# REPORT: The Belarusian Spy in Toulouse — How Russia Films Our Drone Factories

> On June 3, 2026, agents of the General Directorate for Internal Security detained a 48-year-old man born in Belarus, near Toulouse. The scene belongs to no spy novel. It unfolded in real France, a few kilometers from an industrial zone housing a facility of Delair — one of France's leading manufacturers of civil and military drones, a supplier to both the French and Ukrainian a

- Author: Maxime Marquette
- Publisher: MadMax (https://mad-max.co)
- Section: Reportage
- Published: 2026-06-29
- Canonical URL: https://mad-max.co/en/article/reportage-l-espion-belarusse-de-toulouse-comment-la-russie-filme-nos-usines-de-d

## Introduction: An arrest near Toulouse that exposes the war in the shadows

### June 3, 2026 — when the DGSI strikes in Toulouse

On **June 3, 2026**, agents of the **General Directorate for Internal Security** detained a **48-year-old man** born in **Belarus**, near **Toulouse**. The scene belongs to no spy novel. It unfolded in real France, a few kilometers from an industrial zone housing a facility of **Delair** — one of France's leading manufacturers of civil and military drones, a supplier to both the French and Ukrainian armies. The man was filming. The man was transmitting. His formal indictment was announced on **June 19, 2026**. And suddenly, what seemed to belong to the Cold War is here, in front of us, in France, in 2026.

This arrest is not an isolated incident. Since **January 2026**, France has been targeted by at least **three operations** of **sabotage or espionage** linked to Russia — including an attempted sabotage of an **SNCF electrical transformer**. The man from **Toulouse** fits a documented, systematic pattern that Western counterintelligence services are tracking with growing attention: the deployment of Russia-aligned operatives on the territory of allied democracies to collect industrial intelligence, fuel sabotage operations, and send signals of intimidation. Welcome to **Putin's** hybrid war. It happens here too.

### Delair — a strategic target for Moscow

**Delair** is no anonymous company. Founded in **Toulouse** in 2011, it has established itself as one of the global leaders in **long-endurance drone** development for professional and military applications. Its systems are used by both the **French and Ukrainian armies**, notably for surveillance, reconnaissance, and in certain configurations target acquisition. The prototype the Belarusian operative was filming is precisely the type of technology that Russian intelligence services have the strongest interest in analyzing — not to steal its complete design, but to identify its **operational capabilities**, its **electronic vulnerabilities**, and the **deployment conditions** that could allow the development of countermeasures.

In the logic of military intelligence, footage of a Delair drone prototype — even shot from a distance and without access to technical specifications — has real value. It allows analysts to estimate the craft's size and weight, which gives clues about its autonomy and payload. It can reveal configuration or antenna characteristics that inform about on-board communication systems. And above all, it confirms that a given prototype exists and at what stage of development — information that allows adversaries to calibrate the urgency of counter-development. For a **few hundred euros** paid to an individual willing to take risks, Russia potentially obtained data that would have cost millions to acquire by other means.

*A few hundred euros. That is reportedly what this man was paid to film a drone prototype protecting Ukrainian soldiers. There is something deeply revolting about this economy of espionage. A Ukrainian fighter's life bargained for the price of a round-trip flight from Minsk to Toulouse. That is what human lives are worth in Putin's intelligence ledger. And that is why this war is not only out there, on the front. It is here, next to us.*

## The spy's biography — what the established facts reveal

### A 48-year-old man born in Belarus — the profile of a proximate intelligence asset

Publicly available information on the man arrested on **June 3, 2026** is deliberately limited. French judicial procedures generally allow minimal identification in the early weeks of an investigation. What is known: the man was **48 years old** at the time of his arrest. He was born in **Belarus**. He was found near a **Delair** facility in the act of filming. He allegedly sent this footage to a contact in **Russia via the Telegram application**. French prosecutors charged him with **espionage for the benefit of a foreign power** — a legal qualification that, under French law, requires that sufficient elements have been gathered to justify opening a formal investigation.

The Belarusian nationality of the individual fits a well-documented profile in Russian intelligence operations across Europe. **Alexander Lukashenko's Belarus** has since 2020 been a state vassalized by Russia, whose security services (**Belarusian KGB**) collaborate closely with the **Russian FSB** and **GRU**. Belarusian citizens residing in Western Europe are sometimes recruited as proximate intelligence sources — not necessarily trained professional agents, but individuals paid for one-off information-gathering missions. This type of **proximity human intelligence** is less sophisticated than classic espionage, but also less exposed because it does not require deploying professional intelligence officers.

