Donald Tusk told the Sejm on 17 September, the 87th anniversary of the Soviet invasion of Poland, that intelligence from NATO, Ukraine and the United States shows Russia planning strikes on the countries that arm Ukraine. "In the assessment of intelligence services, Russia's plans also include hybrid strikes with drones and missiles on states supporting Ukraine, including Poland," Tusk said. "There is a real risk that the territory of one or several NATO countries on the eastern flank may be entered by drones or other types of missiles, which may even cause destruction." He said Moscow would describe such strikes as accidents, with the aim of paralysing NATO and showing that Article 5, the alliance's mutual defence clause, exists only in theory. "Article 5, allied loyalty, fidelity to commitments must become our hallmark," he said.
Tusk said the assessment runs to early spring and that late autumn and winter would be "the most critical phase of the Russian-Ukrainian war so far." "It is a scenario involving serious events and requiring us to be focused, serious and, above all, mentally ready to pass difficult tests," he said. He told deputies that Russia now flies "jet-powered drones that travel at much higher speeds and operate at high altitude before dropping and hitting their target," and that few countries are equipped to stop them. He also said "there is nothing to suggest an invasion." Russia's Foreign Ministry called the accusations "contrived" and "far-fetched." Tusk travelled to Ukraine on 18 September for the first summit of the Carpathian Eight, and Warsaw said it was preparing a new military aid package for Kyiv that could include Patriot missiles.
The drones already over NATO territory
A Russian drone hit a train at Yahodyn station, on the Ukrainian side of the border crossing with Dorohusk in Poland, on 13 September, minutes after a diplomatic train carrying Boris Johnson, the former British prime minister, Carl Bildt, the former Swedish prime minister, and security advisers from several EU states had pulled out. The group was returning from the Yalta European Strategy conference in Kyiv, and David Petraeus, the former CIA director, was still at the station when the drone struck. Ukrzaliznytsia, the Ukrainian state railway, said the diplomatic train "had purposely left the station at Yahodyn ahead of schedule" and that "it is highly probable that the Russian drone's intended target was in fact the diplomatic train." Nobody was reported hurt. "This wasn't our train, but the one just minutes after us by the Polish border crossing," Bildt wrote. An earlier Russian strike on a lorry near the same crossing had already shut it for several hours.
Polish authorities recovered a Russian Gerbera-2 drone near Rusinowo on the West Pomeranian coast the next day. "It contained a fragmentation-high-explosive warhead together with a fuze," Colonel Bartosz Okoniewski, deputy district military prosecutor, told the Polish Press Agency, and sappers detonated it on the beach on the evening of 15 September. Polish and Lithuanian investigators believe it may have crossed Lithuania on 13 September before entering Polish airspace. Lublin and Rzeszów airports closed at about 07:00 on 16 September and again at midday on 17 September while Russian drones struck western Ukraine near the border.
Italian fighter jets flying for NATO's Baltic Air Policing mission shot down a drone near Pratkūnai, north of Kaunas, overnight into 15 September, the first shootdown in Lithuanian airspace. Vilmantas Vitkauskas, head of Lithuania's national crisis management centre, said it had most likely entered from Belarus and flew for about 30 minutes along the edges of populated areas. The Lithuanian air force commander said it was likely carrying explosives. Gitanas Nausėda identified it the next day as a Gerbera. "Most likely, it was a Russian drone intended for Ukraine that was diverted from its course by Ukrainian electronic warfare measures and entered our territory, where it was shot down," the Lithuanian president said. Robertas Kaunas, the defence minister, said the interception showed "what it means to be an ally."
A Russian frigate fired two flares at a Danish air force Fennec helicopter on a photographic flight over international waters off Gedser, Denmark said on 15 September, with one flare passing close to the aircraft. "Reckless action from Russia towards Danish military during a routine overflight yesterday," Mette Frederiksen, the Danish prime minister, said. "Russian actions are meant to intimidate and divide." Lars Løkke Rasmussen, the foreign minister, said: "Russia is gradually shifting the boundary for what they consider acceptable behaviour. That is something we cannot accept." Copenhagen summoned Vladimir Barbin, the Russian ambassador, who called the pilots' conduct "provocative."
Mark Rutte, NATO's secretary general, said on 14 September: "Russia is growing increasingly reckless as it continues its terrible war against Ukraine." He said the alliance has "all the response options" against Russia's hybrid campaign, that some of them would not be made public and that NATO "will always do what is necessary to protect every inch of Allied territory."
