France, Germany, Austria and Poland are expanding or reviewing the authority of critical infrastructure operators to defend facilities against drones, raising legal and operational questions over the growing role of civilian companies in national security.

European governments are reconsidering who should be authorised to intercept hostile drones as energy companies and critical infrastructure operators confront an increasingly serious threat to electricity networks, transport systems and other essential facilities.

France has already introduced legislation permitting approved operators to deploy counter-drone systems, while Germany is reviewing similar arrangements and Austria has announced plans to extend certain protective powers to infrastructure companies.

Poland has moved further by authorising designated security units to disable or destroy drones entering restricted areas around important energy installations.

The changes reflect concerns that national police and armed forces cannot provide permanent protection for every substation, power station, railway facility or pipeline against relatively inexpensive unmanned aircraft.

France establishes a new approach

In August 2026, the French parliament approved legislation allowing authorised operators of critical infrastructure and their contractors to detect, jam and intercept drones near designated facilities.

The legislation followed a series of reported drone incursions over sensitive locations, including military installations.

Under the French approach, operators of strategically important infrastructure may eventually use approved counter-drone systems without relying exclusively on the immediate intervention of military personnel.

Potential beneficiaries include electricity operators and organisations responsible for transport infrastructure.

French authorities are testing detection equipment, electronic countermeasures and interceptor drones at Brétigny-sur-Orge, south of Paris.

The programme examines systems capable of identifying approaching aircraft, determining whether they present a threat and initiating an appropriate response.

France intends to expand the protection of sites classified as strategically important, with further deployment planned during 2027.

The initiative would introduce responsibilities traditionally associated with military or police operations into the management of civilian infrastructure.

Germany and Austria reconsider existing restrictions

Germany is examining the legal conditions under which private companies and infrastructure operators could participate in active counter-drone operations.

At present, responsibility for neutralising threatening aircraft remains primarily with the competent public authorities.

The debate has intensified following security incidents involving unmanned aircraft, including the discovery of an explosives-laden drone near a Ukrainian cargo aircraft at Leipzig/Halle airport in August.

German authorities attributed the incident to Russia, an allegation Moscow denied.

The German government’s review concerns not only the equipment that companies may possess but also whether trained security personnel should be permitted to deploy countermeasures without waiting for a separate police authorisation.

Austria announced plans in September to extend comparable powers to selected critical infrastructure operators, including major energy companies.

The government has acknowledged the practical limitations of protecting a large number of widely dispersed installations using state security personnel alone.

Poland has already established restricted drone zones around sensitive energy facilities, with designated security units authorised to intercept aircraft entering those areas under applicable national rules.

Electricity networks face particular risks

Electricity infrastructure presents a difficult security problem because essential installations are distributed across extensive geographical areas.

Transmission operators manage thousands of kilometres of high-voltage lines, while substations, transformers and switching stations connect generation facilities to consumers.

A successful attack against critical equipment can produce consequences extending well beyond the immediate site.

Large power transformers are particularly difficult to replace. Manufacturing, transporting and installing specialised equipment can require lengthy preparation, making rapid recovery uncertain after serious damage.

European utilities have traditionally concentrated on physical security, maintenance and restoring services after technical failures or accidents.

The spread of drones creates additional demands for surveillance, early warning and the ability to respond before an attack reaches its target.

Russia’s repeated strikes against Ukraine’s electricity infrastructure have demonstrated the extensive disruption that attacks on power systems can cause.

European governments are now evaluating how comparable vulnerabilities could be exploited against their own networks.

Who bears responsibility for an interception?

Giving civilian operators access to counter-drone equipment raises unresolved legal questions.

Electronic jamming can interfere with communications and navigation systems beyond the targeted aircraft. A drone brought down over an industrial or residential area could injure members of the public or damage surrounding property.

Security personnel must also determine whether an unidentified drone is hostile, operating unlawfully or simply present because of an error by its operator.