### The use of Telegram as a communication channel — risks and lessons

The fact that the individual allegedly used **Telegram** to transmit the footage to his Russian contact is revealing on several counts. First, it indicates that the level of professionalism in this operation is not that of a high-sensitivity intelligence mission. A professional intelligence officer would use far more secure and opaque communication channels. **Telegram**, despite its encryption features, is not the preferred channel of professional intelligence services for sensitive transmissions. It leaves **digital traces** far more accessible to counterintelligence services.

This suggests that the **DGSI** was likely already aware of this individual or his contact before he even began surveilling **Delair**. The surveillance and apprehension may have been timed to the moment judged most opportune for maximizing available evidence. This is a classic counterintelligence technique: allow the suspect to operate long enough to build a solid case, then move in when he is most vulnerable. The **DGSI** demonstrated here a responsiveness and effectiveness that deserve recognition — in a period when the Russian threat on French soil has intensified significantly.

*Telegram as an espionage tool. I do not know whether this is negligence, arrogance, or naivety. But what it says is that Russia also uses amateurs for its less sensitive operations. People recruited quickly, paid little, instrumentalized and probably abandoned to their fate if things go wrong. This is the absolute cynicism of Putin's intelligence apparatus: individuals are disposable resources. Their fate never enters the equation.*

## Delair in the war in Ukraine — why Moscow wanted this information

### Delair drones on the Ukrainian battlefield — their operational role

**Delair** has supplied **Ukraine** with its **long-endurance reconnaissance drone** systems, including the **DT26**, a fixed-wing drone capable of multi-hour missions allowing the surveillance of large zones. These drones have become critical assets for Ukrainian forces in the ongoing war — they enable the detection of Russian troop concentrations, guide artillery, assess strike results, and maintain an updated operational picture of the battlefield. For **Russian military planners**, understanding the precise capabilities of these systems is an operational priority.

More specifically, the elements that Russian intelligence services seek to know about **Delair** systems include: their **cruising altitude and speed** to calibrate anti-drone systems; their **communication frequencies** to develop targeted jamming capabilities; their **radar, visual, and infrared signature** to improve detection systems; and their **operational employment parameters** (typical distances, altitudes, mission durations) to orient counter-reconnaissance measures. Even imperfect footage of a prototype can contribute to informing several of these points.

### The prototype market — why a prototype is more valuable than a production model

The target was a **Delair drone prototype**, not a model already in service. This distinction matters. A prototype represents a system's **future capabilities** — what the operational version that will equip Ukrainian forces in 12 to 24 months will be capable of doing. Obtaining information on a prototype gives adversary intelligence services a **temporal lead** to prepare countermeasures before the system is deployed. This is precisely why defense companies protect their prototypes with particular care — and why the **Toulouse** operative was specifically targeting a facility where prototype testing could be conducted.

The **Toulouse** area, with its unique concentration of aerospace and defense industries — **Airbus, Thales, ATR, Safran** and dozens of specialized subcontractors — is a prime intelligence target for Russia. This is very probably not the first collection operation targeting the region. And it would be naive to think it is the last. The **DGSI** maintains dedicated teams focused on economic security in this sensitive zone — the **June 3rd** arrest testifies to their vigilance. But the attempts will not stop.

*Toulouse. The pink city. The capital of European aerospace. And now also a city being spied on by Putin's operatives. I say this not to alarm needlessly. But to remind us that Russia's hybrid war takes place in ordinary industrial zones, near discreet test sites, within range of a smartphone camera. Twenty-first-century espionage does not have the glamour of James Bond. It has the banal face of a 48-year-old man with a phone.*

## The pattern of Russian operations in France since January 2026

### The attempted SNCF transformer sabotage — a warning that was underestimated

The arrest in **Toulouse** must be read in the broader context of Russian operations on French soil since the start of **2026**. **France** has been targeted at least **three times** in the space of a few months. One of those operations targeted an **SNCF electrical transformer** — an attempted sabotage of rail infrastructure that, had it succeeded, could have caused massive disruptions to the French transportation network. Railway networks are critical infrastructure whose disruption affects not only civilians but also the **movement of troops and military equipment**.

The fact that three distinct operations have been documented within a few months reveals a **significant intensification** of Russian intelligence activity on French soil. This is not coincidental: **France** is one of the principal arms suppliers to **Ukraine** (**SCALP** cruise missiles, **Caesar** howitzers, **MILAN** anti-tank systems and other platforms), one of the countries pushing most actively for robust Western support for Kyiv, and a nation whose position as an independent nuclear power is perceived as a challenge to Russia's intimidation strategy. Targeting France sends an unambiguous message: **your support for Ukraine has a cost for you too, on your own soil**.

