Dutch Intelligence Says It's Time to Hit Back Against Russian 'State Terrorism'

Dutch intelligence chiefs delivered an unusually blunt message to parliament on Tuesday: the Netherlands needs to stop playing defense in Russia's hybrid war and start hitting back. The heads of both civilian and military intelligence warned that Moscow's campaign of sabotage, espionage, and digital attacks has escalated to levels "bordering on state terrorism," with the Netherlands serving as a prime target due to its support for Ukraine and hosting of international institutions.

The warnings from AIVD Director Erik Akerboom and MIVD Director Peter Reesink mark a significant shift in Dutch security discourse. For years, Dutch intelligence has documented Russian threats in carefully measured language. Tuesday's parliamentary briefing abandoned diplomatic niceties in favor of stark assessment: the Netherlands is operating in a "gray zone" between peace and war, and passive defense is no longer sufficient.

"We're dealing with an adversary who is quite effective at creating uncertainty," Akerboom told lawmakers. "Being resilient to that requires not only investments in defense, but also in the effectiveness of the services-and consideration of more frequent retaliatory strikes to increase the costs so someone doesn't do it again."

What Dutch Intelligence Has Found

The specifics are alarming. In 2024, Russian operatives carried out the first successful cyberattack on Dutch critical infrastructure, targeting the digital control system of an unnamed public service. Another attempted breach was thwarted before it succeeded. Russian ships were caught mapping energy infrastructure in the North Sea, including offshore wind farms, in what MIVD chief Reesink described as reconnaissance activities the agency "hadn't seen before."

The newly identified Russian hacking group "Laundry Bear"-disclosed by Dutch intelligence in May 2025-specifically targeted NATO defense contractors and governments purchasing military equipment for Ukraine. The group used sophisticated techniques including session hijacking via stolen browser cookies purchased on criminal forums, demonstrating how Russian state intelligence exploits both cyber vulnerabilities and criminal marketplaces.

Physical surveillance operations have intensified as well. Russian diplomatic facilities in the Netherlands routinely operate with staff that exceed what any normal embassy requires, with Dutch intelligence assessing that many of these positions are filled by undercover intelligence officers. In February 2023, the Netherlands expelled at least ten Russian diplomats and shuttered Russia's trade mission in Amsterdam in response to persistent intelligence operations.

The threat extends beyond traditional espionage. Dutch coast guard vessels have intercepted Russian ships operating suspiciously near critical underwater cables and energy infrastructure. The intelligence services note it is "conceivable" Russia could attempt Nord Stream-style sabotage against Dutch water and energy supplies, provided such attacks could be conducted covertly enough to maintain plausible deniability.

Why the Netherlands Is a Target

The Netherlands punches above its weight as a Russian intelligence target for several reasons. Rotterdam houses Europe's largest port, through which significant military aid to Ukraine transits. The Hague hosts the International Criminal Court, which has issued an arrest warrant for Vladimir Putin. Amsterdam serves as a European tech hub with major data centers and telecommunications infrastructure. And the Netherlands consistently ranks among the most vocal EU members supporting Ukrainian resistance.

From Moscow's perspective, degrading Dutch resolve offers multiple strategic benefits. Successful sabotage operations demonstrate NATO's vulnerability to hybrid warfare. Cyberattacks on critical infrastructure spread uncertainty about government capacity to protect citizens. Espionage against defense contractors provides intelligence on Western military capabilities flowing to Ukraine. And persistent low-level disruption creates political pressure to reduce support for Kyiv.

The Dutch intelligence assessment notes Russia shows "greater risk tolerance" in 2025 than in previous years, with "more brutal, aggressive or provocative activities" aimed at groups supporting Ukraine. This escalation tracks with broader European reporting of Russian sabotage attempts, including arson attacks on logistics facilities in Germany and Poland that authorities attribute to Moscow-directed proxies.

The Intelligence Sharing Dilemma

Dutch intelligence faces an additional complication: Donald Trump's return to the US presidency has created uncertainty about intelligence sharing with Washington. In an October interview with de Volkskrant, Akerboom and Reesink acknowledged the Netherlands has become "more cautious" about sharing Russia-related intelligence with American counterparts, fearing it could be "politicized" or potentially compromised.

This represents a seismic shift in Dutch-American intelligence cooperation. The Netherlands has historically maintained exceptionally close ties with US intelligence agencies, dating to Cold War collaboration that never entirely ended. But Trump's ambiguous relationship with Russia and his administration's inconsistent approach to Ukrainian support have introduced doubts about whether sensitive intelligence would be protected.

