A BBC Panorama investigation published Monday has identified Russian state operatives as the orchestrators of arson attacks on properties linked to UK Prime Minister Sir Keir Starmer. Roman Lavrynovych, a 22-year-old Ukrainian national, was convicted at the Old Bailey on Monday of conspiring to commit arson alongside Stanislav Carpiuc. The BBC investigation identified their handler as Evgeny Lyukshin, 23, the son of a senior Russian diplomat, trained at MGIMO — Russia’s foreign ministry diplomatic academy — and photographed with Russian Deputy Foreign Minister Alexander Grushko. The attacks targeted a car previously owned by Starmer, the entrance to a flat where he had lived, and the entrance to his current house. Separately, the investigation exposed Russian-created fake groups — a far-right organisation called “Direct Action UK” and a fictitious Islamist group called the “Takbir Foundation” — designed to inflame social unrest in Britain.
The received wisdom
The mainstream security establishment’s reading of this investigation is one of grim confirmation: Russian hybrid warfare has graduated from disinformation and electoral interference to physical violence against Western leaders. British security officials, opposition politicians, and NATO allies have each said variants of the same thing — that this represents an unacceptable escalation, that the UK must respond robustly, and that the recruitment of Ukrainian nationals as unwitting proxies is a particular moral outrage. The Guardian and BBC’s own coverage frames the story correctly as a state intelligence operation, noting that the handler’s MGIMO training, diplomatic connections, and use of Rybar’s “information warfare” manuals trace the operation directly to the Russian state. Prime Minister Starmer has described the revelations as deeply serious. The received wisdom is: this is what authoritarian aggression looks like in the hybrid age, and it demands a firm response from the democratic world.
A different read
The received wisdom is substantially correct. But there is a deeper structural story here that the “Russia bad, West must respond” framing obscures — one about the gap between our rhetoric and our institutions.
Consider the operational architecture of what the BBC has uncovered. Lyukshin was not a shadowy back-room figure. He was photographed with a Deputy Foreign Minister at an official Kremlin event. His father is a serving diplomat. He was trained using manuals co-authored by Putin’s presidential administration. He was connected to Mikhail Zvinchuk, a UK-sanctioned individual who sits on Putin’s special working groups for the Ukraine war and who is wanted by US law enforcement. The programme Lyukshin trained under was created at Kremlin direction, two years ago, with the explicit purpose of running “information warfare” operations in the West.
This is not a rogue operation. It is a managed, state-directed programme operating with considerable institutional depth. And yet it recruited foot soldiers through Telegram groups for Ukrainians seeking work in London, escalating their tasks from putting up posters to committing arson with the gradualist logic of radicalisation — a technique that exploits the economic desperation of migrants, not ideological conviction. The victims of this operation, in a grim irony, are themselves Ukrainian nationals — people who fled Russian aggression and were then weaponised against their host country’s leader.
The fake “Direct Action UK” far-right group that Russian operatives created after the Southport riots — its messages bearing Moscow timestamps, its content lionising Tommy Robinson, its campaigns vandalising six London mosques — and the mirror-image “Takbir Foundation” Islamist fake, designed purely to make the far right angrier, reveal a strategy of deliberate social polarisation. This is not propaganda in the sense of promoting Russia’s values; it is arson of the social fabric, aimed at making Britain ungovernable and West-focused political attention internally consumed. Students of the Internet Research Agency’s operations in the 2016 US election will recognise the playbook immediately.
The harder question is why this was so easy. Lyukshin’s network was constructed through openly accessible Telegram channels. His fake groups operated for months. The Rybar connection — Rybar being a publicly identified Russian information operations outlet — was apparently not actionable intelligence until BBC journalists mapped it. Counter-intelligence agencies in a country of Britain’s capability should have flagged a son of a serving Russian diplomat, trained at MGIMO, photographed at official Kremlin events, running Telegram campaigns inciting violence in London. The fact that the conviction came via criminal prosecution of the proxies rather than expulsion and disruption of the principal suggests the system identified the fire but not the arsonist.
None of this diminishes the seriousness of Russia’s actions. It amplifies it. A state that can run a programme this sophisticated, this openly connected to its official structures, and remain operationally active for long enough to commit arson on a sitting prime minister’s properties — while recruiting its victims’ own compatriots as the instrument — is a state that has accurately judged the West’s response threshold.
What to watch
- Government response: Whether Starmer’s government uses this as grounds for additional sanctions, diplomatic expulsions, or further exposure of Russian networks will reveal whether the UK has a proportionate counter-hybrid strategy — or whether it remains reactive.
- Lyukshin and the diplomatic immunity question: Lyukshin appears to hold embassy credentials. Whether the UK moves to declare him or his father persona non grata will test the limits of diplomatic convention under provocation.
- Rybar and MGIMO connections: The BBC investigation implicates a structured training programme. Whether allied intelligence agencies pursue the network upstream — toward Zvinchuk, Sushentsov, and the presidential administration — matters more than the prosecution of the foot soldiers.
- Domestic polarisation: The fake Direct Action UK and Takbir Foundation accounts caused real-world vandalism of mosques. Watch whether the broader disinformation architecture has deeper roots in UK far-right networks than currently known.
— J