The Invisible Occupation: Russia’s Networks Inside the Ukrainian State

By Matthew Parish

Tuesday 15 September 2026

There is a comforting way of thinking about occupation. An enemy army crosses a border, captures a town, removes the flag from the municipal building, installs another one and appoints its own officials. The population knows that it is occupied. When the enemy army retreats, the flag changes back and liberation has occurred. Kherson should have cured us of this excessively simple conception of Russian power, because the history of the city since February 2022 suggests that occupation is not merely a matter of controlling territory. It is also about controlling, penetrating and exploiting institutions, and those forms of occupation can survive long after the soldiers have gone.

When Russian forces entered Kherson in March 2022, they did not arrive upon an institutional desert. A modern city cannot be administered by soldiers alone. Somebody must operate the police stations, prisons and municipal departments. Somebody must identify influential residents, political opponents and former servicemen. Somebody must understand where records are kept, which officials matter and which of them can be frightened, persuaded, bribed or recruited. Russia therefore needed Ukrainians, and we know beyond reasonable dispute that it found some.

The Security Service of Ukraine and National Police subsequently identified what they described as an organised criminal group created to operate Russia’s supposed “Main Directorate of the Ministry of Internal Affairs” in occupied Kherson. According to the Ukrainian investigation, the organisation possessed a hierarchical structure overseen at the top by Russian officials including an FSB representative. Its purpose was not ordinary policing but enforcement of the occupation regime and suppression of Ukrainian resistance. The State Bureau of Investigation has subsequently pursued Ukrainians who crossed into these institutions, including former members of Ukrainian law-enforcement and penitentiary structures.

These are not rumours. They are documented examples of something that should trouble us considerably more than the individual prosecutions themselves: Russia did not merely occupy Ukrainian territory but penetrated Ukrainian institutions. The distinction matters because military occupation ends when an army withdraws whereas institutional penetration does not necessarily do so. The collaborator who openly accepted a Russian position, wore a Russian uniform and fled across the Dnipro with the retreating Russian army presents a relatively straightforward counter-intelligence problem. Everybody knows broadly what he did, witnesses remember him and records of his activities may survive. The more interesting intelligence asset is the person who did none of these things.

Such a person might have remained outwardly Ukrainian and never formally joined an occupation administration. His assistance might have been occasional rather than continuous. He might have provided names, telephone numbers, institutional information or introductions, or quietly indicated who could be recruited. His relationship with Russia might have preceded the invasion by many years and, after liberation, he might have continued doing exactly what he had done before. The distinction between collaborator and intelligence asset is therefore considerably more complicated than the imagery of occupation sometimes encourages us to believe.

We know that Russian intelligence is capable of operating on exceptionally long timescales because Ukrainian counter-intelligence continues to discover people whose alleged relationships with Moscow are neither recent nor superficial. In July 2026, the SBU announced the arrest in Kherson of what it described as a deeply clandestine FSB agent, a man originally from the South Caucasus who had reportedly lived in Ukraine since the 1990s using false documentation and headed a local public organisation as cover. According to the Ukrainian authorities, he was assisting Russian attacks upon Kherson. If those allegations are eventually proved, their most disturbing feature is not that another person was spying for Russia, because espionage occurs in every war. It is the suggested duration and depth of the cover. Three decades represents something quite different from tactical reconnaissance: it represents implantation.

This brings us to a difficult subject about which responsible journalism must be unusually precise. The Lviv Herald has received information from sources alleging continuing Russian penetration of public institutions in Kherson. We are not presently in a position independently to establish the identities, institutional affiliations or precise activities alleged by those sources, and we will not publish names merely because somebody has privately accused another person of working for Russian intelligence. That restraint should not be mistaken for a conclusion that the underlying phenomenon is imaginary, because publicly established evidence demonstrates beyond sensible dispute that Russia recruited Ukrainians in Kherson, incorporated some of them into occupation institutions and has continued obtaining intelligence from people in the region after liberation.

