On Tuesday, 18 November 2025, during his address in the Sejm concerning two sabotage incidents on the Polish railway network, Prime Minister Donald Tusk announced that he would sign an order later today introducing the third CRP alert level (CHARLIE–CRP) on designated railway lines (Polish Prime Minister Donald Tusk: Two Acts of Sabotage targeting Poland’s Railways)
Image: Polish Ministry Of Interior And Administration
He stated that the intensive work of the security services, Police, and the prosecutor’s office made it possible to identify the individuals responsible for the sabotage act in the village of Mika (attempt to blow up railway tracks) and near Puławy (attempt to damage railway infrastructure), which were intended to cause a railway disaster.
As established in cooperation with allied services, the suspected perpetrators were two Ukrainian citizens who had been acting and cooperating for a long time with Russian intelligence services. Their identities have been established, but at the request of the prosecutor’s office they cannot be made public at this stage of the investigation, as further operations are currently underway.
One of them had been convicted by a court in Lviv in May this year for sabotage acts on Ukrainian territory and is currently in Belarus. The second is a resident of Donbas, an employee of a local prosecutor’s office. Both entered Poland from Belarus in the autumn of this year, shortly before the attacks.
Immediately after committing the sabotage in Mika, the individuals left Polish territory through the Terespol border crossing, returning to Belarus, at a time when they had not yet been identified by Polish services. Polish services and the prosecutor’s office possess full data and recorded images of these individuals.
The sabotage acts occurred at different times. The first involved mounting a steel clamp on the track that could have derailed a train. The perpetrators placed a mobile phone with a power bank near the track to record the incident. Fortunately, this attempt was completely unsuccessful.
The second incident took place on 15 November at 20:58, as shown in surveillance footage. A military-grade C4 explosive was detonated using a triggering device connected by a 300-meter electrical cable. Some unexploded explosive material was also secured at the scene. The charge exploded during the passage of a freight train on the Warsaw–Puławy route, not causing a derailment but slightly damaging the floor of one wagon. The driver did not even notice the incident while passing through the area.
“Poland remains in constant contact with the intelligence services of allied countries, and we will do everything possible to pursue the perpetrators, with ongoing efforts to identify all those responsible and their collaborators,” the Prime Minister said.
The first report, made by a resident of Mika, occurred on Saturday, 15 November at 21:40. The woman told the Police she had heard a loud bang. Officers arrived 20 minutes later. Based on her testimony, the area was searched for over an hour, after which the search was discontinued, with no findings noted.
At 07:40 on Sunday, another train passing through the area stopped at the place where the explosion had occurred. Thanks to the driver’s quick reaction, a derailment was prevented in the location further weakened by subsequent trains. At 09:43 on Sunday, following the driver’s report, the Police informed state authorities: the Prime Minister’s Office, the President’s Office, and the relevant ministers.
Prime Minister Donald Tusk emphasized that this is an unprecedented incident, possibly the most serious since the outbreak of the full-scale war in Ukraine on 24 February 2022, because a certain threshold has been crossed. He stressed that Poland has long been the target of numerous sabotage, disinformation, and even kinetic actions, such as the deliberate arson of the Marywilska 44 shopping center.
He assured that the Polish state will track down those responsible, including those behind this act of sabotage. He said that after the sabotage attempt in Wrocław in January this year (a Ukrainian living permanently in Germany, recruited by Russians, attempted to set fire to a paint warehouse), the intelligence services presented the modus operandi of Russian sabotage operations—not only in Poland—to the Council of Ministers. So far, 55 people suspected of sabotage have been detained in Poland, including 23 arrested, and 28 expelled to Ukraine, where the authorities sent them to the front. Eight more individuals were recently detained (see link below). In all cases, the orders came from Russian intelligence services.
The Prime Minister said that recently he had received the same signals from partners in Moldova, Romania, the United Kingdom, and Germany about the very same methods—such as an attempted assassination of the British Prime Minister a few months ago by two Ukrainians recruited by Russian services, who planted incendiary bombs at his private residence. In Romania and Moldova, individuals carrying explosives and claiming to have arrived from Poland were detained. The modus operandi is always the same: citizens of other countries are hired, most often Ukrainians (only one detained individual was a Russian citizen).
He stressed that the intention behind Russia’s actions is not only the direct effects of sabotage (disruption, chaos, panic, speculation, uncertainty), but also the social and political consequences: stirring anti-Ukrainian sentiment. This is particularly dangerous in countries like Poland, where there are more than one million Ukrainian refugees and where anti-Ukrainian resentment can be easily manipulated. Russian disinformation such as “Ukrainian drones attack Poland” or “Ukrainians blow up trains” is doubly beneficial for the Kremlin. He emphasized that at this moment it does not matter what public opinion thinks about Ukraine or Russia, because the aggressive political and military intentions of the Kremlin are unequivocal.
