Imagine how Russia would fare against 32 Ukraines.

Journalists from 17 European public service broadcasters, coordinated by the European Broadcasting Union’s (EBU) Eurovision News Spotlight network, published an interactive map on 23 October 2026. It documents hybrid incidents linked to Russia across 17 European countries between 1 April and 15 October. Journalists compiled a database of hundreds of reported incidents, categorizing each by type and the source and strength of its alleged links to Russia, then verifying them through open-source research.

The map comes as officials warn the campaign is growing. On 28 September, EU foreign policy chief Kaja Kallas said in Brussels that Russia was planning more acts of sabotage to divide societies and intimidate them into abandoning their support for Ukraine. The points on the map represent an incomplete list of publicly known cases attributed to Russia or suspected of being linked to it, the report states.

The map covers airspace violations, sabotage attempts, “disposable” agents with no formal intelligence training, migration used as a weapon, and Russian military activity near or across European borders. It excludes cyberattacks, influence operations, and espionage by trained intelligence officers.

The EBU calls the result a very conservative estimate, not an official tally. Russia has consistently denied responsibility for the incidents. Many single points represent several incidents of the same type in one area or in quick succession. In Moldova, for example, Defense Minister Anatolie Nosatîi said on 30 September that the government had recorded 84 drone incursions.

Four German incidents are on the map, out of many more

The map shows four incidents in Germany, according to BR.

• On 2 August, German authorities arrested a 33-year-old Ukrainian man in Thuringia on suspicion of photographing a Bavarian weapons manufacturer for a foreign intelligence service as part of an alleged sabotage plot.
• On 4 August, a drone carrying explosives and a detonator struck the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but failed to explode.
• On 3 September, attackers threw firebombs from a car onto a construction site next to defense firms in Munich, and German security authorities suspect Russian intelligence.
• On 14 September, investigators learned of a crashed drone found near the Bundeswehr’s Wunstorf air base.

Internal papers from the new Joint Hybrid Defense Center, seen by Correctiv, record 163 suspected sabotage cases in 2026 up to 19 August. The targets included rail lines, military facilities, substations, and radio masts. The same papers record 1,034 drone overflights of critical infrastructure, military sites, and defense companies, and 25 espionage investigations. The papers cover possible attacks by Russia, China, and Iran, and media did not report a breakdown of the sabotage cases by country.

European leaders sound the alarm over Russian hybrid attacks

On 15 April, Swedish civil defense minister Carl-Oskar Bohlin said pro-Russian groups had moved from denial-of-service attacks to attempts at destructive cyberattacks, including one on a Swedish power plant in 2025. On 1 September, German Foreign Minister Johann Wadephul named Russia as the perpetrator of the Leipzig attack and accused Moscow of “blatant hostility” toward Germany.

On 18 September, French President Emmanuel Macron said Russia’s hybrid attacks would not go unanswered and ordered a plan to protect France’s critical infrastructure. On 1 October, German Chancellor Friedrich Merz said Germany was preparing for new hybrid attacks, “including serious ones.” NATO Secretary General Mark Rutte on 14 October called the attacks a sign of Russian weakness at a press conference in Tallinn and said NATO would react where needed without being “rattled.”

An investigation involving 17 European public-service news organisations has documented hundreds of suspected hybrid attacks across Europe in just over six months, revealing the scale of a security challenge that increasingly extends beyond conventional espionage and cyberwarfare.

The investigation, coordinated by the European Broadcasting Union, examined incidents reported between 1st April and 15th October 2026, including sabotage attempts, arson, airspace violations, suspicious drone activity and the exploitation of migration routes along the European Union’s eastern borders.

Published on 23rd October, the resulting interactive map provides a geographical picture of incidents publicly linked to Russia by intelligence agencies, law-enforcement authorities, government officials or reporting. The degree of attribution varies considerably, however, and many incidents remain under investigation.

The findings point to a fundamental problem for European security: hostile activities can be conducted across national boundaries without necessarily triggering the legal, military or political mechanisms designed to respond to conventional aggression.

Sabotage Without Conventional Warfare

Among the cases examined is an incident in Munich in September, when two Bulgarian nationals allegedly threw incendiary devices from a moving vehicle onto a construction site near several defence companies.

Police arrested the suspects after a witness reported the incident. Bavarian Interior Minister Joachim Herrmann and regional criminal investigators subsequently indicated that political motives were being considered. Investigators reportedly suspected possible involvement by Russia’s military intelligence service, the GRU, although the allegations have not been established in court.

The case illustrates growing concern about so-called disposable agents: individuals recruited to undertake relatively limited operations without formal intelligence training or a longstanding relationship with an intelligence service.

Such arrangements can complicate investigations. Even where perpetrators are identified, establishing a legally demonstrable connection between their actions and a foreign intelligence organisation may prove considerably more difficult.

Germany’s Federal Criminal Police Office has registered a mid-three-digit number of suspected sabotage and reconnaissance cases since the beginning of 2026, according to information provided to investigators involved in the European mapping project.

Only a small proportion have been publicly attributed to Russia. Four German incidents were included in the map, demonstrating the distinction between a broad national caseload and cases meeting the investigation’s publication criteria.

Europe’s Eastern Borders Under Pressure

The geographical distribution reveals substantial activity along NATO’s eastern flank, particularly around the Baltic states, Belarus and the Black Sea.

Incidents include repeated airspace violations, suspected reconnaissance operations and attempts to facilitate unauthorised border crossings. Lithuanian authorities have accused Belarus of deliberately exploiting migration as an instrument of political pressure.

Commercial shipping has also become increasingly exposed. Drone attacks involving vessels near Romania and Bulgaria have raised concerns about the extension of the war’s consequences into maritime areas adjoining EU and NATO territory.

These developments reinforce earlier warnings about Russia’s expanding sabotage campaign, particularly the difficulty of distinguishing isolated security incidents from coordinated operations intended to test national responses.

Teija Tiilikainen, director of the European Centre of Excellence for Countering Hybrid Threats, identified Russia’s invasion of Ukraine as an important factor behind the increasing pressure. According to her assessment, Moscow’s objectives include weakening Western unity and undermining continued support for Ukraine.

The Legal and Institutional Challenge

The central difficulty is not simply the absence of criminal legislation. Arson, espionage, sabotage and unlawful interference with critical infrastructure are already punishable under national laws.

Rather, the challenge involves establishing foreign direction, coordinating investigations across jurisdictions and identifying when a series of apparently separate offences constitutes a wider hostile campaign.

Germany’s domestic intelligence chief, Sinan Selen, has described the environment as a grey area between war and peace. German foreign intelligence chief Martin Jäger has similarly identified Russia as the country’s most dangerous adversary.

European governments are beginning to address these difficulties collectively. At their 15th–16th October summit, EU leaders condemned intensifying hybrid attacks and called for stronger resilience, greater use of existing countermeasures and accelerated work on drone security.

On 8th October, the Council also extended sanctions targeting Russian destabilisation activities until October 2027. The restrictions cover 80 individuals and 20 entities.

Meanwhile, a European Commission research initiative, published on 23rd October, proposes combining anticipation, active defence and retaliatory measures into a more coherent deterrence strategy.

From Individual Incidents to Collective Security

The investigation’s significance extends beyond the number of incidents recorded. By bringing together information previously dispersed among national authorities and separate investigations, it makes possible a wider assessment of the methods, geographical concentration and recurring characteristics of suspected hostile operations.

Nevertheless, the map does not establish Russian responsibility for every incident it records, nor does it constitute a complete European database. Russia has repeatedly denied conducting the hybrid attacks attributed to it.

For European governments, the unresolved question is how to move from recognising a pattern of hostile activity to demonstrating responsibility and responding effectively.

As EU foreign policy chief Kaja Kallas has warned, the consequences already extend beyond infrastructure disruption to risks affecting civilian lives.

The emerging security challenge therefore concerns not only the detection of individual perpetrators, but also Europe’s ability to connect incidents across borders, establish responsibility and prevent successive operations from becoming an accepted feature of the continent’s security environment.

• A Ukrainian drone maker was surprised by how much explosive weight soldiers loaded onto one of its drones.
• A drone's payload is limited by the weight of its battery, camera, and other equipment.
• Drone makers push technical limits, but Ukrainian soldiers often go even further.

