Ransom

The art auction at Wickham House draws a massive crowd. Knight, flanked by SIS officers posing as bodyguards, plays the part of a grieving husband, telling guests he still hopes to find his wife, Alice. Gabriel, Chiara, Sarah, and Ingrid monitor the attendees, searching for a potential assassin. A latecomer, a gray-haired man using an ebony cane who identifies himself as Walter Klein, draws their suspicion.

During the auction, Klein makes several bids but never follows through, confirming to Gabriel that he is not a legitimate buyer. After the Bellotto sells for a high price, Klein approaches Knight, his limp gone and the cane now held in his right hand. Gabriel and the team grow suspicious that the cane may be a weapon. Christopher, also sensing the danger, has his SIS team immediately escort Knight from the room, foiling the attempt. The assassin exchanges a look with Christopher before resuming his limp and departing.

SIS tracks the assassin, whose Spanish passport identifies him as Felix Serrano, as he leaves the auction. After a tracking device is fitted to his car, agents tail him to a ferry at Holyhead bound for Dublin. Onboard, he walks without his cane. An investigation into his passport reveals it was issued by Spain to a Venezuelan citizen.

Through facial recognition analysis of old GRU academy photos, SIS’s Russia House determines his true identity: Captain Yuri Ivanov, a high-ranking illegal operative in GRU Unit 29155. Ivanov flies from Dublin to Lisbon, where the SIS follows him to an apartment in the Alfama district. For a week, he lives as a tourist, his wanderings serving as countersurveillance maneuvers. 

Gabriel, Christopher, and Ingrid observe him from a nearby apartment but are forbidden from breaking into his flat. Eventually, they witness Ivanov retrieve a note left for him at a café by a female courier. The courier is tracked to Belgrade, where she meets with a known GRU officer, confirming her role in the network. The operation uncovers new, alarming intelligence, prompting Seymour to travel to Portugal for an urgent meeting.

In Portugal, Seymour briefs Gabriel and Christopher. He reveals that recent drone incursions over European airports, including in Helsinki and Amsterdam, were Russian intelligence operations to probe air defenses. Dutch intelligence (AIVD) has hacked into GRU headquarters in Moscow and discovered a room with 10 drone operator stations. Crucially, they have CCTV footage confirming Yuri Ivanov was present in both cities during the attacks.

Seymour explains that SIS has also identified another GRU agent in London, a Canadian PhD student named Chloé Lamont, who met with Ivanov and is now under MI5 surveillance. Seymour must return to London for a critical summit at 10 Downing Street, where the leaders of Britain, France, Germany, and Denmark will meet with the Ukrainian president to announce a new aid package. As the meeting concludes, they receive word that Ivanov is on the move again.

After learning that Ivanov is flying to Copenhagen, Seymour authorizes Gabriel to warn Lars Mortensen, the head of Denmark’s security and intelligence service (PET). Gabriel, Christopher, and Ingrid immediately fly to Copenhagen, where they are taken to the Christiansborg Palace to meet with Mortensen and the Danish Prime Minister, Kalla Eriksen.

Eriksen, whose country has been a target of Russian drone incursions due to its strong support for Ukraine, wants to arrest Ivanov immediately. Gabriel argues against this, proposing they place air defenses on heightened alert and surveil Ivanov, then arrest him once the drones come, providing undeniable proof of Russian involvement. After a tense debate with Mortensen, Eriksen reluctantly agrees to a 48-hour surveillance window.

The PET begins surveillance on Yuri Ivanov, bugging his hotel room and tracking his movements. Ivanov reconnoiters the perimeter of Copenhagen Airport, increasing the Danish government’s fears of an imminent drone attack. That night, Gabriel discovers from a New York Times article that the details of the upcoming Downing Street summit have been leaked, likely by the White House, removing the element of surprise.

The next day, Ivanov makes a brush contact with a female operative in a cemetery; SIS follows her to the Russian Embassy. While Gabriel and Ingrid are walking on the nearby Strøget, PET calls Gabriel to warn them that Ivanov is heading toward them. Moments later, they see a commotion nearby and discover Ivanov collapsed on the ground. A woman is attempting CPR, but Gabriel pulls her away to prevent mouth-to-mouth resuscitation.

A hazmat team seals off the street after Yuri Ivanov dies from what Gabriel correctly identified as a nerve agent, likely Novichok. The PET officer who attempted to help him is in critical condition at the hospital. At PET headquarters, Lars Mortensen shows Gabriel and his team CCTV footage revealing the assassination method: A miniature “mosquito drone” flew up to Ivanov and sprayed the poison in his face.

They deduce that Ivanov was lured into a trap by the GRU, who likely killed him to prevent his capture by the Danes, but because he was killed by a drone, his phone was left behind. Prime Minister Eriksen decides to address the nation and expose the attack. Though warned that naming Ivanov could tip off other GRU illegals like Chloé Lamont, she resolves to proceed. She then invites Gabriel, Christopher, and Ingrid to fly to London with her for the summit.

