INVESTIGATION: Moscow put a price on the THeMIS, and Tallinn blames its services for the Milrem fire

Betooni Street, at night

Lasnamäe, August 15

Three Latvian nationals have been held in Tallinn since mid-September over the August 15 fire at Milrem Robotics, and the sponsor the Estonian state points to has neither a name nor a face.

Someone is missing from this file. The one who paid.

The three suspects have a court, a prosecutor, a cell. Whoever ordered the fire has only a plural in a press release: the special services.

The fire broke out overnight from August 14 to 15, in a building on Betooni Street, in the Lasnamäe district, used by the defence company Milrem Robotics.

Emergency crews arrived right away. The fire was quickly brought under control. No lives were in danger, the government says.

The damage has not been costed. A month later, its extent was still to be determined, according to ERR.

A resident made the call

It all starts with a neighbour. A local resident noticed suspicious comings and goings near the building and alerted the emergency centre, according to ERR.

No film cameras. No secret agent. A resident, an August night, and a phone call.

An emergency call, as everyone knows, always starts the same way. Three digits. A dial tone. A voice that answers.

ERR carries the thanks addressed to that resident. No name.

Before the services, there was a phone call.

Two days in Latvia

August 17 and 18

On August 17, two Latvian citizens suspected of setting the fire were arrested in Latvia. A third followed on August 18.

Searches followed at locations tied to the suspects. Numerous data storage devices were seized, along with items that may have been used to start the fire, according to the Estonian government.

Forty-eight hours from smoke to handcuffs. Fast. Very fast.

From the outset, Prosecutor General Astrid Asi said suspects had been identified from evidence gathered by the Internal Security Service, ERR reported. The investigation was in its early stages, she added, and the sabotage hypothesis still had to be examined.

Two days is not much. It is the time it takes when someone is already holding a lead.

September 17 and 18

On September 17 and 18, Latvia handed the three suspects over to Estonia.

After questioning by the Internal Security Service, they were brought before Harju County Court. The judge found their detention justified, according to state prosecutor Gardi Anderson.

Evidence gathering is continuing, the prosecutor said at the time. Every hypothesis is being examined, including sabotage.

They are suspects. Not convicts. They remain suspects until judgment.

Three suspects in a cell, and a sponsor out of reach.

A bounty on a THeMIS

The robot rolling toward Ukraine

Milrem Robotics supplies Ukraine, together with European Union countries, with THeMIS unmanned ground vehicles.

Ground robots, operated remotely. Machines that go where a soldier should not have to.

The THeMIS heads to Ukraine with EU countries. Aiming at Milrem means aiming at a link in a European chain.

The Internal Security Service warns that defence companies and organizations supporting Ukraine face a heightened threat.

Back in August, its director, Margo Palloson, told ERR that Russia poses a long-term existential threat to Estonia.

2022, the reward

In 2022, Russia announced a reward for capturing and delivering a THeMIS deployed in Ukraine, ERR recalls.

First a bounty on the machine. Then a fire at its maker.

Three Latvians in a cell. No sponsor named.

Nobody has proven before a judge a link between the 2022 bounty and the 2026 fire. And yet it reads without effort.

The bounty named the target. The fire found it.

September 29, 9:54 in the morning

The Stenbock House release

On September 29, at 9:54 a.m., the Estonian government published its conclusion.

Prime Minister Kristen Michal said he was fully confident: the August 15 fire was “an act of sabotage commissioned by the special services of the Russian Federation.”

The prime minister sees in it Moscow’s growing desperation at failing to reach the goals of its aggression against Ukraine. Estonia, he adds, is exceptionally difficult terrain for an adversary, and other operations were stopped before they could happen.

The Internal Security Service reached that conclusion after a thorough assessment of its information, according to the same release.

Foreign Minister Margus Tsahkna called such actions “absolutely unacceptable.” Russia’s representative was summoned. It was the chargé d’affaires, the Associated Press specifies.

This sabotage is part of a broader Russian campaign in Europe, meant to intimidate us and weaken our support for Ukraine, Tsahkna wrote.

What this investigation stands for

This investigation stands with Milrem’s engineers and with the Ukrainian soldiers waiting for its THeMIS vehicles. Against the Russian services Tallinn names. Because on September 29, the Estonian state concluded that the August 15 fire had been ordered by them.

And it asks for one thing more than the release does. The name.

A state’s certainty calls for a name.

The Kapo’s written finding

Prepared, commissioned, attributable

The Internal Security Service, known as the Kapo, published its own conclusion, quoted by the Associated Press.

