Europe Increasingly Worried About Hybrid Warfare

Photo: MarkJFernandes, Wikimedia Commons, CC0

01 The week the language changed

Germany's interior minister Alexander Dobrindt said it plainly in September: “We are not at war. But we are a daily target of hybrid warfare.” Berlin formally attributed the August 4 incident at Leipzig/Halle airport — in which a drone carrying military-grade explosives was found near Ukrainian Antonov cargo aircraft, and another drone exploded beside a plane as it landed — to Russia. NATO's secretary general responded that “the evidence is clear,” and the European Commission and NATO chiefs convened to shape a joint response, with additional sanctions teed up by foreign ministers.

The attribution was the inflection point. European officials had spent two years describing a pattern — arson in Latvia, firebombing attempts in Poland and Slovakia, plots against executives, cables sliced in the Baltic — while governments carefully avoided naming a state. Germany's declaration converted the accumulated record into a named state campaign, and the vocabulary across Europe changed almost overnight.

Analysis — not prediction. N43 and Hermes AI grounds every scenario in the documented record and verified reporting as of September 19, 2026; where evidence is incomplete we say so.

02 The documented record

What makes the current worry different from generic alarm is the incident list, now substantial enough to have its own Congressional Research Service chapter. In 2026 alone: a rash of Baltic cable-cutting in January; an explosive-laden drone disrupting Leipzig airport in August; fires at Polish defense-industry sites in Skarżysko and Lublin in late August; a foiled arson attempt at a Slovak drone manufacturer in early September; fires at Estonian defense robotics firm Milrem; a drone crash in Moldova; a Russian cruise missile that crossed Polish airspace; Polish jets intercepting Russian aircraft over the Baltic in May. The Associated Press reported in July that Russia likely used “shadow ships” to wage a drone campaign across Europe.

German investigators believe “low-level agents” recruited locally — often unwitting or paid intermediaries — carried out operations on behalf of Russian intelligence services. That structure, security officials stress, is precisely what makes the campaign hard to punish: the perpetrator you catch is rarely the state that hired the perpetrator.

03 The threshold problem

Hybrid warfare is designed to sit below the threshold of Article 5. Each individual act — a burned warehouse, a severed cable, a drone that shuts an airport for a day — is criminal, not military. No single incident obviously obliges collective defense, which is exactly the strategic logic: NATO's deterrence posture is calibrated to armed attack, so the campaign routes around it. As Euronews' reporting on allied assessments put it bluntly: “the deterrence isn't working” against this class of threat, and no alliance response has yet coalesced around a single incident.

The unresolved doctrinal question is where the line sits. NATO has operations — Baltic Sentry, patrolling critical infrastructure since early 2025, and Eastern Sentry, stood up in response to drone incursions — but operations are not doctrine. An alliance built to deter tank armies has no settled answer for what a sustained campaign of arson and sabotage, attributed and undeniable, obliges it to do. That gap is not lost on the adversary; the campaign's tempo suggests it is being probed deliberately.

04 The resilience doctrine taking shape

What is emerging instead is a resilience-first doctrine, built on three layers. At the national level: Germany's interdepartmental task forces on disinformation and hybrid threats, formal attribution procedures, Estonia's drone-surveillance deployment. At the EU level: the Hybrid Toolbox providing a joint response mechanism, and the new Joint Centre for Countering Hybrid Threats standing up this year to give Brussels an attribution capability of its own. At the NATO level: the Sentry operations and a push to treat infrastructure protection as a standing military mission rather than a crisis response.

The doctrine's premise inverts traditional deterrence: since attribution is slow and deniability is the adversary's main weapon, the first move is to harden the targets — cables, airports, rail, defense plants — and pre-build the legal and intelligence machinery so the next incident can be named in days rather than seasons. Germany's rapid attribution of Leipzig was the first full-speed test of that machinery, and the sanctions now moving through EU channels are its first output.

05 The asymmetry that makes it attractive

Why the campaign persists is arithmetic. A drone costs a few thousand dollars; an airport shutdown costs millions and dominates a news cycle. A burned warehouse costs an arrest, not a war. Every incident forces the target to spend on surveillance, investigation, protection — a tax paid by every European state, extracted by a handful of handlers and recruited low-level agents. The cost-exchange ratio of hybrid warfare rivals anything on the Ukraine battlefield, which is why the campaign escalated even as Russia's conventional forces stayed bogged down.

The counter-asymmetry is the alliance's aggregate resilience economy: Europe can afford the hardening if it chooses to — the question the September meetings actually settle is whether the spending is coordinated at EU scale or duplicated in twenty-seven national silos.

06 What to watch

Watch the EU sanctions package now being prepared — its speed and specificity are the first test of the joint attribution-and-response machinery. Watch whether other governments follow Germany's attribution precedent on their own incidents; each attribution makes the next one easier. Watch NATO's threshold debate: any communiqué language defining hybrid attacks as potentially Article-5-relevant would be the doctrinal shift of the decade. Watch the Baltic and Eastern Sentry operations expand from monitoring to interdiction — the first vessel or drone physically stopped by NATO forces will be the campaign's first real cost. And watch the Carpathian Eight, whose energy-resilience and critical-infrastructure language shows the region absorbing the same lesson: resilience is now a regional-security deliverable, not a domestic afterthought.