate from institutional response. Public attribution, protest notes, NATO consultation, security deployments, and official reassurances, all communicate how the state understands the incident and what kind of response it is prepared to make. The risk is that signalling can move faster than legal proof. The benefit is that silence or excessive caution may also invite further probing. This tension is precisely where attribution, lawfare, and deterrence intersect: the state must communicate enough to impose costs and reassure audiences without undermining prosecution, intelligence protection, or alliance management.
Responsible disclosure is therefore central to sabotage governance. Authorities may need to warn private operators, reassure the public, and expose hostile activity without compromising classified intelligence, ongoing investigations, sources, methods, or future prosecutions. This is particularly important where private firms operate the systems through which hostile activity moves. Logistics companies, airports, rail contractors, shopping-centre owners, insurers, and private security providers need usable threat information, but public authorities may not be able to disclose everything they know. A practical resilience framework must therefore distinguish between public attribution, confidential operator warnings, classified intelligence-sharing, and evidentiary disclosure for prosecution.
False-flag possibilities further complicate this balance. The possibility that an adversary may mislead investigators, manipulate evidence, or exploit premature public claims reinforces the need for careful attribution. This does not mean that authorities should avoid public attribution altogether. Rather, attribution should be staged, evidence-based, and calibrated to the purpose it serves. A criminal indictment, diplomatic statement, public warning, NATO consultation, and operator advisory may each require different levels of evidentiary detail. Such calibration also reduces the risk that Russia can turn legal caution, evidentiary uncertainty, or public disagreement into additional confusion.
The public–private dimension is the most important practical implication of the study. The Polish cases show that commercially ordinary systems can become strategically consequential when they support mobility, supply, public confidence, or alliance logistics. Marywilska involved a commercial site. The parcel plot exploited logistics networks. The rail case affected transport infrastructure. The drone cluster disrupted aviation and airport operations. In each case, private or commercially operated systems became targets, conduits, witnesses, or cost-bearers in a wider security problem (
This means that public–private resilience cannot depend on general calls for vigilance alone. Private operators in exposed sectors need clearer reporting channels, baseline protective expectations, continuity plans, and access to timely threat information. Public authorities, in turn, need mechanisms for receiving reports from commercial actors, distinguishing ordinary incidents from hostile probing, and sharing actionable guidance without disclosing sensitive intelligence. The relevant policy question is not whether private actors should replace the state. They should not. The question is how public authorities and private operators can coordinate when the target is privately operated but the threat is geopolitical. This is also a resource problem: forcing public authorities and private operators to spend time, money, personnel, and political attention on protective adaptation is itself one of the effects Russian hybrid operations seek to produce.
Cost allocation is part of this problem. Screening, closures, delays, insurance disputes, security upgrades, staff training, and business interruption may fall on private actors even when the underlying threat is state-linked. If those costs are treated only as ordinary commercial risk, private operators may underinvest in security or fail to report suspicious activity. If all costs are shifted to the state, resilience becomes fiscally and operationally unrealistic. A stronger model would clarify minimum protective standards, reporting duties, liability expectations, and channels for public support in sectors exposed to hostile state-linked disruption (
The Polish cases also point to a need for professionalisation. Security preparedness in exposed commercial systems should include staff training, incident documentation, suspicious-activity reporting, continuity planning, and coordination exercises with public authorities. Professional security standards and certification frameworks are not a substitute for national strategy, but they can help private operators build defensible preparedness and improve cooperation with state agencies. The key issue is not any single credential. It is the development of recognisable standards and trained personnel capable of operating at the boundary between commercial risk management and national security.
Overall, the discussion supports the study’s central argument: Russian-linked sabotage operations create a governance problem because attribution, legal classification, and operational adaptation move at different speeds. That misalignment is not simply an accidental by-product of ambiguity; it is one of the ways hybrid pressure works, because Russia can exploit evidentiary delay, legal caution, institutional division, and resource strain. The state must investigate carefully, communicate credibly, deter further action, protect infrastructure, and coordinate with allies and private operators before the evidentiary picture is complete. That misalignment is not an administrative failure. It is a defining feature of sabotage conducted within a hybrid-warfare environment.
This article examined how Polish authorities publicly interpreted, legally framed, and institutionally managed recent Russian-linked sabotage and disruption affecting economically and strategically significant infrastructure, and what those cases suggested about the strengths and limits of public–private resilience under conditions of attributional uncertainty (
Public attribution hardened at different speeds across the cases, while legal and institutional responses expanded according to the character of each incident. Criminal-law tools remained central, but they were supplemented by diplomatic signalling, international investigation, protective mobilisation, airspace defence, and allied consultation. This supports the article’s central argument that Russian-linked sabotage operations create a governance problem that cannot be reduced to attribution alone. Nor should delayed attribution be read as a product of ambiguity alone. It also reflects evidentiary thresholds, political choice, alliance consultation, diplomatic risk, possible retaliation, and the practical costs of naming a hostile state publicly. The more difficult issue is how authorities act responsibly before certainty is complete.
