The Kremlin does not need a major war with NATO. For Moscow, it is far more advantageous to create an incident in which the attack itself lasts only a few minutes, while the alliance’s 32 capitals spend several days arguing over what exactly happened, who was behind it, and where the line lies between a provocation and an armed attack. In this logic, a drone, missile, act of sabotage, or cyberattack becomes not so much a weapon of destruction as an instrument of testing: how quickly NATO can reach agreement, make a political decision, and respond before uncertainty begins working in the adversary’s favor.
On November 15, 2022, in the Polish village of Przewodów, a few miles from the Ukrainian border, a missile struck a grain-drying facility and killed two local residents. Europe spent the next twenty-four hours in what diplomats would later describe as the most tense period since the beginning of the war: Warsaw was preparing to request consultations under Article 4 of the Washington Treaty, while Article 5 was already being seriously discussed in public. It later emerged that the missile was most likely Ukrainian, fired by an S-300 air defense system during an attempt to repel a Russian strike. The crisis dissipated within two days.
Both sides absorbed the lesson of Przewodów.
The alliance learned that the first hours after an incident belong to competing versions, not to established facts. Moscow learned exactly the same lesson, but from the opposite perspective. Nearly four years later, Polish Prime Minister Donald Tusk addressed the Sejm with a warning that reads almost like a description of that lesson being turned against the West. According to him, Russian drones and missiles could enter the territory of one or more countries on NATO’s eastern flank and even cause damage, after which “the official version will be that it was an accident.”
The warning came only days before the end of the State Duma elections. The coincidence produced a convenient narrative in the European press: the elections are over, therefore escalation begins. The narrative is wrong, although not entirely meaningless. The real threat looks different and, in my view, is more troubling for Europe than the familiar image of tanks moving toward the Suwałki Gap.
57 Percent and Not a Single Shot: What Actually Ended on September 20
The three-day vote ended on the evening of September 20. By the morning of September 21, with more than 90 percent of precinct protocols processed, the Central Election Commission had United Russia at 57.86 percent of the party-list vote. According to official figures, turnout reached 56.66 percent, higher than in both 2016 and 2021. Candidates from the ruling party were leading in 208 of the 225 single-member districts, putting the final number of seats comfortably above 300 out of 450. Yabloko never made it to the finish line: the party was removed from the election by a Supreme Court ruling. Dmitry Medvedev headed the federal party list, a man whose pronouncements about Europe have long since evolved into a literary genre of their own.
I regard the Central Election Commission’s figures as a political document, not as sociology. The discrepancy is visible without a magnifying glass. A state-run VTsIOM exit poll gave United Russia 49.4 percent, while INSOMAR put it at 52.8 percent. In remote electronic voting, which the authorities control from beginning to end, the party received 49.06 percent. The final result came in between five and eight and a half percentage points above the Kremlin’s own polling.
For foreign policy, this arithmetic changes almost nothing.
The Kremlin needed an image: a country at war calmly voting to continue the existing course. It got that image. The domestic electoral cycle is closed, and the next federal milestone is the 2030 presidential election. Between the two lie three and a half years during which the authorities can make unpopular decisions at minimal political cost.
Today’s date is more eloquent here than any forecast. Exactly four years ago, on September 21, 2022, ten days after Russia’s unified election day, Vladimir Putin announced partial mobilization. A year earlier, in September 2021, the previous State Duma elections had taken place, and by November a military buildup was already visible near the Ukrainian border, drawing the attention of intelligence agencies across Western capitals. On December 17, the Russian Foreign Ministry published draft agreements with the United States and NATO that effectively demanded the alliance roll back to its 1997 borders. Two months later, the invasion began.
The precedent does not prove that history will repeat itself. It proves something else: for the Kremlin, the post-election autumn has traditionally served as a window for decisions that would have been too costly before voting. What exactly those decisions will be in 2026 is publicly known to no one. Anyone claiming otherwise is selling certainty they do not possess.
A Factory That Never Shuts Down: The War Economy as the Main Argument
European military staffs are studying not the Central Election Commission’s calendar but the production schedules of Russia’s defense industry.