### 192 Russian attacks in Europe since 2022 — mapping a systematic hybrid war

The **Associated Press** has documented at least **192 Russian attacks in Europe** since the invasion of Ukraine in **2022**. This figure covers attempted infrastructure sabotage, political destabilization operations, cyberattacks, industrial espionage operations, and intimidation acts targeting public figures. This is not a series of isolated incidents. It is a **systematic campaign**, planned and coordinated by Russian intelligence services — principally the **FSB** and the **GRU** — with the objective of creating sufficient insecurity and instability in allied democracies to erode their will to support Ukraine.

The geography of these **192 attacks** covers the entire territory of **European NATO**: from **Great Britain** to **Germany**, from **Scandinavia** to the **Mediterranean**. No country is spared. The level of sophistication varies: some operations clearly bear the hallmarks of professional intelligence officers; others, like the **Toulouse** affair, use locally recruited individuals with rudimentary means. This variety is itself a strategy: it maximizes the number of incidents while **limiting the exposure** of professional intelligence officers who cannot be everywhere at once.

*192 attacks in Europe since 2022. Nearly one per week. If a hostile power committed 192 acts of physical aggression against European states, we would call it war. We would be right. Hybrid war is real war. It does not look like the wars in history books. But it kills, it destabilizes, it intimidates. And it deserves a response commensurate with what it is: not an occasional policing problem, but a structured strategy of aggression against our democracies.*

## The GRU and FSB in Europe — the organizational structures behind the attacks

### How Russian military intelligence organizes its operations in Western Europe

The **192 documented attacks** do not occur in an organizational vacuum. They reflect the structures and capabilities of Russian intelligence services operating across Europe. The **GRU** — Russian military intelligence — has a long tradition of active operations in hostile territory, including sabotage, assassinations, and the collection of industrial and military intelligence. The **Skripal** affair in 2018 in the United Kingdom, the explosion of an arms depot in the **Czech Republic** in 2014, the attempted poisoning of **Sergei Navalny** — all these operations bear the signature of the GRU or its affiliates.

The **FSB** — the KGB's successor for counterintelligence and domestic operations — has progressively expanded its mandate to overseas operations since 2014. Its methods differ somewhat from the GRU: it is more focused on **recruiting local sources**, political influence, and disinformation operations. Cooperation between **GRU** and **FSB** has been reinforced since 2022, under the pressure of disappointing results in the war in Ukraine. Parallel command structures emerge for specific operations, blurring accountability lines and complicating judicial attribution.

### The profile of local recruits — who agrees to serve Russian intelligence in Europe

The **Toulouse** affair illustrates a category of recruit that Western intelligence services sometimes designate as **circumstantial assets** — individuals who are not agents recruited and trained over several years, but people approached for one-off missions, often through diaspora communities, online groups, or social contacts. Financial motivation (a few hundred euros for a mission lasting a few hours) and the minimization of perceived risk ("I'm just filming from the street, that's not illegal") lower the recruitment threshold.

This low-cost, low-threshold recruitment model is particularly difficult for counterintelligence services to counter. It generates volumes of operations that exceed individual surveillance capacity. The **DGSI**, **MI5**, **Germany's BfV**, **Sweden's SÄPO** — all these services face a **scalability challenge**: how to monitor hundreds of individuals potentially recruited by Russian services when counterintelligence human resources are limited? The answer involves mass data analysis, cooperation among allied services, and adapted legislation that enables arrest before damage is done.

*Recruiting ordinary citizens for proximity espionage. This is the most insidious aspect of Russia's hybrid war. No need for super-agents. Just someone who needs money, was born in the wrong country, and underestimates the risk. Putin's network in Europe is built from these thousands of banal complicit acts. That is the real face of the threat. And that is why every arrest like the one in Toulouse matters so much — not only for the individual case, but as a signal to all those who might be tempted.*

## The French response — the DGSI's capabilities in the face of the Russian threat

### The DGSI — mandate, methods, and counterintelligence capabilities

The **General Directorate for Internal Security** is France's domestic counterintelligence and counterterrorism service. Created in 2008 as a replacement for the **DST**, it combines missions of **counterintelligence** (monitoring and neutralizing foreign agents operating in France), **counterterrorism**, **counter-subversion**, and **protection of France's economic and scientific heritage**. This last mission — protecting industrial technologies and expertise from economic espionage — is precisely what led it to surveil the perimeter of the **Delair** facility.

The **DGSI** has reinforced its counterintelligence capabilities in the Russian domain since 2022. Specialized units have been created to track influence and destabilization operations. Cooperation with allied services — **CIA**, **MI6**, **Germany's BND**, Nordic country services — has intensified. Real-time information exchanges on Russian intelligence activities across Europe enable better anticipation of operations. The result is that the **DGSI** is in a better posture today than in 2022 to detect and neutralize this type of operation — but the challenge remains considerable as the frequency of attempts multiplies.