A mistaken interception could expose infrastructure companies to compensation claims and other legal consequences.

European governments must therefore establish who can authorise an intervention, which countermeasures are permitted and how responsibility is allocated when damage occurs.

There is no uniform European approach.

Some operators support expanding their protective powers, while others argue that the use of force should remain the responsibility of the state.

Finland’s national electricity transmission operator, Fingrid, has expressed reservations about transferring such authority to energy companies.

The position reflects a wider concern that infrastructure operators should concentrate on maintaining essential services rather than assuming responsibilities for armed or coercive security operations.

A growing European security market

The regulatory debate is developing alongside a rapidly expanding market for counter-drone technology.

Manufacturers are offering equipment that integrates radar, optical sensors, electronic detection and software capable of classifying possible threats.

Interceptor drones and electronic countermeasures are increasingly being designed for use around civilian infrastructure rather than exclusively on military installations.

German defence company Rheinmetall has reported growing interest from private infrastructure operators in counter-drone protection.

However, the technology is advancing faster than the legal frameworks governing its use.

The immediate challenge for European governments is to establish protective arrangements that allow rapid intervention while preserving clear accountability.

A counter-drone system can identify an approaching aircraft within seconds. Determining who is authorised to stop it remains a matter for national law.

A cyberattack affecting approximately 700 supermarkets in France has exposed serious weaknesses in the digital systems used to control commercial refrigeration, raising concerns about the vulnerability of European food distribution networks and other essential infrastructure.

The attack began overnight on 11–12th October, when intruders gained access to remotely managed refrigeration equipment and altered operating settings, causing refrigerators and freezers to overheat.

Stores belonging to several major supermarket chains were affected, including Intermarché, Netto, Coopérative U, Carrefour and Monoprix. Some were forced to discard substantial quantities of fresh and frozen food.

French Finance Minister Roland Lescure confirmed that approximately 700 of the country’s 10,000 supermarkets had been affected, although the severity of the disruption varied between locations.

The Paris prosecutor’s office has opened an investigation into the attack, including the damage caused by destroyed merchandise and reported fires.

The incident has drawn attention to industrial control systems that are routinely connected to the internet but may receive less cybersecurity protection than corporate networks and customer databases.

Refrigeration systems remotely manipulated

Investigators have established that refrigeration equipment was targeted through vulnerabilities associated with remote monitoring and control systems.

The French cybersecurity authorities identified compromises involving products supplied by Danish manufacturer Danfoss and American company Copeland.

Some of the affected systems used older equipment that no longer received regular security updates.

According to information released by the companies and cybersecurity specialists, certain industrial controllers had been accessible through public internet connections, creating opportunities for unauthorised access.

Hackers reportedly manipulated defrost cycles and increased temperature settings, preventing equipment from maintaining the cold conditions required to preserve food.

The attack affected approximately 300 Intermarché and Netto stores, while Coopérative U reported disruption at around 80 outlets.

Several retailers managed to contain the damage, but others lost substantial quantities of stock.

The consequences extended beyond malfunctioning equipment. Businesses faced the cost of replacing spoiled food, repairing refrigeration systems and restoring normal operations.

The precise financial damage is still being assessed, although estimates from the retail sector indicate that losses across France could amount to tens of millions of euros.

Vulnerabilities in connected equipment

The incident illustrates the security problems created by the growing use of internet-connected industrial equipment.

Modern refrigeration installations allow contractors and maintenance specialists to monitor temperatures, adjust settings and diagnose faults remotely.

These arrangements can reduce operating costs and improve efficiency, but they also create additional access points that attackers may exploit.

Cybersecurity specialists have identified vulnerabilities in commercial refrigeration platforms manufactured by Danfoss and Copeland.

The manufacturers subsequently addressed identified flaws, although older or unsupported equipment remained a concern.

A critical problem for businesses is that industrial machinery often remains operational for many years after its original software has become obsolete.