A major drone maker said Ukrainian soldiers surprised it by packing one of its drones with more explosives than the company ever thought it could carry.

When loading up an attack drone with explosives, combat units are limited by how much weight it can carry and still fly. Batteries, cameras, and other essential equipment also take up some of that capacity. That doesn't stop soldiers from pushing the equipment to its limit.

"One of the most surprising videos I've seen recently is that one of the units has managed to put the huge explosive part on our drone," Oleg, an executive at TechEx, told Business Insider.

The drone was carrying "something like five or seven kilos, and they managed to fly into the building and put it completely to the ground with one single FPV."

"I was like, 'How do you literally put this amount of explosives on one single FPV?' But it managed to carry this on and did the mission," the TechEx exec said, speaking on the condition that he be identified only by his first name for security reasons.

TechEx lists a maximum payload of two kilograms for three of its NATO-codified fiber-optic drones: the Stalker XO-10 China-Free, Stalker XO-15 MAX PRO, and Stalker XO-13.

Weight is a major constraint for Ukraine's drone makers, who are constantly trying to accommodate more firepower and bigger batteries, as well as heavier weapons and cameras. It's a constant trade-off, with every gram mattering.

Soldiers fighting for survival often push beyond advertised limits. Last year, a sergeant major in a heavy bomber company told Army Inform, Ukraine's defense ministry media, that while a Bat drone can fly up 8 kilometers and carry up to 12 kilograms, his unit pushed it to fly a little farther and carry a little more.

Weight is an important consideration for TechEx drone development. The company advertises its "ultralight fiber optic reel" as one of its product advantages. Last year, Ukraine's Ministry of Defense characterized TechEx's Stalker series as having a "record-low spool weight among Ukrainian fiber-optic drones."

The struggle with weight is particularly acute for fiber-optic drones because, in addition to gear like batteries, they have to carry the spool containing the fiber-optic cable that trails behind them, maintaining a connection with the drone operator. The cable makes them resistant to enemy jamming, but the added weight limits how many explosives they can carry. The cable spool can weigh several kilograms on some drones.

Olha, a TechEx representative, told Business Insider that the company developed its own technology to reduce spool weight, making "tiny tweaks and changes" to how the spool is assembled and the fiber is wound into it. Those adjustments allow the company to keep the spool lightweight while maintaining a stable connection and minimizing the risk of the cable breaking during flight.

The company needs the "perfect balance" to make sure it stays reliable and durable, as not all drone pilots have a wealth of flying experience, Oleg said.

The company faces trade-off decisions. Extending the range of its fiber-optic drones, for instance, would require larger cable spools, potentially leaving less room for explosives, Olha said. But not every drone needs a heavy payload. For some, speed and agility matter more.

Ukraine's soldiers often surprise the manufacturers of their weapons with how they use and adapt their gear, with troops sometimes repairing and modifying equipment near the front lines and experimenting with new tactics.

Kuldar Väärsi, the founder and CEO of Estonian ground robot maker Milrem Robotics, previously told Business Insider that Ukrainian soldiers used the company's technology in ways it was not expecting, including adding and attaching things to the robots. "Ukrainian troops are really creative, and they really find very simple ways how to get even more out of the equipment," he said.

How gear is used in the field often informs how Ukraine's defense companies update and modify their products. Soldiers give feedback to firms like TechEx every day, and companies send their own employees close to the fight to gather feedback and make changes.

Oleg said that TechEx receives direct feedback from soldiers constantly, resulting in weekly changes to its products. Without changes, a product in Ukraine "within three months, it will be outdated, and nobody will use it, because the industry is moving extremely fast," he said.

TechEx encourages soldier experimentation, including by making its drones with parts that are interchangeable. Soldiers can swap components to repair damaged drones or combine parts to create configurations the company never designed.

"Part of what I think TechEx is really great at is the ability to customize," Olha said.

• Drones in Ukraine act as flying communications bridges between operators and mission drones.
• They repeat the operators' signal to allow drones to fly farther while staying connected.
• The signal-repeating drones make other drones more resistant to Russia's electronic warfare.

Ukraine has created drones that act as flying relay towers, allowing its drones conducting missions to fly farther while making them harder for Russia to jam.

In a war where drones gather intel and account for more than 95% of Russia's front-line losses, Ukraine wants its operators to keep control of their drones over longer distances with stronger signals that are harder for Russia to break.

One solution is the signal repeater drone, a flying signal booster that operates between a pilot and a mission drone, relaying commands to the aircraft and sending back video and intelligence to the operator. Able to fly much higher than a ground antenna, airborne repeaters can extend a drone's range and help preserve the connection under pressure.

It increases the mission drone's operational range by extending how far it can fly while staying connected to its pilot. It's a similar principle to how wifi repeaters work.

Ukrainian arms maker Twist Robotics makes a signal-repeating drone, born from its Saker Scout drone.

Rostyslav Olenchyn, the company's co-founder and chief information officer, told Business Insider that the drone was widely used for reconnaissance and strike operations, but this war changes rapidly, with arms and warfighting technology quickly becoming obsolete. And without updates, this drone was at risk of falling victim to that pattern in the cat-and-mouse technology race.

Drones needed to be effective at longer ranges, and the Saker Scout's range was "not enough" for many missions. So, the drone was redesigned "for another objective. It became the signal relay station," Olenchyn said.

The Saker Scout, able to also be used in other combat roles, can extend the operational range of drones by more than 50 kilometers, according to the company.

The concept of using aircraft as signal middlemen isn't new. Militaries have used helicopters and planes to relay communications between assets and forces disconnected by the terrain, though usually troops rather than drones. These crewed aircraft, however, struggle to operate over Ukraine, but while such air assets are few and far between, drones are prolific.

Large crewed aircraft cannot "necessarily survive in the heavy saturated air of the battlefield," where drones and air defenses are a threatening presence, Olenchyn said. "So the small, versatile platform was a solution." He said that serial production of the Saker Scout with this function started in 2023.

The company's strike drone, the Signal Hunter, can also be used as a relay.

Other Ukrainian companies are also working in the space, with some updating existing drone types and some designing new ones. Roboneers, for example, developed a version of its Wardog drone that can carry relay equipment weighing up to three kilograms, and Skyriper makes the Skyriper-R Airborne Repeater, a dedicated drone with the single function of acting as an airborne repeater.

Volodymyr Zinovskyi, the CEO of the Ukrainian defense firm TAF Industries, told Business Insider that his company started making relay drones last year at the request of units, describing the technology as going from optional to essential.

Brave1, Ukraine's state-backed innovation platform, wrote last year that "the use of UAVs over long distances or in difficult terrain requires the use of repeaters - special devices that help increase the range of a stable signal several times."

Some Ukrainian drones are built for this relay mission, while others can be fitted with add-on repeater equipment.

Beyond overcoming geographical challenges, airborne repeaters also help counter Russian electronic warfare by strengthening the communications link between operators and mission drones, making it harder to disrupt, though Russia can still target the relay itself.

An analysis published by the Center for Strategic and International Studies, a US think tank, last year described the creation of relay systems as a response to growing electronic warfare tactics, including the ability that both sides have to trace drone control signals back to their source for strikes on operators, priority targets in this war.

Dmytro "Liber" Zhluktenko, a former drone operator who now serves as a lessons-learned analyst with Ukraine's 413th Unmanned Systems Regiment "RAID," told Business Insider that Ukrainian forces are "keeping somewhat a stable radio link by mass utilizing signal repeaters."

He said that some uncrewed repeater aircraft are fixed-wing drones, while some are repurposed bomber-type drones. Instead of bombs, it just carries the signal repeater," he said.

"We optimize those signal repeater carriers to just stay in the air for an extremely long time, like one hour plus," he said. "That's their only job: to be in the air." Working with strike drones, they give operators a "great radio link over the target."

Oleksiy, the commander of the 2nd UAV engineer platoon of the International Defense Legion of Ukraine, told ArmyInform, the official information agency of the Ministry of Defense of Ukraine, last year that his unit uses repeaters on drones to expand the radio horizon of the drones they want to use and fly further to target Russia.

Russia is using the technology too, including to help attack drones fly deeper into Ukrainian territory.

And these lessons aren't limited to the Ukraine war. The US military is also experimenting with ways to extend drone operations and keep operators connected from farther away. The Marine Corps, for instance, has experimented with using helicopters as FPV motherships, as well as handing off control after launch.