### The legislative and judicial limits of French counterintelligence

Detaining an individual filming from a public road is legally complex in France. French law protects **freedom of movement** and in principle prohibits surveillance without established grounds. Counterintelligence services must therefore have sufficient preliminary evidence — wiretaps, surveillance, intelligence shared by allied services — to justify arrest and formal indictment. In the case of the man from **Toulouse**, the indictment announced on **June 19, 2026** — more than two weeks after the arrest — indicates that investigators needed that time to consolidate the judicial file.

French espionage legislation has been strengthened in recent years, notably with the **2015 intelligence law** and its subsequent revisions. But gaps remain, particularly in the precise definition of what constitutes **illegal intelligence collection** for the benefit of a foreign power, and in the possibilities for acting against individuals who have not yet transmitted collected information but are about to do so. The law must adapt to the reality of hybrid war — where preparatory acts are as consequential as completed ones.

*I am not a legal expert. But when I see the DGSI obliged to let an individual film a drone prototype for a period of time before being able to make an arrest — because the law requires building a file — I wonder whether our statutes are truly adapted to the hybrid war of the twenty-first century. There is a delicate balance between civil liberties and national security. But that balance deserves to be debated openly, not left to legal specialists alone in the shadow of ministerial offices.*

## The Starmer case in the United Kingdom — the same war, the same pattern

### The arson linked to a Russian-speaking agent in Britain

Just weeks after the arrest in **Toulouse**, a British court convicted on **June 19, 2026** two men for having set fire to properties belonging to Prime Minister **Keir Starmer**, in what prosecutors characterized as a conspiracy directed by a Russian-speaking figure known as **"El Money."** The former head of the **Metropolitan Police**'s counterterrorism unit was explicit: the case matched the documented pattern of **Russian state sabotage**. This is not an opinion. It is a professional diagnosis made by someone who has spent decades studying these methods.

Both cases share structural characteristics: local executors (no identifiable Russian officers), direction from outside through intermediaries, objectives aimed at creating instability and intimidating decision-makers or collecting strategic information, and a financial cost to Moscow that is derisory relative to the potential impact. This model of **outsourcing operational risk** — using domestic nationals as a shield — is designed to maintain **plausible deniability** for the Russian government while keeping pressure on allied democracies.

### Coordination among allied services facing a common Russian threat

The near-simultaneous timing of the French and British affairs underlines the crucial importance of coordination among allied counterintelligence services. The **DGSI** and **MI5** share information on Russian networks operating in Western Europe. The **Five Eyes** (United States, United Kingdom, Canada, Australia, New Zealand) have well-established counterintelligence information-sharing mechanisms. The **EU** has developed cooperation frameworks in the domains of **cybersecurity** and **critical infrastructure protection**. But coordination in the area of physical counterintelligence — particularly for tracking Russian recruitment networks — remains a work in progress.

Lithuanian Defense Minister **Ingrida Šimonytė** and other Baltic officials have repeatedly stated that their experience with Russian intelligence — enriched by decades of proximity with Moscow — is under-exploited by their **Western European** partners. Every arrest of a Russian spy in France or the United Kingdom should trigger systematic sharing with Baltic services, which can sometimes identify operational methods, recruitment structures, or even specific individuals in the relevant networks. This bidirectional, fluid, and rapid cooperation is an operational necessity that intelligence bureaucracies must still learn to institutionalize.

*The Baltic states know the signature of Russian intelligence the way they know their own mother tongue. They lived it for fifty years of Soviet occupation. They have endured it for thirty years of independence under permanent pressure. And despite that, Western Europe has often told them — implicitly — that they exaggerate. That their warnings are paranoia. The man from Toulouse, the fire at Starmer's, the 192 documented attacks — is that still paranoia?*

## Defense industrial espionage — a systemic threat to Western technological superiority

### What Russia seeks to obtain through defense industrial espionage

The operation against **Delair** is part of a broader campaign of **defense industrial espionage** that Russia conducts across Europe and North America. The objective is less about stealing complete blueprints than about obtaining **comparative information** that allows evaluation of the gap between Russian and Western capabilities in specific domains, and identification of development priorities for closing that gap. In the field of **surveillance and attack drones** — where Ukraine has demonstrated significant Ukrainian-Western superiority — pressure to obtain information is particularly intense.

Russia's technological intelligence agencies — notably the **SVR** in its foreign intelligence component — maintain divisions dedicated to collecting information on Western defense technologies. These divisions combine human espionage (as in Toulouse), **cyber-espionage** (computer intrusions into industrial systems), **open-source exploitation** (academic publications, patents, trade show presentations), and sometimes legal acquisitions disguised through shell companies. The combination of these methods gives Russia a relatively complete picture of the strategic orientations of Western defense industries.

