[Tusk: "Russia Preparing Drone and Rocket Attacks on NATO Territory"]

Russia’s "war that is not quite a war" appears to be pushing Europe past its tolerance threshold. Following an explosive-laden drone targeting a Ukrainian cargo aircraft at a German airport, a Russian warship fired warning flares at a Danish military helicopter, and a NATO fighter jet shot down an explosive-bearing drone over Lithuanian airspace for the first time.

Europe’s perception is undergoing a fundamental shift. While incidents involving arson, sabotage, cyberattacks, and airspace incursions were previously handled as isolated events, there is a growing consensus that they must now be countered collectively as a continuous, unified "hybrid threat." This structural realization is driving the EU to pursue a new joint-response mechanism akin to a "European version of NATO Article 4."

Polish Prime Minister Donald Tusk issued a grave warning during a parliamentary address, stating that Russia is preparing hybrid attacks using drones or rockets against Ukraine’s allies, including Poland.

Tusk specifically warned that Russia might disguise these strikes as "accidental incidents" to undermine the collective resolve of NATO member states. While the immediate execution of such attacks cannot be independently confirmed, his statements highlight the heightened state of alert in Eastern Europe regarding Russian hybrid operations.

[First Ever: NATO Fighter Jet Downs Drone in Lithuanian Airspace]

Preceding that warning, a drone crossed into Lithuanian airspace from the direction of Belarus overnight between September 14 and 15. According to the Lithuanian Ministry of Foreign Affairs, Italian Air Force Eurofighter Typhoon jets operating under NATO command to conduct Baltic Air Policing were scrambled and successfully intercepted the target. On September 18, Lithuanian officials formally announced that an explosive device discovered within the drone's wreckage had been safely rendered inert.

Although Lithuanian authorities suspect the drone originated from Belarus, investigations into the exact origin, ownership, and objective of the flight remain ongoing. Consequently, it cannot be definitively categorized as an intentional Russian attack drone at this stage. Nevertheless, the physical interception of an intruding drone by a NATO fighter inside Lithuanian airspace starkly illustrates the worsening security environment around the Baltic Sea.

[Russian Warship Fires Flares at Danish Helicopter… One Narrowly Misses]

On September 14, a direct military encounter unfolded between a Russian warship and NATO member Denmark's armed forces. According to the Danish military, a Russian frigate deployed two flares toward a Danish Air Force Fennec helicopter conducting routine photographic surveillance over international waters near Gedser, with one flare passing in close proximity to the aircraft.

Moscow lodged a formal complaint with Copenhagen, asserting that the Danish helicopter engaged in unsafe maneuvers near its vessel. While conflicting accounts persist, the near-collision between a NATO aircraft and a Russian naval warship underscores the escalating military friction in the Baltic Sea.

[von der Leyen: "EU Needs a Response Mechanism Akin to NATO Article 4"]

Against this backdrop, European Commission President Ursula von der Leyen formally proposed a new "counter-hybrid playbook" during a address to the European Parliament in Strasbourg on September 16. The core objective is to establish a operational framework enabling EU member states to convene immediately and coordinate joint responses when faced with severe security threats—such as sabotage, drone incursions, or cyberattacks—that fall short of traditional armed attacks. This concept mirrors NATO Article 4, which allows member states to request consultations whenever their territorial integrity, political independence, or security is threatened.

Von der Leyen also introduced a vision for a "European Security Council" that could incorporate non-EU partners including the UK, Norway, Ukraine, and Canada. While specific activation thresholds and legal mechanics remain to be finalized, the policy intent is unambiguous: to build an institutional mechanism capable of countering Russian sub-threshold aggression.

[Leipzig 'Bomb Drone'… Germany Officially Points at Russia]

A key catalyst altering Europe's stance was the explosive drone incident on August 4 at Leipzig/Halle Airport in Germany. A drone carrying explosives and a detonation device was discovered near an Antonov Airlines cargo plane operated by Ukraine. Following a month-long investigation, the German government officially publicly attributed Russian involvement to the incident on September 1.

