The Belarusian State safety Committee (KGB) remains 1 of the fewer safety services in Europe that survived the collapse of the USSR without an organization “de-KGB-ization”. Minsk, in keeping with Kremlin's direct expectations, has built a permanent model of force on NATO's east flank states, including Poland in particular.
Magda Grosz
Today, the KGB has the function of maintaining the power of Alexander Lukashenko and the external force tool — in practice extending the strategies of the Russian peculiar Services. In Poland, his activity takes the form of combining classical individual interview with long-term information and cybernetic operations and low-intensity actions at the border – “kinetics” understood as events below the threshold of open conflict. The common denominator of course remains unchanged: the link between Minsk’s tactics and Russia’s interests — from doctrine to execution.
No change
The State safety Committee of the Republic of Belarus inactive bears the name and structure inherited from the russian model. He is straight subordinate to the president and remains the central pillar of the Lukashenko Force System. As of September 2020, the KGB has been headed by Gen. Ivan Tertel, a erstwhile military reconnaissance officer, subject to the sanctions of the European Union, the United States and the United Kingdom for participating in the pacification of protests following the 2020 presidential election.
There are various supporting links around the KGB, including police GUBOPiK, officially called “to fight extremism” and in practice to service the government to neutralise the opposition; the military intelligence of the General Staff; and the State Border Committee, which oversees all the activities of the “teatra” on the border barrier lines, generating the top emotions on our political stage.
Formally, they're separate institutions. In practice, they form a coherent mechanism, as the Centre for east Studies reminds us, noting that Moscow and Minsk signed a fresh package of agreements within the State of the Union in December 2024, “Safety first”, and that the integration of both states concerns not only the military's actions against NATO structures, but besides safety services. External analysts, including Clingendael Institute experts, interpret the 2020 staff rosada as a political signal of Minsk's full beginning for close coordination with Russian services.
"These are not cooperation episodes, these are doctrinal and operational integration," the analysts stressed in abroad media.
According to them, the KGB now has 4 main directions of action: the government within (continuous public pacification and control of diaspora as a permanent policy), border pressure, information-cibernetic operations and a permanent Russian vector.
A border like a theatre
Minsk uses the border as a leverage. Mechanics is repetitive: the instrumentization of migration, provocations towards patrols, escalation of physical and media contacts.
When the news of the death of Polish soldier Mateusz Sitek came to Warsaw in 2024 (brought with a knife by the attacker who pushed the blade through the gap in the barrier), the case exceeded the framework of emergency management.
The Associated Press agency reported ceremony ceremonies, Parliament's reactions and the fast restoration of buffer zones, while Reuters pointed to the administrative boundaries of the "no-go zone", setting the sections of the highest hazard and depth of the region in the Białowieża Forest. The Politico portal explained that the incidental became a symbol of the alleged "manufactured crisis" – a crisis created to accomplish a circumstantial political, economical or social nonsubjective – which the European Union has been associated with Minsk since 2021. Those who know the spheres of service, in a conversation with the Financial Gazette, stressed that this is the best example of a ‘teatura with real effects’, which quotes ‘binding resources for years, investigating procedures and vulnerability and at the same time creating susceptible ground for information operations’.
The government’s consequence to these actions took the form of investment in the east shield — a strategy of permanent engineering obstacles, sensors, drone protections, and fortifications stretched over hundreds of kilometres. As Financial Times wrote, Warsaw is seeking EU co-financing and wants to "seal" the most delicate episodes in the short term, while expanding the project's ambition in subsequent years. any government communications and press reports indicate a horizon of 2028 for full implementation, dependent on backing and technological progress. The scale of the effort confirms the diagnosis that the border force from the erstwhile east bloc states is not an episode, but a fresh form of “war” activities.