Eriksen delivers a televised speech, accusing Russia’s GRU Unit 29155 of carrying out the assassination in Copenhagen with a nerve agent. The Kremlin responds with a swift and mocking denial. On the flight to London the next morning, Lars Mortensen gives Christopher a hard drive containing the full contents of Yuri Ivanov’s phone.

In London, Christopher heads to the Downing Street summit, while Gabriel and Ingrid join Sarah at her home. As they watch the news coverage of the summit, Ingrid briefs Sarah on the events in Copenhagen. Sarah theorizes that the GRU did not kill Ivanov because he was a traitor, but as a feint. She suggests they knew he was under surveillance and sacrificed him to distract Western intelligence from a much larger operation targeting the five world leaders gathered at Downing Street.

The narrative follows Zoya Danilova, a GRU illegal posing as Chloé Lamont, a Canadian PhD student in London. She realizes she is under surveillance by MI5 after spotting the same watchers over several days. She reports this to her handlers in Moscow, who order her to complete her mission before escaping to a safe house near Inverness owned by the GRU front company Landmark Ventures.

After seeing the news of Yuri Ivanov’s assassination in Copenhagen, she briefly considers defecting but decides it is too risky. On the morning of the Downing Street summit, she goes to the crowded Trafalgar Square, where she changes her appearance, discards her belongings, and successfully loses her MI5 tail. Meanwhile, MI5 Director-General Amanda Wallace is infuriated to learn from her deputy, Miles Kent, that they have lost track of a high-priority Russian operative on such a critical day.

Political journalist Samantha Cooke, covering the summit at 10 Downing Street, spots MI5 Director-General Amanda Wallace arriving, which she finds highly unusual for such an event. Inside, Wallace confronts SIS Seymour and Christopher Keller, informing them that MI5 has lost Chloé Lamont. The meeting exposes deep inter-service tension, as Wallace is furious that SIS ran the initial operation that identified Lamont without MI5’s knowledge. Seymour reveals details selectively, including Gabriel Allon’s role in bringing them Alice Winter. Wallace absolves her service of any blame for potential consequences and warns Christopher to keep Gabriel out of London.

In the Netherlands, Anton de Graaf, director-general of the Dutch intelligence service (AIVD), monitors activity inside GRU headquarters through a secret digital breach. He is alerted that the commander of GRU Unit 29155 has entered the drone control room, where 10 operators are at their stations, signaling a major operation is underway. De Graaf immediately calls Graham Seymour at Downing Street with a warning.

Meanwhile, Gabriel discovers a diagram in the data taken from Ivanov’s phone showing 10 lines radiating from a central point. The image was emailed to him six months earlier from an anonymous Proton Mail address with the subject “HELLO” and the message “Thought you might find this interesting…” (345). As Gabriel shows it to Ingrid and Sarah, Christopher calls to report that MI5 has lost Chloé Lamont and begins to relay the Dutch warning about the drones just before the call is cut off.

Seymour informs Prime Minister Jonathan Lancaster that GRU drone operators in Moscow appear poised to launch an attack and advises him to evacuate the summit to an underground bunker. Lancaster flatly refuses, unwilling to be seen fleeing.

All phone and internet service across London suddenly fails in a massive cyberattack. Gabriel, Sarah, and Ingrid realize it is a prelude to a physical drone strike. Gabriel overlays the diagram from Ivanov’s phone onto a map of London. The 10 lines are flight paths originating from a single point and terminating at major landmarks, including 10 Downing Street, Buckingham Palace, and the MI5 and SIS headquarters. The launch point is identified as 27 Wilton Crescent in Belgravia. Unable to contact authorities, the trio arm themselves with Christopher’s pistol and race to the address.

London is frozen by the communications blackout as they speed through the streets to 27 Wilton Crescent. Gabriel picks the lock, and they enter the large, completely unfurnished house. They find evidence that two people—likely Chloé Lamont and an accomplice—were there recently and have fled through a back garage.

Meanwhile, MI5 analysts finally locate Chloé on CCTV footage, tracking her from Trafalgar Square to the Wilton Crescent address. They also spot Gabriel’s team breaking in and alert their superiors. Upstairs in the house, Gabriel finds a padlocked door leading to the roof. He shoots the locks off to gain access.

After being alerted that Gabriel is at the launch site, Seymour instructs MI5 to dispatch an armed police unit. He and Christopher then make a final, desperate attempt to persuade the Prime Minister to evacuate. On the roof, Gabriel discovers 10 large drones, three of which are armed with heavy explosives. He manages to disable one, but the other nine launch and fly toward their targets, with two armed drones heading for Downing Street.

Just as the five world leaders step outside for a press conference, armed police storm Wilton Crescent house and arrest Gabriel, who is still holding a pistol. As he is pinned to the ground, two massive explosions detonate in the distance, followed by a third, much closer explosion that plunges the scene into darkness.