Deputy Head of National Police Andrii Niebytov: Russian recruiters are difficult to identify, Telegram does not cooperate with law enforcement agencies
Who is behind the organization of explosions near TCR (Territorial Recruitment Centers), at police stations, and the attempted to blow up the train station in Ivano-Frankivsk? Do the adolescents and adults being used to plant explosive devices know that they may be deliberately detonated? How are those who carry out such criminal acts on the territory of our country selected and motivated? How many acts of sabotage and terrorist attacks have law enforcement officers been able to prevent since the beginning of this year?
We addressed these and other questions to Andrii Niebytov, Deputy Head of the National Police of Ukraine and Chief of the Criminal Police.
We also discussed the recent high-profile murder of Demian Hanul in Odesa, the possible "Russian trace," and the issue of unrestricted possession of firearms, as this discussion has once again intensified in society following the activist’s death.
"IN NONE OF THE CASES DID WE IDENTIFY PRO-RUSSIAN OR UKRAINOPHOBIC SENTIMENTS AMONG THE PERPETRATORS OF THESE CRIMES."
– Last year, the Russians actively used teenagers to carry out arson attacks on relay cabinets and vehicles belonging to the military and volunteers. Now we are talking about crimes involving the use of explosives. This issue is currently being discussed in society, as we all understand the consequences we may face if such terrorist attacks are not prevented. The other day, a journalist posted on social media, addressing not only parents but also children, urging them to report if they receive such offers. Are such reports being submitted to the police?
– Shortly before your arrival, a teacher from a school in the Lviv region called. According to her, some student group chats had been discovered that included messages about manufacturing explosives.
Police officers have already been dispatched and will be investigating the matter.
– So, schools have started responding to this negative trend? Are you conducting any preventive measures, or is it just that some teachers are particularly active and concerned?
– Juvenile police officers have carried out a number of measures in schools, spoke with teachers, and, where possible, with parents as well.
The enemy is insidious and finds levers of influence over our children. And it is operating across various regions — not only in the eastern regions near the frontline, but also in the western ones. For example, in Ivano-Frankivsk, two teenagers were manufacturing explosives to plant at the railway station. In Ternopil, a 14-year-old girl was making explosives and placing them under a police vehicle.
– What motivates children and adults to commit crimes? And when did all of this start?
– The active phase began in April 2024, when the number of arson attacks targeting relay cabinets and vehicles belonging to the military and volunteers increased. In none of the cases did we identify any pro-Russian or Ukrainophobic sentiments among the perpetrators of these crimes. They usually commit these acts in exchange for a promised monetary reward. There are also cases of recruitment through compromising material. For example, personal information is collected and used to threaten exposure. This was the case with the girl in Ternopil.
In cases involving men, they are initially tasked with photographing certain facilities, and then manipulated with threats that the photos containing their personal data of these men could allegedly be forwarded to the Security Service of Ukraine or the National Police to bring them to justice. After that, they are pressured into carrying out more serious actions related to sabotage or terrorist attacks.
– In cases where personal information is collected, do they search for people on social media?
– Yes, on social media, across various groups. At first, we found information about possible recruitment in Telegram channels that offer drugs and are frequented by drug-dependent individuals. They were searching through them. But when we began to unravel certain cases and identify where the original post had appeared, they told us it was on a local forum where people look for jobs. We continued the investigation and established that the same advertisement had been posted in a Telegram channel used by the Russian Federation’s intelligence services to recruit our citizens. That is, they have already reached a point where they are able to post recruitment offers even on Ukrainian websites.
– They don’t write directly: "We invite you to engage in subversive activities." Do they somehow disguise it?
– Of course. They post ads offering money for completing simple tasks. They specify that no experience is required in order to attract large numbers of people. Individuals follow the provided link, and then communication begins.
Many people do not fall for these recruitment attempts and report them to law enforcement agencies. Some children, in families where proper upbringing and trust-based relationships exist, inform their parents about it. And some, unfortunately, accept the offers made to them.
Moreover, we have repeatedly detained groups of individuals who committed not just one, but several arson attacks on vehicles. Naturally, after the first arson, the National Police initiates an investigation, we follow the trail of the offenders, and they are apprehended.
