Arson, Accidents, or Sabotage? The Dual Threat to Europe’s Defence Industry

The Milrem case is the clearest warning.

When an industrial accident becomes a security case

The fire at Milrem Robotics’ facility on Betooni Street was followed by arrests after a local resident reported suspicious activity near the building. Estonia’s law enforcement authorities detained suspects, while the Office of the Prosecutor General sought their arrest. Prime Minister Kristen Michal said investigators were examining suspected arson and possible Russian state involvement.

That is materially different from the other incidents reported over the same period.

At Stora Enso’s Kaukopää pulp mill in Imatra, an overpressure explosion ruptured a tall oil storage tank. The plant is only about 7km from the Russian border, but Finnish authorities and the company attributed the incident to a technical malfunction and ruled out sabotage. At KNDS Ammo Italy’s plant in Colleferro, a fire in the gunpowder pressing area caused a major explosion after workers had been evacuated; prosecutors formally excluded sabotage in favour of technical causes.

Bulgaria’s EMCO ammunition plant experienced another severe accident when a truck fire spread to warehouses containing finished products, triggering secondary explosions. Local authorities again pointed to operational or technical causes. In Rotterdam, an explosion during pipeline maintenance at Gunvor Energy killed a contractor and injured several others, with police finding no link to hostile state activity.

The incidents therefore cannot credibly be treated as one coordinated wave of attacks.

But neither can the Milrem investigation be dismissed as simply another industrial fire.

Estonia’s Internal Security Service has framed the broader threat in strategic terms, warning that Russia represents a long-term existential challenge involving non-military provocations. Its director general, Margo Palloson, has called for immediate improvements to physical and digital security around critical infrastructure, even while saying the country’s overall threat level remains unchanged.

That distinction - between an individual criminal act and a wider national-security threat - is becoming increasingly important for Europe’s defence industry.

The uncomfortable cost of rearmament

European defence factories are being asked to do something they were not designed to sustain indefinitely: maintain exceptionally high production rates while operating in an increasingly hostile security environment.

Since 2022, defence plants have been working under intensive production schedules to meet replenishment orders from Western militaries and contractual commitments connected with Ukraine. For ammunition manufacturers, that means more output, greater mechanical wear and fewer opportunities for scheduled maintenance. It also creates more room for procedural failures and human error.

The incidents at KNDS Ammo Italy and EMCO illustrate the vulnerability.

Both companies are part of Ukraine’s wider ammunition supply chain, but they produce different types of artillery ammunition. KNDS Ammo Italy manufactures NATO-standard 155mm shells, while EMCO produces Soviet-standard 122mm and 152mm artillery ammunition and rockets. Damage at either facility therefore matters beyond the perimeter of the plant.

Yet the precise effect on Ukrainian deliveries cannot be inferred simply from the fact that production was interrupted. The briefing does not establish the scale or duration of any resulting supply shortfall. What is clear is that every production halt adds another point of fragility to a supply network already operating under pressure.

This is the paradox at the heart of Europe’s defence expansion.

The continent needs to manufacture more weapons faster. Doing so increases the physical and operational strain on the very facilities that have become strategically indispensable.

Sabotage exploits the same vulnerability

Russian covert operations, if directed at European defence infrastructure, do not need to destroy an entire industrial network to create disruption. A fire at a specialised robotics facility, a warehouse or a critical production area can impose delays, trigger investigations and force companies to divert resources towards security.

Milrem Robotics is particularly revealing because it is not a conventional ammunition factory. The Estonian company develops autonomous systems and defence robotics, including unmanned ground vehicles used by Ukrainian forces. A suspected attack on such a facility points to the breadth of the emerging target set: the vulnerability is not confined to explosives plants or weapons warehouses.

That is precisely why industrial safety and counter-sabotage can no longer be treated as separate policy fields.

A factory operating at maximum capacity has one set of vulnerabilities. The same factory operating under the assumption that an adversary may deliberately exploit those vulnerabilities has another. Access controls, surveillance, digital security, physical protection and intelligence monitoring become part of production resilience rather than ancillary corporate expenses.

For private defence companies, this creates a difficult balancing act. Security measures can protect production, but they also add costs and potentially complicate an already demanding effort to increase output. The greater the dependence on a small number of specialised facilities, the more expensive the consequences of disruption become.

Europe’s security perimeter is moving inward

For decades, European defence planning largely separated military security from the protection of domestic industrial infrastructure. Factories were industrial assets; military forces were security assets.

That division is becoming harder to maintain.

A defence manufacturer supplying Ukraine can be a strategic node even if it is privately owned and located far from any battlefield. Its employees, warehouses, production lines and information systems can all affect the ability of European governments to sustain military support.

The Milrem investigation makes that shift particularly visible. Estonia’s counter-intelligence apparatus is involved alongside conventional law enforcement because the suspected threat is not simply damage to property. It is potentially part of a foreign intelligence or sabotage operation directed against a strategic industrial capability.

The response therefore cannot depend exclusively on the companies themselves.

The briefing points towards a model in which critical defence infrastructure requires state-level physical security, counter-intelligence and counter-sabotage oversight, together with greater redundancy. It is a significant change in the relationship between governments and private manufacturers: security is becoming an operational requirement of defence production.

There is also a less sophisticated but important layer of protection.

The Tallinn case began, at least in part, with an observation by a local resident. Civilian awareness can matter when covert operations depend on anonymity and access. The incident demonstrates how a suspicious movement near a strategically relevant facility can become useful intelligence when reported to authorities.

That does not turn communities into intelligence agencies. It does mean that the security perimeter around Europe’s defence industry extends beyond factory gates.

The information war benefits from ambiguity

The simultaneous appearance of genuine sabotage allegations and genuine industrial accidents creates another vulnerability: the information environment.

The Kremlin-aligned media ecosystem can exploit real incidents without having caused all of them. A technical explosion at a Finnish industrial plant, an ammunition factory fire in Bulgaria and an investigation into suspected arson in Estonia can be presented as evidence of a single story — that Europe’s industrial base is collapsing or that its defence mobilisation is inherently unsafe.

That narrative does not require every incident to be a covert attack.

Indeed, the existence of demonstrable technical failures makes the propaganda more difficult to counter. European authorities must simultaneously acknowledge real industrial weaknesses and prevent unsupported claims from turning unrelated accidents into evidence of a coordinated campaign.

For European governments, the danger is therefore not only physical disruption. It is the interaction between disruption, uncertainty and public perception.

A successful sabotage operation can damage a facility. A cluster of unrelated accidents can expose weaknesses. Together, even without a common operational cause, they can create the impression of systemic vulnerability.

Europe’s defence industry is consequently entering a phase in which resilience will have to mean more than increasing production capacity. The factories themselves must be capable of continuing to operate when machinery fails, maintenance is delayed, suspicious activity occurs or a hostile actor attempts to exploit an exposed point in the chain.

That is a considerably more demanding standard than simply producing more shells, vehicles or robotic systems.

And it is one that Europe will have to meet while the very production tempo required to support Ukraine continues to place additional stress on the industrial infrastructure it is trying to secure.

Sources:  ERR