Helen Worrell

This is a sign of a gig economy, of people being recruited online, often paid via crypto, to do actions in the real world.

Hello.

So one of the attackers who we've written about is a young Ukrainian called Roman Lavrinovich, who arrived in the UK around the time that Russia invaded Ukraine.

He worked in construction.

It seems that he was sort of struggling to get regular work.

He struggled with English and he posted regularly in Ukrainian language groups on Telegram.com.

looking for cash in hand work.

And he was essentially recruited on Telegram by a Russian speaking handler called El Money, who we have established was based in Russia and is affiliated with a Russian hacking network.

I think one of the interesting things about people who are recruited to do this sort of informal work online is that often it relies on either a level of naivety or a sort of willingness to believe that they're doing something completely different.

So first of all, Lavrinovich was asked to put up posters in London for a fake far-right group that was sort of part of a far-right propaganda campaign.

Then he did some reconnaissance around Starmer's house, looking at arson targets.

And he also did some anti-Islamic graffiti on mosques around the capital.

So he said in a police interview after the attack that he had absolutely no idea who he was targeting.

He even claimed that he had no idea who Keir Starmer was.

So clearly, whoever was tasking Lavrovich was benefiting from the fact that he was willing to do these actions without asking too many questions.

Of course, yeah.

So the piece that I wrote earlier this month looks at both Russia and Iran and similarities in how essentially they are recruiting proxies online to carry out work for them.

They seem to be targeting minors across mainland Europe and also in Israel.

And often these are quite vulnerable people.

That may be because they're young or because they are spending lots of time online.