The complexity of the tasks assigned to individuals increases gradually. For example, arson of a vehicle. Those who are tasked with locating military vehicles do not set them on fire. They do nothing beyond that. The assignment is roughly phrased as: "Please send us photos of military vehicles parked in courtyards in the evening that you see." The individual takes the photos and sends them. Next, another person is recruited and given the task of purchasing a chemical mixture or gasoline, placing it at a specific location, and sending the geolocation. The next perpetrators then receive the coordinates, along with information about the vehicle, and the task — to set it on fire. However, the recruiters do not state that this is an act against the Armed Forces and that it is subject to criminal liability. They may present it under the guise of personal revenge or claim that the vehicle belongs to an alleged wrongdoer. No one tells a 15-year-old boy, "You are going to work for Russia, you will be our agent." No — they use other methods. They find out what the teenager is interested in, what he cares about, what he is emotionally affected by — and then they start to "manipulate" that. For instance, his father was mobilized. And online, the teenager has read that everyone working at TCRs is a villain — a narrative actively spread by the Russian side through social media. Using that as a basis, the handler tells him that a TСR vehicle should be set on fire. In other words, they try to convince the boy that he will not only earn money, but also allegedly commit a "good deed."
As soon as individuals carry out the tasks they are given, the handler obtains compromising material on each of them. Therefore, the next assignment may already involve the complete package: locating a vehicle, purchasing gasoline, and setting it on fire.
If someone refuses, they are threatened that the information will be passed on to law enforcement.
If we fail to detect such agent networks in a timely manner, I am certain that the assignments will become increasingly complex. It started with relay cabinets and vehicles, postal and bank offices, and village councils. Next, it could be bridges or other infrastructure targets. That is why rapid detection and disruption of these crimes at the early stages are critically important.
Unfortunately, the process of identifying recruiters is quite difficult, as Telegram Messenger does not cooperate with Ukrainian law enforcement agencies the way other platforms do.
Anonymity in these Telegram channels is largely maintained, and no user information is disclosed, which makes them highly convenient for committing various crimes — fraud, arms trafficking, drug distribution, and child pornography.
Investigations have shown that the organizers operate from the territory of the Russian Federation or temporarily occupied regions of Ukraine. To communicate, they use IP addresses provided by internet service providers in the aggressor state.
– You mentioned that last year arson attacks on military vehicles and relay cabinets intensified. What is the reason behind this? Could it be that Russia has a phased plan for a special operation that began with these arsons and will be followed by other crimes?
– This war has shown how an army can adapt — both ours and the enemy’s. Do you remember how in 2022 they advanced in columns of equipment? But when they realized that our Armed Forces were destroying them with artillery, they began to change their tactics. And now, drones are everywhere.
The same applies to the sabotage and terrorist activities of their intelligence services. They are constantly developing new methods, using them to counter our military, destabilize the situation inside the country, and create the illusion of a complicated situation. Because everyone understands: if the rear is weak, we cannot maintain a strong front.
That is why they began operating gradually. While in 2023 there were isolated incidents of sabotage, such as the arson of relay cabinets on the railway, in 2024, they have clearly planned an entire program. And now we are witnessing a shift toward terrorist acts involving explosives manufactured in domestic settings. At the same time, they not only provide instructions and supervision but sometimes eliminate those they have recruited. For example, this happened in Khmelnytskyi: a man who, following the handler’s instructions, was delivering a package to a military enlistment office was killed after they saw on video that he had not been allowed to enter the premises of the Territorial Recruitment Center. They detonated him at the checkpoint. In other words, they stop at nothing. The Russians are simply using our citizens to generate instability through sabotage and terrorist activity on the territory of Ukraine. On Sunday in the Odesa region, a woman brought a package containing an explosive device into the lobby of a police department. The explosion occurred at around 6 p.m. Three police officers sustained shrapnel wounds. The woman was killed.
– How many cases involving the use of explosives have there been?
– Since the beginning of 2025, officers of the National Police of Ukraine, in cooperation with the SSU (Security Service of Ukraine), have documented 26 criminal offenses classified under Article 258 of the Criminal Code of Ukraine (terrorist act – ed.). The involvement of 10 teenagers in 6 terrorist acts has been established. Twelve terrorist attacks across the country were prevented, meaning the crimes were not brought to completion. For example, in Chernivtsi, two local youths aged 17 and 18 manufactured a bomb on the orders of Russian intelligence services. The accomplices were involved in drug trafficking: they had set up their own drug laboratory for the production of amphetamine, which they distributed across Ukraine via a Telegram channel. That is how they came to the attention of the criminal police. While documenting the drug trafficking group, investigators discovered that both individuals had been recruited by handlers from the Russian Federation and were preparing an explosion.