Though different from Ukraine's airborne repeater work, both address a similar battlefield problem, which is that drones are only useful if operators can launch them, control them, and keep receiving information at tactically relevant distances.

Olenchyn said that updates, like the signal repeating ability, are critical in combat. He said that every two weeks, the company has "a new update, new kinds of techniques, new kinds of drones or functionality which are released."

The violence accompanying France’s October protests has revealed how foreign influence networks can exploit domestic grievances to undermine governments and European support for Ukraine. New evidence suggests Russian-linked operations were active before the riots, raising questions about whether information manipulation is moving beyond propaganda towards the mobilisation of political unrest.

France’s violent protests have exposed a vulnerability in European security that conventional policing cannot easily address: the ability of foreign information networks to exploit domestic political crises, amplify social divisions and transform legitimate grievances into instruments of geopolitical pressure.

President Emmanuel Macron has acknowledged foreign manipulation of information surrounding the disturbances of 17–18 October but insists there is no evidence that foreign actors organised the violence itself. His assessment reflects the evidence currently available, although new investigations indicate that Russian-linked networks were actively exploiting the protest movement weeks before the worst disorder began.

On 24 October, France deployed approximately 70,000 police officers and gendarmes to prevent further violence. Yet the security operation addresses only the physical consequences of a crisis whose online dimension extends across national borders.

Russia’s operations began before the riots

An investigation published on 22 October by Alliance4Europe provides evidence that Russian-linked information networks were exploiting French discontent well before the disturbances.

Researchers examined 547,471 posts and articles across nine languages. They identified 639 coordinated messages attributed with high confidence to Russia’s Doppelgänger operation, generating approximately 7.4 million views in the six weeks preceding 17 October.

The campaign used genuine concerns about living costs and public expenditure to promote a particular political argument: money allocated to Ukraine was being taken from European citizens.

This was not a random selection of grievances. France’s budget difficulties, public-service pressures and disagreements over defence expenditure provided material through which Moscow could seek to weaken support for Kyiv.

The researchers found that the operation targeted pro-European and pro-Ukraine politicians across the political spectrum. It praised selected proposals associated with Jean-Luc Mélenchon while also promoting nationalist narratives, illustrating a strategy driven less by ideological consistency than by opposition to existing European policies.

From manipulating opinion to encouraging mobilisation

An earlier investigation by EK Strategies, published on 8 October, identified an additional development.

Russian-linked channels were not merely commenting on existing demonstrations. They were circulating protest dates, identifying organisers and encouraging French audiences to follow the example of demonstrators in Germany.

On 28 September, the International Reporters network published an appeal urging French audiences to take to the streets. Other channels subsequently reproduced information about planned school blockades and demonstrations.

In one instance, a channel identified as Gavroche published rhetoric encouraging an attack on France’s Education Ministry.

Such activity goes beyond retrospective propaganda. It attempts to influence participation and behaviour while events are developing. Nevertheless, evidence that a network encouraged protests does not establish that it controlled the organisers or directed subsequent violence.

The original demonstrations arose from domestic grievances over schools, prices and government policy. The significance of the foreign activity lies in attempts to redirect and intensify an existing movement.

How France’s crisis was rewritten abroad

Once violence erupted, the information campaign acquired an international audience.

Alliance4Europe found that claims blaming migrants or Islam for the disturbances appeared in approximately one in 33 French-language posts, compared with nearly one in five English-language posts.

False allegations that immigrants had burned Limoges town hall circulated substantially more frequently in English than in French.

The same report identified 1,018 articles distributed through 28 websites associated with the Russian Pravda network. Their rapid republication across languages enabled a common narrative to reach audiences far beyond France.

The operation also presents a longer-term technological problem. Repeated publication of manipulated accounts can contaminate material subsequently retrieved or reproduced by artificial-intelligence systems, allowing false narratives to persist beyond the original campaign.

The political effects were visible when President Donald Trump and other foreign leaders portrayed France’s unrest principally through immigration and cultural conflict.

Speaking in Qatar on 21 October, Macron rejected these portrayals and criticised the circulation of fabricated AI-generated images. His remarks identified foreign manipulation after the riots but stopped short of alleging foreign responsibility for their organisation.

The Heritage Foundation and transatlantic networks

The transcript raises a more substantial allegation: that the American Heritage Foundation and Russia’s FSB have participated in a coordinated effort to destabilise France.

There are documented connections between the Heritage Foundation and political institutions associated with Hungary’s former prime minister Viktor Orbán.

A 2026 investigation into Hungarian-funded international influence networks established that the Danube Institute had channelled substantial public funding towards foreign researchers and commentators. The institute also maintained a formal relationship with Heritage.

Heritage has acknowledged its cooperation with Hungarian conservative institutions but denied receiving funding or direction from foreign governments.

These relationships demonstrate the development of transatlantic political networks capable of circulating common ideas about sovereignty, migration and European integration.

They do not establish operational cooperation with Russian intelligence. Nor has credible evidence emerged connecting Heritage to the organisation or financing of France’s October riots. Ideological convergence, institutional cooperation and participation in a clandestine operation require separate evidential assessments.

The implications for European security

The European Union’s response has exposed a regulatory problem.

Under the EU’s Digital Services Act, major online platforms must address systemic risks arising from their services, including the amplification of illegal content and threats to public security.

On 23 October, the French government announced enhanced cooperation with digital platforms. More than 100 priority reports had been submitted ahead of the weekend demonstrations, approximately half resulting in account suspensions.

These measures targeted unlawful online activity, particularly incitement to violence and looting. They did not constitute findings that the suspended accounts belonged to foreign intelligence networks.

The European Commission has likewise refrained from activating emergency measures under the Digital Services Act without sufficient evidence connecting foreign manipulation to the violence.

The broader security concern is that foreign operations can exploit the interval between the emergence of social unrest and the establishment of reliable information about its causes.

Russia need not organise an entire protest movement to advance its strategic interests. By amplifying domestic grievances, promoting hostility towards support for Ukraine and circulating distorted accounts internationally, it can attempt to convert France’s internal political difficulties into pressure on European policy.

With France approaching its 2027 presidential election, these operations warrant continuing scrutiny. The central investigative question is no longer simply whether foreign networks spread false information after violence occurred, but whether their activities before and during demonstrations materially influenced mobilisation, radicalisation or political responses.

The evidence currently demonstrates organised manipulation and attempts at amplification. Establishing direct responsibility for violence would require a further evidential step, involving financial records, communications, operational instructions or connections with identifiable perpetrators.

France’s experience illustrates how contemporary information warfare can operate within a democratic society without necessarily directing events on the ground. Its immediate objective may be to alter the political interpretation of a crisis; its longer-term consequence may be to influence the policies adopted in response.

• A NATO drone maker is partnering with a Ukrainian firm to manufacture drone parts underground.
• ORQA says the partnership offers lessons in keeping factories running during wartime.
• Western companies often overlook Ukraine's experience in manufacturing under attack, it says.

A NATO drone maker is teaming up with Ukraine's defense industry and building drone parts underground. The company's CEO said it's seeking to learn lessons in wartime production that could prove critical for Western defense companies in a crisis.

Croatian drone technology company ORQA and Ukrainian drone maker General Cherry are jointly developing and manufacturing interceptor drones, components, and other counter-drone systems in both countries. As part of the partnership, they are building an underground factory in Ukraine to make components.

Working amid Ukraine's wartime risks teaches the company valuable lessons in manufacturing while under attack, ORQA CEO Srđan Kovačević told Business Insider. Producing components in Ukraine is also more efficient than making them in NATO and shipping them to the Ukrainian military, he said.

Kovačević said his company is "learning from Ukraine," where industry is "under constant threat."

"They were also compelled to go underground, to go wide, to de-risk their assets in distribution," he said. "So I think that's the way forward for any critical capabilities."

Ukrainian defense firms are splitting their manufacturing across multiple sites, frequently relocating, and moving some work underground to avoid being targeted by Russian attacks. It's less efficient, but more resilient to attacks. Some Western officials and companies warn that it's time for European industry to learn these practices amid concerns about Russian aggression.

"Distributed systems are much more resilient to any disruption than concentrated systems, centralized systems," Kovačević said. "It's simply about not having a single point of failure."

