Lithuania Charges Two Suspects with Terrorism over Starlink Sabotage Attempt

Lithuanian prosecutors have brought terrorism-related charges against two suspects over an attempted arson attack on Starlink satellite communications infrastructure in Vilnius on 18 October, marking a significant development in an investigation into suspected sabotage targeting services important to Ukraine's military capabilities. The suspects, who live in Germany, were identified through an investigation conducted in cooperation with foreign law enforcement agencies and have already been detained in Germany under European arrest warrants issued by Bulgaria in connection with a separate attack on Starlink equipment. Lithuanian authorities suspect that the two incidents are connected, although the full extent of the alleged operation and the individuals involved remains under investigation.

The charges announced on 29 October include suspected participation in an organised terrorist group, travelling for terrorist purposes and committing a terrorist act that could have caused serious consequences. The allegations are serious, but the suspects have not been convicted, and the investigation has yet to establish their individual roles and any wider organisational links. One suspect holds Turkish and German citizenship, while the other holds Serbian and German citizenship. Lithuanian investigators have been working with counterparts in Germany, Bulgaria and Poland to establish how the suspects travelled between countries and whether the incidents form part of a coordinated campaign.

An attack targeting communications infrastructure

The attempted arson took place during the early hours of 18 October at a company site in Vilnius where Starlink satellite communications equipment was installed. The fire was extinguished before firefighters arrived, and the incident caused no reported disruption to the network's operations. Lithuanian officials have said the attack appeared to be planned rather than spontaneous, with information from the investigation indicating that the suspects travelled to Lithuania specifically to carry it out and left shortly afterwards.

Lithuania has treated the incident as a potential act of sabotage linked to Russia, arguing that the likely strategic objective was to undermine Ukraine's military capabilities. Vilmantas Vitkauskas, head of the Lithuanian government's National Crisis Management Centre, previously connected the attempted attack to incidents involving Starlink infrastructure in Poland and Bulgaria. Moscow has rejected similar accusations of Russian involvement in sabotage operations in Europe.

The distinction between physical damage and strategic impact is important in this case. Although the attempted attack did not interrupt Starlink services in Lithuania, targeting a communications facility can expose vulnerabilities in infrastructure whose importance extends beyond the country in which it is located. The investigation is therefore examining not only the immediate criminal act but also whether the incident was intended to disrupt a wider communications network supporting Ukraine and other users across Europe.

A wider pattern of attacks across Europe

The Lithuanian investigation has gained significance because of its links to a series of incidents involving Starlink infrastructure in several European countries. In September, a fire at a Starlink facility in Poland damaged its power system and backup generator. Polish authorities suspected sabotage and detained four people in connection with the incident. On 9 October, several Starlink antennas were reportedly targeted by arson near Sofia, Bulgaria, prompting a separate investigation that led to the arrest of the two suspects now implicated in the Lithuanian case.

According to Lithuanian police, the suspects identified in the Vilnius investigation are the same individuals suspected of involvement in the Bulgarian incident. Investigators are also examining possible connections to other people detained in Poland. The overlap between the cases raises the possibility that the attacks were not isolated acts of vandalism but components of a broader operation targeting infrastructure associated with Ukraine's defence.

The cross-border dimension presents a challenge for European security services. Suspects can move between EU member states, while evidence, witnesses and potentially relevant intelligence are spread across different jurisdictions. Cooperation between national police forces, prosecutors and security agencies is therefore central to establishing whether the attacks share a common organiser, operational method or source of financing. At the same time, investigators must distinguish confirmed links between individual suspects from broader allegations about who may have directed the attacks.

The fact that the two suspects were detained in Germany at Bulgaria's request also creates a complicated legal process. Bulgarian authorities are seeking their transfer in connection with the attack near Sofia, while Lithuania has its own terrorism-related charges to pursue. The countries will need to coordinate the handling of the competing investigations and determine how the suspects can be brought before the relevant courts.

Why Starlink matters to Ukraine's defence

Starlink, operated by SpaceX, has become an important part of Ukraine's wartime communications infrastructure. Its satellite internet terminals allow military personnel to maintain connectivity in areas where conventional telecommunications networks are damaged, unavailable or vulnerable to disruption. Ukraine also uses Starlink-connected systems in unmanned aerial operations, including drones employed for reconnaissance and strikes against Russian targets, as well as interception systems used against Russian attacks.

This makes the infrastructure strategically relevant beyond its commercial function. An attack on a ground facility may not directly interrupt services across the network, but repeated incidents can force operators and governments to invest in additional physical protection, monitoring and contingency arrangements. If the suspected campaign is coordinated, the selection of targets could be intended to identify weaknesses, impose security costs and demonstrate that infrastructure supporting Ukraine remains vulnerable even when it is located inside NATO and EU territory.

The case also illustrates the difficulty of protecting civilian-owned technology that has acquired military importance during a war. Satellite communications infrastructure is operated by private companies, while its security may depend on cooperation between commercial providers, national authorities and military users. The resulting responsibilities are not always straightforward, particularly when facilities serve multiple customers and are distributed across national borders.

For European governments, the implications extend beyond Starlink itself. Telecommunications facilities, energy infrastructure, logistics hubs and defence manufacturers can all become potential targets if hostile actors seek to undermine support for Ukraine without engaging in conventional military confrontation. Even attacks that cause limited physical damage can consume investigative resources, increase operating costs and place pressure on governments to strengthen the protection of strategically important assets.

The challenge of establishing responsibility

Lithuanian authorities have identified the attempted arson as a suspected terrorist act and described it as potentially connected to Russia. However, establishing the suspects' involvement in the physical attack is only one part of the investigation. Prosecutors will also need to determine whether the alleged conduct was directed by a wider network, whether the incidents in different countries were coordinated and whether there is evidence connecting the operation to Russian state structures or other actors.

These distinctions matter for Europe's response. If the cases establish a coordinated campaign, governments could face pressure to strengthen intelligence-sharing, improve the protection of critical infrastructure and expand cooperation on counter-sabotage investigations. If the evidence instead points to separate operations with different motives or organisers, the appropriate response could be narrower. The charges announced in Lithuania represent a significant investigative step, but they do not by themselves establish who ultimately commissioned the attack.