Here, the picture is unequivocal. According to official budget documents, spending under the “National Defense” category in 2025 amounted to roughly 13.5 trillion rubles, or about 6 percent of GDP. Western estimates that include classified items and related expenditures put the 2024 figure at more than 7 percent of GDP, or approximately $149 billion. The two figures differ, but both describe an economy that has been operating for war for five consecutive years and has no mechanism for a rapid return to a peacetime footing.
In the summer of 2026, one major Washington-based analytical study documented a sweeping restructuring of Russia’s military-industrial complex: capacity is being expanded not for a one-off campaign but to replace losses and meet the army’s long-term demand. The logic is simple and unpleasant. Factories, newly hired workers, loans to defense enterprises, and regional budgets that have grown dependent on military contracts all create their own inertia. Such a system does not tolerate pauses well.
Its most visible product is the strike drone. On the night of September 7, 2025, Russia launched approximately 810 drones at Ukraine, setting what was then a record. By the fall of 2026, the qualitative dimension had changed: Tusk explicitly referred to the mass deployment of jet-powered drones that fly faster and higher than earlier Geran systems. The Polish prime minister acknowledged something politicians rarely say aloud: even Poland does not yet possess sufficient means to counter every new type of threat effectively.
For NATO’s eastern flank, that means less time to make decisions. A slow drone gives an air defense crew dozens of minutes. A jet-powered drone leaves only minutes, and even less once it approaches the border. Every minute the adversary saves is a minute taken away from a NATO decision-making process that is collective by definition and therefore slow.
Tusk Described the Scenario. It Is More Dangerous Than an Invasion
The Polish prime minister’s remarks deserve to be read carefully, without the newspaper abbreviations.
Tusk did not speak about a Russian armored division massing on the Polish border. He spoke about a late-autumn and winter period that he called critical, and about intelligence indicating possible hybrid attacks involving drones and missiles against countries supporting Ukraine, primarily Poland. According to him, Polish security services consider such a scenario the most likely, although not the only one. The prime minister separately highlighted the danger to facilities located very close to border crossings with Ukraine. “We must assume that the attacks will continue,” he told lawmakers.
The logic becomes clear from geography. Most Western military aid to Kyiv crosses the Polish-Ukrainian border through rail crossings, highway terminals, warehouses, and Rzeszów-Jasionka Airport. Russia systematically strikes the Ukrainian side of this chain, from locomotives to storage facilities. If a strike on a warehouse a few hundred yards from the border spills over onto Polish territory, Moscow gains two advantages at once: logistics are disrupted, while the allies are forced to decide whether an attack on a NATO state has actually occurred.
The scenario has already had a dress rehearsal. On the night of September 9–10, 2025, according to Warsaw’s official count, 19 Russian drones crossed into Polish airspace. Some were shot down by Polish and Dutch F-35s, while one aircraft damaged a residential building in the village of Wyryki. Poland requested consultations under Article 4, and on September 12 NATO launched Operation Eastern Sentry to strengthen air defenses along the eastern flank. Russia’s Defense Ministry responded by stating that no strikes on targets inside Polish territory had been planned.
Nine days later, on September 19, 2025, three Russian MiG-31s spent approximately twelve minutes inside Estonian airspace near Vaindloo Island. Tallinn also requested Article 4 consultations. Moscow denied that any violation had occurred. Unidentified drones then appeared over the airports of Copenhagen and Oslo, followed shortly afterward by drones over Aalborg in Denmark, while Munich Airport was forced to suspend operations for several hours in October. Public attribution of these incidents has still not been completed, and that, in fact, is precisely the point.
Every such episode provides an adversary with information no intelligence network could buy. How many minutes pass between detection and the decision to fire? Who makes that decision, a national commander or the integrated command structure? How long does it take Warsaw, Berlin, Paris, London, and Washington to agree on common language? Where is the legal boundary between a provocation and an armed attack? For a general staff planning years ahead, the answers to these questions are worth more than a dozen downed drones.
Article 5 Was Written for Tanks. It Will Be Tested With Drones
The Washington Treaty was signed in April 1949, and its fifth article reflects a world in which an attack looked like a column of military vehicles crossing a border. In the alliance’s 77-year history, Article 5 has been invoked only once: on September 12, 2001, following the terrorist attacks in New York and Washington. Attribution at the time was not in doubt.
