UNDECLARED WAR

Europe is increasingly confronted with acts of sabotage and targeted disruption that, until recently, were not readily perceived as elements of armed conflict. The issue of subsea cables being severed, alongside the growing trend of drone activity over airports, and the disruption to rail networks and energy grids, are gradually defining a new reality for nations that remain formally at peace.

European authorities have characterised these operations as elements of a Russian "shadow war". However, Moscow has rejected these allegations. Meanwhile, European states are fundamentally overhauling their critical infrastructure protection, acting not against a hypothetical hazard, but in response to an active confrontation.

The front line runs through critical infrastructure

In previous years, electrical substations, undersea communications lines and freight airports were viewed primarily as civilian assets. In the current geopolitical climate, there is an increasing perception of these entities as primary targets for hostile actions, operating in a manner that is tantamount to open military conflict.

The level of concern is clearly illustrated by Lithuania's approach to constructing a new electrical substation near the border with Russia's Kaliningrad enclave. Transformers are being encased in reinforced concrete bunkers, paired with anti-tunnelling sensors and specialised defensive systems to counter kamikaze drones. These precautions have inflated project costs by at least €48 million.

Energy grid design specifications now explicitly incorporate defense scenarios against Shahed-type uncrewed aerial vehicles carrying heavy explosive payloads.

Another worrying development occurred on 16 September 2026, when a Gerbera drone was shot down in Lithuanian airspace. President Gitanas Nauseda stated that the craft was likely destined for targets in Ukraine before being diverted off course by Ukrainian electronic warfare systems. While emphasising that Lithuania's overall security environment remains stable, he noted that isolated provocations, sabotage, or false-flag operations cannot be ruled out.

In Poland, this has resulted in formal executive warnings. On 17 September 2026, Prime Minister Donald Tusk informed the Sejm that intelligence assessments indicated that Russia might be planning hybrid drone and missile strikes against states that support Ukraine, including Poland. Tusk specifically highlighted a scenario in which such attacks would be disguised as accidental incursions to complicate or blunt a collective NATO response. This is a possibility actively evaluated by Polish intelligence, rather than a confirmed future strike.

An incident in Germany provided further insight. On 4 August 2026, an explosive-laden drone was discovered at Leipzig/Halle Airport in close proximity to a Ukrainian cargo aircraft. German authorities have classified the discovery as an attempted hybrid attack. On September 1, 2026, the German government announced that forensic evidence and intelligence findings indicated Russian responsibility for the operation, even as criminal investigations remained ongoing. NATO Secretary General Mark Rutte strongly criticised the incident, labelling it a "reckless hybrid attack" by Russia. In a dedicated statement, he emphasised: "NATO stands in full solidarity with Germany. You have 31 friends and allies standing by your side," he added, emphasising that the sole response to such actions would be intensified support for Ukraine.

At the same time, NATO has emphasised the urgent need to protect critical infrastructure throughout the Baltic Sea basin.

It is becoming increasingly apparent that the current series of isolated, troubling episodes are in fact a distinct category of threat. This new category involves the primary arena of confrontation being energy grids, transit corridors, airports and subsea cables. European governments are having to completely revise their defensive strategies. This involves fortifying physical energy assets, shielding sovereign airspace against uncrewed systems and establishing specialised collective mechanisms to handle hostility that does not escalate to open war. The current operational environment is characterised by a grey zone that separates peace from open military conflict.

Moscow: baseless accusations

In the aftermath of the incident at Leipzig/Halle Airport, the Kremlin issued a statement that went beyond the usual denials. On 4 September 2026, Dmitry Peskov, the Russian presidential spokesperson, stated that the accusations made by Germany against Russia were "entirely groundless" and lacked "a shred of convincing evidence". He went on to say that Moscow "categorically rejects these allegations". Peskov went on to say that, in Russia's opinion, Berlin had not taken similar action against Kiev following the investigation into the Nord Stream pipeline bombings.

Russia's Foreign Ministry also dismissed Berlin's claims as "entirely fabricated," classifying them as a deliberate provocation intended to escalate bilateral tension. They further warned that the actions of German authorities would meet a firm response.

Foreign Minister Sergey Lavrov expanded upon this perspective. In an interview with Rossiya-1, he linked the German allegations to subsequent diplomatic measures against Russian institutions, remarking: "This marks the start of a genuine war." The foreign minister drew parallels between the closure of Russian diplomatic facilities in Germany and the diplomatic manoeuvres that took place prior to the Second World War.

Concurrently, Moscow is putting forward a broader narrative. Russian officials have repeatedly asserted that the concept of a "hybrid war" is a fabrication intended to justify the expansion of defence budgets and the acceleration of militarisation against Russia. In this context, successive drone incidents are not indicative of Russian covert operations, but rather serve as a pretext for European governments to adopt a more robust foreign policy stance.

Consequently, a single incident can generate two irreconcilable interpretations. Germany analyses it through the lens of Russian hybrid warfare against Europe; Russia rejects the claims as unevidenced provocations driving further escalation. Regardless of which claim is substantiated in court, the underlying pattern itself is perilous: incident, accusation, retaliatory sanction, and renewed counter-allegations of escalation.

The rules are changing

European states are gradually transitioning from guarding individual facilities to constructing a unified counter-hybrid defence architecture. On 16 September 2026, European Commission President Ursula von der Leyen noted the increasing frequency of cyberattacks, sabotage, arson and drone incursions, and proposed the creation of a European Emergency Security Protocol. Under this mechanism, activation by a single member state would rapidly convene EU partners to coordinate a collective response, contain escalation, and mitigate damage from security incidents that fall below the threshold of armed aggression.

NATO is taking proactive steps to enhance its critical infrastructure protection measures. In September, the Alliance issued updated resilience requirements for its member nations, explicitly addressing physical sabotage, cyber intrusions, and threats to critical energy, transport, and communications systems. Operation Baltic Sentry, an active deployment of naval vessels, maritime patrol aircraft and uncrewed platforms, is underway across the Baltic Sea to monitor and protect subsea pipelines and cables.

However, a significant legal question remains unresolved. NATO maintains that Article 5 pertains strictly to an "armed attack," evaluated individually on a case-by-case basis. While the Alliance acknowledges that severe cyber intrusions or hybrid attacks could, in certain circumstances, be classified as an armed attack, there is no automatic transition from sabotage to Article 5 invocation. Every scenario requires a tailored consensus decision among allies.

This results in a new range of challenges, including operations that require a coordinated allied response but do not automatically lead to open warfare.

Where war begins

The most intricate challenge of this new standoff is that the traditional boundary separating peace from war is becoming increasingly blurred. The presence of a severed subsea cable, a drone over an airfield, a cyber intrusion, or a localised act of sabotage does not, in itself, constitute the start of a war. However, when such events recur systematically against vital infrastructure, states are forced to formulate their responses using military parameters.

A number of European governments are operating under the assumption that Russia is methodically probing Western thresholds, deploying sub-threshold instruments to avoid triggering a direct military conflict with NATO.

Moscow, by contrast, views these accusations as part of an information campaign that itself elevates the risk of escalation, maintaining that conclusive proof of responsibility remains subject to ongoing investigation.

The defining danger of an "undeclared war" is that it can occur without the knowledge or consent of the affected parties. Conventional conflicts are characterised by clearly defined starting points, such as an invasion, a formal declaration of war, or large-scale military engagement. In this emerging reality, the threshold is obscured: one party cites covert sabotage, another alleges deliberate provocation, and a third claims a technical accident. Meanwhile, concrete bunkers around power substations, subsea cable patrols, and anti-drone defences are being installed as permanent features of daily life in Europe.