In a landmark verdict delivered Monday, a 21-year-old Ukrainian national recruited online to carry out a string of arson attacks targeting properties linked to British Prime Minister Keir Starmer has been found guilty of conspiracy, alongside his unidentified accomplice. But the shadowy, Russian-speaking handler who orchestrated the plot — operating under the online pseudonym “El Money” — remains at large, escaping all public accountability and legal punishment, leaving a critical gap in Britain’s effort to counter what counterterrorism experts say fits a pattern of Russian state-backed sabotage across Europe.
The botched 2025 attack plot laid bare the challenges Western law enforcement faces in countering Moscow’s emerging hybrid warfare tactics, which rely on low-cost, locally recruited proxies to carry out destabilizing acts while leaving little traceable evidence of direct state involvement. Court documents from the six-week trial outline that El Money recruited the attacker, Roman Lavrynovych, via messaging app Telegram, and provided him with step-by-step instructions: specific target locations, guidance on mixing flammable materials from local hardware stores, and a requirement to film each attack to generate publicity. Over several days in May 2025, Lavrynovych carried out three arson attempts: one targeting Starmer’s former personal vehicle, and two striking residential properties previously owned by the prime minister. No one was killed or seriously injured in the attacks, which caused only limited structural damage, but smoke inhalation left Judith Alexander — Starmer’s sister-in-law, who was staying in one of the targeted homes at the time — gasping for air, according to witness testimony.
Far from being satisfied with the attacks themselves, El Money grew frustrated by the limited media coverage the arsons generated. Poor documentation by Lavrynovych left the handler without usable viral content: one clip purporting to show Starmer’s former car ablaze lasted only seconds, while a second video filmed in near total darkness captured little more than the repeated scratch of striking matches. “It’s all dead quiet so far — not a single article or announcement about the incident on this street,” El Money complained to Lavrynovych in a message sent after the final attack, unaware that the plot had already caught the attention of British counterterrorism detectives.
Testimony during the trial revealed that Lavrynovych was not initially tasked with arson. El Money first paid him to post anti-Islam posters and spray anti-Muslim graffiti across majority-Muslim neighborhoods in London, an apparent attempt to stoke sectarian unrest ahead of the more high-profile attacks targeting Starmer. When El Money ordered the arsons, Lavrynovych was threatened with harm if he refused, and promised a large cash payment for completing the job. His defense attorney, James Scobie, described Lavrynovych as a “vulnerable, ignorant” puppet manipulated by a far more sophisticated, unseen operator. “It must be a bit of a frustration that no part of this case has really looked into the devil in the background,” Scobie told the court, noting that the attacks were clearly aimed at Starmer over his unwavering support for Ukraine, and amounted to an attack on Britain’s democratic institutions.
Notably, prosecutors opted not to bring charges under Britain’s 2023 National Security Act, a piece of legislation crafted specifically to counter state-backed threats. That decision meant no evidence of a wider conspiracy linked to Moscow was ever presented to the jury. Presiding Justice Neil Garnham went a step further, directing jurors not to speculate on the identity or affiliations of El Money, calling him the “central figure in the case but a man or group about whom we know very little.” The result is a conviction that holds only the low-level proxy accountable, while leaving the orchestrators untouched.
Current head of UK counterterrorism police Helen Flanagan emphasized that publicly disclosed police evidence has not confirmed a state-backed plot targeting the prime minister, drawing a clear line between unclassified law enforcement evidence and classified intelligence assessments. That distinction is at the core of the challenge Western governments face in addressing this new wave of Russian hybrid activity, according to Cmdr. Dominic Murphy, the veteran investigator who oversaw the initial probe into the Starmer arson attacks before retiring in March. With more than 20 years of experience investigating Russian state-aligned activities in the UK — including the high-profile 2018 Sergei Skripal poisoning plot — Murphy told the AP that the Starmer plot matches the exact profile of Russian state-backed sabotage.
“There is a difference between proving something in court — which could raise public awareness — and assessing such attacks in the context of a wider threat, where intelligence is often classified and incomplete,” Murphy explained. Often, critical intelligence gathered by spy agencies cannot be presented in open court, because doing so would expose sensitive intelligence gathering capabilities and tactics, making it impossible to meet the high bar of “beyond a reasonable doubt” required for criminal convictions. Even so, Murphy noted that police evidence confirms El Money spoke Russian and is likely based in Russia, and that his operational tactics are “very similar” to those consistently used by Russian intelligence services operating on British soil, with such plots often requiring “very senior sign-off” from Moscow. That assessment aligns with data compiled by the Associated Press, which has tracked at least 192 attacks across Europe — including arson, cyberattacks, and attempted assassinations — linked to Russian covert activity since Moscow’s full-scale invasion of Ukraine in 2022. European officials have repeatedly warned that Russia is exploiting the gap between classified intelligence and admissible court evidence to carry out a sustained sabotage campaign against Western countries that support Ukraine.
When asked in June about allegations of a Russian covert war against the West, Russian President Vladimir Putin dismissed the claims, asking, “What are the specific facts? What has been proven?” British officials have so far declined to publicly attribute the Starmer plot to Moscow. The UK Home Office called the attacks “abhorrent” in a statement and confirmed that the prosecuted conspirators have been brought to justice, but declined to answer questions about whether the British government blames Russia for the plot. The prime minister’s office referred all questions about attribution to the Home Office, while counterterrorism police declined to comment on intelligence matters.
Murphy and other security experts argue that public attribution and transparent court cases are critical tools for raising awareness of growing Russian threats, and can justify tougher action including new sanctions and expanded defensive measures. The Skripal attack, for example, was publicly attributed to Moscow by the UK government, leading to the mass expulsion of Russian intelligence officers operating under diplomatic cover across the Western world. Since that 2018 incident, Murphy noted, Russia has shifted its tactics dramatically, moving away from direct operations by Russian intelligence officers to the recruitment of low-level, easily replaced local proxies like Lavrynovych. This shift makes it far harder to trace direct links to the Kremlin. In the end, Scobie told the court, the only winner in the Starmer arson case is the unseen shadow operator who manipulated Lavrynovych and escaped unscathed. Shortly before Lavrynovych’s arrest, El Money reassured the young recruit, “Don’t worry, I won’t set you up.” Lavrynovych never received the payment he was promised.