German Minister of the Interior Alexander Dobrindt stated that the physical components of the drone, along with the explosive and detonation technology used, match patterns previously identified in Russian hybrid operations and during the war in Ukraine. In response, Berlin summoned the Russian ambassador and announced the closure of the Russian Consulate General in Bonn and the "Russian House" cultural center in Berlin. Moscow denied all allegations.

[151 Confirmed Russian-Linked Hybrid Operations]

The Leipzig incident is particularly alarming because it does not represent an isolated event. A joint assessment by GLOBSEC and the International Centre for Counter-Terrorism (ICCT) documented 151 confirmed Russian-linked hybrid operations across Europe between February 2022 and February 2026. The researchers noted that 41 of these cases were identified in the latter half of 2025 alone.

Crucially, these operations rarely involve direct deployment of high-profile Russian special forces. Instead, they feature arson, explosions, and logistics destruction executed by local criminal syndicates or low-cost proxies to obfuscate attribution—a classic "grey-zone strategy" designed to inflict costs and foster internal instability while remaining beneath the threshold of open warfare.

[Europe Takes Action… Boarding Operations Simulated in Baltic Sea]

European counter-responses are extending beyond political declarations into operational readiness. On September 17, Finnish authorities conducted live-action boarding drills in the Baltic Sea, simulating scenarios where critical infrastructure—such as undersea cables—was targeted, requiring forces to forcibly halt and search suspicious vessels.

Coast Guard, police, and military personnel executed fast-rope insertions from helicopters to secure vessels and conduct onboard searches. Finland has been systematically upgrading its operational posture following repeated disruptions to power lines, telecommunications cables, and gas pipelines in the Baltic region. European counter-hybrid posture is thus evolving from post-incident investigation toward active, real-time interception.

[An Even Tougher Adversary Exists… "EU Internal Division"]

The core vulnerability confronting Europe, however, remains its internal cohesion. Precisely as calls grow for 27 member states to present a united front against Russian hybrid aggression, existing sanctions mechanisms are faltering due to internal disagreements. On September 14, EU member states failed to reach a consensus on renewing standard 6-month sanctions against Russian individuals and entities, resulting in a temporary 7-day extension through September 22. The impasse was driven by demands from France and Slovakia to remove Russian billionaire Alisher Usmanov from the sanctions list—a decision requiring unanimous agreement among all 27 member nations.

This impasse exposes a central paradox: while the EU calls for collective action against external hybrid threats, it struggles to maintain unanimity on existing economic sanctions. For von der Leyen's proposed playbook to serve as an effective deterrent, member states must first resolve fundamental operational questions—including what constitutes a hybrid attack, how attribution is determined, and whether joint responses will require unanimous consent.

[Why Times Insight]

The primary takeaway from recent developments is not merely the occurrence of individual Russian provocations, but the fundamental transformation in how Europe perceives them. Previously, Russia’s hybrid operations exploited the "grey zone" existing beneath NATO Article 5. A single act of arson, an isolated drone incursion, or a targeted cyberattack rarely meets the criteria required to trigger collective defense under Article 5. However, as these incidents recur and interconnect, Europe is shifting from evaluating isolated events to countering a systemic strategy.

Von der Leyen’s "counter-hybrid playbook" represents an institutional effort to close this vulnerability. If Moscow continues to execute sub-threshold attacks, Europe intends to aggregate these acts into a unified security threat requiring a coordinated response. While distinct from lowering the threshold for NATO Article 5 activation, this initiative seeks to narrow the operational vacuum that has existed beneath it.

Nevertheless, Europe faces an equally challenging internal front: domestic political fragmentation. If member states struggle to maintain consensus on routine sanctions renewals, even the most robust collective-defense frameworks risk operational paralysis during an active crisis. Consequently, the true test of the new playbook lies not only in deterring Russian aggression, but in whether 27 sovereign nations can achieve rapid alignment and act decisively when a crisis unfolds.

Ultimately, the key vector to monitor is not an immediate activation of NATO Article 5, but whether Europe can collectively impose costs on sub-threshold aggression. As Russia continues to probe for weak links, von der Leyen’s framework stands as an institutional attempt to ensure the grey zone no longer remains an unmonitored space.