Replacing entire refrigeration installations can involve substantial expense and operational disruption, encouraging operators to retain equipment that may no longer meet contemporary cybersecurity standards.

The risks are particularly difficult to manage when responsibility for maintenance, software updates and network security is divided between retailers, equipment suppliers and external contractors.

France’s delayed cybersecurity legislation

The attack has renewed scrutiny of France’s implementation of the European Union’s NIS2 Directive, which is intended to strengthen cybersecurity across sectors providing important economic and public services.

The directive establishes common requirements covering risk management, incident reporting, organisational responsibility and protection against cyber threats.

Its scope extends beyond traditional critical infrastructure such as energy, telecommunications and transport to include certain businesses involved in food production, processing and distribution.

EU member states were required to incorporate the directive into national legislation by 17 October 2024.

France was among the countries that received a formal warning from the European Commission in May 2025 over incomplete implementation.

French cybersecurity specialists have since warned that delays have complicated efforts to establish consistent obligations for organisations operating industrial and commercial systems.

However, NIS2 does not automatically cover every supermarket. Its application depends on the nature and size of an organisation and the provisions of national implementing legislation.

The incident therefore raises questions not only about the pace of legislative implementation but also about the practical protection of equipment already in use.

Wider implications for European infrastructure

The disruption demonstrates how a cyberattack can cause physical damage without directly targeting a conventional industrial facility.

Unlike breaches intended to steal customer information, the French incident interfered with machinery responsible for preserving essential products.

The distinction is important for European policymakers, who increasingly face threats to infrastructure that combines digital controls with physical operations.

The European Union’s cybersecurity agency ENISA has organised cross-border exercises to test how authorities and companies would respond to disruption affecting essential services.

The attack itself has been established, but responsibility for it has not been publicly attributed.

French authorities have said there is no immediate threat to national food supplies. Nevertheless, the destruction of merchandise and interruption of ordinary retail operations have demonstrated the potential economic consequences of weaknesses in relatively commonplace equipment.

The continuing investigation must establish how access was obtained, which systems were compromised and whether the vulnerabilities were known to operators before the attack.

For Brussels and national regulators, the case provides a practical test of whether European cybersecurity legislation can translate into effective protection for the connected equipment on which ordinary commercial activities increasingly depend.

Russia has started fitting its enlarged Gerbera-2 drones with a 10-kg warhead and an extra bag of incendiary mixture, Ukrainian military outlet Militarnyi reported on 18 October. The setup is designed to start a fire where the drone hits and is probably meant for attacks on critical infrastructure and warehouses, the outlet said.

Russia’s industry makes about 3,000 jet-powered Geran-4 and Geran-5 drones a month, Ukraine’s military intelligence has said, and Russian strikes have destroyed 2.1 million m² of Ukraine’s modern warehouse space since the full-scale invasion began. A cheap drone that carries fire adds one more threat for air defenses that already let nearly half of Russia’s jet-powered Shaheds through.

A fire bag behind the warhead

Ukrainian Telegram channel Polkovnyk HSh posted photos of the payload on 17 October. Gerbera-2 strike and reconnaissance drones had begun to appear with a 10-kg high-explosive fragmentation-incendiary warhead and an extra package of incendiary mixture, the channel wrote. They navigate with Kometa-M12, a 12-element antenna array designed to resist jamming, it added.

Explore further

Russian drones set their own detonators at altitude: Why cutting wires won’t save from new Gerberas?

In the photos, the incendiary mixture sits in a separate soft plastic tank behind the main warhead, Militarnyi said. Gerbera-2s have been seen with warheads of 4 to 10 kg depending on range, while strike versions of the original Gerbera usually carried up to 5 kg, the outlet noted.

Half a Shahed engine

Russia has mainly fielded the Gerbera, a cheap drone shaped like a Shahed, as a decoy and reconnaissance platform flying alongside Shahed-type strike drones. It has also used bigger Gerberas to drop FPV drones.