Ghostwriter: Polish traces
As far as information and cybernetic operations are concerned, 2 independent US cybersecurity units: the Google Threat Analysis Group and the Mandiant attributed the "highly confident" components of the operation "Ghostwriter/UNC1151" to the Belarusian State, indicating the circumstantial activities of the KGB of TTP elements (tactics, techniques and procedures): acquisition of accounts and services, substitution to public institutions, publications of prefabricated "lists" and local amplification in state media. "Mandiant is very assured that UNC1151 is linked to the government of Belarus," said the investigation company. It is uncommon in the cyber world, where state distribution usually remains in the grey area and is highly hard to detect.
This “Ghostwriter” is not a one-off run but a model of action. The method core, as reported by Google Threat Analysis Group and Mandiant, is classical phishing and hardening passwords, hacking into media content management systems and institutions and “hack-and-leak”, i.e. stealing data combined with their controlled publication to give them the appearance of authenticity. However, what is crucial is not the "breaking" itself, but what happens next: impersonating authoritative or media channels and fast publicity in local information spaces, including state tv in Minsk.
In December 2021, Meta announced the removal of a network of false accounts assigned to the Belarusian KGB. The accounts, as reported by the media, were to “saturate the migration crisis at the border of Belarus and Poland” by impersonating journalists and activists. Washington Post then explained in his papers that the accounts criticized Poland during the border impasse.
In Polish operational practice, described methods meant regular impersonation of offices and services, publication of alleged "official writings" and sending prepared letters to media and activists. The border context acted like an amplifier: the greater the voltage, the lower the threshold of reliability of counterfeiters, which are easier to "pin" into the current course of events.
Small volume, dense damage
In the area of individual intelligence, Minsk uses classical methods: recruitment by force on families in the country, financial offers, "legalization" of stay or tiny services. Polish prosecutorial files show a typical profile of tasks: reconnaissance of military airports, reflection of transport tracks and equipment traffic, investigating of patrol consequence — without spectacular operations, but with advanced utility for hostile analysts. Reuters described the indictment of November 2024 on the White Podlaska case, concerning the reflection of military movements, and PAP and Notes from Poland reported the judgement of 26–27 May 2025 erstwhile a Belarusian citizen heard 2 years and 2 months in prison for spying on Minsk. The scale of cases is smaller than in direct Russian threads, but the profile well illustrates the rule of "low volume — advanced perniciousness". As regards the Russian factor, in the case of Belarus, it is constantly in the background.
The Dutch Institute of global Relations "Clingendael" summarises that the increasing economic, military and doctrinal dependence makes Belarusian and Russian operations linked together, as well as interchangeable functionally: planned in 1 centre and operated by another. This can be seen, for example, after regular Russian-Belarusian joint military exercises, which in practice means for Poland that all "Belarusian" operating way should be examined simultaneously for the Russian vector.
The Clingendael study of 2025 points out that with the increasing dependence of Lukashenko on the Kremlin, the likelihood of a "full coupling" of the service apparatus and doctrines — including in the field of atomic weapons, as the institute recalls in the context of the inclusion of Belarus under the Russian atomic umbrella in the fall of 2024.
On the method side, the Mandiant remains a key origin in the Ghostwriter case. "Assess with advanced assurance that UNC1151 is linked to the Belarusian government," wrote the firm without a doubt. This short conviction has major consequences: a run that any researchers have late treated as exclusively Russian has a Belarusian core, even if the political burden and long-term benefits fall upon Moscow. In Polish legal practice, the difference is important: the contribution to Minsk allows the usage of another diplomatic and sanctioning regimes.
Forecasts for Poland
In 2025 Poland leads the game at 2 “scenes” simultaneously. At the border, maintaining buffer zones, expanding the east shield and seeking permanent EU funding. In the infosphere, strengthening the institutions' resilience to “substitutions”, counterfeits and acquisitions of accounts, in collaboration with technology companies, which have already once, like Meta and Google, provided hard evidence linking circumstantial accounts and TTP with the Belarusian state. According to the Financial Times, Warsaw argues in Brussels that the border with Belarus is now an EU and NATO border, and the cost of the shield should be shared. The forecasts made by RAND and ISW are sober: Russian-Belarusian integration in the safety area will proceed, strengthening joint planning and crisis response.
