A drone packed with explosives discovered at Leipzig airport in August has become the latest flashpoint in a shadow war that European intelligence chiefs say is moving from sporadic provocation to systematic sabotage. Denmark's foreign intelligence service warned on Thursday that Russia is actively preparing operations against the Danish defence industry, while France's domestic spy chief used a rare public appearance to tell business leaders they should expect similar targeting.
From Leipzig to Copenhagen: the pattern hardens
The Leipzig device, found during routine screening at the DHL logistics hub, was not an isolated curiosity. German investigators concluded it had been inserted into the supply chain with the intention of detonating in flight, a method that mirrors earlier incidents in the United Kingdom and Poland. Berlin formally blamed Moscow; the European Union said the episode bore all the hallmarks of state-sponsored terrorism. EU members summoned Russian envoys and began discussing a twenty-second sanctions package.
Days later, the Danish Defence Intelligence Service issued its own assessment. Russia, it said, is actively preparing sabotage against companies supplying materiel to Ukraine. The language was deliberate: not "planning" or "considering", but "actively preparing". That distinction matters. It moves the threat from theoretical to operational, and it aligns with what French officials have been saying privately for months.
Celine Berthon, head of the DGSI, appeared at a business forum in Paris last week under the blunt title "Are we ready to face war?" Her message to French executives was direct: the Leipzig drone was a signal. French defence contractors, logistics firms and critical infrastructure operators should assume they are in the crosshairs. "We need to adapt," she said, a phrase that carried more weight for its understatement.
A toolbox that no longer fits
The problem, as Andrei Soldatov puts it, is that the Western toolbox was designed for a different era. Expelling declared intelligence officers, publishing attribution reports, adding names to sanctions lists, these worked when the adversary cared about diplomatic reputation or access to Western financial systems. They do not work against a campaign that uses criminal proxies, cut-out companies and deniable supply-chain interference.
Soldatov, who has tracked Russian security services for two decades, argues that naming-and-shaming has become performative. "We need to accept that we are facing a long hybrid war," he told AFP. "In this war, solutions devised during the Cold War will not work, nor will ideas developed over the past decade prove effective." The US Congressional Research Service reached a similar conclusion in August, noting that Russian agencies have demonstrated flexibility in adapting to heightened European scrutiny while conducting more aggressive operations that carry greater risk of exposure.
That exposure risk is deliberate. When a proxy is caught, a criminal network recruited to plant a device, a migrant paid to photograph a military base, the Kremlin denies involvement. The proxy takes the fall. The operation continues. European prosecutors secure convictions; the strategic picture barely shifts.
Sanctions: economic pain, strategic patience
Twenty-one rounds of EU sanctions have exacted a measurable toll. Russia's economy has been reshaped: capital flight, technology denial, a war-footings budget that now devotes more than 6% of GDP to defence. But the deterrent effect on hybrid operations is, at best, uncertain. The sabotage campaign has accelerated since the most restrictive packages were adopted in late 2023 and 2024.
Part of the reason is structural. Sanctions target state revenue and military-industrial capacity. Hybrid operations are cheap, outsourced and often run by the GRU's Unit 29155 or the SVR's special operations directorate, entities that operate on budgets rounding to zero in macroeconomic terms. Cutting off semiconductor imports does not stop a handler in Moscow from messaging a recruit in Hamburg via an encrypted app.
Advocates of a tougher approach argue the West must match the Kremlin's willingness to inflict pain. Antoine Arjakovsky, writing in Le Monde, called for ending all remaining trade with Russia and responding tit-for-tat to Russian attacks. "If we are to prevail in this hybrid war, we must be prepared to terrorise the Kremlin, just as it seeks to terrorise us," he wrote. The phrase "terrorise the Kremlin" is deliberately provocative; it reflects a frustration that has been building in Paris, Warsaw and the Baltic capitals for two years.
Germany's dilemma and the American variable
Germany's reaction to the Leipzig incident has drawn particular scrutiny. Sergey Lagodinsky, a Russian-born MEP from Berlin, did not mince words: "If I were sitting in the Kremlin, I'd probably breathe a sigh of relief." His assessment, that Berlin is running out of retaliatory measures, captures a wider European anxiety. Germany hosts the largest US military presence in Europe, its defence industry is a primary target, and its political consensus has historically favoured dialogue over confrontation.
That consensus is fraying. The Bundestag has approved a special defence fund, the chancellor has spoken of a "Zeitenwende", and the intelligence services have been given expanded powers. But each step is debated, litigated and leaked. The result is a response that looks reactive: summon the ambassador, draft the sanctions, wait for the next incident.
Complicating matters further is the American variable. The source text notes that the United States has become an increasingly unreliable partner within the transatlantic alliance under President Donald Trump. European officials, speaking privately, describe a NATO where Article 5 consultations are hypothetical and intelligence sharing with Washington is filtered through a political lens. That forces Europe to build its own hybrid defence architecture, a task for which it has neither the integrated command structure nor the shared legal framework.
Intelligence sharing: the missing architecture
Soldatov's prescription is systematic: improve intelligence-sharing across European agencies and accept that the work will be "very complex and very costly, and it will also require a shift in mindset within intelligence services themselves." The mindset shift is the harder part. European services guard their sources, their methods and their national jurisdictions. The DGSI does not automatically share raw intercepts with the BND; the Danish service does not pool its maritime surveillance with the French DGSE in real time.
There are frameworks, the EU Intelligence and Situation Centre (INTCEN), the NATO Intelligence Fusion Centre, bilateral liaison networks, but they operate at the level of finished assessments, not raw data. By the time a finished product circulates, the operational window has often closed. A drone in a DHL warehouse is a tactical problem; the network that put it there is a strategic one. Connecting the two requires speed that current structures do not provide.
Escalation without guardrails
Alexander Gabuev warns that the absence of agreed rules for hybrid escalation is itself a danger. Nuclear deterrence rests on decades of doctrine, hotlines and mutual understanding of red lines. Hybrid warfare has none of that. "There is no agreed framework governing escalation, which increases the risk of mass-casualty events," he said. A sabotage operation that kills civilians, a drone that detonates over a residential area, a cyberattack that disables a hospital, could trigger a response that spirals beyond the grey zone.
The Kremlin knows this. Its calculus appears to be that Europe will absorb a high volume of low-casualty provocations rather than risk a confrontation that could invoke Article 5 or, worse, a nuclear exchange. So far, that calculus holds. But each incident raises the probability of a miscalculation: a proxy who goes further than instructed, a European service that decides to strike back covertly, a politician who demands visible retaliation before an election.
What Europe might actually do
Three concrete steps are under discussion in Brussels and national capitals. First, a standing European hybrid threat cell with authority to task national services, not just request liaison. Second, a legal framework that treats proxy sabotage as an armed attack for the purposes of collective defence, effectively extending Article 5 logic below the kinetic threshold. Third, a sanctions mechanism that triggers automatically on attribution, removing the political veto that delays each package.
None of these is new. The first has been proposed since 2018; the second requires treaty change or a creative reading of existing obligations; the third faces opposition from members who fear losing leverage. But the Leipzig drone and the Danish warning have shifted the mood. The next EU foreign ministers' meeting in October will test whether that mood translates into decisions.
People mentioned
-
Andrei Soldatov
-
Celine Berthon
-
Alexander Gabuev
Organisations
European Union · NATO · DGSI · Carnegie Russia Eurasia Center · US Congressional Research Service