### Protecting defense industrial secrets — the identified weaknesses

The arrest in **Toulouse** reveals a specific vulnerability: prototype testing facilities are often less secured than production plants or R&D offices. Drone test zones require open space — secondary airfields, peri-urban areas, clear zones accessible from public roads. This operational necessity creates an **observation window** that adversary intelligence services seek to exploit. Securing these zones — safety perimeters, electronic perimeter surveillance, encrypted communications during testing — is an ongoing challenge for both companies and security services.

**France** has strengthened its mechanisms for **trade secret protection** and the safeguarding of its defense technological heritage in recent years. The **SGDSN** (Secretariat-General for National Defense and Security) coordinates recommendations to companies working in defense. The **General Directorate for Armaments** imposes security standards on suppliers. But a security chain is only as strong as its weakest link — and a prototype tested in an open space, as discreetly as possible, remains an opportunity for a patient and motivated observer.

*The security of drone test zones. It is not the most glamorous subject in defense journalism. But after Toulouse, it becomes so. Every test of a prototype potentially linked to Ukraine should be conducted with the same protections as a classified military operation. Because that is exactly what it is. Delair does not make parcel-delivery drones. Its products protect Ukrainian soldiers. That level of criticality demands a commensurate level of protection.*

## Kubilius and escalation forecasts — is Europe really preparing?

### The warning from the EU Defense Commissioner

**Andrius Kubilius**, the European Union's Defense Commissioner, stated on **June 23, 2026** that Europe must prepare for more hybrid attacks following what he described as a "suspected targeted killing" in Poland. This warning, delivered by one of the **European Union**'s most senior defense officials, is significant on several counts. It officially acknowledges that Russia's campaign of hybrid attacks in Europe is not over — it is intensifying. It places these attacks on a continuum with the Ukrainian conflict. And it explicitly calls for heightened readiness, not only from security services, but from institutions and societies as a whole.

The incident in **Poland** to which **Kubilius** refers — a suspected targeted killing of Russian origin — adds to the list of Russia's active operations in Europe. If this type of operation is confirmed, it marks a **significant escalation**: from espionage and infrastructure sabotage toward the targeted physical elimination of individuals deemed adversaries of the Kremlin. This escalation, if real, places European democracies before a dilemma: how to respond without feeding a spiral of escalation, while dissuading sufficiently to make Russia understand that the cost of these operations exceeds their benefit?

### The European institutional response — swift or bogged down in bureaucracy?

The **European Commission** adopted in 2024 an **action plan against foreign hybrid interference**. Mechanisms for rapid information-sharing between member states on hybrid attacks have been reinforced. Joint exercises in hybrid crisis response have multiplied. But the actual implementation of these frameworks is uneven across the **27 member states**. Some — the Baltic states, Poland, Finland — have robust national frameworks and are proactive in sharing information. Others — particularly in Southern and Western Europe — have institutional cultures less adapted to the Russian hybrid threat.

**NATO**'s intelligence committee and similar **EU** structures sometimes struggle to operate at **the speed of Russian operations**. Multilateral decision-making processes — which require consensus or at least a majority among members — are structurally slower than the unilateral decisions of Russian services. Closing this decision-making speed gap is one of the most pressing institutional challenges for allied democracies. The response to the Toulouse spy — arrest within 24 hours, indictment within two weeks — demonstrates the **DGSI**'s reactive capacity. But European coordination to prevent the next operation remains an open worksite.

*Kubilius warns it will get worse. The DGSI arrests a spy. MI5 dismantles a plot against Starmer. 192 attacks since 2022. And yet we are still debating the level of support for Ukraine as if the war were far away. It is not far away. It is in the industrial zones of Toulouse. It is in the streets of London. It is in our rail infrastructure. Putin's hybrid war is a war against us. All of us. Now.*

## Belarus as an operational platform — Lukashenko's role

### How Minsk became a forward base for Russian services targeting Europe

**Belarus** occupies a particular place in the geography of Russian hybrid operations in Europe. Since the crackdown on the pro-democracy movement in **2020** and **Lukashenko**'s fall into total tutelage under **Moscow**, the country has become a **logistical and operational platform** for Russian services targeting Central and Western Europe. Belarus's geographic position — at the borders of **Poland, Lithuania, and Latvia** — makes it a natural transit point for operations targeting these countries and, beyond them, the whole of Western Europe.

Belarusian nationals present in Western Europe constitute a target population for recruitment by Belarusian and Russian services. This community is heterogeneous: it includes political refugees fleeing **Lukashenko** (who are potential victims of harassment or intimidation), economic workers without political affiliation, and a small number of individuals who maintain ties with Belarusian or Russian security circles. For adversary intelligence services, the Belarusian community offers relatively low-cost recruitment opportunities among that last group.

