Certain Russian expat groups systematically visit targets and facilities in Switzerland that could be of particular interest to spies and saboteurs. The intelligence service warns.
Apr 7, 2026, 5:14 amApr 7, 2026, 5:14 am
There are dozens of them: groups of foreign nationals in Switzerland who organize themselves via Facebook, Instagram or Telegram, are diverse and are very active. They regularly meet up with fellow countrymen for social events.
Object of Russian desire? Steam flows from the cooling tower of the Gösgen nuclear power plant. (archive image)Image: sda
Everything possible is on the program for these enterprising expats: game nights and cooking workshops, church tours and concerts, trips to mountains and lakes, visits to wrestling festivals and chocolate factories and much more.
But not all of these leisure groups are just about entertainment and harmless further education. A few actors obviously have other things in mind. In recent months, observers have noticed among the vast number of expat groups a number of Russian-speaking people who are particularly interested in a specific category of objects in Switzerland: critical infrastructure.
These are facilities and systems that are of central importance for society and the economy. The The Federal Office for Civil Protection (BABS) subdivides them in nine sectors: government, energy, waste disposal, finance, health, information and communication, food, public safety, transport. If such critical infrastructure fails due to sabotage, this can have catastrophic consequences for public safety and lead to supply bottlenecks.
Striking interest in critical infrastructures
Since the beginning of the Russian war of aggression against Ukraine, certain groups of Russian-speaking expats have repeatedly visited systems and facilities that would be of great interest to potential attackers and saboteurs: nuclear and other energy plants, hydroelectric power plants, railway and airport infrastructure, logistics centers for post offices and major distributors, organizations from the emergency services and rescue sectors, biogas, water treatment and disposal plants – and even the Federal Palace in Bern.
There are groups that have been guests at Swiss nuclear power plants up to three times since the beginning of 2024. They are interested in systems such as the Gotthard Base Tunnel or Zurich Airport. Observers suspect that certain actors exploit such leisure groups in order to gain unobtrusive access to critical infrastructure.
Intelligence service: “Awareness of group visits”
Such activities have not escaped notice from the Federal Intelligence Service (NDB). Spokesman Christoph Gnägi says:
«The FIS is aware of group visits to facilities that are part of Switzerland’s critical infrastructure. He constantly assesses such events in the overall geopolitical context and is in close contact with the responsible national and cantonal partners.”
The NDB “does not provide any public information about operational details, individual groups or specific objects,” said the spokesman. “These assessments are reserved for federal and cantonal decision-makers – also in order to initiate protective measures if necessary.”
One thing is certain for the intelligence service: “Espionage activities are often not detected or reported. “It can be assumed that the number of unreported cases is high,” says Gnägi.
Information is collected in advance
These suspicious visits do not take place in secret. On the contrary. They are initiated through the operators’ official channels, usually by registering via the Internet. Spies may be taking advantage of this publicity. “Hiding in plain sight” is the English expression. The vast majority of other expats in such groups are also unlikely to realize what is going on.
NDB spokesman Gnägi says: “Information about critical infrastructure is collected and evaluated years in advance and often in peacetime. In the context of intensified hybrid conflict management, the importance of such research has further increased.”
Russia and China as the biggest espionage threats
Whatever the case, one thing is certain for the intelligence service:
“The biggest espionage threat continues to come from Russia and China. Critical infrastructure is among the targets that foreign intelligence services target using various means, including human sources.”
British security authorities, for example, also issue urgent warnings. The National Protective Security Authority (NPSA) in London describes this “hostile reconnaissance” as “targeted observation with the intention of gathering information for planning a hostile attack against a specific target”. It’s about assessing security precautions, detection risks, vulnerabilities and chances of success.
Information about a place or event could be obtained “through online research, on-site visits and, if possible, through insider knowledge.” The British security authority states:
“The enemy actor can visit a facility multiple times, both physically and online.”
Site visits as an important part of espionage
Visits that seem harmless can be about checking existing or already collected information or assumptions in order to test security policies and security culture. The informants are concerned with how logistics and visit processes work and how access controls work. It’s about locating entrances and non-public areas. About finding weak points.
The British authorities also warn that repeated visits could also serve to establish contacts with staff. The aim would be to gain access to insiders who have important information. Such people may be brought into submission through pressure, money or so-called honey traps – classic sexual espionage.
In addition to the intelligence service, the canton of Aargau has recently emerged as a warning about espionage in Switzerland. At his annual media conference in January, police commander Michael Leupold spoke of “activities from which one must conclude that foreign services are interested in our infrastructure.” The surrounding area, access or security precautions would be explored.
Last week, Leupold specified on television in western Switzerland: “In the last two years there have been around a dozen incidents that we have attributed to foreign services.” It is probably mainly Russian or Chinese services.
Acts of sabotage with fatal consequences
The canton of Aargau is particularly exposed. Its territory is home to critical infrastructure such as the Leibstadt and Beznau 1 and 2 nuclear power plants, the “Stern von Laufenburg” electricity hub, which is extremely important for Europe, the largest fuel storage facility in Switzerland and key passages for European rail freight transport. If hostile actors succeed in an act of sabotage in the right place, it would have fatal consequences far beyond Switzerland.
The cantonal police do not say who exactly is targeting the Aargau infrastructure. It does not provide any further information about the systems affected, the suspects or their methods. According to Leupold, the Aargau police took measures last year to minimize risks.
Is Switzerland underestimating the danger? Operators of critical infrastructure – including nuclear power plants, airports, post offices, SBB, Migros and also the parliamentary services in the Federal Palace – emphasize in unison that security is the top priority. They point to established protection processes, ongoing reviews and close communication with the authorities. For security reasons, they hardly provide any concrete information about their measures.
As all operators emphasize, visits are only carried out under clear conditions: usually with prior registration, ID checks, security checks and strictly limited access, with the involvement of police authorities. Several operators also say sensitive areas remain closed to the public. Requests could be rejected if the purpose is unclear or there are security concerns.
What is still irritating is that photos and videos of such visits continue to appear on social networks – recordings that sometimes contain information about entrances, the inner workings of facilities or even staff. This raises the question of whether all operators are fully aware of the risks. And also the question of what other recordings such actors have.
Binding requirements for operators are in the works
Authorities such as the intelligence service indicate that they want even more caution and prudence. This also applies to the Federal Office for Civil Protection (BABS). Spokesman Philippe Boeglin says: In the “Protection of Critical Infrastructures” guide, his office recommends “paying particular attention to external visitors”.
However, this guide is not yet binding. That should change. In February, says Boeglin, the BABS received the order from the Federal Council “to develop key parameters for a new legal basis with binding requirements for the operators of critical infrastructure in sectors with federal responsibility by the end of this year.”
The NDB also sees the situation with growing concern. “The threat situation has worsened significantly; “Increased vigilance by everyone involved is necessary,” says spokesman Gnägi. The service carries “with his Prophylactic awareness program and its prevention work actively contributes to raising awareness of espionage risks. Last year, the NDB carried out 121 awareness campaigns and 69 preventative speeches.
The Prophylax program is about espionage prevention. The aim is to make companies, business organizations, universities, research institutes and authorities aware of the risks. The intelligence service recommends concrete security measures against illegal knowledge transfer and the passing on of sensitive information.
Will this still be able to stop the Russian agents and saboteurs who are at work all over Europe? (aargauerzeitung.ch)