EMET NEWS PRESS

The IISS Assessment

The July 2026 research paper by Charlie Edwards, Rex Fox O’Loughlin and Louis Bearn examines 144 selected incidents recorded between August 2024 and February 2026 across twelve NATO states and Ireland. Germany accounts for 58 reported incidents, followed by Belgium with 25, Denmark with 16 and the Netherlands with nine.

Approximately 48 per cent of the selected sightings occurred over military facilities, 18 per cent over civilian airports and 26 per cent over ports, energy installations or other critical infrastructure. Reported activity increased sharply between September and December 2025, reaching an average of 22.5 incidents per month compared with approximately four per month during the preceding period.

The targeting pattern deserves attention. Incidents were reported around Ramstein, RAF Lakenheath, Kleine-Brogel, Volkel, Île Longue and several German military and industrial sites. These locations include NATO command infrastructure, bases associated with nuclear deterrence, naval facilities, energy terminals and nodes involved in supporting Ukraine.

The report interprets the activity through the Russian concept of reconnaissance by battle. 

Under this model, the drone does not have to penetrate undetected or return with conventional imagery to complete its mission. The defensive reaction becomes part of the collected intelligence. Radar activation, electronic countermeasures, fighter launches, police mobilisation, airport closures and delays in political authorisation reveal capabilities, procedures and operational thresholds.

That interpretation is credible. Repeated incursions can simultaneously measure reaction times, identify sensor coverage, expose jurisdictional gaps and impose disproportionate costs. They can also establish a new baseline in which violations of protected airspace become frequent enough to be treated as disruption rather than hostile state activity.

What the Evidence Establishes

The strongest individual case occurred in the Øresund on 26 February 2026. Swedish forces observed a drone launching from the Russian signals-intelligence vessel Zhigulevsk during the visit of the French aircraft carrier Charles de Gaulle to Malmö. Swedish systems detected the activity and activated electronic countermeasures. Subsequent technical analysis confirmed an unauthorised Russian drone flight.

This incident establishes three material facts. Russia possesses the capability to deploy drones from vessels close to sensitive European military assets. Such activity can be conducted inside the ambiguous operating environment of a busy maritime passage. European forces can attribute an incident when they possess continuous surveillance, technical collection and an identified launch platform.

The broader pattern is also operationally plausible. Commercial vessels provide mobility, endurance, accommodation for trained personnel and substantial deck space. Launch locations can be changed without crossing a land border. AIS manipulation, flags of convenience, opaque ownership structures and transponder gaps complicate retrospective investigation. Fixed-wing, vertical-take-off and commercially modified platforms could all be operated from suitable vessels.

The report is also correct that conventional European air-defence systems were optimised for aircraft and missiles presenting clearer radar signatures and more predictable flight profiles. Small drones operating at low altitude can disappear into ground clutter, avoid cooperative identification systems and create an unfavourable cost ratio if intercepted with high-value missiles or combat aircraft.

Where the Attribution Becomes Vulnerable

The IISS assessment relies on four source streams: AIS maritime tracking, ACLED incident data, media reporting and interviews with European security officials. None independently proves that a selected commercial vessel launched a drone. Their combination can strengthen an attribution, but only when the underlying selection and correlation methods are sufficiently transparent.

The complete incident dataset, coding rules and vessel-selection criteria are not published as an auditable annex. Readers therefore cannot independently determine why particular sightings were included, which were excluded as hobbyist activity or misidentification, or how competing explanations were weighted. The report also does not provide a statistical baseline showing how frequently Russian-linked vessels would have been present within the chosen distance bands on nights without drone incidents.

This creates a base-rate problem. Russian-linked merchant traffic is persistent in the Baltic, North Sea and Atlantic approaches. A vessel located 100, 200 or 400 kilometres from an incident may demonstrate opportunity, but proximity in a heavily trafficked maritime region does not establish operational involvement. A valid test would compare incident periods with control periods, account for overall shipping density and define the suspect-vessel population before examining the correlation.

AIS blackouts are similarly ambiguous. They can indicate sanctions evasion, equipment failure, poor reception, safety-related conduct or deliberate concealment. An unidentified ship detected by synthetic-aperture radar may justify further investigation, although its presence alone does not identify its operator, cargo or activity.

