Romanian intelligence services say a Russian-directed network was responsible for a fire near an arms manufacturing facility in Brașov. Investigations involving Germany and Poland have exposed what authorities describe as a wider operation targeting military and industrial defence infrastructure across Europe.

Romania has accused Russia of coordinating a cross-border sabotage network responsible for an industrial fire near an arms manufacturing facility, prompting a diplomatic confrontation with Moscow and investigations involving several European countries.

Romanian intelligence and prosecutors announced on 26th October that they had identified three foreign nationals allegedly involved in the operation, which caused a fire on an industrial site in Brașov on 14th September.

The suspects, two Belarusian nationals and one Ukrainian, are alleged to have participated in a network directed by individuals operating from Russia.

Two suspects have been detained in Germany, while a third has been located in Poland.

Romania is seeking their extradition as investigators examine possible connections to other attempted attacks against military and industrial installations.

Russia has rejected the allegations.

The case has drawn attention to the security of European defence production facilities at a time when NATO governments are seeking to increase military manufacturing capacity and sustain assistance to Ukraine.

Fire near a Romanian arms manufacturer

The investigation concerns an industrial complex in Brașov, a city with an established defence manufacturing sector.

The fire occurred on 14th September at premises situated close to CARFIL SA, a subsidiary of Romania’s state-owned defence company ROMARM.

According to the Romanian Intelligence Service, the incident was caused by individuals belonging to a sabotage network coordinated from the Russian Federation.

The fire damaged premises occupied by several commercial businesses.

Although the industrial site is associated with the CARFIL complex, authorities have not established publicly that the arms manufacturing facility itself sustained damage.

That geographical distinction is important when assessing the consequences of the operation.

CARFIL manufactures military equipment and ammunition and has pursued partnerships involving drones, explosives and other defence technologies.

Its proximity to the incident has heightened concerns about the security of industrial facilities supporting Romania’s armed forces.

Suspects identified in three countries

Romania’s Directorate for Investigating Organised Crime and Terrorism, known as DIICOT, says the evidence connects three individuals to the incident.

According to Romanian national news agency AGERPRES, the Bucharest Court of Appeal issued European arrest warrants following the investigation.

Two suspects were detained in Germany while allegedly preparing similar operations.

The third was located in Poland, where authorities received a further European arrest warrant issued on 26 October.

Romanian prosecutors are pursuing extradition procedures.

The nationalities of the suspects do not establish responsibility on the part of Belarus or Ukraine. Romanian authorities attribute the alleged coordination to individuals based in Russia.

The investigation also indicates that the Brașov incident may not have been an isolated operation.

Romanian intelligence claims the network’s potential targets included government-owned and private arms manufacturers, military-related facilities and other strategic industrial sites in several European countries.

Those claims remain subject to ongoing criminal investigation.

Bucharest summons Russian ambassador

The Romanian government escalated the matter diplomatically on 27th October.

Foreign Minister Dan Neculăescu summoned Russia’s ambassador, Vladimir Lipaev, to deliver a formal protest concerning the alleged operation.

According to the Romanian Foreign Ministry’s account reported by AGERPRES, Bucharest stated that evidence gathered during the investigation demonstrated Russian responsibility.

The ministry described the operation as part of a broader pattern of hostile activity affecting European states.

President Nicușor Dan also condemned the alleged sabotage, linking it to attempts to undermine European security and solidarity.

Moscow rejected the accusations.

The Russian Embassy maintained that the allegations were unfounded and disputed Romania’s account of the evidence presented during the diplomatic meeting.

The conflicting positions mean the attribution remains contested, notwithstanding the conclusions announced by Romania’s intelligence authorities.

A recruitment model designed for deniability

The Romanian Intelligence Service has provided details about how it believes the wider network recruits and directs participants.

According to its statement, recruitment can begin through social media with offers of payment for apparently minor activities, such as photographing or observing particular locations.

Subsequent assignments may become more serious, involving property destruction, arson or other acts of violence.

Individuals may be targeted because of financial difficulties or other personal vulnerabilities.

The service also identified methods allegedly used to conceal movements, payments and communications.

These include encrypted messaging applications, telephone numbers registered outside the country of operation and accommodation or transport arrangements booked under other identities.

Such methods can complicate investigations because the individuals physically carrying out an operation may have limited knowledge of the organisers.

Romanian authorities emphasised that individual indicators should be assessed in context and do not themselves prove involvement in sabotage.

Defence factories become a security concern

The case has implications beyond Romania.

European governments are investing in ammunition production, air defence systems and military technologies, partly in response to the continuing war in Ukraine.

The resulting expansion of manufacturing capacity creates additional infrastructure requiring protection.

Industrial sites may be vulnerable not only to direct attacks but also to disruption affecting nearby businesses, transport networks, power supplies and specialist contractors.

The Brașov investigation illustrates how an incident outside a defence factory’s perimeter can nevertheless raise questions about the security of the wider industrial complex.

It also demonstrates the importance of cooperation between European intelligence services and criminal investigators.

The detention of suspects in Germany and the identification of another in Poland show that investigations into alleged sabotage may cross several jurisdictions.

The wider European response

Romania’s allegations come amid growing concern over hostile activities involving cyberattacks, disinformation, surveillance and physical sabotage.

Attributing such incidents to a foreign government requires intelligence assessments, criminal evidence and international cooperation.

The public allegations against Russia do not replace the judicial process concerning the three suspects.

However, the investigation has already prompted a diplomatic response and additional scrutiny of industrial security.

For European governments seeking to expand their defence industries, the immediate challenge is protecting production facilities and associated infrastructure without allowing relatively small-scale disruptive operations to undermine wider manufacturing programmes.

The outcome of Romania’s criminal proceedings will be important in establishing the responsibility of those accused and clarifying how the alleged network operated across national borders.

Main Image: By MAPN – http://www.mapn.ro/fotodb/20051020_expomil?page=1, CC BY-SA 3.0, https://commons.wikimedia.org/w/index.php?curid=14997305

Europe has already learned to better recognize hybrid threats, which is definitely a good thing, but recognition alone is not enough and doesn't serve as sufficient deterrence.