A deliberate act. An act planned in advance. An act commissioned by Russian security services.

The modus operandi is consistent, the Kapo writes, “with other acts of sabotage carried out in Europe on behalf of Russia.”

The attack, in its assessment, is “directly attributable to the Russian Federation.”

Three adjectives. No name.

The Kapo advises defence companies to tighten their physical and cyber security. The advice amounts to an admission: other targets exist.

The criminal case goes on

The criminal investigation into the exact circumstances continues. Its first findings also point to a commissioned act, according to the government.

Two tracks. Intelligence, which concludes. Justice, which is still searching.

They say the same thing. They do not say it with the same evidence.

Our job, says the Kapo’s director, is to foil these plans at a very early stage. This time, the plan went ahead.

Intelligence has concluded. The court has not begun.

Without any substantiation

Peskov’s reply

At the Kremlin, Dmitry Peskov replied the same day.

Unfounded, ill-considered statements, bearing no relation to reality and without the slightest proof, he said, according to the Associated Press.

“We cannot take such statements seriously, and we won’t,” he added.

The strongest version of the denial

This reply has to be taken in its best form. It has something to stand on.

The release publishes no evidence of the commission. No exchange of messages. No transfer of money. No officer’s name.

And the three suspects are not being prosecuted for sabotage. They are suspected under the Penal Code article on damaging and destroying property, the state prosecutor said last week. That could change, he added.

A Moscow lawyer would need nothing else. A state that accuses without public evidence hands the accused the argument of slander.

Peskov is right on one point, and one only.

What the file cross-checks

Five dated elements

And yet the case holds up without the secret evidence.

There is the 2022 Russian bounty on the THeMIS. There is the arrest of the suspects within forty-eight hours, with data devices seized. There is the modus operandi, which the Kapo links to other sabotage. There is the criminal case, which also points to a commission. There is, finally, a series.

Five elements. None is proof on its own. Together, they add up to a body of evidence.

Germany blamed Russia for an attempted attack on Leipzig/Halle airport in early August, with a drone loaded with explosives, the Associated Press recalls.

What Peskov leaves unsaid

He does not say who else would want to burn down a supplier of combat robots to Ukraine.

He does not say why three Latvians would have picked, on their own, that particular building among all of Tallinn’s.

He does not say what was on the data devices seized in Latvia.

He denies. He does not explain.

Denial costs a sentence. An explanation would cost a name.

The first fire that worked

What the Kapo admits

We also have to write down what bothers our own camp.

This fire worked. It was the first successful attack in Estonia this year on behalf of the Russian services, Kapo director Margo Palloson acknowledged to ERR.

Successful. The word comes from the intelligence chief himself. Once is enough.

Most of the others were prevented, he says. He declines to say more. We have to take him at his word.

Operatives kept in the dark

And the operatives may not be who we imagine. The usual motive of recruits, Palloson says, is money: the chance of an easy gain.

Often, he adds, the Russian services use them blindly. They do not tell them who they are working for.

The same day, in Brussels, Lithuanian Prime Minister Mindaugas Sinkevicius said the risk remains but is not rising, according to Euronews.

That is true. And it does not change this: a service that gives orders in the dark is still the one giving orders.

An operative who does not know his boss does not erase the boss.

From Moldova to Latvia

The recruiters’ pool

Palloson describes a wide pool.

There are people from Estonia’s Russian-speaking community. There are people from organized crime networks. There are foreigners.

Last year, the fire at the Slava Ukraini restaurant was set by operatives recruited in Moldova, he recalls.

Three Latvian passports

This time, they came from Latvia. And people living in Russia, able to travel, have also taken part in earlier attacks, the Kapo director adds.

A restaurant named for the Ukrainian salute. Then a company that arms Ukraine.

The target changes size. The hand changes passports.

The recruiter pays. The operative takes the risk. The sponsor would not even have to cross a border.

Recruit elsewhere, strike here, and never show your face.

Two hundred incidents

The Associated Press tally

The Associated Press has counted some 200 incidents of sabotage and malicious activity blamed on Russia in Europe since the full-scale invasion of February 24, 2022.

Plots to torch warehouses. Drone launches. Attempts to eliminate opponents abroad. Thefts of defence technology. Cyberattacks on critical infrastructure.

A list that keeps growing

Two hundred. More than three a month, for four and a half years.

Each one, taken alone, looks like a minor news item. A warehouse. A fire. A drone. Three lines in a local paper.

European governments say Moscow is stepping up this campaign as its troops struggle at the front, according to Euronews.