The implications are significant. If the Netherlands and other European intelligence services begin compartmentalizing Russia-related intelligence from American partners, it degrades collective Western understanding of Russian operations. Moscow benefits from any friction in NATO intelligence cooperation, which is precisely why Russian influence operations work to amplify transatlantic divisions.

The "Hit Back" Debate

Akerboom and Reesink's call for "retaliatory strikes" marks new territory for Dutch security policy. The Netherlands has traditionally favored diplomatic responses to intelligence provocations-expelling diplomats, imposing sanctions, publicly attributing cyberattacks. Active cyber or covert operations against Russian intelligence infrastructure would represent a significant escalation.

Proponents argue passive defense invites continued aggression. If Russian intelligence can conduct sabotage operations with impunity, deterrence fails. Raising the operational costs through targeted retaliation-disrupting Russian intelligence networks, exposing agents, conducting proportional cyberattacks against Russian infrastructure-might convince Moscow that hybrid warfare against the Netherlands carries unacceptable risks.

Critics worry about escalation dynamics. Russia's threshold for conventional military response is unclear. Active Dutch operations against Russian intelligence could provide Moscow justification for more aggressive actions, either against the Netherlands directly or against other NATO members. The gray zone between peace and war cuts both ways-covert operations create ambiguity about what constitutes an act of war.

The Dutch government has not publicly endorsed the intelligence chiefs' recommendation. Defense Minister Ruben Brekelmans told parliament the government takes Russian threats "very seriously" but declined to discuss specific countermeasures, citing operational security. This suggests internal debate about whether the Netherlands should adopt a more aggressive posture.

What "State Terrorism" Actually Means

The AIVD's characterization of Russian activities as "bordering on state terrorism" deserves examination. Terrorism typically refers to violence targeting civilians to achieve political objectives. Russian hybrid operations-cyberattacks, infrastructure reconnaissance, attempted sabotage-clearly aim to spread fear and undermine social stability. Whether they constitute terrorism depends on how one defines deliberate violence against civilians versus covert operations against state infrastructure.

The semantic debate matters for policy. Terrorism invokes different legal frameworks and response mechanisms than espionage or cyberwarfare. If Dutch intelligence formally assesses Russian operations as state terrorism, it could justify invoking NATO's collective defense provisions or EU mutual assistance clauses. It also shifts public discourse from abstract security threats to visceral fear of attacks on civilian infrastructure.

Russia would certainly reject the characterization. Moscow frames its actions as legitimate intelligence operations no different from Western espionage, conveniently ignoring the sabotage and intimidation components. The Kremlin portrays Western complaints about Russian hybrid warfare as hypocritical deflection from NATO's own covert operations.

Regardless of terminology, the operational reality is clear: Russia is conducting a sustained campaign to weaken the Netherlands and other European countries through means short of conventional warfare. Dutch intelligence assesses this threat will persist "including after a possible end to the war against Ukraine," suggesting Moscow views hybrid operations as a permanent feature of its relationship with the West.

The Gray Zone Gets Darker

Reesink's warning that the gray zone between peace and war is "becoming increasingly dark" captures the strategic dilemma facing the Netherlands and broader Europe. Traditional deterrence concepts assumed clear lines between peace and conflict. Hybrid warfare deliberately blurs those lines, creating ambiguity about when collective defense obligations trigger and what responses are proportional.

For the Netherlands specifically, this creates difficult choices. The country lacks the intelligence and military capabilities of larger European powers, making unilateral action risky. But Dutch participation in collective responses-whether through NATO, the EU, or ad hoc coalitions-requires political will that may not materialize if other members view escalation as too dangerous.

The intelligence chiefs' parliamentary testimony suggests frustration with these constraints. Their call for retaliatory measures reads as an attempt to shift political debate toward more aggressive responses, even if implementation remains uncertain. Whether Dutch policymakers embrace this shift or maintain traditional restraint will determine how the Netherlands positions itself in Europe's evolving confrontation with Russia.

In the meantime, the reconnaissance continues. Russian ships map North Sea infrastructure. Cyber operatives probe defense contractors' networks. Intelligence officers cultivate assets and gather information. And Dutch intelligence services document it all, warning that uncertainty has become the rule rather than the exception.

Welcome to the gray zone. It only gets darker from here.