European officials have grown accustomed to scenarios where a cyberattack disrupts public services and critical infrastructure, drones appear over sensitive sites,

Men before a British court charged under the National Security act over an alleged, attempted Iranian state-backed guerrilla attack.

The post First Alleged RAF Fairford American Base Plotters Appear Before Court appeared first on Breitbart.

The attack is "part of a larger campaign of sabotage operations attributed to the Russian Federation in Europe," according to the Romanian Intelligence Service.

Journalists from 17 European public service broadcasters, coordinated by the European Broadcasting Union’s (EBU) Eurovision News Spotlight network, published an interactive map on 23 October 2026. It documents hybrid incidents linked to Russia across 17 European countries between 1 April and 15 October. Journalists compiled a database of hundreds of reported incidents, categorizing each by type and the source and strength of its alleged links to Russia, then verifying them through open-source research.

The map comes as officials warn the campaign is growing. On 28 September, EU foreign policy chief Kaja Kallas said in Brussels that Russia was planning more acts of sabotage to divide societies and intimidate them into abandoning their support for Ukraine. The points on the map represent an incomplete list of publicly known cases attributed to Russia or suspected of being linked to it, the report states.

The map covers airspace violations, sabotage attempts, “disposable” agents with no formal intelligence training, migration used as a weapon, and Russian military activity near or across European borders. It excludes cyberattacks, influence operations, and espionage by trained intelligence officers.

The EBU calls the result a very conservative estimate, not an official tally. Russia has consistently denied responsibility for the incidents. Many single points represent several incidents of the same type in one area or in quick succession. In Moldova, for example, Defense Minister Anatolie Nosatîi said on 30 September that the government had recorded 84 drone incursions.

Four German incidents are on the map, out of many more

The map shows four incidents in Germany, according to BR.

• On 2 August, German authorities arrested a 33-year-old Ukrainian man in Thuringia on suspicion of photographing a Bavarian weapons manufacturer for a foreign intelligence service as part of an alleged sabotage plot.
• On 4 August, a drone carrying explosives and a detonator struck the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but failed to explode.
• On 3 September, attackers threw firebombs from a car onto a construction site next to defense firms in Munich, and German security authorities suspect Russian intelligence.
• On 14 September, investigators learned of a crashed drone found near the Bundeswehr’s Wunstorf air base.

Internal papers from the new Joint Hybrid Defense Center, seen by Correctiv, record 163 suspected sabotage cases in 2026 up to 19 August. The targets included rail lines, military facilities, substations, and radio masts. The same papers record 1,034 drone overflights of critical infrastructure, military sites, and defense companies, and 25 espionage investigations. The papers cover possible attacks by Russia, China, and Iran, and media did not report a breakdown of the sabotage cases by country.

European leaders sound the alarm over Russian hybrid attacks

On 15 April, Swedish civil defense minister Carl-Oskar Bohlin said pro-Russian groups had moved from denial-of-service attacks to attempts at destructive cyberattacks, including one on a Swedish power plant in 2025. On 1 September, German Foreign Minister Johann Wadephul named Russia as the perpetrator of the Leipzig attack and accused Moscow of “blatant hostility” toward Germany.

On 18 September, French President Emmanuel Macron said Russia’s hybrid attacks would not go unanswered and ordered a plan to protect France’s critical infrastructure. On 1 October, German Chancellor Friedrich Merz said Germany was preparing for new hybrid attacks, “including serious ones.” NATO Secretary General Mark Rutte on 14 October called the attacks a sign of Russian weakness at a press conference in Tallinn and said NATO would react where needed without being “rattled.”

An investigation involving 17 European public-service news organisations has documented hundreds of suspected hybrid attacks across Europe in just over six months, revealing the scale of a security challenge that increasingly extends beyond conventional espionage and cyberwarfare.

The investigation, coordinated by the European Broadcasting Union, examined incidents reported between 1st April and 15th October 2026, including sabotage attempts, arson, airspace violations, suspicious drone activity and the exploitation of migration routes along the European Union’s eastern borders.

Published on 23rd October, the resulting interactive map provides a geographical picture of incidents publicly linked to Russia by intelligence agencies, law-enforcement authorities, government officials or reporting. The degree of attribution varies considerably, however, and many incidents remain under investigation.

The findings point to a fundamental problem for European security: hostile activities can be conducted across national boundaries without necessarily triggering the legal, military or political mechanisms designed to respond to conventional aggression.

Sabotage Without Conventional Warfare

Among the cases examined is an incident in Munich in September, when two Bulgarian nationals allegedly threw incendiary devices from a moving vehicle onto a construction site near several defence companies.

Police arrested the suspects after a witness reported the incident. Bavarian Interior Minister Joachim Herrmann and regional criminal investigators subsequently indicated that political motives were being considered. Investigators reportedly suspected possible involvement by Russia’s military intelligence service, the GRU, although the allegations have not been established in court.

The case illustrates growing concern about so-called disposable agents: individuals recruited to undertake relatively limited operations without formal intelligence training or a longstanding relationship with an intelligence service.

Such arrangements can complicate investigations. Even where perpetrators are identified, establishing a legally demonstrable connection between their actions and a foreign intelligence organisation may prove considerably more difficult.

Germany’s Federal Criminal Police Office has registered a mid-three-digit number of suspected sabotage and reconnaissance cases since the beginning of 2026, according to information provided to investigators involved in the European mapping project.

Only a small proportion have been publicly attributed to Russia. Four German incidents were included in the map, demonstrating the distinction between a broad national caseload and cases meeting the investigation’s publication criteria.

Europe’s Eastern Borders Under Pressure

The geographical distribution reveals substantial activity along NATO’s eastern flank, particularly around the Baltic states, Belarus and the Black Sea.

Incidents include repeated airspace violations, suspected reconnaissance operations and attempts to facilitate unauthorised border crossings. Lithuanian authorities have accused Belarus of deliberately exploiting migration as an instrument of political pressure.

