The guerrilla war on Belarus’s railways

For months, Belarusian activists have been damaging railroads to hinder Russia’s army. Now they could face the death penalty.

In May 2022, Belarusian President Alexander Lukashenko signed a law making any attempt to commit a terrorist attack punishable by death — and terrorism is exactly the charge being brought against a number of Belarusians who stand accused of damaging the country’s railroads. Belarus's "railroad war" began before Russia’s full-scale invasion of Ukraine, when the Russian and Belarusian armies began conducting joint exercises; since then, there have been dozens of attacks. At Meduza’s request, Belarusian journalist Anya Perova reports on Belarus’s railroad guerrilla fighters.

“In early spring, law enforcement came to me with a search warrant. At first, I didn’t even understand what it was for, but the officers explained that I was considered a witness in a case under Article 309. That turned out to be the law against “intentionally damaging a vehicle or a means of communication,” said Natalia (name changed at her request), a Belarusian citizen who lives in a city with a major railroad junction.

After an interrogation, which focused on recent railway sabotage attempts, the authorities confiscated Natalia’s electronics. They then brought her to the police station for several hours before releasing her. To this day, she doesn’t know why the police chose her specifically. “Maybe I was near one of the incidents when it happened and they determined my location from my cell phone,” she suggested.

Two other people also told Meduza about being questioned as witnesses in railroad sabotage cases because officials “found them near the scene of the crime” using geolocation methods. Both of them claimed to have no connection to opposition organizations or to the incidents.

Back in early March, after the initial wave of high-profile attacks, the Belarusian Investigative Committee announced it was investigating “acts of terrorism on the railroad,” claiming the perpetrators’ goal was to cause “disaster and human death.”

Soon after, security agents began conducting raids in cities where the incidents had occurred. According to the human rights organization Vyasna, those cities included Dzyarzhynsk, Baranavichy, and Stowbtsy — the main railway hubs between Moscow and Brest.

“They break into your home, conduct a search, and brutally arrest you. They beat you during the arrest, on the way to the police department, and inside the station,” a Stowbtsy resident told Radio Svoboda’s Belarusian service.

By mid-June, according to Vyasna, at least 11 people had been charged with committing “acts of terrorism” related to the railroad incidents. All of them were arrested and are currently being held in various prisons. Human rights advocates have called them political prisoners.

All 11 prisoners are being charged under Article 289 of the Belarusian Criminal Code: “Terrorist acts.” The maximum sentence for the crime is capital punishment. On May 18, 2022, Alexander Lukashenko signed a set of amendments to the Criminal Code, making “attempted terrorist attacks” (as opposed to just successful ones) punishable by death as well.

‘Belarusians don’t want the Russian army on their territory’

The first attack on a Belarusian railroad happened a month before Russia launched its full-scale war in Ukraine — on January 24, when Russian forces started traveling to Belarus for the “Allied Resolve” joint military initiative. According to the Telegram channel Belarusian Railroad Workers’ Community, 200 convoys of about 50 military vehicles each were sent to Belarus from Russia by rail. As the channel noted, this was unprecedented: during the Zapad 2021 exercises in September 2021, over the course of a month, only 29 convoys were sent.

The January 24 attack was reported by the anonymous collective Cyber Partisans, which claimed responsibility for it: according to members of the group, they disrupted the railway’s automated train schedule development system as well as its document management system.

That same day, Belarus's state-owned rail company, Belarusian Railway, announced that its online ticketing system was unavailable “for technical reasons.” The system stayed down for two weeks, during which cashiers had to write out all tickets by hand.

“It was a way to show that Belarusians don’t approve of the Russian army’s presence on our territory,” Cyber Partisans representative Yuliana Shemetovets told Meduza. But according to her, disrupting the ticket sales system wasn’t the hackers’ goal. “We’re trying to do as little damage as possible to infrastructure that affects regular people,” she said. According to Shemetovets, Cyber Partisans usually don’t agree to carry out attacks when “it’s not clear what the consequences will be.”

On the fifth day of the war, the first real world attacks began. In the Railroad Workers Telegram channel, reports appeared that a signaling control cabinet had burnt down near the Stowbtsy train station in the Minsk region. As a result, the traffic lights and track switches at that railway section had stopped working. The same day, the channel reported that a control cabinet had been burnt down in the Gomel region on the Ostankovichi-Zherd line. Belarusian Railway has not commented on the incidents.

On March 2, the Cyber Partisans announced an attack on Belarusian Railway’s transportation control center. According to a post on the Belarusian Railroad Workers Telegram channel, that same day, the company’s timetable stopped functioning, along with several other of its systems.

Altogether, over 80 incidents of sabotage against Belarus’s railroads were reported by the start of April, according to the Belarusian Interior Ministry. Since then, neither the Belarusian opposition nor its government agencies have reported any incidents.

