Poland’s Internal Security Agency, ABW, published its latest Starlink arson update on 16 October, four days after two suspects were arrested in Germany. One detail caught my attention.
ABW says it separately detained someone who had surveyed the site independently of the alleged arsonists. The agency describes preliminary photography and video assignments sent over Telegram, followed by instructions to examine the station’s security. It has not established publicly that both strands had the same organiser. ABW’s update, 16 October.
I would keep that distinction in view. The second trail deserves investigation. Connecting it to the arson requires evidence about the people commissioning the work.
What Poland has said publicly
The fire occurred on 23 September at Wola Krobowska. In its initial statement, Poland’s National Prosecutor’s Office said investigators had established deliberate arson and suspected an operation ordered by Russian intelligence. Prosecutors described the suspected objective as disrupting Starlink communications in Poland and other countries in Central and Eastern Europe. An intended disruption should not be confused with a demonstrated outage across that region.
At the 12 October announcement, the Interior Ministry identified the two people arrested in Germany as Turkish citizens suspected of carrying out the attack. Minister Tomasz Siemoniak attributed it to Russian services and described their increasing use of people connected to the criminal world. The ministry said Polish police, ABW and prosecutors had assembled the evidence used for the arrests.
Those are the authorities’ allegations and assessments. They are serious. They are also subject to an ongoing investigation; an arrest announcement is not a verdict.
The wider problem is already on the record
The day after the arrests, MI5 Director General Ken McCallum gave his annual threat update in London. He said his service’s state-threat caseload had quadrupled over a decade. In discussing Russia, he linked the use of criminals and volunteers to the loss of its traditional covert presence after almost 1,000 expulsions since the invasion of Ukraine.
McCallum’s account is relevant context, not independent proof of who commissioned the Polish fire. It does, however, describe the investigative difficulty that concerns me: the person carrying out a task may be several steps removed from the state that wants the result.
Catching that person can stop an immediate threat. Working back through the intermediaries is what determines whether the next assignment can still be issued. I would judge the longer-term result by whether investigators identify and disrupt the commissioning chain.
What I would ask from Vienna
For Austrian infrastructure operators, I would start with a practical question: who receives a report of suspicious activity around a site, and who has enough context to assess it?
A photograph taken from a public road is not evidence of espionage. Routine maintenance, legitimate visitors and ordinary curiosity all exist. The useful work is in documenting concerns consistently, preserving relevant records lawfully, and giving police a clear account of what was observed. Suspicion should be tested against evidence.
I would also want the physical-security team and the people responsible for service continuity in the same discussion. Which dependencies would interrupt the service? How quickly could an operator recover? Has that recovery actually been tested? Buying another security product is an easier decision than answering those questions.
Poland has made arrests and published more of its case. The next thing I will be looking for is evidence about who selected the target, who commissioned the work, and whether those links have been disrupted. Until then, the investigation remains unfinished.
