Russian intelligence will offer you two hundred dollars to take some photographs of an address. Tens of thousands to kill a man. When the money fails, sabotage is asked. The numbers are public now because the Southern District of New York unsealed charges on 15 September against five members of a network run for the intelligence services of the Russian Federation. The indictment lists the going rates.

Photograph a target address	$200
Pre-operational surveillance	$1,000 to $1,500
Kill a man in Lithuania	$25,000
Eliminate a dissident in the United States	$40,000
Burn a food warehouse or a substation	the simpler job

Read the sequence of that list, beyond their individual numbers. An FSB officer recruits a US citizen for two hundred dollars of photography. The assignment is completed, but it escalates. The officer introduces his boss, a colonel, who offers twenty five thousand dollars to murder the man in the photographs and suggests gasoline or a knife.

When the recruit declines, the colonel immediately offers something simpler to suit motivations: set fire to a warehouse of property or food, or throw a bottle of gasoline at an electrical substation. He explains that the purpose is to target all the countries helping Ukraine, and that he is offering serious money for serious work.

The same thing happens with the second recruit. A thousand to fifteen hundred dollars buys surveillance of a dissident’s home. Forty thousand for the killing meets a refusal, at which point the recruiter asks whether the man knows somebody else who would. They seek people motivated by money, although something else could motivate as well.

Two approaches, two refusals at the same threshold, with a downgrade to attacking infrastructure both times. Money was taken for reconnaissance and offered for arson. It did not get murder from either case, which makes higher motivation a question worth asking.

The services know where and how to look, thanks to chat apps and social media. RUSI’s work on sabotage financing records that ideological motives reinforce payment among people already consuming extremist or pro-Kremlin material. The head of the BND told the Bundestag that recruiters watch pro-Kremlin Telegram channels to identify candidates for small tasks. Recruitment samples a primed population, because priming is the part money cannot purchase.

Franz von Rintelen understood this in 1915 for purposes of stopping munitions from reaching a war front in Europe. Half a million dollars did not buy strikes at American munitions plants. It bought Labor’s National Peace Council, a vehicle in which real grievance produced them. The money supplied targets, timing and infrastructure. The motivation was already American, and that is exactly why the sabotage read as a domestic labor dispute.

Which brings us to what a motivated domestic actor does afterward.

European rail sabotage by the ultra-left announces itself to draw attention. The September 2023 arson on German rail cable ducts came with a claim on an extreme-left site. Anarchists published a manifesto two days after the Bologna and Pesaro attacks in February 2026. French investigators examining an October 2025 cable sabotage went to a post on Indymedia Nantes that tied the rail attack to the same-night burning of construction plant beside the track. The communique is the product, because making the argument is the point. They are pushing a message.

Now the opposite list. France, July 2024, three high speed lines. The Hague, June 2025, thirty rail cables burned as the NATO summit opened. Cléon, September 2026, a rail fragment on the track and forty four injured. The Netherlands, 15 September 2026, pipes fastened to the rails across the central and eastern network.

Then there is a third category, which is what a front produces. Berlin, September 2025, two pylons in the southeast and fifty thousand households dark for sixty hours. Berlin, January 2026, a cable bridge at Lichterfelde and forty five thousand households without heat in a winter freeze, the longest outage the city has seen since 1945. Both arrived with a claim, both were pushed as left-extremist within the hour, and both were pinned on the Vulkangruppe, a name that fails every test of German left-wing practice. German intelligence has acknowledged a 2015 strategy paper indicating fixed structure, and linguistic analysis of the claim letters points to a partly identical circle of authors. Fifteen years with zero convictions. A claim letter is evidence of a claim. It is not evidence of who wrote it.

France shows what happens next. Gérald Darmanin jumped to name the ultra-left within forty eight hours and posted the link to an arrest at Oissel on X. The Rouen prosecutor said no damage had been found. The Paris prosecutor said there was no arrest in that investigation. The man was convicted in November of entering a railway area closed to the public. Trespass. That’s it. The gendarmerie stood up a national investigation cell named Sabotage SNCF in March 2025, eight months after the attack, and by December 2025 the case had produced no suspect and no mise en examen.

Darmanin had asked the right question on France 2 before his own attribution overtook it.

The question is whether they were manipulated or is it for their own account.

Two years later the French state has not answered its own interior minister. Germany has run the same play and produced the same result.

The Dutch AIVD opened its own investigation into the rail sabotage on the first day, with a spokesperson saying it is looking at which direction this comes from.

The political scientist Sylvie Ollitraut supplied the test everyone skipped. Claimed ecological sabotage in France has targeted construction that harms the environment, while rail is the mode ecologists promote. The claim of motive did not fit the target.

Now look at the Dutch farmer grievance against Dutch rail. They are angry about nitrogen policy, forced buyouts and land expropriation. They are described as anti-government, anti-coordination, loosely organized if at all. Simultaneous placements across the central and eastern network stop a commuter service between Putten and Ermelo, for what? That advances nothing for them and reaches nobody who decides any of it. The hay bales burning along motorways on Tuesday afternoon are the farmer action that announces farmer grievance clearly, attribution wanted. NOS reports the call for the hay bale fires came from farmer activists. Visible, known, symbolic anger, on the roads farmers use.

NOS and the police reports say fires burned in the verges near the A2, A28, A30, A1 and A7, with hay bales and car tyres beside the road, at Groningen positioned to keep smoke off the carriageway, so that traffic was unaffected.

The pipes shutting down rail, by exploiting a technical control layer vulnerability, serve none of those aims, even though there is overlap in place names. Putten, Lunteren and Barneveld had both rail pipes and road fires, hours apart, in the same rural districts.

Farmers Defence Force secretary Sieta van Keimpema told WNL that farmer involvement cannot be ruled out, that the national organisation coordinates nothing, and that regional groups prepare regional actions. Voorman Mark van den Oever said the group is not involved and individual farmers are not excluded. NOS found sources in agricultural circles confirming that a local tractor group discussed the rail sabotage, including how the pipes should be fastened. A constituency was offered, their coordination was denied, so responsibility remains unclaimed.

That combination of the two is what the Rintelen design produced during WWI, the foundations of intelligence operations to this day.

German federal security services published the recruitment template in September 2025. Foreign intelligence, mostly Russian, hires Wegwerf-Agenten through social media and messenger apps for small sums, and the BKA target list names transport and rail.

So the Dutch investigation has three questions with answers to be checked.

1. Whether the fastening technique entered those channels from somebody with no farming history.
2. Whether the pipe stock was uniform across the sites, which means a supplier, or improvised at each, which means scrap.
3. Whether anyone in those groups received money.

The third question is the one the Germans keep answering, the one the Americans just published, and one that nobody in the Netherlands has spoken about yet.