The report acknowledges that an independent review of 61 European sightings found no confirmation of a hostile or illegal drone in 55 cases. The paper argues that such uncertainty may itself serve a Russian strategy of engineered ambiguity. That is possible, but it creates a methodological risk: the absence of confirming evidence cannot automatically become evidence that the operation was designed to prevent confirmation. Without independent technical indicators, the hypothesis becomes difficult to falsify.

Source quality also varies. Official military statements and technical records stand alongside press reports, eyewitness accounts and confidential interviews. The latter may provide essential context, but they cannot be independently tested. No publicly presented case involving a suspected shadow-fleet tanker contains the complete chain expected for high-confidence attribution: verified drone detection, recorded flight path, technical telemetry, identified launch point, platform forensics and demonstrable command relationships.

The report uses “highly likely” for the existence of a Kremlin campaign but later describes its Kremlin-level orchestration assessment as carrying medium confidence. Probability and evidential confidence are separate concepts in intelligence analysis, so the two formulations are not necessarily contradictory. The paper does not, however, define its probability and confidence scales. This weakens the precision of its most consequential judgment.

Leipzig/Halle and Mechernich

Events after the IISS reporting period reinforce the threat assessment while leaving the maritime attribution unresolved.

During the night of 4–5 August 2026, a drone equipped with professional explosive material and a detonator was discovered at Leipzig/Halle Airport. The Federal Public Prosecutor General assumed the investigation after finding sufficient indications that an explosion had been intended on the airport premises. A cargo aircraft approaching the airport may also have collided with a separate drone. No perpetrator or directing state has been publicly identified.

The Leipzig/Halle incident demonstrates that drones can be used for attempted physical sabotage against European transport infrastructure. Whether it is connected to the earlier surveillance and disruption pattern examined by the IISS remains unknown. It fits the same target category but cannot validate the shadow-fleet hypothesis or establish Russian responsibility. The launch point, control method, perpetrators and any directing actor remain under investigation.

During the night of 6–7 August 2026, further drone activity was reported above the Bundeswehr facility at Mechernich, where Patriot air-defence systems are maintained. The Bundeswehr confirmed that two drones had been sighted. Investigative reporting stated that private security personnel recorded six separate overflight events between 10 p.m. and 5 a.m. Police officers and Bundeswehr military police reportedly observed at least one later overflight, with the military police viewing the aircraft from approximately 40 metres.

An initial assessment contained in a confidential police report identified the observed aircraft as possibly resembling a Fly-380 VTOL. This identification remains preliminary. The publicly available information does not establish how many individual aircraft generated the six reported overflights. The number of confirmed drones and the number of observed passes must therefore remain analytically separate.

The proximity in time of Leipzig/Halle and Mechernich strengthens the assessment that German military logistics and Ukraine-support infrastructure face sustained UAV surveillance or attack risk. Neither incident has been publicly attributed to Russia as of 9 August 2026.

European and German Response

The European Commission’s February 2026 Action Plan on Drone and Counter-Drone Security recognises gaps in detection, civil-military coordination, critical-infrastructure protection and cross-border response. It proposes common testing, improved command-and-control systems, rapid counter-drone teams and closer cooperation between the EU, NATO and Ukraine.

The action plan expressly includes maritime resilience and maritime-domain awareness. It does not yet create an integrated mechanism for identifying, inspecting or interdicting commercial vessels suspected of supporting airborne drone operations. The IISS criticism is therefore directionally correct, although its description understates the maritime provisions already contained in the EU framework.

Germany has established the Joint Drone Defence Centre, bringing together federal and state police, the Federal Criminal Police Office and the Bundeswehr. It can combine situation reporting and technical expertise, but the decision-making powers of the participating authorities remain institutionally separate. Coordination does not by itself resolve the constitutional, legal and operational division between police responsibility, military assistance and aviation safety.

The decisive requirement is a shared low-altitude air picture combining radar, passive radio-frequency detection, optical and infrared sensors, acoustic arrays, telecommunications data and forensic exploitation. Every serious incident should generate a standardised evidence package suitable for intelligence analysis and criminal proceedings.

Maritime attribution requires more than AIS correlation. Vessel tracks must be combined with satellite imagery, radio-frequency emissions, communications intelligence, port inspections, crew records, ownership networks, financial data and drone flight reconstruction. Ships repeatedly associated with high-confidence incidents should face coordinated port-state inspections and evidence-preservation measures under existing maritime and sanctions law.