Commercial shipping has also become increasingly exposed. Drone attacks involving vessels near Romania and Bulgaria have raised concerns about the extension of the war’s consequences into maritime areas adjoining EU and NATO territory.

These developments reinforce earlier warnings about Russia’s expanding sabotage campaign, particularly the difficulty of distinguishing isolated security incidents from coordinated operations intended to test national responses.

Teija Tiilikainen, director of the European Centre of Excellence for Countering Hybrid Threats, identified Russia’s invasion of Ukraine as an important factor behind the increasing pressure. According to her assessment, Moscow’s objectives include weakening Western unity and undermining continued support for Ukraine.

The Legal and Institutional Challenge

The central difficulty is not simply the absence of criminal legislation. Arson, espionage, sabotage and unlawful interference with critical infrastructure are already punishable under national laws.

Rather, the challenge involves establishing foreign direction, coordinating investigations across jurisdictions and identifying when a series of apparently separate offences constitutes a wider hostile campaign.

Germany’s domestic intelligence chief, Sinan Selen, has described the environment as a grey area between war and peace. German foreign intelligence chief Martin Jäger has similarly identified Russia as the country’s most dangerous adversary.

European governments are beginning to address these difficulties collectively. At their 15th–16th October summit, EU leaders condemned intensifying hybrid attacks and called for stronger resilience, greater use of existing countermeasures and accelerated work on drone security.

On 8th October, the Council also extended sanctions targeting Russian destabilisation activities until October 2027. The restrictions cover 80 individuals and 20 entities.

Meanwhile, a European Commission research initiative, published on 23rd October, proposes combining anticipation, active defence and retaliatory measures into a more coherent deterrence strategy.

From Individual Incidents to Collective Security

The investigation’s significance extends beyond the number of incidents recorded. By bringing together information previously dispersed among national authorities and separate investigations, it makes possible a wider assessment of the methods, geographical concentration and recurring characteristics of suspected hostile operations.

Nevertheless, the map does not establish Russian responsibility for every incident it records, nor does it constitute a complete European database. Russia has repeatedly denied conducting the hybrid attacks attributed to it.

For European governments, the unresolved question is how to move from recognising a pattern of hostile activity to demonstrating responsibility and responding effectively.

As EU foreign policy chief Kaja Kallas has warned, the consequences already extend beyond infrastructure disruption to risks affecting civilian lives.

The emerging security challenge therefore concerns not only the detection of individual perpetrators, but also Europe’s ability to connect incidents across borders, establish responsibility and prevent successive operations from becoming an accepted feature of the continent’s security environment.

The violence accompanying France’s October protests has revealed how foreign influence networks can exploit domestic grievances to undermine governments and European support for Ukraine. New evidence suggests Russian-linked operations were active before the riots, raising questions about whether information manipulation is moving beyond propaganda towards the mobilisation of political unrest.

France’s violent protests have exposed a vulnerability in European security that conventional policing cannot easily address: the ability of foreign information networks to exploit domestic political crises, amplify social divisions and transform legitimate grievances into instruments of geopolitical pressure.

President Emmanuel Macron has acknowledged foreign manipulation of information surrounding the disturbances of 17–18 October but insists there is no evidence that foreign actors organised the violence itself. His assessment reflects the evidence currently available, although new investigations indicate that Russian-linked networks were actively exploiting the protest movement weeks before the worst disorder began.

On 24 October, France deployed approximately 70,000 police officers and gendarmes to prevent further violence. Yet the security operation addresses only the physical consequences of a crisis whose online dimension extends across national borders.

Russia’s operations began before the riots

An investigation published on 22 October by Alliance4Europe provides evidence that Russian-linked information networks were exploiting French discontent well before the disturbances.

Researchers examined 547,471 posts and articles across nine languages. They identified 639 coordinated messages attributed with high confidence to Russia’s Doppelgänger operation, generating approximately 7.4 million views in the six weeks preceding 17 October.

The campaign used genuine concerns about living costs and public expenditure to promote a particular political argument: money allocated to Ukraine was being taken from European citizens.

This was not a random selection of grievances. France’s budget difficulties, public-service pressures and disagreements over defence expenditure provided material through which Moscow could seek to weaken support for Kyiv.

The researchers found that the operation targeted pro-European and pro-Ukraine politicians across the political spectrum. It praised selected proposals associated with Jean-Luc Mélenchon while also promoting nationalist narratives, illustrating a strategy driven less by ideological consistency than by opposition to existing European policies.

From manipulating opinion to encouraging mobilisation

An earlier investigation by EK Strategies, published on 8 October, identified an additional development.

Russian-linked channels were not merely commenting on existing demonstrations. They were circulating protest dates, identifying organisers and encouraging French audiences to follow the example of demonstrators in Germany.

On 28 September, the International Reporters network published an appeal urging French audiences to take to the streets. Other channels subsequently reproduced information about planned school blockades and demonstrations.

In one instance, a channel identified as Gavroche published rhetoric encouraging an attack on France’s Education Ministry.

Such activity goes beyond retrospective propaganda. It attempts to influence participation and behaviour while events are developing. Nevertheless, evidence that a network encouraged protests does not establish that it controlled the organisers or directed subsequent violence.

The original demonstrations arose from domestic grievances over schools, prices and government policy. The significance of the foreign activity lies in attempts to redirect and intensify an existing movement.

How France’s crisis was rewritten abroad

Once violence erupted, the information campaign acquired an international audience.

Alliance4Europe found that claims blaming migrants or Islam for the disturbances appeared in approximately one in 33 French-language posts, compared with nearly one in five English-language posts.

False allegations that immigrants had burned Limoges town hall circulated substantially more frequently in English than in French.

The same report identified 1,018 articles distributed through 28 websites associated with the Russian Pravda network. Their rapid republication across languages enabled a common narrative to reach audiences far beyond France.

The operation also presents a longer-term technological problem. Repeated publication of manipulated accounts can contaminate material subsequently retrieved or reproduced by artificial-intelligence systems, allowing false narratives to persist beyond the original campaign.

The political effects were visible when President Donald Trump and other foreign leaders portrayed France’s unrest principally through immigration and cultural conflict.

