Summary

  • Sixteen NATO member states have reported drone incursions or recovered drone remnants over the past two years, with the pace accelerating in recent months as the EU’s planned drone shield remains under construction toward a 2027 endpoint, leaving the alliance structurally dependent on costly fighter-jet intercepts in the interim.
  • Germany publicly attributed the August Leipzig airport drone findings to Russia; Romania attributed a May Galați high-rise strike to the one-way attack drone Geran-2; Poland identified the reconnaissance drone Gerbera after a September 2025 nighttime swarm crossed Polish airspace; analysts at the International Institute for Strategic Studies named the Merlin-VR as likely involved without attaching it to a specific incident.
  • NATO officials and IISS analysts characterize the pattern as gray-zone combat below the Article 5 threshold; the Kremlin denies the characterization, and the substrate does not establish whether attribution ambiguity is a deliberate feature of the position.
  • Until distributed detection and interception networks reach operational status, fighter aircraft remain NATO’s principal high-speed response, with Belgium equipping F-16s with specialized Thales rocket pods to address the cost asymmetry between high-end interceptors and low-cost drone targets.
  • A third category of sightings involves Ukrainian drones misdirected by Russian electronic warfare, which complicates attribution if a serious incident occurs before the EU shield becomes operational.

Sixteen NATO member states have reported drone incursions or recovered drone remnants on their territory over the past two years, with the pace of such incidents accelerating in recent months as the alliance races to expand its counterdrone capabilities, according to a Wall Street Journal report published September 8, 2026. Germany publicly blamed Russia in August for explosive drones found at Leipzig airport, a supply line for Ukraine; the same month, Romania scrambled jets to destroy a naval drone sailing close to a Black Sea gas platform. Alliance officials and analysts at the International Institute for Strategic Studies have characterized the pattern as gray-zone attacks — a characterization the Kremlin denies. The European Union’s planned drone shield, a multilayered network of sensors, electronic warfare systems, and interceptor drones designed to protect the bloc’s eastern border, is expected to be fully operational by the end of 2027, with basic radar and infrastructure deployed along the eastern borders by the end of this year, per the European Parliament. Until the shield becomes operational, fighter jets remain NATO’s main high-speed response; air-to-air missiles are an expensive option against low-cost targets, and Belgium is equipping its F-16s with specialized Thales rocket pods to address the cost asymmetry.

The documented incident pattern and its attribution

The Journal’s reporting describes two main categories of incursion. The first is drones loitering over critical infrastructure deep within Europe; the second is military-grade unmanned aerial vehicles that have crossed into NATO airspace. A third group — Ukrainian drones misdirected by Russian electronic warfare — accounts for some of the sightings, complicating attribution. Witnesses and photographs describe a mix of fixed-wing surveillance craft and quadcopters, including one reported case of a larger fixed-wing “mother ship” launching smaller drones. Determining where the drones originate, what type they are, and what their operators intend is difficult, according to analysts cited by the Journal.

Two drone types have been publicly identified in connection with NATO-side incidents. The Romanian government said the one-way attack drone Geran-2 struck a high-rise building in the town of Galați in May; the substrate does not give a year for the Galați strike. The Polish military identified the reconnaissance drone Gerbera in September 2025 after a nighttime swarm of Russian drones crossed Polish airspace. IISS analysts told the Journal that Russia’s Merlin-VR, designed for prolonged monitoring of infrastructure, is likely involved in what they characterized as gray-zone combat; the Merlin-VR was not linked to a specific incident in the reporting. Data from ACLED, an independent organization that tracks conflicts worldwide, show a proliferation of incursions in Europe over the past year as Russia has stalled on the battlefield in Ukraine, the Journal reported; the European Council on Foreign Relations compiled the underlying incursion mapping.

Specific attributed episodes outside the two named above include the August Leipzig airport finding — explosive drones Germany publicly attributed to Russia — and the August Black Sea episode in which Romania scrambled jets to destroy a naval drone near a gas platform. German Interior Minister Alexander Dobrindt said this month, “We do not consider ourselves at war, but we are the daily target of hybrid warfare.” Almost every week this summer brought new reports of drone incursions over the alliance’s eastern frontier, with NATO jets repeatedly mobilized to intercept them.