The intended victims were police officers who were to be lured into a trap by a false emergency call reporting "a woman screaming for help," as well as civilians who happened to be nearby.
Irreparable consequences were prevented thanks to the professional actions of the Chernivtsi police in cooperation with the SSU.
Another terrorist attack was timely prevented in the Ternopil region. This is the case I mentioned earlier, when a girl attempted to blow up a law enforcement vehicle. During investigative and operational measures, it was established that approximately six months ago, she met a man on the Telegram messenger who offered her a way to earn money by sending him photographs of buildings in the city where she lived. She refused and stopped communicating with him.
Later, he sent her files containing her personal sensitive information and said that if she did not follow his instructions, he would disseminate that information. She has now been served with a notice of suspicion under Part 3 of Article 15 and Part 1 of Article 258 of the Criminal Code of Ukraine (attempted terrorist act).
– Are teenagers aware that they could become "suicide bombers"? That they could blow themselves up, as in the case in Ivano-Frankivsk, or be blown up, like the man in the Khmelnytskyi you mentioned?
– No, we have not had such cases. The boy in Ivano-Frankivsk, who survived — his legs were blown off — managed to report where the other explosives were and who had proposed to do that. This allowed us to understand that they were not intending to die. What happened demonstrates just how insidious the enemy is. For the Russians, using children to carry out sabotage and terrorist acts is a normal practice. So is murder. In fact, these children were supposed to plant explosives near the railway station. Just imagine the consequences of that terrorist attack — how many people could have been killed or injured.
I always emphasize that during this war, we must be twice as attentive to our children, especially when such cases occur and the enemy attempts to exploit them. We need to know how they are doing, who they are communicating with, what kinds of offers they are receiving, especially online. We must talk to children about such incidents and such risks.
– What is the impact of publicity?
– When the arson attacks on military vehicles began in April 2024, we discussed whether it was necessary to provide more information to the public about these incidents, or not to trigger an emotional wave of similar crimes. Ultimately, we decided to provide information, to carry out preventive work, involve journalists and teachers, and inform the public. And we started doing so.
There was a peak in such arson attacks up until June. After that, the preventive efforts began to yield results. First, we started receiving information from parents, teachers, and children. Second, the number of arson attacks gradually decreased.
I believe that preventive and awareness-raising efforts produce significant results.
– On the one hand, you say that the number of arson attacks has decreased. On the other hand, we are seeing that the crimes have become more serious. That is, children have read that arsonists are being detained and face years of imprisonment, and yet they still go through with it. Have you analyzed why?
– We have. They did not read about it and did not know what options were available to them in the situations they found themselves in. That is why we must talk not only about liability, but also about the steps children should take.
– What are those steps?
– First of all, tell an adult you trust what is happening. It doesn’t necessarily have to be your parents. Even a neighbor. I’ll repeat: the person must be someone you trust. Or you can call the police yourself.
We are now trying to communicate this information to them. And we hope that it will yield results.
"HANDLERS GIVE THE ORDER TO SET UP A PHONE TO RECORD TERRORIST ACTS"
– Are children mostly told where to buy the components for making an explosive device, or are they given ready-made explosives?
– There are cases where a person is instructed to assemble and hide an explosive device, while someone else is responsible for planting it. In cases involving minors, we see that they are also tasked with manufacturing the device. They are given a list of chemicals they must purchase and then instructed to mix them according to specific guidelines. In some cases, the handler connects via video and supervises the entire process.
– Are the same people always the ones who plant and detonate the explosives?
– No. Very often, they separate these roles. By taking into account the moral and psychological state of the recruited individual and their willingness to plant explosives. Some cannot overcome the moral barrier to plant explosives, knowing that they will detonate and kill or injure many people. So they separate these roles, which also creates complications for us, as more security measures are used.
They also create an illusion that the individual believes and then evinces: "I didn’t make the explosives, I just carried the suitcase and placed it. I am not responsible for this." Or: "I made it, but I didn’t know what it was for."
– Are the explosives detonated remotely?
– Yes, by making a call to a mobile phone. The electric detonator is triggered, and an explosion occurs. The handlers also give the order to install a phone to record the terrorist act, so that the footage can later be used on Russian propaganda channels claiming it was allegedly found somewhere.