Ukraine has "this immensely valuable lived experience of building and scaling under fire," the ORQA CEO said, "that's being often abstracted and neglected by Western companies." That, however, is starting to change, he said.

"I think the thinking is really shifting on the European side as well, that this distributed nature actually reinforces resilience even though there are economic downsides to it."

Raivis Melnis, the defense minister of Latvia, told Business Insider that NATO companies work in a far more concentrated way than Ukrainian ones do, and "the question is whether we are ready to produce the systems in different locations, dispersed, and how we organize that."

He wants Latvian and Ukrainian defense industries to work together in part so they can learn how Ukrainian companies maintain production during a war.

Davyd Aloian, the deputy secretary of Ukraine's National Security and Defense Council, told Business Insider earlier this year that defense companies within parts of NATO should "definitely" start breaking up their production more.

Some defense industry figures have voiced similar concerns about the state of production in the West. Karmo Saar, the head of sales for Estonian drone maker Krattworks, told Business Insider that in a war with Russia, if European companies don't disperse more, "I think we're going to be punished."

Dispersing production is not without trade-offs, though. Achi, CEO of the Ukrainian-Estonian defense technology company and ground robot maker Ark Robotics, told Business Insider that such defensive steps are "necessary," but "not ideal." Operations would be easier with everything in one place.

Choosing Ukraine despite the danger

Some Ukrainian companies have begun setting up production in NATO countries, both to better share their expertise with partner nations and to operate without the risk of Russian attacks.

But Kovačević, whose company makes drones as well as drone technology, including controllers, receivers, goggles, video equipment, and flight simulators, said that building in Ukraine comes with upsides.

The company, which supplies 24 NATO allies, could have done all of its work with General Cherry in Croatia, but instead, they are spreading their joint work across both countries.

Kovačević said building components in Europe and then importing them into Ukraine is "more inefficient than actually doing it in Ukraine." It's also more expensive, and Ukraine has shown its ability to produce in large volumes.

Localizing the supply chain also means that all parties can "exchange information more efficiently," including about what's happening and what's needed on the battlefield.

He said he understands why some Ukrainian companies are building gear on NATO soil, but he sees value in partnering with General Cherry in Ukraine. He said the Ukrainian company, one of the country's largest drone makers, has "a high operational excellence in running their own manufacturing operations in a safe manner, even under constant threat."

The partnership also offers lessons beyond manufacturing. He said that while the West "has a very deep technology expertise," it lacks "this lived experience of taking that technology and applying it to the operational reality of the 21st-century warfare."

The goal is to both supply Ukraine and to equip NATO with weapons shaped by Ukraine's battlefield experience and expertise. In Croatia, the partners are establishing a joint serial-production facility for co-developed interceptor drones and other counter-drone systems destined for NATO, while in Ukraine, they intend to create drone components, including electronics and communications systems, which General Cherry says it will supply to "all our partners in Ukraine," not just use itself.

Ukraine is already able to make the drones that the partnership will produce in Croatia, but "what they lack is the capacity to build components that go into those systems," Kovačević said, explaining the focus of the Ukrainian facility. He said the project won't disrupt Ukraine's existing supply chains. One of ORQA's priorities is to reduce reliance on Chinese products, and it wants to help Ukraine's industry do the same.

"Now," he said, "it's time to merge the two and emerge better off on both sides of this partnership."

Italian authorities are examining whether foreign interference helped intensify violent protests across the country, as Defence Minister Guido Crosetto warns that social media is being used as an instrument of hybrid warfare. Prime Minister Giorgia Meloni has introduced emergency security measures and deployed additional troops to Milan, while further demonstrations are planned for Saturday, 24 October.

Italy is investigating the possibility that foreign actors, including Russian operatives, helped amplify the violent unrest that swept Milan and other Italian cities on 17–18 October. The inquiry introduces a national security dimension to demonstrations initially driven by rising living costs, dissatisfaction with public services and broader economic grievances.

According to information disclosed about the government’s intelligence inquiries, officials working under Prime Minister Giorgia Meloni have requested assessments of whether foreign provocateurs contributed to the disorder. No public evidence has established that Moscow organised the violence, and Meloni’s office has declined to comment on the reported intelligence discussions.

The developments follow EU Today’s earlier coverage of the Milan disturbances, which documented extensive looting, attacks on police and the detention of hundreds of young people, many of them minors. Since then, Rome has moved beyond emergency consultations, approving legislation that expands police powers and introduces tougher criminal penalties for violent demonstrations.

On Saturday, 24 October, Italian security forces are preparing for another wave of protests, with additional military personnel, drones and specialist police units deployed in several major cities. The immediate question is whether the government can prevent further disorder while establishing how much of the unrest was locally organised and whether foreign information operations influenced its development.

Crosetto warns of hybrid warfare through social media

Defence Minister Guido Crosetto introduced the hybrid warfare argument during a Defence Procurement Forum in Rome on Tuesday, 20 October. In remarks recorded by Italian public broadcaster Rai, he described the disturbances as the culmination of a form of conflict being conducted through TikTok, YouTube and other social media platforms.

Crosetto argued that young Italians were undergoing what he called a form of counter-education outside their families and schools, absorbing political attitudes and values increasingly hostile to democratic institutions. He criticised Western governments for failing to recognise the consequences of this process, although he did not publicly present intelligence establishing Russian responsibility for the riots.

His comments also exposed differences within the governing coalition. Deputy Prime Minister Matteo Salvini questioned suggestions of Russian involvement, arguing that the immediate priority was identifying violent groups and preventing their movement into Milan.

Russian information operations under scrutiny

European investigators have identified activity by established Russia-linked disinformation networks, including Operation Overload and Doppelgänger, which have circulated and amplified material concerning the unrest.

These operations have previously used manipulated content, misleading narratives and coordinated online distribution to influence European audiences. In the present case, investigations into the online amplification of the violence have identified foreign exploitation of the disturbances, rather than proof that foreign governments organised them.

The European Commission has consequently declined to initiate emergency intervention against social media platforms, citing insufficient evidence linking foreign manipulation directly to the organisation of the protests.

France has taken a similarly cautious position. President Emmanuel Macron acknowledged that foreign actors had manipulated information after the violence but said there was no established evidence that they caused the disturbances. French Foreign Minister Jean-Noël Barrot has separately identified hostile narratives originating from Russia, China and Iran.

For European security authorities, the principal investigative question concerns the relationship between genuine domestic grievances and externally coordinated information campaigns. Foreign networks can exploit political divisions without necessarily directing the organisations or individuals involved in street violence.

Meloni introduces tougher security legislation

Meanwhile, Meloni’s government has proceeded with a substantial legislative response. Following cabinet approval on 20 October, Decree-Law No. 190 of 22 October 2026 entered into force on 23 October.

The legislation introduces penalties of two to five years’ imprisonment and fines of €10,000 to €20,000 for specified forms of organised violence during public demonstrations. Those organising or encouraging qualifying violent groups, including through digital communications, face potential prison terms of four to twelve years. It also expands provisions concerning juvenile offenders and preventive policing. The decree must undergo parliamentary consideration within 60 days.

Separately, the Italian Defence Ministry confirmed the deployment of 500 additional soldiers to Milan under Operation Strade Sicure until 31 December. The soldiers will reinforce security around sensitive locations and support existing police operations without acquiring additional judicial policing powers.

New demonstrations test the government’s response

Security arrangements have been intensified ahead of demonstrations scheduled for Saturday, 24 October, in Milan, Rome, Turin, Bologna, Florence and other cities.

According to the latest security preparations, Rome is deploying approximately 1,500 officers, while Milan is preparing a combined police and military presence supported by aerial surveillance.

On Friday, Italian investigators conducted searches targeting approximately 100 people suspected of involvement in the previous weekend’s disturbances, including 51 minors. Authorities are also monitoring online calls for renewed protests, some organised by groups whose leadership and membership remain unclear.

The unrest presents Meloni with two parallel challenges: containing violence and determining whether hostile foreign networks have played a significant role in its escalation. Italy’s investigations may help establish whether the events represent primarily a domestic public-order crisis, the exploitation of existing tensions by foreign actors, or a combination of both.

For Brussels, the outcome could influence future enforcement of the EU’s Digital Services Act and its wider response to foreign information manipulation. For now, the evidence supports concern about Russian amplification of European unrest, but not a definitive conclusion that Moscow orchestrated the riots.