The SBU has continued reporting arrests of alleged informants accused of collecting information about Ukrainian military positions and movements around Kherson, while other defendants have been convicted of providing targeting information to Russian forces. The unknown quantity is therefore not whether Russian intelligence networks have existed in and around Kherson. They plainly have, and Ukrainian authorities say they continue uncovering them. The unknown quantity is how far they extend, and that is a substantially harder question to answer. Perhaps nobody, including the Ukrainian counter-intelligence services, knows the complete answer.

Intelligence organisations do not maintain convenient public registers of their agents. Successful penetration operations are precisely those that remain undiscovered. Some people cooperate for money, others from ideological sympathy, resentment, coercion or fear. Some may not even regard themselves as Russian agents. They may perform occasional favours for an acquaintance without understanding the architecture surrounding that relationship. The FSB does not need to place a uniformed Russian officer behind every desk in a Ukrainian institution; it merely needs access, and this is the central concept necessary to understand Russian intelligence activity in Ukraine.

Imagine a regional public institution containing one hundred employees. Russia does not need fifty of them and may not even need ten. One well-placed person who understands internal personnel, communications and decision-making may be considerably more valuable than twenty ideological sympathisers standing outside the building waving Russian flags. That person does not necessarily need to steal classified documents if he can identify who possesses them. He does not need to order an official to make a particular decision if he can explain which official is financially vulnerable, and he does not need personally to recruit a judge, prosecutor or policeman if he can identify a debt, business interest, family connection or concealed source of income that allows somebody else to apply pressure. Intelligence penetration consequently resembles a network rather than an army, and its strength depends less upon the number of participants than upon where its nodes are situated.

This observation casts a different light upon Russia’s occupation of Kherson. The Russian withdrawal in November 2022 was an important Ukrainian military victory, but it cannot automatically be assumed to have erased every intelligence relationship created before or during the occupation. Indeed, Russian intelligence had powerful incentives to leave networks behind because Kherson is an exceptionally valuable intelligence environment. The city lies immediately beside the military frontier. Ukrainian troop movements, drone operations, logistics, command facilities and air defences are potentially observable from civilian surroundings, while Russia attacks the city relentlessly. Information that would be mundane in Lviv can be lethal in Kherson.

Hence the continuing arrests of alleged spotters and informants are unsurprising. Russia does not require a sophisticated spy carrying microfilm through a railway station when a civilian with a smartphone can mark coordinates on an electronic map. Yet military targeting is only the most visible level of intelligence penetration. Institutional intelligence may ultimately be more valuable, because an official can provide information about evacuations, reconstruction, procurement, humanitarian assistance, police investigations, military movements or personnel. A compromised law-enforcement officer might discover who is under counter-intelligence investigation, somebody connected with a court might know which searches or arrests are imminent and an official involved in reconstruction might reveal infrastructure vulnerabilities.

At that point the distinction between corruption and espionage becomes disturbingly porous. This is particularly important in Ukraine because corruption has historically been one of Russia’s most effective instruments of influence. Western popular culture imagines espionage principally in ideological terms: the spy possesses a secret allegiance to another country and betrays his own because he believes in the enemy’s political system. That undoubtedly occurs, but Russian intelligence has traditionally been perfectly comfortable with less romantic motivations. A corrupt official is already accustomed to secrecy, possesses undeclared relationships and perhaps unexplained money, and may already fear exposure. His corruption supplies both an incentive and a potential means of coercion.

The person who can be bribed to manipulate a procurement contract may eventually be bribed to provide information. The person who fears exposure of the first transaction may be coerced into undertaking the second. This is why apparently ordinary corruption in wartime Ukraine cannot always be regarded as entirely separate from national security, even though it would be equally dangerous to assume that every corrupt official is therefore a Russian agent.

