Gig economy workers open a new front in hybrid warfare
by Mike Cinnamon · The Washington TimesOPINION:
In August, the Leipzig/Halle Airport in Germany was targeted by three drones. The first drone struck the wing of a parked Ukrainian Antonov cargo aircraft but failed to detonate. A second drone was spotted in the airport’s vicinity that same night, and a third drone was discovered lying west of the airfield on Aug. 14.
By early September, German authorities had linked the drones to Russia and determined that they followed the “well-established pattern of Russian hybrid operations in Europe” carried out by “low-level agents,” according to German Interior Minister Alexander Dobrindt.
Additional Russian sabotage attacks in August targeted an ammunition depot in Bulgaria, the KNDS ammunition factory in Italy, the Milrem Robotics facility in Estonia and WB Electronics in Poland.
People were interested in these podcasts
On Sept. 9, a British citizen was charged in connection with a sabotage operation linked to the GRU, Russia’s primary military intelligence agency.
Since Russia’s invasion of Ukraine in 2022 through December 2025, The Associated Press documented 145 Russian sabotage incidents in Europe.
The perpetrators of some of these attack attempts might surprise you: “gig economy” workers.
Hybrid operations have demonstrated that Russia, along with other adversaries, such as Iran, have the means to exploit the gig economy in any country by identifying potential candidates through online chat groups and social media, criminal networks, the local diaspora community and others who are ideologically aligned.
The gig work they undertake to generate income, in some cases not knowing a nation-state such as Russia is directing them, may consist of taking photographs or videos of a certain location, operating a drone, scouting out local businesses, vandalizing a monument, throwing a Molotov cocktail or igniting flammable materials, following someone around or, worse, assassination.
Advertisement Advertisement
Hybrid operations are also happening in the United States. In September, a New York federal grand jury indicted five people — two Russians, two Cubans and one Venezuelan — for their work as surrogates for Russian intelligence services.
This work is said to have included recruiting American citizens to carry out specific, temporary tasks such as surveillance, the assassinations of Russian dissidents and involvement in other sabotage activities in Eastern Europe.
In May, a U.S. citizen and former truck driver was sentenced to 10 years in prison for his role in a plot targeting Iranian American author and activist Masih Alinejad. Federal indictments specifically attributed the murder-for-hire plot to senior officials within Iran’s Islamic Revolutionary Guard Corps.
Contracted gig workers from these groups are likely invisible to local security and police services. They blend into society with otherwise normal lives, and they may cross borders, making their detection difficult.
Compounding the problem: Communication between the gig worker and the foreign intelligence service can be conducted via encrypted commercial messaging applications.
Advertisement Advertisement
A rinse-and-repeat approach to stopping these gig workers can overwhelm a country’s investigative manpower and direct law enforcement and intelligence resources away from more important work.
In the U.S., what may start as a local police inquiry can quickly become a multijurisdictional counterintelligence investigation that requires the FBI and CIA to coordinate on intelligence sharing, while the State Department evaluates possible diplomatic scenarios.
Hybrid operations are a cost-saving approach by an adversary that likely uses far fewer resources than those tasked with unraveling their bad deeds. They also cause public hysteria.
Institutions such as NATO’s Joint Intelligence and Security Division and the European Center of Excellence for Countering Hybrid Threats are valuable incubators for learning, evaluating and assessing hybrid operations. The speed at which lessons learned can be shared among allies and turned into new counter-hybrid strategies will determine how quickly we improve detection and deterrence.
Advertisement Advertisement
National police and security services in pro-Western countries will need to continue to innovate investigative techniques and strengthen intelligence sharing, prioritizing speed over certainty to effect counteractions.
Despite current debates over its direction and development, artificial intelligence will likely play a prominent role in identifying physical locations and other targets vulnerable to hybrid attacks.
With such improvements, hybrid operations suspects could be identified sooner, helping us organize physical and online surveillance to better understand the network that recruited them and providing the U.S. and our allies with invaluable counterintelligence.
• Mike Cinnamon is a retired CIA officer. All statements of fact, opinion or analysis expressed are those of the author and do not reflect the official positions or endorsement of the CIA or any other U.S. government agency.
Advertisement Advertisement