Europe learns the wrong lesson from Russia’s drone war

European governments are preparing for a form of confrontation that their current investments do not fully match.

While Russia-linked sabotage typically uses drones, logistics networks, criminal intermediaries and deniable proxies against European cities, official policies and national strategies remain focused on detecting and intercepting each incident as it occurs.

This approach only addresses the attack instrument, leaving the vulnerability it exploits largely neglected.

This vulnerability is obvious: the European security architecture remains slow, fragmented and costly to mobilize across agencies and national borders.

In this environment, drone incursions become just separate incidents, while the problem of lengthy and ineffective responses remains. The August 4 incident at Leipzig/Halle Airport, with a quadcopter carrying plastic explosives that went unnoticed by security systems and landed near a Ukrainian cargo plane without exploding, is part of a broader pattern of Russian sabotage activities against European cities, particularly those targeting the continent’s main airports.

Each case, whether or not an attack was intentional or carried out, leaves the same residue of uncertainty, and this uncertainty is what makes a cheap and deniable activity so effective against otherwise very capable institutions.

A drone flying near or above an airport can disrupt the normal operation of critical civilian infrastructure by forcing the immediate closure of airports, overburdening the work of police and intelligence services, and occupying resources even if no attack ensues.

Democratic governments have legitimate reasons to take ambiguous threats seriously, but this very caution may give Moscow and its proxies an operational advantage, since an attacker capable of creating enough doubt to disrupt normal activity need not defeat an air defense system at all.

Thus, the strategic value of such operations lies in their ability to force the defender to devote time, resources, and political capital to determining whether an attack actually occurs.

Under these conditions, Europe could win individual tactical engagements while losing the broader struggle for resources, resilience and pace.

More importantly, the European interpretation of Russia’s drone campaign in Ukraine has focused attention on counter-drone technology, sensors, and interception systems, all of which are necessary to protect infrastructure but cannot compensate for the institutional fragmentation that an adversary actively exploits.

In fact, Ukraine’s experience demonstrates the importance of an organizational approach.

In the face of years-long Russian drone attacks, Ukraine has gradually connected battlefield reporting, aerial surveillance data, acoustic and other sensor inputs, drone feeds, and intelligence into increasingly integrated situational awareness and command systems, including the DELTA platform, allowing information from different sources to be collated and distributed to those responsible for the action.

It also adapted its response architecture by combining centralized information with distributed defensive capabilities, allowing mobile units and teams to respond to threats without waiting for each decision to go through a complex hierarchical process.

As a result, Ukraine has streamlined the process of detection, identification, decision and action. This is a useful model that Europe should explore.

Attribution is another issue, because deniable sabotage is designed to take advantage of the interval between an incident and a verdict.

When investigators need several weeks to establish responsibility, as was the case in the Leipzig incident, where German authorities took around four weeks to publicly assign responsibility to Russia, attribution becomes a retrospective exercise and no longer functions as an indispensable aspect of deterrence and defense.

This is because public attribution requires credible evidence, and obtaining one can take a long time before authorities establish rock-solid data. .

However, when a citizen suddenly finds themselves stranded at an airport due to a drone-related disruption, the consequences of a delay in decision-making are immediate and tangible.

To effectively address these challenges, Europe must organize counter-sabotage efforts that would integrate connections, allowing aviation authorities, law enforcement, intelligence services and armed forces to share information across institutional and national boundaries before an incident develops into a crisis.

In this process, it is essential to apply the lessons of the Ukrainian experience, because Ukraine was forced to solve the problem that Europe faces today, and it learned how to transform fragmented information into a usable operational picture, and then convert that picture into action before an adversary can use the gap as a weapon.

Intercepting a drone can prevent an incident, but it cannot address the larger system behind it, leaving the entire process supporting a single drone operation largely intact.

Success should therefore not be measured by the number of drones intercepted, as this does not reflect much on the capabilities of the entire system.

The decisive advantage is to ensure that Russia, not Europe, is forced to react, deprived of initiative, deprived of the ability to dictate the pace and forced to deal with operational costs and risks. Because it is only by regaining the initiative that Europe will be able to move from a posture of reaction to one of control and force its adversaries to put themselves on the defensive.

Editor’s note: The views expressed in the opinion section are those of the authors and do not purport to reflect the views of the Kyiv Independent.