Romania counted 23 Russian drone incursions into its airspace in the first eight months of 2026, against 18 in the four years from 2022 to 2025, and found drone fragments on its territory 27 times, according to figures published in August. Its air force has shot down four Russian drones this year. A drone carrying explosives crashed into Galați in May, set an apartment block on fire and injured two people. A Romanian F-16 destroyed an explosive-laden sea drone on 20 August a few hundred metres from the work site of Neptun Deep, Europe's largest offshore gas project, about 80 nautical miles east of Constanța. Radu Miruță, the defence minister, said Ukraine had confirmed the drone was not Ukrainian. "This is hybrid warfare," Ursula von der Leyen, president of the European Commission, said. Romania's defence ministry said: "Based on the data and evidence we have at this time, we cannot conclude that the increased number of drone incidents on our territory is the result of a deliberate attempt to target specific locations."
Belarusian armour at the Suwałki Gap
Belarus's western military command ran tank and mechanised infantry battalions through four days of drills from 15 to 18 September under Pavel Muraveyko, chief of the general staff, at the Gozha range near Lithuania and the Brest and Ruzhany ranges, about 15 km and 60 km from Poland. Reservists were called up for territorial defence units. The ranges surround the Suwałki Gap, the strip of land along the 104 km Polish-Lithuanian border between Belarus and Russia's Kaliningrad exclave that forms NATO's only overland route to the Baltic states. Minsk called the drills "purely defensive," said they involved guarding infrastructure, manning checkpoints and fighting saboteurs and drones, and said numbers stayed below the threshold that requires notice under the 2011 Vienna Document. It gave no figure and allowed no observers. Aliaksandr Lukashenka inspected a training ground on 11 September.
Russia is building barracks, depots and equipment parks along its border with Finland and Norway. A joint investigation by NRK, SVT, DR and Delfi, published in June and based on Planet Labs satellite imagery, found Russia could station up to 80,000 troops facing Finland, against about 20,000 before the invasion of Ukraine, an assessment that Pasi Välimäki, commander of the Finnish army, confirmed. A new complex in the Pechenga district of Murmansk, near the Norwegian border, can house about 17,000 personnel. Night-time light at 16 of the 19 military sites mapped by the former Finnish intelligence officer Marko Eklund grew brighter over the past year.
Paris: the intelligence chiefs in the bunker
Emmanuel Macron gathered the leaders of every party in parliament and the declared candidates for next year's presidential election in a secure room beneath the Élysée gardens at 10:30 on 18 September. With him were the prime minister, Nicolas Lerner of the DGSE, France's foreign intelligence service, Céline Berthon of the DGSI, its domestic intelligence service, the director of military intelligence, the secretary general for defence and national security and the director general of energy. Marine Le Pen and Jean-Luc Mélenchon stayed away and sent Jordan Bardella and Manuel Bompard.
"The Russian hybrid threat against Europeans and against France has intensified," Macron said when he came out at 13:57. "Russia has multiplied its attacks against European interests." He called Tusk's warning "solid" and "documented" and said what happened at Leipzig could happen in any other European city. "We must all be vigilant, ready to act, aware that such manoeuvres and such attacks are possible in our cities and our capitals," Macron said. He ordered a plan to protect critical infrastructure "as well as the most sensitive sites of our defence industrial and technological base against drone attacks and cyberattacks" and said the attacks "will not go unanswered." "The intention behind it is to intimidate us and to derail the effort to support the Ukrainians. The consequence will be the opposite," he said. "We are not intimidated, because we know that what is at stake today in Ukraine is our security." "The situation is serious and we must remain united and mobilised," he said. Laurent Nuñez, the interior minister, had convened the prefects of every defence zone the day before "to raise the posture and the vigilance towards Russian hybrid attacks," Macron said.
Édouard Philippe, the Horizons candidate, told reporters the Leipzig operation had been "carried out at the request of the Russian services." "Our country must protect itself and prepare for an escalation that could happen," Philippe said. Raphaël Glucksmann, of Place Publique, said: "We are in a situation of hybrid war," and, of the discussion in the room: "The term state terrorism was used." Marine Tondelier, the Greens candidate, said of the Leipzig drone: "The aim was not to frighten but to kill." Fabien Roussel, the Communist candidate, said: "Everything was put on the table, including Russia's provocations." Bruno Retailleau, of Les Républicains, said he had learned nothing very precise.
Alice Rufo, the junior armed forces minister, told BFMTV-RMC on 17 September: "Russia is testing the limits, and testing NATO and the European Union." Céline Berthon told business leaders at the Medef conference on 28 August that foreign interference in France had seen a "staggering and major increase" and that hostile operations were moving towards direct violence, with the Leipzig drones as proof that physical sabotage was now possible in Europe. General Fabien Mandon, chief of the defence staff, told the National Assembly's defence committee on 9 April: "An open war with Russia remains my primary concern." He said the Russian army would grow from 1.3 million soldiers in 2025 to 1.9 million by 2030, its tanks from 4,000 to 7,000 and its combat aircraft from 1,200 to 1,500. Nicolas Lerner said on LCI in July 2025: "No service in the world can say that Vladimir Putin will attack such a country on such a day. But the ideological foundations of a military intervention are being laid."