### The measures needed to counter the Belarusian platform

Responding to the Belarusian threat as a platform for Russian operations requires action at several levels. At the **diplomatic level**: maintaining and reinforcing sanctions against the **Lukashenko** regime, particularly against entities involved in security service activities. At the **security level**: reinforcing surveillance of individuals from Belarus in high-risk contexts (near sensitive industrial zones, defense installations). At the **institutional level**: developing information-sharing protocols among allied services specifically focused on the Belarusian threat, drawing on the expertise of Lithuanian, Latvian, Estonian, and Polish services who know this platform best.

Finally, and perhaps most importantly, it is essential to **clearly distinguish** between Belarusian nationals who are **victims of the Lukashenko regime** — dissidents, political refugees, pro-democracy activists — and those who might serve the interests of the Russian and Belarusian regimes. No national community should be subject to collective suspicion. But security protocols must be sufficiently robust to detect individuals in the second category before they have the opportunity to cause harm. This is the delicate balance that democratic societies must find: security without discrimination, vigilance without paranoia.

*I think of the thousands of Belarusians who fled Lukashenko at risk of their lives after 2020. Men and women who wanted democracy, who endured the brutalities of Minsk's political police, who left everything to live free in Europe. They do not deserve to be collectively suspected because of an individual who may have betrayed their values as much as he betrayed ours. Nuance is necessary. It is difficult. But it is indispensable in a democracy worthy of the name.*

## Protecting defense technologies — the stakes for Western strategic superiority

### Industrial espionage as a threat to the Western technological advantage in Ukraine

**Ukraine** maintains superiority in certain drone categories thanks to its capacity for rapid innovation and the technological support of its Western allies. This advantage is precarious: **Russia** is investing heavily to close the gap, combining its own development with industrial espionage, forced technology transfers from its partners (Iran, North Korea), and the acquisition of components through sanction-circumventing supply networks. The arrest in **Toulouse** is part of this Russian strategy of technological intelligence collection to reduce the Ukrainian-Western advantage.

Every piece of information obtained on a **Delair** prototype can contribute to accelerating the development of **Russian countermeasures** that, if deployed in Ukraine, will cost Ukrainian soldiers their lives. The causal chain is direct: spy in Toulouse → transmission to Moscow → analysis by Russian defense engineers → adaptation of detection or jamming systems → deployment on the Ukrainian front → Delair drones more vulnerable → casualties on the Ukrainian side. Preventing this type of espionage is therefore not merely a question of French national security. It is a matter of life and death for Ukrainian fighters.

### Recommendations for better protection of defense technologies in allied countries

Based on the reporting of this case and the documented trends in Russian hybrid operations, several recommendations emerge for strengthening the protection of defense technologies in allied nations. First, **extend security perimeters** around prototype test facilities and systematize electronic perimeter surveillance. Second, **strengthen awareness** among employees of defense companies regarding the risks of proximity espionage — the individuals most vulnerable to recruitment are often company staff or their immediate circle. Third, **accelerate information-sharing** among allied services regarding detected espionage attempts, to enable rapid identification of similar patterns in other countries.

Fourth, and perhaps most important over the long term, **adapt the legislative framework** to allow earlier interventions against proximate intelligence actors — before they have transmitted collected information, not only after. The indictment of the Toulouse spy two weeks after his arrest suggests that evidence was sufficient from the outset. That earlier intervention was not possible suggests procedural gaps to be corrected. In the hybrid war of the **twenty-first century**, legal responsiveness is as important as operational responsiveness.

*Recommendations. Security perimeters. Awareness programs. Legislative frameworks. I know that can seem abstract in the face of a man arrested in Toulouse. But these structural changes, these institutional adjustments, these legislative adaptations are what will determine whether we are better prepared for the next Russian operation. And there will be a next one. Putin does not stop. We must adapt faster than he innovates.*

## The invisible front — what the Toulouse affair reveals about the war in France

### France as a central target in Russia's European hybrid war

**France** occupies a particular position in Russia's hybrid warfare strategy in Europe for several reasons. Its independent nuclear power, its status as a permanent member of the **UN Security Council**, its diplomatic influence in **Africa** (where Russia seeks to displace French influence), its growing commitment to supporting **Ukraine** under the Macron presidency — all of this makes Paris a priority target for Russian destabilization operations. The **three operations** documented since January 2026 reflect this prioritization.

**France** is responding to this threat through a combination of active counterintelligence (**DGSI**), calibrated public communication designed to alert without alarming, and a diplomacy of firmness in the face of Russian actions. The expulsion of Russian officers under diplomatic cover since 2022 — several of whom were declared personae non gratae for espionage activities — has reduced the operational capacity of Russian services officially based in Paris. But this pressure displaces activity toward non-diplomatic channels — such as the recruitment of locally sourced operatives of the Toulouse type — which are harder to detect and neutralize.