The current turmoil surrounding Ukraine’s Prosecutor General’s Office inevitably raises some of these broader questions. Prosecutor General Ruslan Kravchenko has resigned amid Operation Carthage, an investigation by NABU and SAPO into an alleged criminal organisation involving officials within his office. Investigators allege that members of the organisation protected fraudulent call centres and laundered criminal proceeds. Kravchenko has denied involvement and has not been charged in the alleged scheme. President Volodymyr Zelensky has called upon parliament to remove him, while Kravchenko has launched serious accusations of his own against senior anti-corruption officials.

Against this factual background, considerably more sensational claims have begun circulating. One account supplied to the Lviv Herald alleges that investigators discovered Russian-manufactured secure communications equipment, direct channels to FSB personnel, dossiers concerning senior judges and prepared criminal files intended for use against Ukrainian military officers, volunteers and anti-corruption activists in the event that Russia captured Kyiv. Those would be allegations of breathtaking significance if true. As of 15 September 2026, however, we have found no reliable public evidence establishing them. Neither the publicly reported Operation Carthage materials nor credible independent reporting available to us substantiates the supposed discovery of an FSB communications system or occupation files at premises associated with Kravchenko.

We therefore do not assert that these things were found, still less that Kravchenko was a Russian agent. There is presently no adequate evidential basis upon which to publish such a conclusion. Yet the allegations remain interesting for a different reason, because they describe a method of Russian state capture that is not inherently implausible when Ukraine has already experienced elements of precisely such a method elsewhere. Kherson provides an obvious example. When Russia captured Ukrainian territory in 2022, it required lists of people, police officers, prisons, investigators and officials capable of transforming military conquest into administrative control. Ukrainian investigations subsequently described the Russian occupation police in Kherson as a structured organisation overseen by Russian security personnel. Occupation, in other words, had an administrative plan.

This raises an uncomfortable counterfactual about Kyiv in February and March 2022. Had Russian forces broken through at Hostomel, overwhelmed Ukrainian resistance and entered the capital in force, Moscow would have faced exactly the same administrative requirements on a vastly greater scale. It would have needed detention facilities, prosecutors, police, administrators and lists of people considered dangerous. Ukrainian military commanders, intelligence officials, political leaders, journalists, civil-society activists and prominent volunteers would have been obvious targets. It would be remarkable if Russian intelligence had made no preparations whatsoever for this eventuality.

That proposition is quite different from asserting that a particular cache of occupation files existed in a particular house. The latter requires evidence we do not presently possess, whereas the former follows naturally from the character of the Russian invasion and from what subsequently happened in territories Russia actually occupied. Kherson therefore provides the model through which rumours concerning deeper penetration of the Ukrainian state should be assessed: neither believed automatically nor dismissed automatically.

The danger in wartime journalism lies at both extremes. If every whispered accusation of Russian collaboration is published as fact, Ukraine will begin doing Russia’s work for it. Officials will accuse rivals of treason, personal disputes will become counter-intelligence allegations and public confidence will collapse beneath a mountain of conspiracy theories. Russian information warfare positively encourages such paranoia because a society in which nobody trusts anybody is easier to destabilise. Yet the opposite mistake is equally dangerous. To dismiss every allegation because espionage is intrinsically difficult to prove publicly is to misunderstand clandestine activity, because intelligence networks are designed precisely not to generate perfect evidence.

The truth therefore lies in the uncomfortable territory between credulity and complacency. Ukraine must investigate evidence rather than rumours while nevertheless recognising patterns, and the pattern in Kherson is sufficiently clear to warrant serious attention. Russia constructed institutions of occupation, Ukrainians participated in them, some collaborators remained after liberation and Russian intelligence continues attempting to recruit people capable of providing useful information. Ukrainian counter-intelligence continues discovering alleged agents, including some whose relationships with Russia are said to have been unusually deep and longstanding.

There is another institutional dilemma. The more seriously Ukraine undertakes counter-intelligence screening, the easier it becomes for secrecy itself to shield misconduct. Security sometimes requires confidentiality, particularly in a region such as Kherson where Russian forces remain close enough to exploit apparently innocuous information. Yet secrecy can also make accountability substantially harder. An effective counter-intelligence state must therefore avoid becoming an unaccountable state, because institutions that cannot be scrutinised eventually develop precisely the informal networks and opportunities for abuse that foreign intelligence services are best equipped to exploit.