The findings also show that resilience in this environment cannot be limited to formally designated critical infrastructure. Commercially ordinary systems may become strategically exposed when they support logistics, mobility, public confidence, continuity, or deterrence. Shopping centres, parcel networks, rail corridors, airports, warehouses, contractors, insurers, and private security providers may become targets, conduits, witnesses, or cost-bearers in a wider security problem. This means that public–private resilience requires more than general calls for vigilance. It requires clearer reporting channels, baseline protective expectations, continuity planning, information-sharing mechanisms, and more explicit allocation of risk and responsibility between public authorities and private operators. These measures matter because resource diversion, precautionary cost, and uncertainty management are themselves part of the pressure produced by Russian hybrid activity.
The Polish experience therefore offers a wider lesson for frontline and transit states facing deniable coercion below the threshold of war. Russian sabotage operations conducted within a broader hybrid-warfare environment exploit the gap between suspicion and proof, domestic law and international security, and public responsibility and private ownership. They also exploit lawfare, attribution costs, and institutional seams between criminal investigation, intelligence assessment, alliance signalling, and privately operated infrastructure security. Future research could extend this analysis through interviews with public officials and infrastructure operators, judicially developed case materials where available, and comparative cases from other European states facing similar Russian-linked disruption. Such work would help clarify how legal resilience and public–private infrastructure security can be strengthened before the next ambiguous incident occurs.
This research received no external funding.
The data presented in this study is available on request from the author.
No potential conflict of interest was reported by the author. The author read and agreed to the published version of the manuscript.
Coding framework used for qualitative content analysis.
| Code family | Code | Definition | Illustrative meaning in this study |
|---|---|---|---|
| Incident characteristics | IC-KIN | Kinetic or physically destructive action | Fire, explosives, direct material damage, or physical disruption. |
| Incident characteristics | IC-TEST | Resilience testing or probing activity | Actions revealing response gaps, preparedness weaknesses, or monitoring limits. |
| Incident characteristics | IC-RECON | Reconnaissance- or surveillance-related activity | Drone incursions, probing, observation, or preparatory exposure of vulnerabilities. |
| Attribution | AF-AMB | Ambiguous or cautious attribution | Official reluctance to name a perpetrator or state link directly. |
| Attribution | AF-DIR | Direct attribution | Explicit public linkage to Russian services or a hostile state actor. |
| Legal/institutional response | LR-KK130 | Criminal-law framing | Use of sabotage-related criminal provisions and prosecutorial process. |
| Legal/institutional response | LR-DIP | Diplomatic response | Expulsions, diplomatic retaliation, or interstate signalling. |
| Legal/institutional response | LR-INT | International coordination | Eurojust, NATO-linked coordination, cross-border investigation, and allied cooperation. |
| Legal/institutional response | LR-MOB | Mobilisation/protective deployment | Visible deployment, increased security posture, and operational protective action. |
| Public–private resilience | PR-VULN | Infrastructure vulnerability | Monitoring gaps, exposed corridors, weak points, and systemic dependencies. |
| Public–private resilience | PR-COOR | Coordination demands | Information-sharing, interagency cooperation, and operator-state coordination. |
| Public–private resilience | PR-COST | Precautionary or operational cost | Delays, business disruption, compliance burdens, or security expenditures. |
| Public–private resilience | PR-DISP | Disposable agent pattern | Use of proxies, intermediaries, or low-cost deniable operatives. |
Note. Values indicate the number of coded source rows within each case in which the code appeared. These counts are descriptive and based on the current workbook’s title-based coding; so, they should be presented as supporting indicators rather than definitive measures.
Descriptive distribution of selected codes across four Polish cases.
| Codes | Marywilska 44 | Parcel plot | Rail sabotage | Drone cluster |
|---|---|---|---|---|
| AF-AMB (ambiguous/cautious attribution) | 2 | 1 | 1 | 3 |
| AF-DIR (direct attribution) | 4 | 2 | 4 | 1 |
| LR-KK130 (sabotage/terrorism provisions) | 3 | 0 | 2 | 0 |
| LR-DIP (diplomatic retaliation) | 2 | 0 | 0 | 0 |
| LR-INT (international coordination) | 1 | 6 | 1 | 3 |
| LR-MOB (mobilisation/protective deployment) | 0 | 0 | 2 | 2 |
| PR-COOR (state–private coordination) | 2 | 2 | 3 | 0 |
| PR-VULN (identified vulnerability) | 3 | 3 | 3 | 3 |
| PR-DISP (disposable agent model) | 3 | 1 | 1 | 0 |
| PR-COST (economic/operational drag) | 0 | 1 | 0 | 2 |
Note. Values indicate the number of coded source rows within each case in which the code appeared. These counts are descriptive and based on the current workbook’s title-based coding; so, they should be presented as supporting indicators rather than definitive measures.