Germany: a bomb at Leipzig and guns in a Brandenburg forest
A drone carrying about 1.8 kg of Semtex approached a Ukrainian Antonov cargo aircraft at Leipzig/Halle Airport on 4 August and was defused before it detonated. Alexander Dobrindt, the interior minister, and Johann Wadephul, the foreign minister, blamed Russia on 1 September. Dobrindt said investigators had found drone components and explosives "known to us from other Russian hybrid operations." Germany ordered the Russian consulate general in Bonn closed from 18 September and shut the Russian House in Berlin, and Moscow closed Germany's consulate general in St Petersburg. Vladimir Putin said "the proof has been planted." Euronews reported on 12 September that investigators have identified a Russian citizen named as Oleg Le., suspected of ties to the GRU, Russia's military intelligence service, and a Belarusian named as Andrei Ka., suspected of flying the drone. A US intelligence source told ABC News the device was linked to Russian military intelligence.
German federal prosecutors are investigating a hidden depot in woodland in Brandenburg on the edge of Berlin holding two handguns and ammunition, on suspicion of preparation of a serious act of violence endangering the state. Investigators found it in 2025 and watched it for months. The Federal Office for the Protection of the Constitution (BfV) believes Russian services set it up for agents carrying out "kinetic operations," NDR, WDR and Süddeutsche Zeitung reported in August. Sinan Selen, the BfV's president, named possible targets as "defence industry managers, opposition figures in exile and supporters of Ukraine." Dobrindt did not rule out the involvement of a foreign state.
General Carsten Breuer, Germany's chief of defence, said in May: "Various indicators, rearmament, increase in personnel numbers, economic and political changes, all point to one possible date of a Russian attack on NATO: 2029. Could it happen earlier? Yes."
The Nordic and Dutch services
Denmark's Security and Intelligence Service (PET) said on 3 September: "The Russian intelligence services are actively preparing acts of sabotage targeting the defence industry in Denmark." Emil Graesholm, PET's head of counterintelligence, told Berlingske that Russia recruits ordinary Danes through social media to photograph sites for sabotage planning, and that such tasks "don't need to look like a spy movie."
Finland's Security Intelligence Service (Supo) told Yle the same day: "The threat is real here as well, even though Finland itself is not a key target country." Supo said "drones containing explosives are consistent with the methods used by Russia" and that sabotage in Europe had picked up again after a quieter period. It has recorded no confirmed Russian sabotage in Finland. Alexander Stubb, the Finnish president, said on 31 August of forecasts of an imminent Russian attack: "I simply see neither evidence nor facts to support it."
The Netherlands' General Intelligence and Security Service (AIVD) and Military Intelligence and Security Service (MIVD) reported on 11 July that Russia had hacked internet-connected cameras, a small number of them along Dutch military routes, to watch transport of defence equipment to Ukraine. "The breaches allowed Russia to gather intelligence on military transport routes and defence equipment being delivered to Ukraine," the agencies said.
Sweden's Security Service (Säpo) said on 11 August that it had broken up an operation run by the SVR, Russia's foreign intelligence service, in which two SVR officers under diplomatic cover and an agent they had recruited inside another country's diplomatic mission gathered information on Swedish decision-making. "Our assessment is that we have prevented the Russian intelligence operation. They have not succeeded in their mission," Christoffer Wedelin, a senior Säpo official, said. All three have left Sweden. Norway's Police Security Service (PST) wrote in its 2026 threat assessment that "Norway is facing its most serious security situation since World War II" and named Russian crews on civilian vessels flagged in third countries as a significant threat.
The Baltic states
Estonia's security cabinet holds a memo on a possible Russian general mobilisation, which entered the government document register on 17 September. Kristen Michal, the prime minister, told ERR that Estonia could close its border with Russia immediately if a mobilisation changed the threat assessment. "The border can also be closed immediately, as we have done on occasion when there have been troublemakers at border crossing points," Michal said. Margus Tsahkna, the foreign minister, said mobilisation would raise tensions inside Russia and pressure on Europe's borders, and on 31 August called Russia's sabotage campaign "state-sponsored terrorism." Kaupo Rosin, director general of the Estonian Foreign Intelligence Service, wrote in February: "Russia has no intention of militarily attacking Estonia or any other NATO member state in the coming year."
Lithuanian military intelligence assessed in August that Russia could fly captured Ukrainian drones into Baltic energy and transport sites so that Ukraine would be blamed. "We are talking about a false-flag operation involving a fake Ukrainian drone," Kaunas said on 10 August. "One of the aims is for NATO to hesitate and reduce its support for Ukraine." Nausėda said the intelligence did not give a place or a time. Andris Kulbergs, the Latvian prime minister, said on 31 August: "Readiness for a possible threat is not the same as an immediate threat," and kept Latvia's military threat level unchanged.