The capability structure behind the incidents, as characterized by IISS analysts, includes drones capable of vertical takeoff and landing that can be launched from ships with minimal deck space — making them potentially suitable for covert operations from Russia’s shadow fleet. The substrate does not establish sanctions, naval interdiction, insurance or registration tracking, or other enforcement pressure capable of reducing that launch pathway; the shadow fleet remains a documented launch option, not a balanced loop in the available evidence.

Why the gap matters: cost asymmetry and the 2027 shield deadline

The reported incident pattern can be read as a stock-and-flow system. The monitored stock is the cumulative set of reported incursions and recovered remnants; the inflow is the rate at which new incidents are reported or discovered. The capacity stock still being built is counterdrone capability — detection at distance, electronic warfare, lower-cost interception, and command systems.

Two reinforcing pathways shape the near-term map. First, each incursion imposes a response burden on NATO. Fighter aircraft remain the alliance’s main high-speed response to drones entering European airspace; the F-16 and F-35 are NATO’s principal interceptor aircraft, with Eurofighter Typhoons also operating in antidrone missions. Fighter pilots typically fire guided rockets or aircraft cannons to shoot down drones, but air-to-air missiles are an expensive option against low-cost targets. Belgium is equipping its F-16s with specialized Thales rocket pods to give the aircraft a cheaper, more effective option against large drone formations. The resulting pressure can increase political demand for cheaper interception methods and for additional support to Ukraine; whether either response changes Russian conduct is not quantified in the source.

Second, the Journal’s account cites ACLED data showing a proliferation of incursions over the past year and characterizes Russia as stalled on the battlefield in Ukraine. If that battlefield characterization is accurate, non-frontline pressure channels could become relatively more useful to Moscow. The possible substitution is a scenario assumption rather than an established causal finding: the observed increase in reports establishes a higher recent incident flow but does not by itself prove that Russia is redirecting operations toward NATO territory. Alliance members are also working to raise the cost for such attacks by increasing their support for Ukraine, and many of the front-line NATO states are developing counterdrone capabilities, though the defenses, per the Journal, “are not uniform” across the alliance.

A balancing loop is in formation: incidents create demand for counterdrone systems; once operational, those systems would reduce the effectiveness or raise the cost of incursions. The central structural feature is delay. The European Parliament expects basic radar and infrastructure to be deployed along the EU’s eastern borders by the end of 2026, with the full drone shield operational by the end of 2027. Until the distributed detection and interception network matures, NATO will continue to depend substantially on aircraft and other uneven national capabilities, indicating that the loop’s stabilizing effect will arrive unevenly across member states.

Peter Senge’s “Fixes that Fail” archetype in systems-dynamics literature appears relevant to the alliance’s interim posture: reliance on high-cost fighter jets to intercept low-cost drones treats the symptom while leaving the underlying cost asymmetry unaddressed. The fiscal sustainability of absorbing that cost asymmetry on each intercept depends on incident rates remaining within politically manageable bounds.

For the EU’s stated 2027 endpoint to be met, sustained member-state funding, technical progress on detection at distance and cost-effective interception, and stable political commitment across multiple election cycles would each need to hold. The distribution of the drone-shield cost burden across member states and the political coalition that will fund the shield’s full deployment are not addressed in the available reporting.

Stated positions and what each side gains

NATO members describe the incidents as falling below the threshold for a collective military response — a characterization compatible with preserving alliance decision space while continuing to signal that the pattern is monitored. The substantive interest is airspace security and infrastructure protection; the procedural interest centers on alliance coordination and the threshold question for an Article 5 response.

Germany has produced a public attribution to Russia — the August Leipzig finding — alongside Dobrindt’s “hybrid warfare” framing, which positions Germany as a daily target without declaring war status. Leipzig airport has been identified as a supply line for Ukraine; Germany has a documented interest in sustaining the flow of Western military assistance into Ukraine.

Russia’s documented conduct as attributed by the Journal includes the August Leipzig finding, Poland’s identification of the Gerbera after the September 2025 airspace crossing, Romania’s attribution of the Galați strike to the Geran-2, and IISS’s characterization of the Merlin-VR as likely involved in gray-zone combat. The Kremlin denies the broader pattern. The denial is compatible with preserving attribution ambiguity; the substrate does not establish that preserving ambiguity is the purpose of the position.

Ukraine’s interest centers on sustaining Western military assistance. The third category of sightings — Ukrainian drones misdirected by Russian electronic warfare — creates a competing interest: accurate attribution of those misdirected drones affects both the alliance’s response threshold and Ukraine’s standing as a recipient of Western military aid.