Laid end to end, they sketch a doctrine: strike below the threshold, where nobody invokes Article 5.

A warehouse. An airport in Germany. A building in Tallinn.

The next address is already somewhere on a map.

Two hundred minor news items add up to a campaign.

Calm, carry on, says Rutte

Brussels, September 29

NATO Secretary General Mark Rutte called for calm that same Tuesday, according to Euronews. His line: “calm, carry on and support Ukraine.”

Russia is pursuing its campaign of hostile acts against the allies, he said. It is failing on the battlefield. It is failing to break unity.

He admitted these actions “can have an impact,” and sometimes do. We must not be naive about Russia, he added, but it knows we are stronger.

The capitals answer

Berlin spoke of an irresponsible act of hostility. Paris said Russia would prevail over neither European unity nor European determination. Stockholm called the attack extremely serious.

Paris also speaks of a dangerous escalation that will lead Russia only to a dead end.

Kristen Michal, for his part, considers a conventional military attack by Putin on Europe unlikely, since his forces are tied down in Ukraine. The best deterrent, he says, is to support Ukraine.

Michal compares the Russian leader to a cornered rat. Putin, he says, tests the allies with covert attacks that are hard to attribute, to undermine NATO’s collective defence.

Hard to attribute. That is the whole subject of this file.

Calm is not forgetting. It is a way of denying the sponsor the show he paid for.

Keeping calm is not closing the file.

The Brussels protocol

Kallas, September 28

The day before, on September 28, EU foreign policy chief Kaja Kallas said intelligence shows Russia is preparing more sabotage, according to Euronews.

Foreign ministers were mandated to build an emergency security protocol. A member state could trigger it as soon as a hybrid threat is identified.

It would cover what stays below the threshold of armed aggression but still calls for a response. The mechanism, championed by Kallas and Ursula von der Leyen, had been sketched out by the Commission president in her State of the Union address in mid-September.

Below the threshold. That is exactly where the Lasnamäe fire sits: too small for Article 5, too deliberate for a minor news item.

What Tallinn promises

Tallinn promises the opposite of what Moscow is after: more pressure, tighter sanctions, new limits on Russian citizens’ travel to Europe, and stronger support for Ukraine.

A protocol. Sanctions. Visas.

None of these tools names an officer.

A protocol answers the fire. It does not say who ordered it.

The missing name

Four open questions

Here is what remains to be established, and what the public does not have.

We do not know who in the Russian services placed the order. We do not know through which intermediary it reached Latvia. We do not know how much the operatives were paid, or how. We do not know whether they knew who they were working for.

The release says “special services.” Plural. No acronym.

There is a possible reason. A service that publishes its sources loses them. I understand that.

The trial ahead

And yet a trial for property damage will judge a fire. It will not judge a commission.

If the charge does not move up a notch, the certainty of September 29 will remain a line in a government release, and Peskov will keep his one point.

The state prosecutor said it himself: the charge can change as the investigation proceeds.

As long as that name is missing, the Kapo has a conviction, the Kremlin has a retort, and the public has a hole.

Without a name, a certainty is only a conviction.

A resident of Lasnamäe

One call, one August night

Back to the beginning. A resident, one August night, noticed comings and goings and called the emergency centre.

Someone saw. Someone called.

Without that call, the fire might have spread further. Without that call, the suspects might have had more than two days.

The August 15 fire cost no lives. It cost something else: the idea that a company arming Ukraine, in Europe, can work in peace.

I admit to a worry. We live far from Tallinn, and we believe fires like this one only happen elsewhere.

The next night

What will the government’s certainty be worth if the trial rules only on property damage?

The Kapo has concluded. The court will judge. Whoever gave the order, the Kapo says, is constantly looking for new opportunities.

A neighbour dialed a number. A service followed a lead. A government signed a conclusion. A court still has to write a name.

The next call may be ours.

A price on the THeMIS, a fire at Milrem, a sponsor with no name.

Sources:

Primary Sources:

• Government of Estonia — Russia responsible for the arson at Milrem, September 29, 2026
• The Associated Press (WSLS) — Kapo finding, chargé d’affaires summoned, Peskov’s reply, September 29, 2026
• ERR — interview with Kapo director Margo Palloson, September 29, 2026

Secondary Sources:

• Euronews — Rutte, European reactions and the Kremlin’s denial, September 29, 2026
• Euronews — Kallas and the EU protocol against hybrid attacks, September 28, 2026
• ERR — three Latvian suspects handed over and the charge retained, September 22, 2026