Žygimantas Solovjovas, head of civil protection at Vilnius city municipality, told Polish Radio on 16 September that one of three evacuation routes from the Lithuanian capital runs to Poland, with the others running north and west inside Lithuania. "Vilnius residents should not expect that during shelling they will leave the city," he said. Local governments in Poland's Podlaskie province are drafting plans to move evacuees from the Baltic states through the region. Lithuania presented the updated plan about a year ago, and no evacuation has been ordered.
Washington, London and Bern
US intelligence assessed that Russia could test NATO with a limited attack on the eastern flank as early as this autumn, the Wall Street Journal reported on 6 August, reversing an earlier view that Moscow would not move against the alliance while fighting in Ukraine. "The Kremlin, Putin, needs a new escalation, some kind of new victory, and in this case the Baltic region and Poland are the closest targets," Kaunas said at the time. John Ratcliffe, director of the CIA, flew to Moscow on 25 August and, according to CNN, cautioned Russian officials against attacks on NATO members, including cyberattacks and limited incursions into the Baltic states.
Donald Trump said on 17 September that "major progress is being made toward establishing a U.S. Army base in Poland" and that its location would be announced "very soon." Karol Nawrocki, the Polish president, said Poland would "do its utmost to provide the best possible location." About 10,000 US troops rotate through Poland, and Władysław Kosiniak-Kamysz, the defence minister, has named Poznań and Wrocław as candidate sites. The Pentagon is weighing options to withdraw between 25,000 and 40,000 US troops from Europe as a whole, Stars and Stripes reported, with a decision expected within two months.
Vladimir Putin was asked in Bishkek on 1 September whether British military sites could be struck if British missiles were used against Russia. "That's a secret. A military secret," Putin said. "Any military facilities in Ukraine are our legitimate target, British or otherwise." British security officials told Andy Burnham, the prime minister, on 26 August to expect retaliation, the Daily Mail reported. "An attack on the UK's defence and security infrastructure is inevitable, based on our high-profile support for Ukraine," one official said.
Switzerland's Federal Council adopted a new security policy strategy on 18 September with 10 objectives and 46 measures to reduce vulnerabilities, protect civilians and infrastructure and rebuild the capacity to defend against armed attack. It names Russia's war against Ukraine and hybrid threats among the main dangers and states that "the international order is becoming progressively weaker."
What official guidance tells civilians to do
France's national guide Tous responsables, published in November 2025, Poland's safety handbook, sent to all 17 million Polish households in January 2026, and the European Commission's preparedness strategy of March 2025 give the same core instructions. Each country's own sirens, alert systems and shelters apply locally.
- Keep supplies for at least 72 hours at home. France's list: six litres of bottled water per person, food that needs no cooking, daily medication and prescriptions, a first-aid kit, spare glasses, a battery radio with spare batteries, a torch, candles and matches, warm clothing and a survival blanket, a phone charger and power bank, a multitool and tin opener, copies of identity documents in a waterproof pouch, spare house and car keys and cash, because cash machines may not work. Check the kit twice a year.
- Pack an evacuation bag with the same documents, medication, cash, a charger and warm clothes so you can leave within minutes, as Poland's handbook advises.
- Learn your local alert. In France the national siren sounds three cycles of one minute and 41 seconds separated by five seconds of silence, and the all-clear is a continuous 30-second tone. France also sends FR-Alert messages to mobile phones in a danger zone.
- Find your nearest shelter now. Poland lists public shelters in a government app, and other countries publish shelter locations through municipal or civil protection services.
- When the alert sounds, go indoors and stay there. France's guide says not to go outside and not to leave shelter without instructions from the authorities. Close doors and windows, switch off ventilation, keep away from windows and do not use naked flames.
- Keep phone lines free for emergency services and follow official radio, television and municipal channels. Do not collect children from school, because schools shelter pupils under their own plans.
- Leave home only when the authorities order an evacuation, and use the routes they give. Vilnius officials say residents must leave before shelling starts, on official instruction, or shelter where they are.
- Do not share unverified reports, videos or casualty claims. France's guide warns that a military confrontation would bring disinformation at home and tells citizens to check information against official sources.
- Call 112, the emergency number that works across the European Union.
- Volunteer through official channels. e.g. France's guide points to the National Guard military reserve (https://www.defense.gouv.fr/garde-nationale), the health reserve run by Santé publique France (https://www.santepubliquefrance.fr/en/health-reserve), volunteer fire services through the fire and rescue service (SDIS) of each department and civil volunteering on the government platform JeVeuxAider (https://www.jeveuxaider.gouv.fr/).
