Key takeaways
- Romania's SRI says a Russian-coordinated network burned a Brașov commercial building on 14 September; three EU residents face proceedings.
- The fire engulfed civilian workshops and a car wash next to CARFIL SA, a state arms maker; officials have not said whether CARFIL itself was damaged.
- Two suspects are held in Germany and the third faces a European arrest warrant; the charges are unproven allegations.
Romania's domestic intelligence service said on Monday 26 October that a fire on the Carfil industrial platform in Brașov, central Romania, on the evening of 14 September was the work of a sabotage network coordinated from the Russian Federation. The Directorate for Investigating Organized Crime and Terrorism (DIICOT), Romania's specialised prosecution unit, has opened criminal proceedings for attempted acts of diversion, the Romanian legal term for sabotage. The suspects are two Belarusian citizens and one Ukrainian citizen, all resident in EU countries. The announcement came from the Romanian Intelligence Service (SRI).
The fire engulfed a commercial building of about 1,000 square metres that housed car repair workshops, a vehicle inspection station and a car wash. It stood immediately next to CARFIL SA, a subsidiary of the state defence group ROMARM that produces military ordnance. According to DIICOT, the fire affected the premises of several companies on the platform; the authorities have not said whether CARFIL SA itself was damaged. The Kremlin and Russian authorities issued no immediate comment. Moscow has routinely denied conducting sabotage in NATO and EU countries.
How the suspects were traced across three countries
The case runs through three countries. Two of the suspects are in pretrial detention in Germany, where authorities allege they were preparing similar sabotage acts. The third was located in Poland. The Bucharest Court of Appeal has issued European arrest warrants in absentia for all three, the last on 26 October, and Romania is seeking their extradition. Prosecutors have not said which suspect is held where.
DIICOT and the police Directorate for Combating Organized Crime (DCCO) handled the case with support from SRI and authorities in several European states. SRI, DIICOT, the Ministry of Internal Affairs (MAI) and the Ministry of National Defence's General Directorate for Defence Intelligence (DGIA) are continuing checks on sabotage operations in Romania.
Romanian authorities say the three were recruited or coerced by Russian handlers. SRI described the recruitment model it associates with such networks. Handlers use social media to approach people with money problems, addictions or criminal records. The first tasks are well paid and look harmless, such as photographing infrastructure, military sites or communication hubs. They escalate to vandalism, arson and attacks, with blackmail and threats if a recruit hesitates. SRI said members of such networks frequently use transport, accommodation and means of payment in other people's names, and communicate through SIM cards from third countries and encrypted messaging applications. The charges remain official allegations pending trial.
Observers are reading: how the Brașov case fits, and does not fit, the wider pattern of European defence-sector sabotage investigations.
Become an Observer, it's free. Get full access to all Crisis.Zone analysis, briefings and breaking coverage.
What the case still has to show
SRI said the purpose of such operations is to intimidate European states, damage defence capabilities and weaken the targeted states' contribution to European and regional security. President Nicușor Dan has repeatedly said that Romania is a target of Russian hybrid warfare, meaning pressure applied short of open armed conflict. Moscow has not answered the Brașov allegation.
The next verifiable steps are procedural. Polish authorities must act on the warrant for the suspect located there, and German authorities must decide on Romania's warrants for the two suspects held in Germany. A court must eventually test the Russian link that SRI asserts. Until then, the established facts are a fire in a civilian building, three suspects described by nationality and an intelligence assessment that points to Moscow. For firms that sit beside defence sites, the case suggests the risk perimeter may extend beyond the fence. That is an analytical reading, not a finding by Romanian officials.
Become an Observer (it's free) to unlock direct links to all sources used in this article.
We believe you deserve to verify everything we write. That's why we meticulously document every source.