Speaking in Qatar on 21 October, Macron rejected these portrayals and criticised the circulation of fabricated AI-generated images. His remarks identified foreign manipulation after the riots but stopped short of alleging foreign responsibility for their organisation.

The Heritage Foundation and transatlantic networks

The transcript raises a more substantial allegation: that the American Heritage Foundation and Russia’s FSB have participated in a coordinated effort to destabilise France.

There are documented connections between the Heritage Foundation and political institutions associated with Hungary’s former prime minister Viktor Orbán.

A 2026 investigation into Hungarian-funded international influence networks established that the Danube Institute had channelled substantial public funding towards foreign researchers and commentators. The institute also maintained a formal relationship with Heritage.

Heritage has acknowledged its cooperation with Hungarian conservative institutions but denied receiving funding or direction from foreign governments.

These relationships demonstrate the development of transatlantic political networks capable of circulating common ideas about sovereignty, migration and European integration.

They do not establish operational cooperation with Russian intelligence. Nor has credible evidence emerged connecting Heritage to the organisation or financing of France’s October riots. Ideological convergence, institutional cooperation and participation in a clandestine operation require separate evidential assessments.

The implications for European security

The European Union’s response has exposed a regulatory problem.

Under the EU’s Digital Services Act, major online platforms must address systemic risks arising from their services, including the amplification of illegal content and threats to public security.

On 23 October, the French government announced enhanced cooperation with digital platforms. More than 100 priority reports had been submitted ahead of the weekend demonstrations, approximately half resulting in account suspensions.

These measures targeted unlawful online activity, particularly incitement to violence and looting. They did not constitute findings that the suspended accounts belonged to foreign intelligence networks.

The European Commission has likewise refrained from activating emergency measures under the Digital Services Act without sufficient evidence connecting foreign manipulation to the violence.

The broader security concern is that foreign operations can exploit the interval between the emergence of social unrest and the establishment of reliable information about its causes.

Russia need not organise an entire protest movement to advance its strategic interests. By amplifying domestic grievances, promoting hostility towards support for Ukraine and circulating distorted accounts internationally, it can attempt to convert France’s internal political difficulties into pressure on European policy.

With France approaching its 2027 presidential election, these operations warrant continuing scrutiny. The central investigative question is no longer simply whether foreign networks spread false information after violence occurred, but whether their activities before and during demonstrations materially influenced mobilisation, radicalisation or political responses.

The evidence currently demonstrates organised manipulation and attempts at amplification. Establishing direct responsibility for violence would require a further evidential step, involving financial records, communications, operational instructions or connections with identifiable perpetrators.

France’s experience illustrates how contemporary information warfare can operate within a democratic society without necessarily directing events on the ground. Its immediate objective may be to alter the political interpretation of a crisis; its longer-term consequence may be to influence the policies adopted in response.

Italian authorities are examining whether foreign interference helped intensify violent protests across the country, as Defence Minister Guido Crosetto warns that social media is being used as an instrument of hybrid warfare. Prime Minister Giorgia Meloni has introduced emergency security measures and deployed additional troops to Milan, while further demonstrations are planned for Saturday, 24 October.

Italy is investigating the possibility that foreign actors, including Russian operatives, helped amplify the violent unrest that swept Milan and other Italian cities on 17–18 October. The inquiry introduces a national security dimension to demonstrations initially driven by rising living costs, dissatisfaction with public services and broader economic grievances.

According to information disclosed about the government’s intelligence inquiries, officials working under Prime Minister Giorgia Meloni have requested assessments of whether foreign provocateurs contributed to the disorder. No public evidence has established that Moscow organised the violence, and Meloni’s office has declined to comment on the reported intelligence discussions.

The developments follow EU Today’s earlier coverage of the Milan disturbances, which documented extensive looting, attacks on police and the detention of hundreds of young people, many of them minors. Since then, Rome has moved beyond emergency consultations, approving legislation that expands police powers and introduces tougher criminal penalties for violent demonstrations.

On Saturday, 24 October, Italian security forces are preparing for another wave of protests, with additional military personnel, drones and specialist police units deployed in several major cities. The immediate question is whether the government can prevent further disorder while establishing how much of the unrest was locally organised and whether foreign information operations influenced its development.

Crosetto warns of hybrid warfare through social media

Defence Minister Guido Crosetto introduced the hybrid warfare argument during a Defence Procurement Forum in Rome on Tuesday, 20 October. In remarks recorded by Italian public broadcaster Rai, he described the disturbances as the culmination of a form of conflict being conducted through TikTok, YouTube and other social media platforms.

Crosetto argued that young Italians were undergoing what he called a form of counter-education outside their families and schools, absorbing political attitudes and values increasingly hostile to democratic institutions. He criticised Western governments for failing to recognise the consequences of this process, although he did not publicly present intelligence establishing Russian responsibility for the riots.

His comments also exposed differences within the governing coalition. Deputy Prime Minister Matteo Salvini questioned suggestions of Russian involvement, arguing that the immediate priority was identifying violent groups and preventing their movement into Milan.

Russian information operations under scrutiny

European investigators have identified activity by established Russia-linked disinformation networks, including Operation Overload and Doppelgänger, which have circulated and amplified material concerning the unrest.

These operations have previously used manipulated content, misleading narratives and coordinated online distribution to influence European audiences. In the present case, investigations into the online amplification of the violence have identified foreign exploitation of the disturbances, rather than proof that foreign governments organised them.

The European Commission has consequently declined to initiate emergency intervention against social media platforms, citing insufficient evidence linking foreign manipulation directly to the organisation of the protests.

France has taken a similarly cautious position. President Emmanuel Macron acknowledged that foreign actors had manipulated information after the violence but said there was no established evidence that they caused the disturbances. French Foreign Minister Jean-Noël Barrot has separately identified hostile narratives originating from Russia, China and Iran.

For European security authorities, the principal investigative question concerns the relationship between genuine domestic grievances and externally coordinated information campaigns. Foreign networks can exploit political divisions without necessarily directing the organisations or individuals involved in street violence.