### Democratic resilience in the face of persistent hybrid war — the long-term stakes

Beyond immediate operational responses, the **Toulouse** affair raises a fundamental question about **democratic resilience** in the face of persistent hybrid warfare. Russian hybrid operations target not only intelligence or sabotage objectives, but also a psychological one: to create sufficient insecurity and distrust in European societies to erode their support for governments that are firmly committed to **Ukraine**. If every espionage incident generates a public demand to "not provoke Russia," then hybrid operations have partially achieved their objective even without tactical success.

Democratic resilience against this threat requires **honest public communication** about the nature and scale of Russian attacks — as this report attempts to do — **sustained trust in the institutions** of counterintelligence that demonstrate their effectiveness (as the **DGSI** did in Toulouse), and **social solidarity** that refuses to let the hybrid threat divide our societies between supporters and opponents of support for Ukraine. This is not a Cold War we are living. It is something new, hybrid, that demands a response that is simultaneously security-based, institutional, and civic.

*Democratic resilience. The term can sound abstract. But it is exactly what Putin seeks to destroy. He cannot defeat NATO militarily. He cannot compete with the West economically. But if he generates enough fear, distrust, and division, he can lead democracies to turn inward and abandon Ukraine. The best response to the spy in Toulouse is to keep supporting Ukraine. Harder. Faster. Without looking back.*

## The future of Russia's hybrid war — scenarios to anticipate

### Toward an escalation of operations if the costs for Russia remain low

The strategic logic of Russia's hybrid war in Europe suggests that operations will continue and could intensify if the **cost-benefit ratio** remains favorable to Moscow. As long as the expulsion of Russian officials, the arrest of recruited agents, and judicial convictions do not create a sufficiently high cost to deter new operations, the pressure will continue. The question for allied governments is therefore: how to raise the cost of Russian hybrid operations without triggering a military escalation?

Available options include **more severe targeted sanctions** against Russian intelligence entities involved in operations in Europe, **proportionate cyber-retaliation operations** against Russian targets, **coordinated mass diplomatic expulsions** among allies, and **documented public revelations** about Russian methods and networks — this last tool deprives operations of their cover and makes recruitment more difficult. None of these options is perfect. All have side effects. But inaction — allowing the Russian campaign to continue without significant cost — is the worst strategic option of all.

### Emerging technologies and the next generation of hybrid war

The **Toulouse** affair represents a relatively traditional form of espionage — an individual physically filming. But emerging technologies will transform hybrid war in the coming years. **Miniaturized civilian drones** will be able to overfly sensitive industrial zones without any detectable human presence. **Artificial intelligence** will allow the automatic analysis of collected images to extract technical information with unprecedented precision. **Deepfakes** and AI-generated disinformation will make it harder to distinguish between authentic information and manipulations.

In the face of these developments, counterintelligence services will need to invest heavily in detection technologies and countermeasures adapted to these new forms of collection. The protection of sensitive facility perimeters will need to integrate **anti-drone systems**, electromagnetic sensors, and revised security protocols for the era of civilian drones. Investment in these capabilities is a necessity, not an option. The next generation of Russian operatives may not look like the **48-year-old man with a smartphone**. They may look like a twenty-dollar quadcopter silently overflying our industrial zones.

*The next spy in Toulouse may be a drone that no one saw coming. This reality concerns me. Not to feed general paranoia, but because it demands rapid adaptation of our security frameworks. Hybrid war evolves. It absorbs every new available technology. And if we wait for an entire generation of new Russian methods to be deployed before adapting, it will be too late. Prevention must precede the threat. Not respond to it after the damage is done.*

## Conclusion: Toulouse as a mirror of the war coming to find us

### What an arrest in Toulouse says about the state of our collective security

The arrest of **June 3, 2026** near **Toulouse** is simultaneously a success and a warning. A success for the **DGSI**, which detected, surveilled, and neutralized an espionage operation before the collected information could cause irreparable damage. A warning about the intensity and persistence of Russia's hybrid campaign against European democracies. Both readings are simultaneously true. The capacity to hold them together without falling into self-satisfaction or panic is precisely what democratic resilience demands.

France — and with it all allied democracies — must strengthen its industrial protection frameworks, adapt its legislation to the reality of hybrid war, and intensify cooperation with allies in this domain. It must also continue to support **Ukraine** with the same determination — knowing that every Delair drone protected from Russian espionage is potentially one Ukrainian soldier's life saved. These two imperatives are linked. The security of France and the victory of Ukraine are complementary objectives, not competing ones.

