BERLIN — The device left at Leipzig Airport in early August was the size of a microwave oven. Eight hundred grams of pentaerythritol tetranitrate, a triggering mechanism that failed, and a Ukrainian cargo aircraft parked thirty metres away. German investigators eventually traced it to Russia’s military intelligence directorate — a finding that Al Jazeera reported Berlin confirmed publicly on September 1. This week, three of Europe’s most senior intelligence chiefs looked at that incident and arrived at a conclusion they delivered in unison: Leipzig was not an isolated act of sabotage. It was a shift.
Speaking to The Guardian in a rare joint interview published Sunday, the heads of intelligence services in the Czech Republic, Sweden, and Latvia warned that Russia’s covert campaign against European targets is entering a more aggressive phase and that Moscow’s threshold for direct action against NATO territory is lower today than at any point since the Cold War.
“We are no longer speaking in years,” Michal Koudelka, director of the Czech Security Information Service, told the newspaper. “Months is the more accurate word.”
The three chiefs — Koudelka, Thomas Nilsson of Sweden’s Military Intelligence and Security Service, and Latvia’s Normunds Mežviets — chose to make their assessments simultaneously and on the record. That coordinated visibility carries its own signal: Europe’s security establishment is not merely tracking what it sees; it wants Moscow to know it is watching.
For Nilsson, the Leipzig Airport incident crossed a line that previous acts of sabotage had not. The quadcopter drone found on airport grounds was not targeting civilian infrastructure at random. Leipzig serves as a hub for NATO’s Strategic Airlift International Solution mission, handling military equipment shipments to eastern European allies and Ukraine through flights operated by Ukrainian cargo companies. Targeting it was, in Nilsson’s framing, an attack on alliance logistics — a step toward deliberate military disruption rather than the arson and harassment campaigns that preceded it. “This was a gamechanger,” he said.
German Interior Minister Alexander Dobrindt told reporters last month that investigators had established, through forensic analysis and intelligence findings, that agents controlling the drone were operating on behalf of Russian state entities. The device bore hallmarks typical of GRU operations, according to United States intelligence.
That denial runs alongside a pattern of public dismissals that have done little to quiet the debate inside European capitals. In September, Polish Prime Minister Donald Tusk warned that Russia was preparing scenarios involving drone incursions into Poland and Baltic states designed to test the alliance’s mutual-defence clause. Finland, Estonia, and Norway published similar threat assessments within weeks of each other over the summer.
What distinguishes Sunday’s joint statement is not its conclusion but the fracture visible within it. Mežviets, the Latvian chief, urged measured interpretation: there were no current indicators pointing to an imminent conventional military attack. The gap between Koudelka’s “months not years” framing and Mežviets’ qualified dissent captures an enduring problem for Western policymakers — the tempo of Russian hybrid operations is accelerating, but the line between hybrid escalation and outright conventional conflict remains a contested inference rather than a settled assessment.
That uncertainty is arriving at a difficult moment for the alliance. A Pentagon review under active consideration would pull up to forty thousand American troops from European bases — reducing exactly the forward presence that deterrence theorists argue prevents Moscow from miscalculating the cost of military action. European Commission President Ursula von der Leyen proposed a new European Security Council and a continent-wide anti-hybrid playbook at the State of the European Union address last week, acknowledging that existing frameworks were designed for a different threat environment.
The alliance’s own position on Article 5 and sub-threshold sabotage remains unresolved. A device found near a military aircraft that fails to detonate does not obviously activate NATO’s collective defence obligation. That ambiguity, the intelligence chiefs suggest, is precisely where Russia has been probing — testing the gap between what the alliance can tolerate and what it can legally characterise as an act of war.
Russia has also expanded its toolkit beyond drone deployments. Russia’s GUGI directorate tested cable-disabling weaponry near Svalbard this spring, driven off by British, Norwegian, and American forces before the exercise could be completed. Arson attacks on logistics warehouses in Poland and Germany have been attributed to Russian intelligence. A NATO assessment documented at least 144 suspected Russian drone sightings over six European member states between 2024 and 2026.
Nilsson described Moscow’s objective as not conquest but erosion: diminishing public support for Ukraine, seeding division within NATO, and creating an atmosphere of threat that corrodes political will before any border has been crossed. The sabotage campaign, in that framing, is less a prelude to war than a substitute for it — a way to achieve strategic degradation at a cost that stays below the threshold of obvious retaliation.
Russia’s warship movements in the Baltic have added texture to that atmosphere without clarifying intent. As of Sunday, three intelligence chiefs had seen the same evidence. One called it months. Another said a conventional attack was not yet imminent. The device at Leipzig Airport still failed to detonate. What any of that means for the week after next remains, for now, an open question.