Help from the railroad workers

Two years ago, Sergey Voitekhovich was working at a train depot in Minsk. After the 2020 presidential elections, he created the Belarusian Railroad Workers’ Community Telegram chat as a way to organize his fellow workers and advocate for their common interests. Other railroad workers began adding their colleagues, and the group gradually grew to about 6,000 members. Later, a Telegram channel of the same name appeared with the goal of sharing industry news. Its administrators openly shared official company documents in what was effectively a public space.

In 2021, Igor Kozlovsky became the deputy head of Belarusian Railway. According to the company’s official site, Kozlovsky “ensures the safe functioning of Belarusian Railway enterprises,” though no information about his professional history is provided. As Cyber Partisans revealed when they hacked into the Minsk City Executive Committee's internal management system, Kozlovsky worked for the KGB from 1995 to 2020.

In early September 2021, the authorities declared the Belarusian Railroad Workers’ Community an extremist group. According to Sergey Voitekhovich, the designation was a result of Belarusian Railway’s new KGB-linked leadership. The Belarusian Railroad Workers’ Community Telegram channel posted documents sent to a court and to the Belarusian Attorney General that were signed by Kozlovsky and another one of the company’s leaders, Pyotr Stotsky (Meduza was unable to confirm the documents’ authenticity). In April 2022, the channel posted lists of Belarusian Railroad employees who had participated in the transport of Russian military equipment.

In May 2021, Voitekhovsky left the country due to pressure from the KGB. In the spring of 2022, the KGB declared the Belarusian Railroad Workers’ Community chat group an “extremist organization” and banned its activities in the country.

“Both the railroad’s leadership and the KGB [always] fought hard against us. They went as far as to check our phones during work hours to see whether we subscribed [to the Telegram channel],” said Voitekhovich. On March 30, pro-government Telegram channels posted 38 “confession” videos of detained Belarusian Railway employees. In the videos, the workers explained when they installed Telegram and subscribed to the “extremist” channel, and then claimed to have unsubscribed after seeing “calls for destructive action.”

As a result, Voitekhovich claimed, citing personal sources, the majority of the detained employees were released. Some were named suspects; others became targets of new administrative cases after the authorities found they were subscribed to other Telegram channels that had been declared extremist. “Security officials periodically posted special links that would de-anonymize devices in the chat — that’s how they found these people,” Voitekhovich said.

“You don’t need to have special knowledge to burn a signaling control cabinet — the railroad workers provide all the necessary information to the guerrillas. That’s the main way they help,” Voitekhovich said. According to him, members of the Railroad Workers’ Community group work with several opposition organizations — Cyber Partisans, By_Pol, and the Peramoha (“Victory”) Plan. They all receive information about train traffic from the workers.

In 2021, Cyber Partisans became part of the Supratsiy (“Resistance”) movement, which is recognized as a terrorist organization by the Belarusian authorities. Cyber Partisans has taken credit for hacking a database of Interior Ministry officials during the 2020 protests, for hacking and conducting DDoS attacks on government websites from 2020 to 2022, and now for conducting attacks on Belarusian rail infrastructure. Shemetovets told Meduza:

Because it’s illegal to openly resist the regime, Cyber Partisans representative Yuliana Shemetovets told Meduza, the type of guerrilla attacks conducted by Cyber Partisans is the only way for people to fight back.

‘You can always spot the security agents’

The Peramoha plan’s creation was announced exactly a year after the 2020 presidential elections. According to the plan’s representatives, there are currently about 200,000 people involved in the plan. Becoming a participant requires sending an application to a chat bot and then undergoing a verification process, which is the organizers’ way of protecting themselves from being infiltrated by security agents. While they haven’t publicly shared what the verification process entails, Belarusian Railroad Workers head Sergey Voitekhovich told Meduza:

You can always spot [security agents] immediately from the way they communicate. Not long ago, one of those "activists" applied [to the Peramoha Plan]. He received instructions for what to do, but at that stage, it became clear that there was something wrong: he kept insisting that he be given a partner to work with. They ultimately caught him because the security forces miscalculated and showed an “incriminating video” on television earlier than they intended to.

According to a Peramoha representative, in early March, Russian trains didn’t pass through Belarus for over a week. “Evidently, they were afraid of more radical attacks,” he said. The same source told Meduza that the constitutional amendments allowing “terrorists” to face the death penalty have not scared Peramoha Plan participants.

“The groups that were prepared to act under the current conditions remain [willing]. Perhaps the part of society that was afraid to register in the chat bot has become even more afraid — [registration] has indeed slowed recently, but that could also be due to the fact that we stopped doing active outreach.”

“There’s effectively no rule of law in Belarus. If [the authorities] request the death penalty, it'll be carried out no matter what,” said Yuliana Shemetovets.

Story by Anya Perova

Abridged translation by Sam Breazeale