Probing the Gaps: The Drone Intelligence Threat in Europe
By Mejreme Asllani | 18 November 2025
Summary
A series of airspace disruptions at major European civilian airports and sensitive military sites in late 2025 is being assessed by national security officials as a coordinated, state-level hybrid warfare campaign, with the aim of intelligence gathering and infrastructure probing.
These "gray-zone" incidents expose significant vulnerabilities in Europe's critical national infrastructure. These incidents ultimately create immediate economic disruption, as they force billions in unplanned defence spending, and also cause significant political and diplomatic strain over the difficulty of attributing the attacks.
It is likely that these deniable intelligence and probing operations will intensify, forcing European Union (EU) and North Atlantic Treaty Organisation (NATO) members to accelerate the procurement of advanced C-UAS systems.
Context
In the autumn of 2025, sophisticated and disruptive Unmanned Aerial System (UAS), or drone, incursions and navigation-signal interference swept across European airspace. The events escalated in early November 2025, with Belgian airspace subjected to a sustained wave of drone activities. Major civilian hubs, including Brussels Airport and Liege Airport, were forced to suspend operations, causing widespread delays and cancellations. New incidents were also reported at Sweden's Gothenburg-Landvetter airport.
Simultaneously, drones were detected over sensitive military installations. The most significant target was Kleine-Brogel Air Base, a critical facility that hosts Belgian F-35 fighter jets and is understood to be part of the NATO nuclear sharing programme, housing US tactical nuclear weapons.
Belgian Defence Minister Theo Francken explicitly described the military overflights as a "spy operation". He detailed a two-phase operation where small drones first appeared to test the radio frequencies of the base's security systems, followed by larger, more capable drones. This advanced, multi-phase tactic is considered well beyond the capability of amateurs and points directly to a state actor assessing the base's electronic defences and response capabilities.
A Europe-Wide Pattern
This incident was not isolated. In September 2025, Denmark's Copenhagen Airport faced a similar shutdown. Danish Prime Minister Mette Frederiksen labelled the event a "hybrid attack" and "the most serious attack on Danish critical infrastructure to date." The Danish government reported the incident to its NATO allies. underscoring its assessment of the event as a national-level security threat.
This pattern of aerial incursions has been observed across Europe, notably over Poland, Romania, Germany, Estonia and Norway, often targeting military bases or critical infrastructure. While public attribution is complex, state and security officials and analysts widely, though often not publicly, suspect Russia is behind these incursions, having extensively developed and field-tested such tactics. The motive is assessed to be twofold: gathering direct intelligence, and conducting a "gray-zone" campaign of psychological pressure, economic disruption, and political destabilisation.
A New Front in Hybrid Warfare – Drones for Reconnaissance
The recent events demonstrate that low-cost, deniable drone technology has opened a new front in hybrid warfare. These actions are deliberately calibrated to exist in the "grey zone": hostile and aggressive, yet falling just below the established legal and political threshold of a "use of force" or "armed attack" that would justify a conventional military response.
The war in Ukraine has served as a large-scale laboratory for drone warfare, proving that UAS are the primary tool for Intelligence, Surveillance, and Reconnaissance (ISR) on the modern battlefield. An adversary can now achieve invaluable intelligence gathering, previously requiring a high-risk human agent or a very expensive satellite/aircraft, with relatively low-cost drones. These drones are highly sophisticated and highly effective in conducting surveillance and gathering intelligence over specific terrains, which adversaries can strategically utilise.
By flying drones over sensitive sites like Kleine-Brogel or the Erding military base near Munich Airport, an adversary can test direction-finding mechanisms, including whether a drone is detected by radar, acoustic, or optical sensors, and at what range or altitude it is able to do so. Furthermore, it can also map electronic defences, namely jamming systems. The failure of the jammer at Kleine-Brogel suggests the drones may have operated on non-standard, agile frequencies specifically to test these systems. Lastly, it can also gauge response times. This probing provides a detailed map of a high-value target's defences, all while maintaining a plausible operating state. This asymmetry complicates attribution and accountability, creating a new and deeply troubling airspace security challenge.
Economic Disruption and Security Costs
The implications of this new threat are not just military but have immediate and severe economic consequences. The shutdown of major economic hubs like Brussels and Copenhagen airports grounds flights, severs supply chains, and results in millions of EUR in lost revenue for airlines, logistics companies, and the airports themselves. The long-term costs, however, are far greater. These incidents have exposed a major gap in national security, forcing a reactive, unplanned, and extremely expensive procurement race for Counter-UAS (C-UAS) systems. This represents a new "security tax" being levied on European nations.
In Belgium, Minister Francken announced an immediate request for an emergency EUR 50m "drone plan" to acquire initial C-UAS capabilities. More significantly, he stated a long-term need for an investment package of EUR 500m to properly defend Belgium's critical sites. In response to the incursions, the UK provides military support to Belgium, followed by Germany and France, who have also agreed to provide anti-drone equipment to Belgium. This pattern is set to be replicated across the EU, diverting billions of EUR from planned budgets to this new, urgent defensive requirement. Every piece of critical infrastructure, such as airports, seaports, nuclear power plants, government buildings, and military bases, is now a potential target that must be hardened at significant expense.
Political and Diplomatic Strain
The political and diplomatic fallout from these "grey-zone" attacks is perhaps the most significant challenge. The strategy is designed to create a "no-win" scenario for the targeted nation, generating internal political pressure and external diplomatic friction.
Domestically, the incidents create a strong public and political perception of government weakness. The inability to prevent a small drone from shutting down a national airport or overflying a sensitive military base is politically damaging. It triggers emergency meetings of National Security Councils, as seen in Belgium, and creates pressure for immediate, visible action, which may not always be the correct strategic response. Externally, the incidents create a severe diplomatic dilemma centred on attribution. While suspicions point strongly toward Russia, establishing a definitive, public link is notoriously difficult. Russia, following its established playbook, routinely denies these allegations and often counter-accuses NATO of “provocation”.
This leaves countries like Belgium in a difficult position. They are certain they are under a "hybrid attack" but lack the indisputable evidence required to justify a strong, proportional diplomatic or economic response. This legal and political "grey zone" is precisely what the aggressor seeks to exploit. It incorporates traditional statecraft, frustrates alliances, and allows the hostile action to continue without significant consequence, all while testing NATO's political cohesion and resolve.
Hacı Elmas/Unsplash
Forecast
Short-term (Now - 3 months)
It is likely that Europe will experience continued, sporadic-to-coordinated drone probing incidents.
These will likely target key logistical and military hubs, particularly on NATO's northern and eastern flanks, to gather further intelligence on response protocols and new defensive systems being deployed.
Medium-term (3-12 months)
It is highly likely that EU member states and the UK will fast-track the procurement and deployment of advanced, integrated C-UAS systems. This will involve a multi-billion EUR investment in layered defences, including radar, radio-frequency detection, and kinetic (missiles, cannons) and non-kinetic (jammers, high-powered microwave) effectors for all critical national infrastructure.
Long-term (>1 year)
It is likely that state attribution for at least one of these incursions will be established, either through the electronic capture of drones or other intelligence means.
It is highly likely that these incursions will accelerate a significant shift in European strategic doctrine moving from a reactive to more assertive and independent defence.
The development of this new posture will very likely be contingent on the perceived level of US engagement.
