European governments are warning of a widening pattern of sabotage, cyberattacks, airspace violations and other covert activity attributed to Russia, increasing pressure on NATO to develop responses to hostile actions that do not fit neatly into the Alliance’s traditional model of collective defence.
Speaking on the sidelines of the UN General Assembly in New York, officials from NATO’s eastern members said Moscow was increasingly combining drone incursions, cyber operations and physical sabotage with other forms of pressure intended to test European responses and weaken support for Ukraine.
EU foreign policy chief Kaja Kallas said Europe was facing a rapid proliferation of sabotage attacks and airspace violations. Polish Foreign Minister Radosław Sikorski went further, pointing to arson, explosions, drone incursions and what Warsaw regards as a deliberate Russian cruise-missile violation of Polish territory as examples of hostile activity already taking place.
The Kremlin has consistently denied conducting sabotage operations inside NATO countries or planning a confrontation with the Alliance.
From sabotage to airspace pressure
The warnings coincide with another series of incidents on NATO’s eastern flank.
On Wednesday, a Russian Mi-8 military helicopter briefly entered Polish airspace from the Kaliningrad region. Poland’s Operational Command said the aircraft remained inside Polish airspace for 42 seconds and penetrated about 300 metres across the border. Fighter aircraft were scrambled and ground-based forces placed on alert.
Poland is not alone in dealing with repeated incursions. Romanian Foreign Minister Oana Țoiu said Bucharest had recorded more than 100 cases involving Russian drones or drone fragments entering Romanian territory as Moscow intensified attacks against Ukrainian infrastructure around the Danube and Black Sea.
Romanian officials have not concluded that the incidents amount to deliberate attacks on Romania. Țoiu said there was no evidence that her country was being directly targeted, while arguing that Russia remained responsible for creating the risk.
The pressure on Romania has been building for months. DefenceMatters has previously documented how Russian drone incursions are placing NATO’s south-eastern flank under sustained pressure, forcing repeated fighter scrambles and creating difficult decisions over when unmanned aircraft approaching NATO territory should be intercepted.
Physical sabotage presents a different problem because attribution is often slower and less certain than identifying a military aircraft crossing a border.
European security services have investigated fires, attacks on transport infrastructure and suspected attempts to interfere with defence-related facilities. In France, for example, authorities have investigated suspected Russia-linked sabotage and espionage cases involving railway infrastructure and defence production.
The EU formally includes sabotage, disruption of critical infrastructure, cyberattacks and information manipulation among the hybrid activities it attributes to Russia. Brussels says such activity has intensified since Russia’s full-scale invasion of Ukraine in February 2022.
Lithuania has meanwhile begun treating physical protection of civilian infrastructure increasingly as a defence requirement. DefenceMatters reported in July that Vilnius was tightening security around critical infrastructure following warnings of possible Russian sabotage.
The Article 5 problem
None of this means European governments currently assess a conventional Russian assault on NATO as imminent.
Estonian Foreign Minister Margus Tsahkna said Russia remained too heavily committed in Ukraine to prepare an immediate large-scale attack on NATO countries. Lithuanian Foreign Minister Kęstutis Budrys nevertheless warned that Moscow could broaden pressure geographically through attacks on critical infrastructure and other hybrid operations.
That distinction lies at the centre of NATO’s problem.
A cyberattack, railway fire, damaged telecommunications cable or drone incursion may individually fall below the threshold normally associated with armed attack. A sustained campaign involving dozens of such incidents can nevertheless impose costs on military logistics, energy systems, communications networks and national security services.
NATO deliberately leaves some ambiguity over where the line is drawn. Its current Article 5 policy states that significant cyberattacks and other hybrid attacks may, depending on their nature and consequences, be considered an armed attack. Such decisions are made case by case.
The Alliance has also stated since 2016 that hybrid operations against one or more members could lead to Article 5 being invoked. At the same time, primary responsibility for responding to hybrid threats remains with the country targeted. NATO can provide intelligence support, counter-hybrid teams and other assistance without immediately moving towards collective military action.
That makes resilience an increasingly important part of deterrence.
NATO’s new 2026 Baseline Requirements for Resilience explicitly include physical attacks on critical infrastructure, sabotage and damaging cyberattacks among the threats allied governments must prepare to withstand. The requirements cover energy supplies, civilian communications, transport, government continuity and the ability to repair essential infrastructure after disruption.
This moves part of NATO’s deterrence problem far beyond additional fighters, missiles and ground forces. Railway networks, electricity substations, ports, telecommunications systems, data infrastructure and private companies supporting military mobility are increasingly part of the Alliance’s defence planning.
Post Views: 1,053