– Do they always try to eliminate the actual doers, or do they leave someone alive so that the person can carry out new subversive acts?
– For them, people are expendable. If the person survives — that’s convenient, as they have person to carry out another terrorist act or act of sabotage, and there is compromising material on them. If something goes off-script, as it did in Khmelnytskyi, the person is eliminated. That’s why we say that if the situation becomes complicated, they observe it and then detonate the explosive device along with the person.
– How do they observe it?
– In 99% of cases, a mobile phone is pre-installed at a distance and streams what is happening on site in real time. Naturally, the phone is camouflaged.
– So they also involve people to set up the devices?
– Sometimes this is done by those who directly carry out the subversive operations or commit the terrorist act, and sometimes it is assigned to other individuals. For example, one person is tasked with installing a phone, another with delivering a bag containing explosives. After that, the terrorist act is carried out. In some cases, the individuals are not acquainted with one another, but there are also instances where a group of young people operates together. For example, in Odesa, food delivery couriers were moving around the city while searching for military vehicles. Later, those vehicles were set on fire. All of them are currently in custody.
– Are tasks mainly assigned to locals, or can actual doers be sent to other regions?
– In the case of minors, actual doers usually reside and carry out assignments in the localities where they live. Adults are used as "birds of passage" — they travel from one region to another.
– You mentioned that it is difficult to identify those who recruit and supervise. Is it generally possible?
– Of course. The National Police, the Security Service of Ukraine, and the Foreign Intelligence Service are working on this. But it is a complex process. We hope that our international partners will provide technological support in this area. Because today it is happening here, in Ukraine, and tomorrow it could happen on the territory of any other country. That is why this type of terrorist activity must be taken very seriously.
– According to open sources, women are also among the perpetrators of such crimes. How do enemy intelligence services work with them?
– The recruitment approach does not differ based on gender. The only difference is that if a person refuses the offer, the handlers may resort to blackmail.
In 2024, 316 individuals were detained under Articles 114, 113, and 194 of the Criminal Code of Ukraine, including: 205 men, 98 minors, and 13 women.
Since the beginning of 2025, 76 individuals have been detained as a result of the measures taken, including: 50 men, 16 minors, and 10 women.
The individuals detained for committing arson confessed to the crimes.
– If we assume that the Russians, when recruiting our people, operate on a quest-like principle, where tasks become progressively more complex, could contract killings become the next level? Is the situation being analysed with any forecasting?
– Of course. I believe the enemy will attempt to use our citizens to carry out any type of actions, including the murder of Ukrainian citizens. The FSB of the Russian Federation aims for this because the more horrific a crime they can organize on our territory, the better it is for them — human life has no value to them.
– Regarding the high-profile murder of Demian Hanul, which recently took place in Odesa. You stated that three versions are being worked through and noted that the investigation does not rule out the possibility of Russian involvement, since the activist had an active pro-Ukrainian position. Has one version been identified as the primary one, or are all three still under consideration?
– It would be inappropriate to select a single version before the full range of operational and investigative measures is completed — only then, based on the results of analysis, which allows us to say that a version does not hold up. Therefore, the version currently prioritized is that the murder was ordered by the special services of the Russian Federation through recruitment. The second version is a contract killing related to his public activity and active pro-Ukrainian stance. The third is personal animosity. But we can already say: what kind of animosity, if they didn’t even know each other?
We have an operational and investigative plan for each version. On the first two, we are working jointly with the Security Service of Ukraine and other agencies that are important to us at this stage of the investigation. As for the third version, I believe we will finalize it in the near future.
– Why did this man go to Odesa if he was listed as AWOL?
– He was serving in the Odesa region. In February, he went on leave, but on the 23rd he did not return to his military unit. On 1 March, he was declared wanted after we received information that he was listed as a serviceman who had left the unit without authorization.
According to our information, he failed to return from leave on time because he did not have enough time to organize and carry out the killing.
– So it wasn’t a spontaneous murder?
– Based on the manner of execution, the preparation involved, and analysis of the initial operational and investigative materials, we can see that this was not a spontaneous act — there was serious preparation.
– Have you been able to determine where he got the weapon?
– We have initial information, which we are currently verifying. During the search, as the Head of the National Police stated publicly, weapons were seized. It was a pistol and two grenades. They are currently undergoing forensic examination to determine whether this was the firearm used in the shooting, and whether the grenades are live.