• A major Western drone firm says working in Ukraine is key to getting gear to the standard NATO needs.
• ORQA is partnering with Ukraine's industry to co-produce drone systems, including for the NATO market.
• Its CEO said Ukraine has battlefield experience and operational excellence that can shape gear for NATO.

A Western company developing drone technology for NATO militaries says that working in Ukraine is the best way to ensure its gear meets the alliance's needs for a future fight.

ORQA, a Croatian company that makes drones and drone technology, including controllers, receivers, goggles, video equipment, and flight simulators, already supplies parts and systems to two dozen NATO allies. But it wants to draw on Ukraine's battlefield experience to improve its products.

Working in Ukraine "creates an opportunity to really channel this sort of operational expertise to shape these products. And then these products can be made to a standard that NATO demands," CEO Srđan Kovačević told Business Insider.

ORQA produces components used by Ukrainian defense tech company General Cherry and is partnering with the firm to jointly make drone systems and spread Ukraine's drone expertise.

The war in Ukraine is the most intense drone war ever fought, and getting feedback from the battlefield provides critical insight into what soldiers need most.

"If I'm being blunt, there are only a few parts of the world where you can actively shoot down these unmanned aerial threats in a real-world environment," Kovačević told Business Insider.

That same drive has prompted Western defense companies, ranging from small start-ups to major primes, to set up manufacturing facilities, repair hubs, and offices in Ukraine, seeking battlefield feedback to improve their technology faster.

ORQA is also seeking to better understand how Ukraine's defense industry scales, moves quickly, and works in wartime.

Ukrainian defense firms are producing drones and other weapons at a much faster rate than many of their Western counterparts.

Kovačević said that "the West has a tremendous amount to learn from Ukraine," saying that the "operational excellence that Ukrainian defense forces have developed is unparalleled in the Western world."

He said that while the West "has a very deep technology expertise," it lacks "this lived experience of taking that technology and applying it to the operational reality of the 21st-century warfare."

"Now," he said, "it's time to merge the two and emerge better off on both sides of this partnership."

General Cherry is one of Ukraine's biggest drone companies and has announced partnerships with other Western defense tech companies.

ORQA and General Cherry intend to manufacture in both countries, supplying NATO and its allies with Ukrainian-developed counter-drone technology while expanding domestic production of drone components in Ukraine.

Kovačević said Ukrainian companies like General Cherry have "immensely valuable lived experience of building and scaling under fire," something that is often "neglected by Western companies," but they can learn.

The significant "volumes that Ukrainian drone companies are able to produce really dwarf anything that's happening in the West right now," he added.

Western leaders are encouraging industrial collaboration, and NATO has launched programs to bring Ukrainian and allied defense companies together.

ORQA isn't alone in looking to Ukraine's extensive battlefield experience to develop better weapons for NATO. Latvia-based Origin Robotics, for example, makes BLAZE interceptor drones purchased by several NATO militaries and BEAK, a drone-launched precision-guided weapon used by Ukrainian forces.

Its CEO, Agris Kipurs, previously told Business Insider that the company takes lessons from its work in Ukraine, "but we adapt those weapons systems specifically to be used in a NATO country. And NATO countries and the armies of NATO countries are our customers. That is the user we build for."

Kovačević said Ukrainian technology can't simply be transplanted into NATO militaries. Ukraine has had to develop weapons at breakneck speed and make do with what's available.

NATO, however, has time to take operational knowledge, contextualize it for alliance forces, and build these products to the necessary standards using Western technology, he said.

Kovačević said the goal of these industrial partnerships is to supply NATO without undermining Ukraine's ability to meet its own wartime needs.

ORQA also aims to boost Ukraine's domestic production of drone components and reduce its reliance on foreign suppliers.

Ukraine is "relying heavily on non-Ukrainian and non-European supply chains," Kovačević said, adding that reducing that dependence is strategically important. ORQA says it manufactures key components in-house and avoids Chinese-made parts to strengthen its supply chain.

Sergei Kiriyenko, first deputy chief of staff of the Russian Presidential Administration, set the goals for the Ukraine strand of the operation, launched in early 2023 under the codename "Uganda." Alexander Kharichev, now head of the Kremlin's Directorate for Monitoring and Analysis of Social Processes, oversaw it, according to hacked correspondence published by The Insider on 21 October.

Doppelgänger disguises Russian narratives as local news through cloned media sites, fake accounts, paid ads, and fabricated videos. The FBI named Kiriyenko among its orchestrators in 2024, and its contractor, the Social Design Agency (SDA), run by Ilya Gambashidze, is still expanding, now targeting AI chatbots. The new files go inside the Ukraine campaign and show the operation reporting even exposed fakes to the Kremlin as achievements.

Telegram channels posing as Ukrainian

An internal briefing on narratives says the project ran its Telegram channels on the principles of agent work and psychological operations, the Russian version of the investigation shows. Early on, the team decided to disguise all its outlets as Ukrainian and to run its campaigns without direct Russian propaganda. Every channel carried Ukrainian news to look unconnected to Russia. Dropping pro-Ukrainian themes, the briefing warned, would eventually expose the client and wreck the whole plan.

Four goals and a can of stew

Kiriyenko set four goals: discredit Ukraine's military and political leadership, split its elites, demoralize its army, and disorganize its population. The SDA prepared the project's pitch and carried out the work.

Political strategist Alexander Asafov proposed fakes of his own: in May 2023, that soldiers were bribing commanders to avoid the front, and in January 2024, that Ukraine was pulling air defenses back to Kyiv to protect the authorities.

After an Il-76 military transport crashed in Belgorod Oblast on 24 January 2024, Moscow claimed it had been carrying Ukrainian prisoners of war. Kharichev's subordinate Yevgeny Kazakov, chairing a meeting in his place, proposed sending a fake to the widows of Ukrainian soldiers: "They died for an expensive Il-76—the Russians have few of those." The idea was dropped.

The same meeting produced another fake, and three days later the team launched it: that recruitment centers had sent widows a can of stewed meat with a little flag as compensation. The same producers also oversaw letters falsely attributed to Deputy Defense Minister Nataliia Kalmykova, the Russian version says.

Debunks filed as results

The SDA collected coverage of its work in a folder for the Kremlin. It filed the "Zelensky's yacht" story, which JD Vance, then a US senator and now US Vice President, echoed, together with its debunk. The report also included a TikTok campaign about former Defense Minister Oleksii Reznikov's family that the BBC had already exposed.

The Insider concludes that the team has had more failures than successes. The US sanctioned Gambashidze and the SDA in March 2024, and the UK followed in October.

• Russia looks to be moving toward 3D printed cruise missiles for its next era of air attacks on Ukraine.
• The threat could be so major, turbojet Shaheds would seem like a small problem, one drone guru said.
• GUR recently posted details of the Filin, a cheap Russian missile reported to fly as fast as 500 mph.

Russia's next big bet in the air war will likely move past jet-powered Shaheds to a deep arsenal of new cruise missiles, two of Ukraine's most prominent drone experts warned on Thursday.

Serhii "Flash" Beskrestnov and Serhii Sternenko wrote separately on their Telegram channels about the Filin, an 11-foot Russian winged cruise missile that Ukraine's military intelligence service recently unveiled.

These cheap weapons possess superior capabilities that would easily overshadow the threat posed by the Shahed, according to the pair, both former drone advisors to Ukraine's defense ministry.

"The mass use of this type of aerial attack weapon is what awaits us very soon," wrote Sternenko, who runs a major foundation that crowdfunds for Ukraine's military, in a Telegram post.

"Then we will remember the jet Shaheds only as a small problem compared to this," he added.

Beskrestnov, a drone analyst, said he had "long predicted that our adversary is betting on cheap cruise missiles for the future, not on jet Shaheds."

He wrote on his Telegram channel that the Filin can fly faster, maneuver better, and carry a heavier payload than Russia's current turbojet drones,

"They do not need drone ports, many of them can be launched from helicopters and UAVs. And most importantly, they can be produced from Russian components," Beskrestnov added.

A strike at nearly 500 mph for cheap

On Wednesday, Ukraine's military intelligence agency, GUR, released extensive details on the Filin, which it said Russia had begun deploying at the end of summer 2026.