Meloni introduces tougher security legislation

Meanwhile, Meloni’s government has proceeded with a substantial legislative response. Following cabinet approval on 20 October, Decree-Law No. 190 of 22 October 2026 entered into force on 23 October.

The legislation introduces penalties of two to five years’ imprisonment and fines of €10,000 to €20,000 for specified forms of organised violence during public demonstrations. Those organising or encouraging qualifying violent groups, including through digital communications, face potential prison terms of four to twelve years. It also expands provisions concerning juvenile offenders and preventive policing. The decree must undergo parliamentary consideration within 60 days.

Separately, the Italian Defence Ministry confirmed the deployment of 500 additional soldiers to Milan under Operation Strade Sicure until 31 December. The soldiers will reinforce security around sensitive locations and support existing police operations without acquiring additional judicial policing powers.

New demonstrations test the government’s response

Security arrangements have been intensified ahead of demonstrations scheduled for Saturday, 24 October, in Milan, Rome, Turin, Bologna, Florence and other cities.

According to the latest security preparations, Rome is deploying approximately 1,500 officers, while Milan is preparing a combined police and military presence supported by aerial surveillance.

On Friday, Italian investigators conducted searches targeting approximately 100 people suspected of involvement in the previous weekend’s disturbances, including 51 minors. Authorities are also monitoring online calls for renewed protests, some organised by groups whose leadership and membership remain unclear.

The unrest presents Meloni with two parallel challenges: containing violence and determining whether hostile foreign networks have played a significant role in its escalation. Italy’s investigations may help establish whether the events represent primarily a domestic public-order crisis, the exploitation of existing tensions by foreign actors, or a combination of both.

For Brussels, the outcome could influence future enforcement of the EU’s Digital Services Act and its wider response to foreign information manipulation. For now, the evidence supports concern about Russian amplification of European unrest, but not a definitive conclusion that Moscow orchestrated the riots.

The suspect allegedly collected relevant information in connection with Russia's war against Ukraine, including on the production of armored vehicles, ammunition, and explosives, as well as on military personnel and facilities on NATO's eastern flank.

France, Germany, Austria and Poland are expanding or reviewing the authority of critical infrastructure operators to defend facilities against drones, raising legal and operational questions over the growing role of civilian companies in national security.

European governments are reconsidering who should be authorised to intercept hostile drones as energy companies and critical infrastructure operators confront an increasingly serious threat to electricity networks, transport systems and other essential facilities.

France has already introduced legislation permitting approved operators to deploy counter-drone systems, while Germany is reviewing similar arrangements and Austria has announced plans to extend certain protective powers to infrastructure companies.

Poland has moved further by authorising designated security units to disable or destroy drones entering restricted areas around important energy installations.

The changes reflect concerns that national police and armed forces cannot provide permanent protection for every substation, power station, railway facility or pipeline against relatively inexpensive unmanned aircraft.

France establishes a new approach

In August 2026, the French parliament approved legislation allowing authorised operators of critical infrastructure and their contractors to detect, jam and intercept drones near designated facilities.

The legislation followed a series of reported drone incursions over sensitive locations, including military installations.

Under the French approach, operators of strategically important infrastructure may eventually use approved counter-drone systems without relying exclusively on the immediate intervention of military personnel.

Potential beneficiaries include electricity operators and organisations responsible for transport infrastructure.

French authorities are testing detection equipment, electronic countermeasures and interceptor drones at Brétigny-sur-Orge, south of Paris.

The programme examines systems capable of identifying approaching aircraft, determining whether they present a threat and initiating an appropriate response.

France intends to expand the protection of sites classified as strategically important, with further deployment planned during 2027.

The initiative would introduce responsibilities traditionally associated with military or police operations into the management of civilian infrastructure.

Germany and Austria reconsider existing restrictions

Germany is examining the legal conditions under which private companies and infrastructure operators could participate in active counter-drone operations.

At present, responsibility for neutralising threatening aircraft remains primarily with the competent public authorities.

The debate has intensified following security incidents involving unmanned aircraft, including the discovery of an explosives-laden drone near a Ukrainian cargo aircraft at Leipzig/Halle airport in August.

German authorities attributed the incident to Russia, an allegation Moscow denied.

The German government’s review concerns not only the equipment that companies may possess but also whether trained security personnel should be permitted to deploy countermeasures without waiting for a separate police authorisation.

Austria announced plans in September to extend comparable powers to selected critical infrastructure operators, including major energy companies.

The government has acknowledged the practical limitations of protecting a large number of widely dispersed installations using state security personnel alone.

Poland has already established restricted drone zones around sensitive energy facilities, with designated security units authorised to intercept aircraft entering those areas under applicable national rules.

Electricity networks face particular risks

Electricity infrastructure presents a difficult security problem because essential installations are distributed across extensive geographical areas.

Transmission operators manage thousands of kilometres of high-voltage lines, while substations, transformers and switching stations connect generation facilities to consumers.

A successful attack against critical equipment can produce consequences extending well beyond the immediate site.

Large power transformers are particularly difficult to replace. Manufacturing, transporting and installing specialised equipment can require lengthy preparation, making rapid recovery uncertain after serious damage.

European utilities have traditionally concentrated on physical security, maintenance and restoring services after technical failures or accidents.

The spread of drones creates additional demands for surveillance, early warning and the ability to respond before an attack reaches its target.

Russia’s repeated strikes against Ukraine’s electricity infrastructure have demonstrated the extensive disruption that attacks on power systems can cause.

European governments are now evaluating how comparable vulnerabilities could be exploited against their own networks.

Who bears responsibility for an interception?

Giving civilian operators access to counter-drone equipment raises unresolved legal questions.

Electronic jamming can interfere with communications and navigation systems beyond the targeted aircraft. A drone brought down over an industrial or residential area could injure members of the public or damage surrounding property.

Security personnel must also determine whether an unidentified drone is hostile, operating unlawfully or simply present because of an error by its operator.

A mistaken interception could expose infrastructure companies to compensation claims and other legal consequences.

European governments must therefore establish who can authorise an intervention, which countermeasures are permitted and how responsibility is allocated when damage occurs.