Serhii Beskrestnov, now an adviser to Ukraine’s president, flagged a much bigger Gerbera in Ukraine’s skies on 7 August. The Gerbera-2 has a larger airframe, a reshaped wing, and a bigger tail fin, Militarnyi said. In August, the outlet reported it had a stronger piston engine: half of the one in the Shahed-type Geran-2, at about 275 cm³. Production of these engines was set up at the Izhevsk Motorcycle Plant, according to preliminary information the outlet cited.

Explore further

Russia equips Geran attack drones with image-based navigation using Google map imagery, reducing reliance on satellite navigation that Ukraine can jam, defense adviser warns

Earlier versions ran on a Chinese DLE60 model-aircraft engine of about 61 cm³. The switch was likely possible because Geran-2 engine output partly freed up as jet-powered Geran-4s took a growing share of Russia’s drones, Militarnyi said. The Gerbera-2’s fuel tank also holds up to 63 liters, against 10 liters on the original.

One reached Poland’s Baltic coast

In September, a drone preliminarily identified as a Gerbera-2 was recovered from the Baltic Sea near Rusinowo, on Poland’s coast. It carried a high-explosive fragmentation warhead of about 4 kg, a Polish military prosecutor said.

Ukrainian and Japanese officials discussed establishing backup bridge crossings in the event of Russian strikes, preparing municipal infrastructure for winter, and Japan's continued assistance with Ukraine's recovery, Ukraine's Minister for Restoration, Infrastructure and Transport, Mykola Kalashnyk, reported on 14 October.

Russia is targeting Kyiv's bridges to paralyze the city and break civilian morale, defense analyst Hamish de Bretton-Gordon wrote in The Telegraph. On 1 and 2 October, Russia attacked Kyiv's Southern Bridge, then struck the Northern Bridge on 3 and 4 October. Ukraine is now working with international partners to establish backup bridge crossings that could maintain connectivity even if major routes are damaged.

The discussions took place during a meeting between Minister Kalashnyk, Japan's Ambassador to Ukraine Yo Osumi, and Osamu Hattori, head of the Japan International Cooperation Agency (JICA) office in Ukraine, according to the statement.

Backup crossings could prevent logistical disruptions if major bridges are damaged

Kyiv's Southern Bridge, for example, plays a critical role in logistics because freight traffic uses it, transport planning expert Dmytro Bespalov noted in an article for Ukrainska Pravda. At the same time, installing additional metal structures to reinforce bridges could be dangerous given their technical condition and existing load levels, he said.

One potential solution is to establish backup bridge crossings.

Ukraine and JICA have agreed to continue working together on engineering solutions for setting up these crossings. Japan has already delivered 720 meters of prefabricated bridge structures to Ukraine, which are expected to be used to create alternative routes if Russia's attacks damage major bridges, Kalashnyk said.

The initiative is intended to help maintain transportation links, ensure the delivery of critical supplies, and preserve evacuation routes for civilians.

Ukraine prepares water utilities and boiler plants for winter amid the threat of Russian infrastructure strikes

During the meeting, Ukraine and JICA discussed equipping water utilities with backup power supplies, addressing the need for modular boiler plants, and obtaining equipment to ensure uninterrupted heating and water services. Ukraine has already submitted lists of the necessary equipment to JICA for consideration as part of a new emergency assistance project, Kalashnyk said.

An intercepted document outlining an alleged Russian plan for strikes against Ukraine this winter reportedly describes attacks on 60 critical infrastructure facilities using up to 1,000 missiles, drones, and aerial bombs. Potential targets include electrical substations, hydroelectric power plants, thermal power plants, boiler facilities, and infrastructure related to water supply and wastewater management.

The document also describes potential strikes on facilities in Kyiv, Kharkiv, Odesa, and several other cities. Such attacks could disrupt electricity, heating, water supply, and wastewater services.