The Filin, it said, is the "continuation of the trend of the Russian military-industrial complex to develop inexpensive air attack weapons with jet propulsion and ground launch."

The ground-launched missile can carry a 100kg warhead, and Russia has said that it can fly at speeds of almost 500 mph at a range of 745 miles. By comparison, the Kremlin's most advanced jet-powered drone deployed so far, the Geran-5, is known to fly at a maximum speed of 370 mph.

The Filin can also fly at "ultra-low altitudes" and as high as 3.7 miles, GUR said.

Similar to Russia's Shahed drones, the Filin features a carbon and fiberglass fuselage, with some of its parts produced via 3D printing, the intelligence service added.

And as with turbojet Shaheds, GUR also said that the Filin is filled with foreign electronics in its flight controller, inertial navigation system, equipment control unit, and counter-jamming hardware.

The agency listed 35 components from the US, including transistors and converters; 22 from China; and 13 more from Japan, Switzerland, Taiwan, and the Netherlands.

Notably, GUR said the Filin's engine is Russian-made, compared to the Chinese engines used on many of Moscow's turbojet drones. The same engine has been found on other recently unveiled Russian missiles, such as the air-launched Kover and Monochrome.

Much of Russia's ability to reduce the cost of its new cruise missiles is owed to its use of commercial engines and components. Another high-profile Russian missile that also uses civilian tech is the Banderol, which emerged in the spring of 2025 and has been straining Ukraine's air defense networks in the last few months.

The Banderol flies more slowly and has a shorter range than the Filin, but it still reaches a max speed of 435 mph, making it much harder for Ukraine to intercept with drones. Its estimated price is $150,000 per unit — about a sixteenth the cost of a traditional Kh-101 cruise missile — so it's easier to mass-produce.

The frequent use of weapons like the Banderol over the summer has led to fears that Russia will lean into its tactic, often nicknamed "missile spam," to keep pushing Ukrainian air defenses.

"What is the Air Force command doing now to build up countermeasures in advance?" Sternenko wrote on Wednesday about the missile threat.

Ukraine's Defense Forces advanced more than 15 km through underground utility tunnels into Russia's rear on the Kupiansk axis in Kharkiv Oblast, the Khartiia Corps of Ukraine's National Guard reported on 22 October. The corps called it Operation Veles. The underground advance was paired with attacks on the surface and drone strikes, hitting Russian forces from two directions, the corps told Militarnyi.

Russian troops have repeatedly crawled through gas pipelines around Kupiansk to get behind Ukrainian lines, even after Ukraine reported confident control of the city in February. This time, Ukraine went underground itself. The operation took away Russia's chance to get into Kupiansk's rear, the corps said.

The corps reported more than 30 Russian soldiers captured and Russian losses of more than 100. Militarnyi, citing the unit, put the number of Russian troops killed at over 100.

Khartiia studied how Russian troops moved through pipes before going underground itself, the corps commander, Brigadier General Ihor Obolenskyi, said.

"We watched how the enemy works underground and studied how they do it. The Russians intended to use gas pipelines to get into the rear of our troops. So we went underground ourselves. We anticipated the enemy's actions and mastered the tactics of underground combat," he said.

Boots under ground!

Asymmetric breakthrough in the Kharkiv Region: Khartiia Corps conducts the subterranean counteroffensive Operation VELES, advancing 15 km underground.

Corps Commander General Ihor Obolenskyi explains a unique operation. pic.twitter.com/qRQ93kckpK

— Khartiia Corps in English (@khartiia_eng) October 22, 2026

For the operation, troops trained physically and psychologically to fight in confined spaces, sappers and engineers prepared the underground route, and special communications, navigation, silent logistics, and life-support systems were put in place, Khartiia told Militarnyi. The operation was named after Veles, the Slavic pagan god of the underworld.

Khartiia's brigade, the R.U.H. assault regiment, the Lava drone regiment, the Achilles drone brigade, and units of Ukraine's military intelligence, including the Freedom of Russia Legion and the Russian Volunteer Corps, took part, the corps said.

Russia has used pipelines to infiltrate before

By September 2025, Russian forces had used pipelines to move troops behind Ukrainian lines three times, Ukrainian monitoring project DeepState reported on 12 September 2025. The first was in Avdiivka, the second near Sudzha, and the third near Kupiansk, where groups crossed the Oskil River through a gas pipe.

Near Sudzha in March 2025, Russian special forces walked through a pipeline that until recently had carried Russian gas to Europe, the Associated Press reported. A pro-Kremlin blogger claimed they covered about 15 km and that some spent several days inside.

Russian troops kept using the pipeline near Kupiansk this year. On 27 September, Khartiia's reconnaissance drones recorded Russian forces leading nine civilians, including children, elderly people, and a person on crutches, through the gas pipeline out of the Kupiansk community. Men of military age in civilian clothes walked alongside them, and the corps believes they were Russian soldiers using the group as cover to withdraw. Ukrainian troops held fire because of the civilians, the corps said, adding that the case has been documented for a war crimes investigation.

Why the war is moving underground

Drones, constant surveillance, and AI-assisted targeting have made the battlefield surface transparent and deadly, argue John Spencer, chair of urban warfare studies at West Point's Modern War Institute, and Col. Drew Craig, principal military engineering staff officer at NATO's Allied Rapid Reaction Corps. In an August analysis, they write that soldiers in Ukraine describe a "death zone" of some 30 km, where moving above ground can draw an attack within minutes. When firepower makes the surface too dangerous, armies have historically gone underground, as they did in World War I and Vietnam, and more recently in Gaza and Lebanon.

"Armies that cannot survive above ground must adapt below it," the authors write.

Fighting in tunnels brings its own requirements, the authors write: detecting the enemy by sound and vibration, and specialized unmanned systems that cannot rely on GPS or stable radio links. Long stretches underground also take a severe psychological and physical toll on soldiers.

Western militaries are not ready for this, Spencer and Craig write. No NATO partner maintains even general capabilities for large-scale underground warfare, and US and British efforts focused mainly on detecting and clearing tunnels rather than occupying and operating in them.

The suspect allegedly collected relevant information in connection with Russia's war against Ukraine, including on the production of armored vehicles, ammunition, and explosives, as well as on military personnel and facilities on NATO's eastern flank.

Russian forces are preparing to resume mechanized assaults in southern Ukraine after a pause of several months and are moving armored vehicles toward areas where they plan to launch offensives, Anastasiia Shevchenko, deputy spokesperson for the Southern Forces Grouping, told Ukrinform on 22 October. The Huliaipole axis remains the hottest in the Southern grouping’s zone, with 10 to 20 combat engagements reported on an average day, she said.

On the Huliaipole axis, one of Russia’s largest force groupings is fighting Ukrainian forces, comprising units from several Russian combined-arms armies, the spokesperson says. Over the past week, as the weather worsened, Russian forces began local assaults there with infantry, motorcycles, and armored vehicles, seeking to break through toward Zaporizhzhia and blockade the city, Ukraine’s 7th Air Assault Corps reported, adding that the area is one of Russia’s key priorities in southern Ukraine. Russia has used fog this way before: last November, Russian troops moved under its cover to avoid detection by Ukrainian drones as they advanced on Huliaipole, the Institute for the Study of War assessed.

Russian forces have abandoned large-scale assaults across a broad front and are attempting to infiltrate Ukrainian positions in small groups. They periodically use motorcycles and quad bikes for assaults, Shevchenko said, adding that these vehicles are fast and maneuverable.

However, Russian forces should not expect to advance unimpeded, the spokesperson noted. Ukrainian units control Russian supply routes and systematically detect and strike Russian personnel and equipment while they are still moving toward their launch positions, she added.

“Specifically, speaking in numbers, since the beginning of October alone, units of the Southern Forces Grouping (Forces) have destroyed more than 3,000 occupiers and 1,300 pieces of weapons and military equipment. Thus, the enemy is suffering significant losses in the operational zone of the Southern Forces Grouping (Forces),” the spokesperson concluded.

Ukrainian drones disrupt Russian logistics

Russian forces had stopped using military vehicles because Ukraine’s unmanned systems forces controlled their logistics, Shevchenko said in comments to Ukrinform on 16 September. Ukrainian drones spotted Russian troops and equipment in time and struck them mostly on their routes of advance, she said.