There is no uniform European approach.

Some operators support expanding their protective powers, while others argue that the use of force should remain the responsibility of the state.

Finland’s national electricity transmission operator, Fingrid, has expressed reservations about transferring such authority to energy companies.

The position reflects a wider concern that infrastructure operators should concentrate on maintaining essential services rather than assuming responsibilities for armed or coercive security operations.

A growing European security market

The regulatory debate is developing alongside a rapidly expanding market for counter-drone technology.

Manufacturers are offering equipment that integrates radar, optical sensors, electronic detection and software capable of classifying possible threats.

Interceptor drones and electronic countermeasures are increasingly being designed for use around civilian infrastructure rather than exclusively on military installations.

German defence company Rheinmetall has reported growing interest from private infrastructure operators in counter-drone protection.

However, the technology is advancing faster than the legal frameworks governing its use.

The immediate challenge for European governments is to establish protective arrangements that allow rapid intervention while preserving clear accountability.

A counter-drone system can identify an approaching aircraft within seconds. Determining who is authorised to stop it remains a matter for national law.

Reviewing internal documents from Germany's armed forces, German media reports that this is the military's second-highest threat classification.

Patrol density along Lithuania’s border with Russia’s Kaliningrad exclave has practically doubled since soldiers joined the border guards there in early October. Lithuanian Armed Forces Commander Raimundas Vaikšnoras told LRT this in an interview. He linked the deployment to provocations and to what he described as Russian preparations for a large-scale mobilization.

Kaliningrad is a piece of Russia wedged between Lithuania and Poland on the Baltic Sea. Lithuanian Defense Minister Robertas Kaunas said people would naturally flee a Russian mobilization. Earlier, on 11 August, President of Ukraine Volodymyr Zelenskyy said that Russia planned to mobilize several hundred thousand people by the end of 2026, after its parliamentary vote.

Commander: Russia lacks troops for a breakthrough

Vaikšnoras said Russia is struggling in Ukraine and needs to fill gaps in its capabilities. Moscow would probably like a breakthrough but lacks people, he added. In July, Ukraine’s Foreign Intelligence Service estimated that Russia had signed about as many new military contracts this year as it had lost troops.

He also cited provocations. In Latvia, armed men recently tried to push migrants across the border, he noted, leaving open whether they were bandits or criminals. Belarusian ruler Alyaksandr Lukashenka denies everything, he added. On 6 October, Latvian Interior Minister Jānis Dombrava wrote that the escorts stood on the Belarusian side, were armed, and threatened Latvian soldiers.

Mission extended to mid-November

Lithuania decided to send troops after that Latvian incident. On 7 October, Interior Minister Martynas Katelynas asked Defense Minister Kaunas for troops to help the State Border Guard Service. Kaunas then approved up to 100 soldiers until 16 October, LRT reported.

On 16 October, Kaunas extended the mission to mid-November at Katelynas’s request. The Defense Ministry cited possible flows of people fleeing Kaliningrad and related illegal border crossings. It also said military intelligence sees no significant changes in military activity in Kaliningrad. Katelynas had earlier called the step preventive, BNS noted. He cited public, non-intelligence reports of a call-up planned after Russia’s parliamentary elections and said the threat level at the border had not risen.

Commander doubts Moscow’s intentions

Vaikšnoras said Russia and Belarus may not want open incidents that leave their traces right now. He added that he does not believe in their good intentions. He noted it has been said publicly that Russia’s capability in Kaliningrad is sharply reduced, because most of its forces are committed to Ukraine. Back in June 2025, Poland’s foreign minister said that, from what he knew, Russia had withdrawn a large part of its troops from the exclave.

Instead, hybrid attacks and sabotage that cannot be traced at once will probably continue, Vaikšnoras said. LRT noted the interview took place before a Ukrainian drone crashed in Pasvalys district on Sunday and before an attempted arson at premises used by SpaceX in Vilnius.

European Union leaders will meet in Brussels on 15–16 October under pressure to address surging energy costs, Russian hybrid attacks, continued support for Ukraine and the bloc’s next long-term budget. The summit comes as economic pressures expose growing differences between national governments.

European Union leaders are preparing for a two-day summit in Brussels dominated by the economic consequences of the Middle East conflict, Russia’s continuing war against Ukraine and mounting pressure on governments to reconcile defence commitments with deteriorating public finances.

The European Council meeting on 15–16 October will bring together the leaders of the 27 member states to consider immediate measures addressing high energy prices alongside longer-term decisions on competitiveness, enlargement, migration and the EU’s budget for 2028–2034.

European Council President António Costa has placed economic competitiveness and energy costs at the centre of the discussions, reflecting concerns that the disruption of global oil and gas markets is threatening the bloc’s industrial recovery.

The meeting also takes place against the background of renewed disputes over national spending limits, with Italy and Greece seeking greater freedom to finance energy relief and France facing increasing pressure over the credibility of its budget.

Energy crisis puts fiscal rules under pressure

The Middle East conflict has created a renewed energy shock for European economies, raising transport and industrial costs while pushing inflation higher.

The disruption of shipping through the Strait of Hormuz has also affected global oil supplies, exposing Europe’s continuing dependence on internationally traded fossil fuels despite efforts to diversify imports following Russia’s invasion of Ukraine.

European leaders are expected to consider targeted and temporary support measures for households and businesses, as well as longer-term policies intended to reduce energy dependence.

The political disagreement concerns how those measures should be financed.

The European Commission has resisted requests from Italy and Greece for further exemptions from the EU’s fiscal framework. Both governments argue that extraordinary energy costs require additional budgetary flexibility.

Brussels maintains that existing provisions already permit exceptional expenditure within defined limits.

The disagreement is particularly difficult for indebted governments that must simultaneously finance military expansion, maintain public services and protect their economies from energy inflation.

France’s position has added urgency to the debate. Its borrowing costs have increased sharply as investors question whether the government can adopt a credible budget ahead of the 2027 presidential election.

A summit agreement on emergency energy assistance would therefore have to accommodate substantially different national fiscal circumstances.