Defensive systems must also provide proportional response options. Electronic takeover, communications disruption and navigation interference should be available alongside interceptor drones, low-cost kinetic systems and conventional air defence. The choice of effect must account for falling debris, explosives, civilian aircraft and densely populated areas.

Intelligence Assessment

There is high confidence that malicious and unauthorised UAV activity presents a persistent threat to European military sites, civil aviation and critical infrastructure. There is equally high confidence that current detection, attribution and response structures remain uneven and fragmented.

There is medium confidence that Russian state or state-linked structures are responsible for a subset of the activity and employ drones as part of wider intelligence-collection and hybrid-pressure operations. Publicly available evidence does not permit the size of that subset to be quantified. The Zhigulevsk incident proves Russian capability and responsibility for one documented maritime operation, but it cannot be extrapolated to the wider dataset without additional evidence.

There is low-to-medium confidence, on publicly available evidence, that shadow-fleet tankers and Russian-linked commercial vessels formed a recurring launch-and-recovery network responsible for a substantial share of the 144 selected incidents. The hypothesis is technically plausible and operationally rational, but remains supported primarily by geographic correlation, opportunity and confidential assessments.

The proposition that the selected incidents constitute one centrally directed Kremlin operation cannot be established above medium confidence from the published material. Competing explanations include parallel operations by different Russian services, locally recruited proxies, unrelated illegal drone activity and misidentification.

The IISS report’s most important finding survives these limitations: Europe’s principal weakness is the gap between detecting an ambiguous intrusion and producing the legal, technical and political certainty required for action. Russia does not need every drone to succeed. It gains intelligence and coercive value whenever European authorities expose their sensors, delay decisions, close airports or fail to establish attribution.

Glossary

• AIS – Automatic Identification System used to transmit vessel identity and position.

• C-UAS – Counter-Unmanned Aircraft Systems.

• GDAZ – Germany’s Joint Drone Defence Centre.

• ISR – Intelligence, Surveillance and Reconnaissance.

• KRITIS – Critical infrastructure.

• RF – Radio frequency.

• ROE – Rules of engagement.

• SAR – Synthetic-aperture radar.

• SIGINT – Signals intelligence.

• UAV – Uninhabited Aerial Vehicle in the terminology used by the IISS report; also commonly termed an unmanned or uncrewed aerial vehicle.

• VTOL – Vertical take-off and landing.

Persons Register

• Charlie Edwards – IISS senior fellow and co-author of the research paper.

• Rex Fox O’Loughlin – IISS analyst and co-author.

• Louis Bearn – IISS project manager and co-author.

• Alexander Dobrindt – German Federal Minister of the Interior.

References

International Institute for Strategic Studies – Russia’s UAV Campaign Over Europe – 2 July 2026
iiss.org/research-paper/2026/06/russias-uav-campaign-over-europe/

Swedish Armed Forces – Confirmation of a Russian Drone Observation – 27 February 2026
forsvarsmakten.se/aktuellt/nyheter/forsvarsmakten-bekraftar-observation-av-rysk-dronare/

European Commission – Action Plan on Drone and Counter-Drone Security – 11 February 2026

eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52026DC0081

German Federal Public Prosecutor General – Investigation into the Drone Found at Leipzig/Halle Airport – 6 August 2026

generalbundesanwalt.de/SharedDocs/Pressemitteilungen/DE/2026/Pressemitteilung-vom-06-08-2026.html

German Federal Government – Measures Against Hybrid Attacks and Drone Incidents – 6 August 2026
bundesregierung.de/breg-de/aktuelles/hybride-bedrohung-fragen-antworten-faq-2449150

Tagesschau – Suspicious Drone Activity over the Bundeswehr Facility at Mechernich – 7 August 2026
tagesschau.de/investigativ/drohnenueberfluge-100.html

Reuters – Germany Warns of Daily Hybrid Warfare after Suspected Drone Attack – 9 August 2026
reuters.com/world/german-minister-warns-daily-hybrid-warfare-after-suspected-drone-attack-2026-08-08/

German Bundestag – Expert Hearing on the Aviation Security Act and Drone Defence – 26 January 2026
bundestag.de/dokumente/textarchiv/2026/kw05-pa-inneres-luftsicherheit-1137322