Ukrainian air strikes destroyed bridges near Polohy in Zaporizhzhia Oblast, complicating Russian supply operations along the Huliaipole axis, Ukraine’s 7th Air Assault Corps reported on 21 September. Russian forces had used these bridges to move personnel, heavy equipment, and ammunition for their offensive toward Orikhiv. Disruptions to logistics have forced Russian units to rely more on motorcycles, which are more vulnerable to Ukrainian strikes, the corps said.

Russian forces are also expected to use fog and rain as cover for assaults, Mykola Zinko, deputy commander of the unmanned systems battalion of the 5th Assault Brigade, said on 19 October. Russia has brought up reserves, and its heavy equipment will move out under the fog, he said.

France, Germany, Austria and Poland are expanding or reviewing the authority of critical infrastructure operators to defend facilities against drones, raising legal and operational questions over the growing role of civilian companies in national security.

European governments are reconsidering who should be authorised to intercept hostile drones as energy companies and critical infrastructure operators confront an increasingly serious threat to electricity networks, transport systems and other essential facilities.

France has already introduced legislation permitting approved operators to deploy counter-drone systems, while Germany is reviewing similar arrangements and Austria has announced plans to extend certain protective powers to infrastructure companies.

Poland has moved further by authorising designated security units to disable or destroy drones entering restricted areas around important energy installations.

The changes reflect concerns that national police and armed forces cannot provide permanent protection for every substation, power station, railway facility or pipeline against relatively inexpensive unmanned aircraft.

France establishes a new approach

In August 2026, the French parliament approved legislation allowing authorised operators of critical infrastructure and their contractors to detect, jam and intercept drones near designated facilities.

The legislation followed a series of reported drone incursions over sensitive locations, including military installations.

Under the French approach, operators of strategically important infrastructure may eventually use approved counter-drone systems without relying exclusively on the immediate intervention of military personnel.

Potential beneficiaries include electricity operators and organisations responsible for transport infrastructure.

French authorities are testing detection equipment, electronic countermeasures and interceptor drones at Brétigny-sur-Orge, south of Paris.

The programme examines systems capable of identifying approaching aircraft, determining whether they present a threat and initiating an appropriate response.

France intends to expand the protection of sites classified as strategically important, with further deployment planned during 2027.

The initiative would introduce responsibilities traditionally associated with military or police operations into the management of civilian infrastructure.

Germany and Austria reconsider existing restrictions

Germany is examining the legal conditions under which private companies and infrastructure operators could participate in active counter-drone operations.

At present, responsibility for neutralising threatening aircraft remains primarily with the competent public authorities.

The debate has intensified following security incidents involving unmanned aircraft, including the discovery of an explosives-laden drone near a Ukrainian cargo aircraft at Leipzig/Halle airport in August.

German authorities attributed the incident to Russia, an allegation Moscow denied.

The German government’s review concerns not only the equipment that companies may possess but also whether trained security personnel should be permitted to deploy countermeasures without waiting for a separate police authorisation.

Austria announced plans in September to extend comparable powers to selected critical infrastructure operators, including major energy companies.

The government has acknowledged the practical limitations of protecting a large number of widely dispersed installations using state security personnel alone.

Poland has already established restricted drone zones around sensitive energy facilities, with designated security units authorised to intercept aircraft entering those areas under applicable national rules.

Electricity networks face particular risks

Electricity infrastructure presents a difficult security problem because essential installations are distributed across extensive geographical areas.

Transmission operators manage thousands of kilometres of high-voltage lines, while substations, transformers and switching stations connect generation facilities to consumers.

A successful attack against critical equipment can produce consequences extending well beyond the immediate site.

Large power transformers are particularly difficult to replace. Manufacturing, transporting and installing specialised equipment can require lengthy preparation, making rapid recovery uncertain after serious damage.

European utilities have traditionally concentrated on physical security, maintenance and restoring services after technical failures or accidents.

The spread of drones creates additional demands for surveillance, early warning and the ability to respond before an attack reaches its target.

Russia’s repeated strikes against Ukraine’s electricity infrastructure have demonstrated the extensive disruption that attacks on power systems can cause.

European governments are now evaluating how comparable vulnerabilities could be exploited against their own networks.

Who bears responsibility for an interception?

Giving civilian operators access to counter-drone equipment raises unresolved legal questions.

Electronic jamming can interfere with communications and navigation systems beyond the targeted aircraft. A drone brought down over an industrial or residential area could injure members of the public or damage surrounding property.

Security personnel must also determine whether an unidentified drone is hostile, operating unlawfully or simply present because of an error by its operator.

A mistaken interception could expose infrastructure companies to compensation claims and other legal consequences.

European governments must therefore establish who can authorise an intervention, which countermeasures are permitted and how responsibility is allocated when damage occurs.

There is no uniform European approach.

Some operators support expanding their protective powers, while others argue that the use of force should remain the responsibility of the state.

Finland’s national electricity transmission operator, Fingrid, has expressed reservations about transferring such authority to energy companies.

The position reflects a wider concern that infrastructure operators should concentrate on maintaining essential services rather than assuming responsibilities for armed or coercive security operations.

A growing European security market

The regulatory debate is developing alongside a rapidly expanding market for counter-drone technology.

Manufacturers are offering equipment that integrates radar, optical sensors, electronic detection and software capable of classifying possible threats.

Interceptor drones and electronic countermeasures are increasingly being designed for use around civilian infrastructure rather than exclusively on military installations.

German defence company Rheinmetall has reported growing interest from private infrastructure operators in counter-drone protection.

However, the technology is advancing faster than the legal frameworks governing its use.

The immediate challenge for European governments is to establish protective arrangements that allow rapid intervention while preserving clear accountability.

A counter-drone system can identify an approaching aircraft within seconds. Determining who is authorised to stop it remains a matter for national law.

Reviewing internal documents from Germany's armed forces, German media reports that this is the military's second-highest threat classification.

Intercepting a jet-powered Geran can cost anywhere from $2,000 to $4 million depending on the weapon used. Cheap interceptor drones are the only option that keeps air defense affordable, the foundation of Ukrainian top war volunteer Serhii Sternenko said on Telegram.

Russia’s jet Gerans now carry every characteristic of a small cruise missile, and Russians keep raising their speed in answer to each Ukrainian countermeasure. Former commander-in-chief Valerii Zaluzhnyi has framed the shift bluntly: an expensive Cold War missile has become a cheap weapon fired in bulk, and the drone is now “a missile in all but name,” affordable to any side, not only wealthy countries.

Sternenko heads a charitable foundation that has purchased 291,502 FPV drones, which have helped Ukraine’s military down more than 12,954 aerial targets. Also, has advised the team of former Defense Minister Mykhailo Fedorov.

Three ways to kill a jet Geran, and what each costs

The foundation laid out the price of each method:

• Aircraft (F-16, MiG-29, Su-27, Mirage 2000): $25,000 to $1.2 million per kill. Effective, but the stock of missiles is critically low, and some air-to-air types are no longer being replenished.
• Surface-to-air and shoulder-fired systems (IRIS-T, NASAMS, Vampire, Avenger): about $30,000 to $4 million. Good for shielding key sites, but a missile capable of reaching a jet Geran at 6 to 7 kilometers costs $0.5 million to $4 million.
• Interceptor drones (makers undisclosed): from $2,000. Cheap, with trained operators ready, but not yet scalable.

Why the cheapest option is the one that matters

No single tool is enough, the foundation stresses. Downing jet Gerans still needs aircraft, small aviation and missile systems together, but it is the interceptors that make the defense affordable, taking out the cheaper Shaheds and saving costly missiles for targets nothing else can reach.

The foundation says it has found a way to counter drones that already match small cruise missiles, working with Ukrainian manufacturers, without disclosing details. The method is far cheaper than other ways of downing jet Gerans and significantly strengthens air defense, it says, as part of a wider Ukrainian push to field interceptor drones fast enough to catch Russia’s fastest weapons.

The commander of an interceptor battalion in Ukraine’s 3rd Army Corps said his unit destroyed several thousand Russian aerial targets during Operation Vivaldi, ArmyInform, the Defense Ministry’s news agency, reported on 21 October.