Ukraine and the changing transatlantic relationship

Support for Ukraine remains a central item on the summit agenda as Russia continues attacks against Ukrainian cities, energy infrastructure and industrial facilities.

EU leaders are expected to review military and financial assistance, the implementation of sanctions against Moscow and the resilience of Ukraine’s economy.

The discussions take place amid renewed uncertainty surrounding American weapons deliveries.

Washington’s reported threats to suspend supplies under the NATO-backed PURL procurement arrangement have raised further questions about Europe’s dependence on the United States for advanced military equipment.

European governments have increased defence expenditure and committed additional support to Ukraine, but replacing American capabilities remains difficult, particularly in air defence, precision-guided weapons and certain intelligence systems.

The summit is unlikely to resolve those industrial limitations, but the broader question of Europe’s ability to sustain Ukrainian defence over several years will influence discussions.

Member states must also consider how increased defence expenditure will be financed alongside other demands on national budgets.

Russian hybrid operations move higher on the agenda

The EU’s published summit agenda includes Russian-linked hybrid attacks within Europe.

The issue has gained prominence as European governments investigate sabotage, cyber operations, information interference and threats against infrastructure and defence-related industries.

Recent warnings concerning possible Russian assassination operations targeting European defence executives and employees of companies supplying Ukraine illustrate the changing nature of the security threat.

Such activities place additional demands on national intelligence services, police forces and European institutions responsible for cross-border cooperation.

The EU has strengthened its sanctions instruments against hybrid activities, but enforcement remains dependent on coordination between national authorities.

Any further measures would need to address intelligence sharing, protection of critical infrastructure and the relationship between internal security and the Union’s wider Russia policy.

A larger EU with a contested budget

Enlargement will form another important part of the discussions following the Commission’s proposals for preparing a wider Union.

Brussels has outlined possible institutional safeguards intended to prevent future members from undermining democratic standards or blocking common decisions.

Montenegro and Albania are advancing through their accession negotiations, while Ukraine and Moldova remain central to the EU’s geopolitical enlargement strategy.

The financial implications will become increasingly important as governments negotiate the next multiannual financial framework covering 2028–2034.

Existing members are already divided over how much the EU should spend, which programmes should receive priority and whether additional common resources should be raised.

Agricultural expenditure, cohesion funding, defence investment and support for Ukraine will compete for resources within the same budget negotiations.

The Commission argues that enlargement can be accommodated through targeted reforms, but securing agreement among member states will require decisions on future expenditure and the distribution of financial benefits.

Competitiveness and the single market

Leaders will also examine progress on the One Europe, One Market agenda, which aims to reduce barriers to economic activity within the EU and improve conditions for European businesses.

The initiative is intended to address structural weaknesses affecting investment, industrial development and the ability of European companies to compete internationally.

High energy prices have made those concerns more immediate, particularly for industries competing against producers in economies where electricity and fuel are cheaper.

The European Council will be asked to provide direction on measures planned for 2026 and 2027, but implementation will depend on subsequent legislation and decisions by member states.

The October meeting brings several unresolved European policy questions into the same negotiation: how to protect economic competitiveness, maintain fiscal credibility, finance defence, sustain Ukraine and prepare for enlargement.

The immediate test will be whether leaders can agree on a credible response to energy prices without reopening broader disputes over national budgets.

More difficult decisions concerning defence financing, institutional reform and the EU’s long-term expenditure commitments will extend well beyond the two-day summit.

Prime Minister Andy Burnham has acknowledged that Russia interfered in Britain’s 2016 referendum on European Union membership, ending a decade in which successive governments avoided making a definitive public assessment of Moscow’s involvement.

British Prime Minister Andy Burnham has confirmed that Russia interfered in the 2016 Brexit referendum, marking a significant change in the government’s position on foreign involvement in one of the country’s most consequential political decisions. The acknowledgement comes more than ten years after Britain voted to leave the European Union and six years after a parliamentary intelligence investigation criticised the failure to examine Russian activities surrounding the vote.

Speaking on The Rest Is Politics podcast, Burnham said he had requested an assessment of Russian interference after becoming prime minister in July. He subsequently received confirmation that Moscow had attempted to influence the referendum, although he declined to disclose the intelligence underpinning that conclusion or explain the methods employed.

The statement establishes an important distinction between Russian interference and the referendum’s outcome. The former is now publicly acknowledged by the British government; the latter remains a separate question. No evidence has been presented demonstrating that Russian activities determined the result, which saw 51.9 per cent vote to leave the EU.

The investigation that never took place

The controversy dates back to the Intelligence and Security Committee’s 2020 report on Russia, which identified serious weaknesses in Britain’s response to hostile foreign influence.

The committee examined Russian activities targeting British political institutions, including attempts to exploit social divisions through state-controlled information channels and online networks. It found that the British government had failed to conduct a comprehensive assessment of potential Russian interference in the Brexit referendum.

That failure was particularly striking when compared with the United States, where intelligence agencies investigated Russian interference in the 2016 presidential election and published conclusions identifying a coordinated campaign.

In Britain, by contrast, responsibility for examining foreign interference had been divided between departments and intelligence agencies. The parliamentary committee found that no organisation had assumed responsibility for assessing the threat to the referendum comprehensively.

The distinction was politically convenient for successive governments. Without a formal investigation, ministers could maintain that there was insufficient evidence to establish interference while avoiding the question of whether the evidence had ever been properly examined.

Burnham’s acknowledgement changes that position, although it does not resolve every question raised by the original inquiry.

What Russia sought to achieve

Russian information operations have repeatedly targeted political divisions within European societies, particularly disagreements over immigration, national sovereignty, NATO and relations with Brussels.

Research into online activity surrounding the Brexit campaign identified networks of accounts associated with Russian influence operations that circulated divisive political messages. Establishing their precise reach, coordination and effect on individual voters remains considerably more difficult.

Moscow had an identifiable strategic interest in weakening European political cohesion. Britain’s departure from the EU removed one of the bloc’s largest economies, a permanent member of the UN Security Council and an important supporter of sanctions against Russia.

