LONDON — The Russian-speaking handler known only as “El Money” was dissatisfied.
A series of arson attacks aimed at a car and two London properties linked to British Prime Minister Keir Starmer had drawn little notice. One reason, prosecutors said, was that the alleged attacker, a 21-year-old Ukrainian recruited online, did a poor job documenting the incidents.
One video meant to show Starmer’s former car burning lasted only a few seconds. Another, shot in near darkness, captured little more than the sound of matches being struck.
For El Money, that was not enough. The shadowy figure wanted attention and was willing to pay for it.
On Monday, Roman Lavrynovych was found guilty along with an accomplice. Yet the individual — or wider network — believed to be operating behind the El Money alias has so far avoided public accountability.
According to Cmdr. Dominic Murphy, who spent 20 years investigating Russian-linked operations and led the early inquiry into the fires before retiring in March, the case bears the hallmarks of Russian state-backed sabotage.
But establishing Moscow’s involvement is difficult. There is a difference between proving something in court — which could raise public awareness — and assessing such attacks in the context of a wider threat and often classified and incomplete intelligence.
European officials say Moscow is exploiting that space as it carries out a sabotage campaign against European countries that support Ukraine. The Associated Press has tracked at least 192 attacks across Europe since the 2022 invasion of Ukraine that include arson and cyberattacks as well as attempted assassinations.
When asked by AP in June if Russia is waging a covert war against the West, President Vladimir Putin brushed the allegations off.
“What are the specific facts?” he said. “What has been proven?”
The U.K. Home Office called the fires an “abhorrent attack” in a statement and said those responsible have been brought to justice. It did not respond to requests for comment about whether the British government blamed Russia.
Three arson attacks targeted property linked to Starmer
Lavrynovych was tasked with setting and filming the fires over several days in May 2025, according to evidence presented during his six-week trial.
El Money recruited him online and sent detailed instructions, including the locations of the targets and how to mix flammable liquids from a hardware store.
The attacks did not cause injuries or major damage, but the prime minister’s sister-in-law, Judith Alexander, said she was left “struggling to breathe” after smoke filled her house in the third attack. She and her family were staying at the residence, which had been Starmer’s home before he became prime minister.
“It’s all dead quiet so far — not a single article or announcement about the incident on this street,” El Money wrote to Lavrynovych on the messaging app Telegram after the fire.
It had, however, attracted the attention of British counterterrorism police.
Jurors heard little about the ‘devil in the background’
At the trial, jurors heard extensive evidence about how Lavrynovych conspired to set the fires — and almost nothing about the person or group of people who ordered them.
He was initially paid to post anti-Islam posters and graffiti in Muslim neighborhoods of London, an apparent attempt to stoke unrest. He told the court he was offered larger sums for the fires — and threatened if he did not comply. His lawyer, James Scobie, said he was a “vulnerable, ignorant” puppet in the hands of a serious operator.
“It must be a bit of a frustration that no part of this case has really looked into the devil in the background,” said Scobie. Without mentioning Russia by name, he said the attacks targeted Starmer over his support for Ukraine, calling them an assault on “the very institutions and fabric of this country.”
Prosecutors, however, did not bring charges under Britain’s National Security Act, passed in 2023 to counter state threats, so no evidence was presented of a wider conspiracy linked to Moscow.
El Money is the “central figure in the case but a man or group about whom we know very little,” Justice Neil Garnham said. For that reason, he directed the jury “not to speculate about him.”
There’s a gap between evidence and intelligence
Police have “no evidence to suggest that this was a state-backed threat and target on the prime minister,” said Helen Flanagan, the current head of counterterrorism police. She was referring to evidence gathered by police, as opposed to classified intelligence assessments.
European intelligence services say Russia is recruiting people online and paying them relatively small sums of money to carry out sabotage. Last year, a British court found three men guilty in the torching of a London warehouse. Prosecutors said the ringleader was recruited online for a plot masterminded by Russia’s intelligence services.
Murphy said there is a difference between assessing state-level involvement in an attack and using evidence like cellphone data and messages to prove something in court beyond a reasonable doubt.
Sometimes evidence, particularly from intelligence services, cannot be shown to jurors because it would reveal “highly sensitive capabilities and tactics,” Murphy said.
Investigators spend “a huge amount of time and effort” trying to identify the individuals overseas behind attacks, he said. They comb digital devices, online footprints and links among suspected co-conspirators, often working with partner countries.
He said evidence gathered by police showed that El Money spoke Russian and is “likely to be in Russia.” El Money’s methods were “very similar” to those known to be used by Russian intelligence services acting in the U.K. Such plots, he said, often have “very senior sign-off.”
But that’s not enough for a jury — or, it seems, to publicly assign blame.
AP asked various departments if the government plans to attribute the attack to Russia or if there was additional evidence suggesting a link to the Russian state that was not shown in court.
The prime minister’s office referred questions to the Home Office, which provided the statement about the case but did not answer questions about Russian involvement. In a statement, U.K. counterterrorism police said a thorough investigation has been carried out and that it does not comment on matters of intelligence.
Officials say the threat from Moscow is growing
British intelligence agencies have accused Russia of probing the U.K. and its European allies with activities just below the threshold of conventional war. Court cases are key to raising public awareness of the threat and can lead to tougher action, such as sanctions, said Murphy.
“We need to keep calling Russia out and we need to ensure our society is as resilient as it possibly can be,” he said, calling for a wider public conversation about the threat from Moscow, including to critical infrastructure.
Murphy was a lead investigator into the attempted killing of Sergei Skripal, a Russian former military intelligence officer, in 2018. The U.K. attributed that attack to Moscow, and it led to a mass expulsion of Russian diplomats — and spies — from Western countries.
Since then, Russia has shifted toward the recruitment of local proxies.
Shortly before police arrested Lavrynovych, El Money wrote to him, promising to pay.
“Don’t worry, I won’t set you up,” El Money wrote. But Lavrynovych never got the money.
There is “only one winner” in the case, Scobie told the court as he argued for his client, “the anonymous devil who manipulated, used and won.”