Operation Vivaldi is a Ukrainian counteroffensive north of Lyman in Donetsk Oblast, where the 3rd Army Corps has reported liberating settlements. In its third phase, Ukrainian forces reclaimed five settlements and expanded their gains to 176 square kilometers. Strikes on Russian logistics and electronic warfare likely neutralized Russia’s drone defenses before Ukraine sent in armor, the Institute for the Study of War assessed.

The commander, who uses the callsign “Betsyk,” leads the interceptor battalion of the 1030th Anti-Aircraft Missile-Artillery Regiment “Aquila,” part of the 3rd Army Corps. He said Russian forces deployed large numbers of reconnaissance drones to locate Ukrainian positions after the corps began advancing.

Betsyk named Zala, Orlan, Supercam, Merlin, and Knyaz Veshchiy Oleg among the reconnaissance drones used by Russian forces.

Russia also brought in reinforcements and units operating strike drones, including first-person-view (FPV) quadcopters, Molniya fixed-wing FPV drones, and Lancet crews, he said. At one stage, Russian forces deployed crews from their Rubicon drone unit to disrupt the advance, but the move did not change the situation.

Betsyk said his battalion’s work deprived Russian forces of the ability to strike Ukrainian troops and track their movements.

Jet-powered Shaheds: speed is the main challenge

The regiment also works against Russian strike drones heading for targets behind the front line. Betsyk said interceptor crews had destroyed some jet-powered drones, but not in significant numbers.

The main difficulty is speed, he said. Interceptor drones need to reach 500–600 km/h to intercept Russian jet-powered attack drones, according to Betsyk.

For now, the regiment mainly uses conventional air-defense systems against these targets: self-propelled anti-aircraft systems, surface-to-air missile systems, and portable surface-to-air missile systems. Betsyk said these systems were historically designed to engage jet-powered targets.

He compared the current challenge with the early use of piston-powered Shaheds. Those drones initially posed a serious threat but later became easier for Ukrainian air defenses to counter. Russia has largely stopped using piston-powered Shaheds on most fronts since summer, he said, but continues to use piston-powered Gerbera drones, which are relatively cheap and can partly exhaust Ukrainian air defenses. The main drones Russian forces use now are jet-powered Shaheds, he said.

Betsyk expects Russian forces to adapt if Ukraine fields effective interceptors against jet-powered drones. They will seek ways to evade the interceptors, increase speed, improve navigation, and change their tactics, he said. However, he added that the battalion had not observed a major evolution so far and did not expect the drones’ speed to double.

What the corps says Vivaldi achieved

Separately, 3rd Army Corps commander Andrii Biletskyi said Ukrainian forces retook 277 square kilometers and 16 settlements during Operation Vivaldi, Ukrainska Pravda reported. Biletskyi also said Russian losses exceeded 8,000 personnel, according to ArmyInform. These figures are Ukrainian claims and have not been independently verified.

Russia’s Rubicon drone unit, which is sent to hunt Ukrainian drone pilots, was not used to being hunted itself, Brigadier General Andrii Biletskyi told journalists on 19 October. He was summing up Operation Vivaldi, which his Third Army Corps fought in northern Donetsk Oblast from May to mid-October. Once its pilots realized they were being killed, Rubicon’s morale dropped sharply, he said.

Russia has fought for 12 years to take all of Donetsk Oblast, and Sloviansk and Kramatorsk anchor the fortress belt of cities Ukraine still holds there. Vivaldi retook 277 km² in northern Donetsk Oblast. Biletskyi says it destroyed Russia’s bridgehead on the Chornyi Zherebets River and forced Moscow to drop its plan to bypass Lyman from the north and encircle the two cities. On that front, the Third Corps had flagged Rubicon, Russia’s elite drone unit, as a threat.

Hunting the hunters

Once a Rubicon position was found, the Third Assault Brigade and the KRAKEN drone regiment committed any number of FPV and bomber drones to destroy its crews, Biletskyi said.

The brigade’s commander, Yaroslav Levenets, said his troops prepared for Rubicon’s arrival and concentrated on killing its pilots. He gave no details.

“Not stable in defense,” Levenets said of Rubicon’s troops.

They dislike sitting in trenches, he said, and under pressure they grow nervous and change positions.

Named for four seasons

Biletskyi said the name was chosen at the very start of planning, in winter 2025–2026, many months before the operation began. The original plan had four stages, one for each season, and later grew to slightly more, ArmyInform reported.

When he first unveiled the operation in September, he put it this way:

“Vivaldi, as is known, has four seasons. And this is only the first one.”

He credited two planners, known by the call signs Yurist and Leshyi. Leshyi, an assault soldier wounded seven times who later moved to staff work, was killed. Yurist was seriously wounded.

A new hand at the Third Corps

Major Dmytro Rohoziuk is now acting commander of the Third Army Corps, the corps press service said on 20 October. The press service said the move is not a transfer, and Biletskyi keeps his formal post as corps commander while he leads the “Center” grouping of the Third, 11th, and 19th corps.

Rohoziuk took over the 60th Mechanized Brigade in October 2025. Its previous commander was arrested in January after the State Bureau of Investigation accused him of embezzling about $1 million in weapons procurement. The brigade fought in all four phases of Vivaldi and retook Kolodiazi without street fighting.

Biletskyi also declined command of the Ground Forces, which oversee mobilization.

“There’s no point taking on something you don’t truly believe you can improve,” he said.

Biletskyi’s count

Russian losses in Vivaldi topped 8,000 troops, and about 270 Russian soldiers were taken prisoner, Biletskyi said. More than 20 officers surrendered, including a chief of staff and three company commanders.

The territory matters less than disrupting Russia’s strategic plan, he said. Russian forces still press toward Dobropillia, where Ukraine is counterattacking.

Patrol density along Lithuania’s border with Russia’s Kaliningrad exclave has practically doubled since soldiers joined the border guards there in early October. Lithuanian Armed Forces Commander Raimundas Vaikšnoras told LRT this in an interview. He linked the deployment to provocations and to what he described as Russian preparations for a large-scale mobilization.

Kaliningrad is a piece of Russia wedged between Lithuania and Poland on the Baltic Sea. Lithuanian Defense Minister Robertas Kaunas said people would naturally flee a Russian mobilization. Earlier, on 11 August, President of Ukraine Volodymyr Zelenskyy said that Russia planned to mobilize several hundred thousand people by the end of 2026, after its parliamentary vote.

Commander: Russia lacks troops for a breakthrough

Vaikšnoras said Russia is struggling in Ukraine and needs to fill gaps in its capabilities. Moscow would probably like a breakthrough but lacks people, he added. In July, Ukraine’s Foreign Intelligence Service estimated that Russia had signed about as many new military contracts this year as it had lost troops.

He also cited provocations. In Latvia, armed men recently tried to push migrants across the border, he noted, leaving open whether they were bandits or criminals. Belarusian ruler Alyaksandr Lukashenka denies everything, he added. On 6 October, Latvian Interior Minister Jānis Dombrava wrote that the escorts stood on the Belarusian side, were armed, and threatened Latvian soldiers.

Mission extended to mid-November

Lithuania decided to send troops after that Latvian incident. On 7 October, Interior Minister Martynas Katelynas asked Defense Minister Kaunas for troops to help the State Border Guard Service. Kaunas then approved up to 100 soldiers until 16 October, LRT reported.

On 16 October, Kaunas extended the mission to mid-November at Katelynas’s request. The Defense Ministry cited possible flows of people fleeing Kaliningrad and related illegal border crossings. It also said military intelligence sees no significant changes in military activity in Kaliningrad. Katelynas had earlier called the step preventive, BNS noted. He cited public, non-intelligence reports of a call-up planned after Russia’s parliamentary elections and said the threat level at the border had not risen.

Commander doubts Moscow’s intentions

Vaikšnoras said Russia and Belarus may not want open incidents that leave their traces right now. He added that he does not believe in their good intentions. He noted it has been said publicly that Russia’s capability in Kaliningrad is sharply reduced, because most of its forces are committed to Ukraine. Back in June 2025, Poland’s foreign minister said that, from what he knew, Russia had withdrawn a large part of its troops from the exclave.

Instead, hybrid attacks and sabotage that cannot be traced at once will probably continue, Vaikšnoras said. LRT noted the interview took place before a Ukrainian drone crashed in Pasvalys district on Sunday and before an attempted arson at premises used by SpaceX in Vilnius.