The European Union is proceeding with a layered network of sensors, electronic-warfare systems, and interceptor drones for the bloc’s eastern border, expected to be fully operational by the end of 2027. The project directly serves the Union’s stated objective of protecting the eastern border.

Attribution complications and the forward picture

Whether the third bucket — misdirected Ukrainian drones — fits the “hybrid warfare” / “gray zone” framework, or instead reflects collateral dynamics of the Ukrainian battlefield rather than a deliberate Russian posture toward NATO, is not established in the reporting. The framework treats the incidents as a single phenomenon below the Article 5 threshold; the substrate does not adjudicate that categorical question. IISS analysts describe the activity as gray-zone combat; NATO officials and analysts describe it as gray-zone attacks; the Kremlin frames the broader pattern as not occurring; Dobrindt frames the German experience as daily hybrid targeting without war status. ACLED and ECFR frame the trend as proliferation correlated with Russia stalling on the battlefield in Ukraine.

The reporting supports a directional comparison with the start of the documented two-year window: a faster recent incident pace and a counterdrone pipeline still approaching full operation make the current system appear more exposed to the coincidence of a serious incident and attribution ambiguity than it was at the beginning of that period.

The principal documented failure pathway is unresolved origin or intent. The Journal reports that some sightings are Ukrainian drones misdirected by Russian electronic warfare; a damaging incident involving such a drone could therefore arise from an origin and mechanism different from the Russian activity documented elsewhere in the same incident pattern. If an incident causing casualties or infrastructure damage occurs while the full EU shield is not operational, attribution may remain contested long enough to complicate alliance decision-making. The substrate does not establish how long an assessment would take, what evidence would be sufficient, or what casualty profile would trigger collective action; it therefore does not support a forecast of an Article 5 response or any other specific threshold-crossing decision.

Four scenarios are visible in the reporting. First, trend extrapolation: continued incident acceleration through the end of 2027, with the drone shield reaching basic capability along eastern borders by the end of 2026 and full deployment by the end of 2027. If the shield reaches operational status on that timeline, the success rate of incursions would decline, reducing political pressure for further investment and producing a stabilization point. Whether operators of the incursions could adapt to the new defenses and reactivate the reinforcing loop is not addressed in the underlying reporting. Second, an orthogonal driver: a shift in the Ukraine conflict — settlement, stalemate, or Russian breakthrough — alters Moscow’s incentive to maintain gray-zone pressure on NATO’s eastern frontier. Third, discontinuity: a drone strike producing significant casualties would reopen the Article 5 threshold question. Fourth, reversal: incursion rates decline as the drone shield becomes operational.

A confidence-building and deconfliction pathway would become more supportable if subsequent attributable reporting showed repeated non-weaponized loitering, short-duration probes followed by withdrawals, or comparable conduct consistent with signaling or response calibration rather than preparation. It would lose support if the record instead showed weaponized incursions, direct attacks, or coordinated preparations. The substrate does not establish a Russian preference for keeping incidents below the alliance’s response threshold, so this pathway remains a conditional alternative rather than a current policy recommendation.

What remains undocumented

Operator intent for the full set of incidents is not established in the available reporting. The probability of escalation is not quantified. What political response would follow a serious incident, how long an attribution assessment would take, what evidence would be sufficient, and what casualty profile would trigger collective action under Article 5 are not addressed. Whether sanctions, interdiction, insurance, registration, or other pressure constrains the vessels, ownership networks, or launch capacity associated with Russia’s shadow fleet is not addressed. Whether operators of the incursions could adapt to new EU defenses once the shield becomes operational is not addressed. The year of the Romanian Geran-2 strike on the Galați high-rise is not specified in the substrate beyond “May.” The distribution of the drone-shield cost burden across member states is not addressed. The political coalition that will fund the shield’s full deployment is not addressed.

Analytical techniques used in this piece

This analysis applies the methods below. Each links to a short, plain-English explainer you can read and reuse.

Interest Mapping
Separates parties’ stated positions from their underlying interests (Fisher & Ury).
Systems Dynamics (Structural)
Maps a system’s structure — stocks, flows, and the architecture that shapes its behavior.
Wicked Futures
Explores a long-horizon, deeply entangled future with no clean resolution.