– Suspilne journalists who were present in court during the remand hearing of the detainee reported that they had spoken with friends of the deceased. One of them, who wished to remain anonymous, told Suspilne that in November 2024, the SSU had warned Hanul that the Russians were preparing an assassination attempt against him. This happened shortly after the Security Service announced the detention in Odesa of a man who had been looking for a hitman to kill a local businessman on behalf of the Russian Federation. Another friend stated that Hanul first suspected he was being followed on 8 March. Are you aware of this surveillance?
– When I was in Odesa, we spoke with the head of the regional directorate of the Security Service of Ukraine and the head of the Odesa Regional Police. We discussed that last year, there was a situation in which he was under threat and had, in fact, been put on a hit list. A criminal proceeding was registered, and all necessary operational and investigative measures were taken. The assassination attempt was prevented. The individuals involved are being brought to justice.
If anyone had information about surveillance, it should have been reported. I say this to every citizen: we are living in a time of war. If you see anything suspicious (a vehicle, individuals, or an object), be sure to report it to law enforcement. We are committed to verifying such reports, because it is far better to check than to face serious consequences later.
– When this murder occurred, a public discussion began about the right to the free possession of firearms. What is your position on this?
– This is indeed a controversial issue. There are people who seek to obtain short-barreled firearms, and there are also those who covertly lobby for the interests of those who sell such weapons.
At present, many experts, criminologists, forensic specialists, and legislators are studying the issue of whether short-barreled firearms can be legalised in Ukraine. And this is the right approach — we must make such decisions in a balanced manner.
Some people believe that having a pistol will make them feel more secure. I want to point out that there have been cases where armed individuals, who were highly skilled in the use of short-barreled firearms — military personnel, law enforcement officers, bodyguards, security guards — were killed. They were ambushed in planned attacks, just as it happened in Odesa.
One case from practice: last year, a serviceman was killed. He was shot in the back. He had a pistol on him, he knew how to use it — but it did not help him in any way.
The same goes for the case of Hanul. He got out of the car, shots were fired at him, and a bullet struck him in the back. He fell. Could a pistol have helped him? I don't think so.
Unfortunately, a pistol does not help in the event of a sudden and premeditated attack. I want to emphasise once again: this is not my personal position "for" or "against" — I trust the experts, who must study this issue comprehensively and provide their assessment. In general, I am not a supporter of drastic decisions, but of gradual ones. There are draft laws on firearms currently under consideration in the Verkhovna Rada, and whatever the legislators decide will be the final outcome.
By the way, I recently returned from the United States. I was there attending a police forum that is held once a year. And do you know what the main issue was? American police officers were discussing the challenges of detaining offenders and the 15 principles that a police officer should follow to ensure safety without causing unnecessary harm to a person during detention.
– It would be interesting to analyse their statistics on crimes involving firearms, or those of other countries with unrestricted circulation.
– Let’s draw an analogy. Take a car: in order to drive one, a person must be responsible, know the rules of the road, pass a test, and obtain a license. A car is considered a source of increased danger. A short-barreled pistol, due to its characteristics, can also be classified as a source of increased danger. Now, imagine a city with one hundred cars driven by conscious and trained drivers. Still, let’s assume that for every hundred vehicles, there are ten various traffic violations: speeding, improper manoeuvring, running red lights, driving under the influence, etc. As a result, traffic accidents occur, including those involving injuries and fatalities. If the number of such vehicles in city X increases from one hundred to one thousand, operated by equally trained drivers, then instead of ten incidents, there will be one hundred, with a proportional increase in the number of casualties. These are objective figures. In my opinion, owning a pistol does not equate to guaranteed safety. There are statistics from the United States, where firearms have been in legal circulation for many decades. Even a migrant can purchase and register a short-barreled firearm. In New York City (with a population of over 8 million), 382 murders occurred in 2024; in Chicago (2.6 million), 573 murders. For comparison, in 2024, Ukraine recorded significantly fewer criminal homicides (not related to hostilities) — 1,052, of which 183 involved the use of firearms.
I am not stating a position "for" or "against" the circulation of such weapons — I am stating facts. But I repeat: an increase in the number of firearms in legal circulation will inevitably lead to an increase in incidents involving these weapons, including injuries and deaths, both intentional and accidental.
Tetiana Bodnia, Censor.NET
