ROME, July 12 — The shift is quiet but unmistakable. For years, European intelligence agencies have warned about the creeping reach of Russian espionage. Now, a detailed counterintelligence operation by Italy’s Agenzia Informazioni e Sicurezza Interna (AISI) has exposed exactly how deep that reach goes.
Code-named ‘Operation Ghost,’ the investigation began in early 2022 when AISI analysts intercepted encrypted communications between Russian embassy personnel in Rome and Italian nationals. What they uncovered was a sophisticated network targeting some of the most sensitive military technology flowing into Ukraine.
The operation, conducted in coordination with the Italian State Police, involved classic tradecraft: surveillance, wiretapping, and financial analysis. But the target was distinctly modern. The network was specifically seeking information on NATO-supplied air defense systems in Ukraine—the Soviet-era S-300 and the US-made MIM-104 Patriot missile system.
AISI, founded in 2007, is Italy’s domestic security and counterintelligence agency. This case represents one of its most significant public successes.
Italian authorities monitored the suspects for over a year before moving in. On March 30, 2023, officers made arrests. Two Italian citizens were taken into custody.
Two Russian diplomats were expelled. During raids in Rome and Milan, police seized documents, electronic devices, and cash.
How the Operation Unfolded
The intercepts that kicked off the investigation were the first clue. Encrypted communications between the Russian embassy in Rome and Italian nationals suggested a coordinated effort to gather intelligence on Western military aid. AISI’s analysts worked to map the network, tracking financial transactions and communications patterns.
Wiretaps and physical surveillance followed. The operation required patience—over a year of monitoring before arrests were made.
The timing of the arrests, late March 2023, came after investigators had built a detailed picture of the network’s structure and objectives. The seizures during the raids are telling. Documents, electronic devices, and cash were recovered from locations in Rome and Milan, the two cities where the network operated.
The cash suggests the operation had financial backing; the devices likely hold communications and data that continue to be analyzed.
The Intelligence Target
The specific focus on the S-300 and Patriot systems reveals the strategic importance of these weapons. The S-300, a Soviet-era system, has been used extensively by Ukrainian forces. The Patriot, a US-made system, represents a significant upgrade in air defense capability.
Information on their deployment, vulnerabilities, and logistics would be of high value to Russian military planners. This is not abstract intelligence-gathering.
It has direct battlefield implications. Knowing where these systems are positioned, how they are supplied, and what their operational limitations are could allow Russian forces to target them more effectively.
What This Means for European Security
The case underscores the role of AISI in protecting national security. It also highlights the persistent challenge of countering Russian intelligence activities in Europe. The use of embassy personnel as a cover for espionage is a well-established tactic, but the sophistication of this network—using encrypted communications and recruiting Italian nationals—shows how the threat has evolved.
The expulsion of two Russian diplomats is a significant diplomatic signal. Italy is making clear that such activities will not be tolerated.
But the arrests of Italian citizens also serve as a warning: collaboration with foreign intelligence services carries severe consequences. Watch this space. The trend underneath is that European intelligence agencies are getting better at detecting these networks.
Operation Ghost is not an isolated event; it is part of a broader pattern of counterintelligence successes across the continent. As the war in Ukraine continues, the targeting of military technology will only intensify.
So will the efforts to stop it.