There will probably never be a neat moment at which somebody opens a filing cabinet and discovers a complete organisational chart entitled “FSB Network in Ukraine”. Real intelligence history seldom works that way. Instead there will be fragments: a telephone recovered during one arrest, testimony obtained in another, financial transfers, an old acquaintance in Russia, surveillance photographs, inexplicable administrative decisions, communications metadata and occasionally an individual who suddenly disappears across a border. Some fragments will connect, others will be coincidences and some accusations will be deliberately fabricated. Years later, archives may disclose relationships nobody suspected while others remain permanently ambiguous.

This is why the question Ukraine faces is not simply “who is a Russian agent?” That formulation is too crude. The more important question is whether Ukrainian institutions contain vulnerabilities through which Russian intelligence can obtain information, influence decisions or protect networks of people useful to Moscow. The answer to that broader question must surely be yes, because virtually every state possesses such vulnerabilities and Ukraine has the exceptional disadvantage of sharing decades of institutional, linguistic, commercial, family and personal connections with the country trying to destroy it.

The proper response is not a witch-hunt but institutional resilience. Officials occupying sensitive positions require proportionate vetting, unexplained wealth and clandestine foreign relationships require scrutiny and law-enforcement institutions must be capable of investigating one another without becoming weapons in political vendettas. Whistleblowers require channels through which credible allegations can be examined confidentially, while courts must ultimately distinguish evidence from accusation. The objective is not to create a society in which everybody suspects his neighbour but a state sufficiently professional that foreign intelligence finds institutional penetration increasingly difficult.

Most importantly, corruption cannot be treated as entirely separate from national security. Every clandestine financial arrangement creates a potential vulnerability. Every official protected by an informal patronage network acquires obligations outside the formal hierarchy of the state, and every institution in which decisions depend upon whom one knows rather than what the law provides becomes easier for a sophisticated intelligence service to penetrate. Russia understands these weaknesses particularly well because the contemporary Russian state itself is governed substantially through informal networks of money, patronage, coercion and security-service power.

Ukraine’s European transformation is therefore simultaneously a counter-intelligence project. Transparent procurement, independent courts, professional prosecutors, competitive recruitment and genuinely independent anti-corruption institutions are not merely bureaucratic requirements invented in Brussels. They make foreign penetration more difficult because they reduce the number of secret relationships upon which hostile intelligence can operate. The rule of law and national security, viewed in this way, are not competing objectives but complementary ones.

Kherson shows us what happens when military occupation and institutional penetration meet. The Russian flag has gone from central Kherson and Russian soldiers have retreated across the river, yet Russian drones still fly above the city, Russian artillery still strikes it and Ukrainian authorities continue uncovering people accused of transmitting information to the enemy. Liberation was therefore real, but it was not complete in the simplistic sense that history books sometimes suggest. A territory can be liberated relatively quickly; institutions, relationships and habits of influence may take considerably longer.

The most dangerous Russian operative in Ukraine may consequently not be the person who publicly praises Vladimir Putin. He may not speak Russian more frequently than Ukrainian, possess a Russian passport or harbour any particular affection for Russia. He may consider himself merely a businessman, intermediary, civil servant or survivor who has maintained useful relationships on both sides. Some of the rumours now circulating through Ukraine will prove false, some will be malicious and some will contain fragments of truth wrapped in exaggeration. A few may eventually prove considerably closer to reality than responsible journalists can presently demonstrate.

We do not know into which category the most sensational allegations now circulating about Ukraine’s law enforcement establishment will ultimately fall. For the moment, the only responsible course is to say what is known, identify what remains unproved and continue looking, because the lesson of Kherson is not that everybody should be suspected. The lesson is subtler and more unsettling: in the history of Russian penetration of Ukrainian institutions, there are some people whom Ukraine may discover, with hindsight, that it should have suspected considerably earlier.