### Refusing to let fear win — the only response worthy of a democracy

The temptation, faced with 192 documented attacks, a spy in Toulouse, a fire at **Starmer**'s, is to retreat into fear — to curtail support programs for Ukraine, to reduce the international profile of our democracies, to offer **Putin** a smaller target. This temptation must be resisted with absolute firmness. Because it is precisely the objective of Russia's hybrid war: to lead us, through fear, to choose the apparent safety of retreat over the real risk of standing by democratic values. Yielding to that fear is not prudence. It is surrender.

A democracy's response to hybrid war is not retreat. It is **transparency** — like this report that documents Russian operations — **institutional vigilance** — like the **DGSI** protecting our industries — **allied solidarity** — like the sharing of intelligence between services — and **unwavering support for Ukraine** — which is the clearest demonstration that our values do not yield under pressure. The **48-year-old man arrested in Toulouse** wanted to send a video to Moscow. That video, he did not send. That too is a victory. And that victory deserves to be named.

*I will not end this report with certainties I do not have. I do not know whether this man genuinely acted on behalf of Russian or Belarusian services — it is for the courts to determine. I know that 192 attacks are documented. I know that three operations have targeted France since January 2026. I know that the DGSI acted. And I know that supporting Ukraine — with Delair drones, with 155mm shells, with SCALP cruise missiles — is the sanest and most just response to this war that comes to find us at home.*

## Final conclusion: The invisible war shaping our time

### The sum of one story and its implications for our future

A **48-year-old man**, born in **Belarus**, filming a drone prototype near **Toulouse**, reportedly paid a few hundred euros to transmit footage via **Telegram** to a contact in **Russia**. This banal — far too banal — scenario is the face of twenty-first-century hybrid war. No trenches, no uniforms, no visible fronts. Ordinary individuals in ordinary spaces, instrumentalized for a war that does not speak its name. Documenting it is the first condition for fighting it effectively.

This affair fits into a far larger picture: **192 attacks** across Europe, an arson in **London**, infrastructure sabotage, permanent cyber operations, and a total war in **Ukraine** that **Putin** is also waging on our soil. Democracy is not a stable condition that can be taken for granted. It is a continuous, fragile construction that demands active vigilance. And that vigilance, in 2026, also passes through protecting a drone test zone in Toulouse, securing a prototype that may save Ukrainian lives, and the collective decision to never let fear guide our foreign and defense policies.

*I wrote this report with the conviction that naming things is the first act of resistance. Naming hybrid war. Naming Russian operations on our soil. Naming the courage of the counterintelligence services that thwart them. And naming, without ever tiring, the support we owe to Ukraine — not out of charity, but because its war is ours too. The spy from Toulouse is the most obvious proof. He came to film a weapon designed to protect soldiers who fight for our values in our place. The least we can do is not leave them alone.*

**By Maxime Marquette, columnist**

## Columnist's transparency note

### Editorial stance

I am not a journalist but a **columnist and analyst**. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. **I claim analytical clarity**, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

### Method and sources

This text keeps the basic distinction between **verified facts and interpretive analysis**. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under **Sources**, never here.

**Primary source families** used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

**Secondary source families**: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under **Sources**.

### Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a **critical, contextual synthesis** based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.

## Sources

### Primary sources

- [Le Monde — Russia's shadow looms behind several sabotage and espionage attempts on French soil — June 20, 2026](https://www.lemonde.fr/en/france/article/2026/06/20/russia-s-shadow-looms-behind-several-sabotage-and-espionage-attempts-on-french-soil_6754683_7.html)

- [UA News — In France, a suspect of espionage for the benefit of Russia was arrested — June 2026](https://ua.news/en/world/u-frantsiyi-zatrimali-pidozriuvanogo-u-shpigunstvi-na-korist-rf)

- [Fakti — Arrest in France for alleged espionage for the benefit of Russia — June 2026](https://fakti.bg/en/world/1062112-arest-vav-francia-za-predpolagaem-shpionaj-v-polza-na-rusia)

### Secondary sources

- [Ground News — French authorities detain Belarusian national suspected of spying on drone facility for Russia — June 2026](https://ground.news/article/french-authorities-detain-belarusian-national-suspected-of-spying-on-drone-facility-for-russia_b307e0)

- [Euronews — Kubilius: Europe should prepare for more attacks — June 23, 2026](https://www.euronews.com/my-europe/2026/06/23/kubilius-europe-should-prepare-for-more-attacks-following-suspected-targeted-killing-in-po)

- [El País — Putin's invisible front: drones, sabotage, and hybrid warfare test Europe — June 5, 2026](https://english.elpais.com/international/2026-06-05/putins-invisible-front-drones-sabotage-and-hybrid-warfare-test-europe.html)

---

Source: Maxime Marquette, MadMax. When citing, name the author and link https://mad-max.co/en/article/reportage-l-espion-belarusse-de-toulouse-comment-la-russie-filme-nos-usines-de-d