Latvia's State Security Service (VDD) opened a criminal case on 9 September over threats of terrorism against Latvian companies that supply weapons to Ukraine, after a pro-Kremlin group issued the same demand to Latvia, Poland, and Portugal.

The threat comes amid a series of fires and explosions at European sites connected to Ukraine's war effort, at least four at ammunition facilities alone since 10 August. No common cause has been established, and authorities have not publicly linked any of them to Global Citizens Against War 1984.

VDD detained one person in Riga on 10 September, searched their home and vehicle, and seized data storage devices and other items, the service said on 17 September. The suspect has been remanded in custody, and the case runs under part two of article 79.6 of Latvia's criminal law.

The ultimatum and the group behind it

The group, calling itself Global Citizens Against War 1984, published its ultimatum on 8 September, demanding that Latvia, Poland, and Portugal stop supplying weapons and ammunition to Ukraine.

The seven companies are Latvia's Eraser, a military drone maker, and Unitrack, which develops all-terrain vehicle prototypes; Poland's PGZ, WB Electronics, JFG Composites, and Nitro-Chem; and Portugal's Tekever, according to inbox.lv. VDD did not name the companies in its statement.

The group said the companies would face operational shutdown "by any means necessary" if the demands were not met by 7 October. It also circulated photographs of graffiti bearing its abbreviation, which it says was sprayed in Riga, Warsaw, and Lisbon.

The group previously claimed responsibility for planning an arson attack on the Slovak plant of Skyeton, a Ukrainian drone maker. Slovak police announced the detention of three foreign suspects on 25 August. Authorities have not said whether the suspects are connected to the group.

An investigation by The Insider found evidence suggesting Russian origins for the group: Russian-language folder labels on its English-language Instagram account, an Orwell quotation on its website back-translated from a common Russian rendering rather than taken from the original, and a proprietary Yandex font left in the page code. The outlet did not establish which Russian organization, if any, operates the group.

European security services have also reported suspected sabotage targeting defense companies and infrastructure, including a fire at an Estonian military robotics company, fires at a Bulgarian ammunition facility, and an explosion at an ammunition plant in Italy. Authorities have not publicly linked those incidents to Global Citizens Against War 1984.