That geopolitical consequence does not establish that Brexit was engineered by Moscow. Britain’s referendum reflected longstanding domestic political divisions, disagreements over European integration and dissatisfaction with successive governments.

Russian interference, however, need not create political divisions to exploit them. Amplifying existing disputes, discrediting institutions and encouraging distrust between political opponents can serve strategic objectives without requiring direct control over a campaign.

Consequences for relations with Europe

The timing of Burnham’s intervention is significant. His government has begun reconsidering Britain’s relationship with the EU, while European governments are confronting increasingly aggressive Russian hybrid operations.

Burnham has also suggested that Britain should be prepared to reconsider EU membership in the future, although such a decision would require a separate political mandate and negotiations with the bloc’s 27 members.

The prime minister’s comments place Russian interference within a broader European security debate. France and Germany are among the countries confronting allegations of foreign information operations, covert political influence and attempts to undermine electoral confidence.

The European Council’s forthcoming October summit will include discussions of Russian-linked hybrid attacks, demonstrating that the problem extends beyond conventional espionage and cyber-security.

For Britain, the outstanding question concerns the intelligence assessment itself. Burnham has not indicated whether further evidence will be published, whether Parliament will receive a classified briefing or whether the government intends to examine failures by previous administrations.

A public acknowledgement without supporting details may establish the government’s position, but it cannot by itself provide a complete historical account.

Ten years after the referendum, Britain is therefore confronting two separate matters: the extent of Russia’s activities during the campaign and the reasons its own institutions took so long to acknowledge them.

The first concerns foreign interference. The second concerns the accountability of the British state.

Intelligence services from five European countries warn that Russia is expanding assassination and sabotage operations against defence manufacturers supplying Ukraine. The threats coincide with an alleged plot against Poland’s prime minister and defence minister, raising concerns about Moscow’s efforts to undermine European military assistance through intimidation and political destabilisation.

European intelligence agencies have warned that Russia is intensifying efforts to assassinate executives of defence companies supplying Ukraine, extending its campaign of sabotage and intimidation into the European military-industrial sector.

According to intelligence assessments obtained from five European security services, Moscow has ordered an expansion of covert operations targeting senior figures at major arms manufacturers and smaller companies producing drones and military components. Germany’s domestic intelligence agency, the BfV, has reportedly advised executives to strengthen personal security, while some manufacturers have already increased protection for senior personnel.

The warnings emerged alongside reports of an alleged assassination plot against Polish Prime Minister Donald Tusk and Defence Minister Władysław Kosiniak-Kamysz. Polish authorities convened an emergency security meeting and subsequently detained a suspect. No connection between the Polish case and Russian intelligence has been established.

Europe becomes Moscow’s principal target

The apparent expansion of Russian covert operations reflects a shift in Moscow’s calculations concerning Western military assistance.

President Vladimir Putin had reason to anticipate that Donald Trump’s return to the White House would weaken American support for Kyiv. Trump repeatedly questioned US military expenditure on Ukraine and advocated a negotiated settlement with Russia. A substantial reduction in American weapons deliveries could have increased pressure on Ukraine to accept Moscow’s territorial demands.

Instead, European governments assumed greater responsibility for sustaining Ukrainian defence capabilities, including financing weapons purchases and expanding domestic production.

The European Union’s €90 billion support programme for 2026–2027 allocates €60 billion to defence procurement and industrial capacity. The EU has also established mechanisms allowing Ukraine to participate in European joint procurement programmes.

Disrupting European manufacturers therefore offers Moscow a means of restricting Ukraine’s military capabilities without directly confronting NATO.

Assassination threats can interfere with procurement even when attacks are never carried out. Large manufacturers can afford extensive security arrangements, but smaller companies producing electronics, drone components and specialised equipment often lack comparable resources.

Intimidation could delay contracts, discourage investment and persuade individual suppliers to withdraw from Ukrainian defence programmes.

Sabotage as an instrument of political pressure

Russia’s alleged interest in targeting defence executives is not unprecedented. In 2024, American intelligence reportedly uncovered a Russian plot to assassinate Armin Papperger, chief executive of Rheinmetall, one of Germany’s principal suppliers of ammunition and military equipment to Ukraine.

As EU Today previously reported, Moscow has also publicly identified European factories involved in Ukrainian drone production, increasing concerns that civilian industrial facilities could become targets of Russian operations.

European authorities have investigated suspected Russian involvement in arson, infrastructure attacks and clandestine networks. An earlier cross-border investigation into alleged assassination and sabotage preparations demonstrated how intermediaries could be recruited to conduct operations while obscuring their sponsors.

Such activity also carries political consequences. Attacks against infrastructure and industrial facilities can reinforce public fears about confrontation with Russia, particularly during elections when parties advocating accommodation with Moscow seek to exploit security concerns.

Poland has already experienced mounting Russian hybrid pressure, including threats to critical infrastructure and information operations intended to aggravate domestic political divisions.

Putin’s strategy against European rearmament

Ukraine’s continuing strikes against Russian refineries and military-industrial facilities have added economic and operational pressures to Moscow’s prolonged war effort. Russia retains substantial military production capacity, but the costs of sustaining the conflict remain considerable.

Interfering with European weapons manufacturing could serve two objectives: restricting Ukraine’s access to equipment and obstructing Europe’s longer-term rearmament.

The Kremlin does not necessarily need European governments to abandon Ukraine formally. Production delays, disrupted contracts and reluctant suppliers could reduce the practical effect of military assistance even while political commitments remain unchanged.

European governments have acknowledged the industrial challenge. In its June conclusions on European defence, the European Council called for accelerated manufacturing capacity, stronger supply chains and closer cooperation with Ukraine’s defence industry.

Russia’s apparent strategy seeks to exploit the dependence of these programmes on private companies and skilled civilian personnel.

The warnings from European intelligence agencies suggest that protecting defence executives, engineers and contractors is becoming part of the continent’s wider security responsibilities.

For Moscow, intimidation offers the possibility of weakening Ukrainian military resistance without an open confrontation with NATO. For European governments, preventing covert operations from disrupting weapons production is increasingly inseparable from their commitment to sustain Ukraine’s defence.