CHARLIE–CRP
The head of the Internal Security Agency (ABW), Col. Rafał Syrysko, and the Minister of the Interior and Administration, Marcin Kierwiński, after receiving the opinion of the team for terrorist threats, jointly requested that Prime Minister Donald Tusk introduce the third CRP alert level (CHARLIE–CRP) in connection with terrorist threats on designated railway lines. In the rest of the country, the second alert level will remain in force, as before.
The Prime Minister also asked Deputy Prime Minister and Minister of Foreign Affairs Radosław Sikorski to take immediate diplomatic action to secure the extradition to Poland of the individuals suspected of the terrorist attack, addressing both the authorities of Belarus and Russia. The Prime Minister also informed partners and allies of all details of the operation carried out against Poland. The Polish Armed Forces have been engaged in securing strategic infrastructure in the country, including railway infrastructure.
He stressed that since the outbreak of the full-scale war, Russia has been escalating sabotage activities across Europe. The Prime Minister appealed for unity in the face of these actions.
Alert Levels in Poland
In Poland, there are two types of alert levels defined in the Act on Anti-Terrorism Measures of 10 June 2016:
- General alert levels (without the CRP designation): These concern terrorist threats in the physical world (e.g., bomb attacks, armed assaults).
- CRP alert levels (with the CRP designation – CyberPrzestrzeń Rzeczypospolitej, i.e., Cybersecurity of the Republic): These apply exclusively to threats in cyberspace (hacker attacks, cyberterrorism) targeting the ICT systems of public administration or critical infrastructure (e.g., energy, banking, transport).
Both systems have four levels: ALFA → BRAVO → CHARLIE → DELTA. A higher level always includes the measures required at all lower levels.
When are alert levels introduced?
The Prime Minister (or in some cases the Minister of the Interior and Administration), after consulting the head of the Internal Security Agency (ABW). They may apply to the entire territory of Poland, selected provinces, counties, or even specific facilities (e.g., railway lines).
CHARLIE is the third and second-highest level on the scale — a very high threat level. It means that there is credible information about a planned terrorist attack, or that an incident confirming such intent has already taken place.
💬 Premier @DonaldTusk w #SejmRP: Intensywna praca służb, policji oraz prokuratury pozwoliła ustalić osoby odpowiedzialne za akty dywersji w miejscowości Mika oraz w okolicach Puław.
— Kancelaria Premiera (@PremierRP) November 18, 2025
💬 Premier @DonaldTusk w #SejmRP:
Mamy pewność, że próba wysadzenia torów oraz naruszenie infrastruktury kolejowej miały charakter intencjonalny i miały na celu doprowadzenie do katastrofy w ruchu kolejowym.— Kancelaria Premiera (@PremierRP) November 18, 2025
💬 Premier @DonaldTusk w #SejmRP:
Ustalonymi sprawcami są dwaj obywatele Ukrainy, którzy od dłuższego czasu współpracowali z rosyjskimi służbami. Ich tożsamości są znane.— Kancelaria Premiera (@PremierRP) November 18, 2025
💬 Premier @DonaldTusk w #SejmRP:
Osoby, które dokonały aktu dywersji, opuściły teren Polski przez przejście graniczne w Terespolu.— Kancelaria Premiera (@PremierRP) November 18, 2025
💬 Premier @DonaldTusk w #SejmRP: We wszystkich przypadkach definiujemy służby rosyjskie jako zlecające akty dywersji oraz działania wywiadowcze.
— Kancelaria Premiera (@PremierRP) November 18, 2025
UPDATE
Prime Minister Donald Tusk has signed an order introducing the third alert level on railway lines managed by PKP Polskie Linie Kolejowe S.A. and PKP Linia Hutnicza Szerokotorowa Sp. z o.o., in force from 19 November 2025 at 00:00 until 28 February 2026 at 23:59.
See also:
- Polish Internal Security Agency detains Ukrainians spying on aid hub for Ukraine
- Polish Security Services Detain Eight People Preparing Sabotage Operations
- Poland: Public Official Indicted for Espionage on Behalf of Russia
- Belarusian Spy Arrested in Poland, Diplomat Expelled
- Russia-Backed Colombian Behind Terror Attacks in Poland, According to Polish Authorities