The alliance has long understood that the world has changed. At the 2014 Wales Summit, the allies formally stated that a cyberattack could trigger Article 5. In Warsaw in 2016, the same principle was extended to hybrid operations. Yet the formula always left the central issue unresolved: any decision would depend on the circumstances of the specific case and would require consensus.
The first major test came long before the current war. In the spring of 2007, after the relocation of the Bronze Soldier monument in Tallinn, Estonia endured weeks of massive cyberattacks targeting the websites of parliament, government ministries, banks, and media outlets. Article 5 was not invoked. A direct link between the attacks and the Russian state was never publicly proven, although Estonian officials had little doubt about their origin. The principal institutional result was NATO’s cyber defense center in Tallinn. A useful institution, but not an answer to an adversary.
The second precedent involved direct military contact. On November 24, 2015, a Turkish F-16 shot down a Russian Su-24 near the Syrian border. NATO convened an emergency meeting, expressed solidarity with Ankara, and simultaneously called for de-escalation. The allies made one thing very clear: solidarity and willingness to go to war are two different categories.
In Baku, the mechanics of an “accident” are understood through bitter experience. On December 25, 2024, an AZAL Embraer passenger aircraft flying from Baku to Grozny was hit over Chechnya, crossed the Caspian Sea, and crashed near Aktau. Thirty-eight people were killed. During the first days, Russian sources speculated about birds and an exploding gas cylinder. On December 28, Putin apologized for the tragedy having occurred in Russian airspace without accepting responsibility. Only in October 2025, in Dushanbe, did he acknowledge that Russian air defense missiles had detonated near the aircraft, describing the incident as the result of a technical malfunction. Nearly ten months passed between the crash and that acknowledgment, and I am convinced that without the firm and consistent position of Azerbaijani President Ilham Aliyev, the acknowledgment would never have come at all.
For NATO, this episode offers a ready-made model. A state that spends ten months disputing an obvious fact surrounding the destruction of a civilian aircraft will have no difficulty disputing the origin of a drone that falls on a warehouse near Chełm. The alliance will have to respond under the same conditions: incomplete attribution combined with the knowledge that an error in either direction could carry an enormous price.
Cables, Arson, Spoofing: The War Already Underway
The debate over whether a hybrid confrontation exists is over. The record of the past two years looks more like a case file than a hypothesis.
In May 2024, the Marywilska 44 shopping center in Warsaw burned down, and the Polish government later stated that the arson had been commissioned by Russian intelligence services. That summer, packages containing incendiary devices caught fire at DHL logistics centers in Leipzig and Birmingham; Western security services viewed them as a trial run for a scheme involving fires aboard cargo aircraft. On December 25, 2024, the Estlink 2 power cable connecting Finland and Estonia was damaged in the Gulf of Finland, and the Finnish Coast Guard detained the Cook Islands-flagged tanker Eagle S, linked to the so-called shadow fleet. In January 2025, the alliance responded with Operation Baltic Sentry to patrol undersea infrastructure.
In November 2025, an explosion damaged tracks on the Warsaw-Lublin rail line used to transport cargo toward Ukraine. Tusk called the incident an act of sabotage and said the perpetrators, two Ukrainian citizens, had been working for Russian services and escaped into Belarus. The recruitment model used through messaging applications, in which the operative is often a petty criminal or someone in debt who receives instructions and cryptocurrency payments from an anonymous handler whom he has never met and whose true sponsors he does not know, makes legal attribution almost impossible. The operative does not know the client. The client leaves no trace. Prosecutors are left trying to prove a state order through a chain in which no written document exists.
A separate category is the jamming and spoofing of satellite navigation over the Baltic, which Finnish, Estonian, Latvian, and Lithuanian aviation authorities have documented for years. Honesty requires one qualification here. The high-profile August 31, 2025, incident involving Ursula von der Leyen’s aircraft in Plovdiv, Bulgaria, initially presented as Russian GPS spoofing, was later challenged by open-source flight-monitoring data. Cases like this weaken Europe’s own position: every unproven accusation is subsequently used by Moscow to discredit those that are substantiated.
In July 2026, NATO formally condemned Russia’s continuing malicious cyber activity against allies and partners, including attacks on government institutions and critical infrastructure. The European Union maintains its own catalog of hybrid threats: cyberattacks, information interference, sabotage and arson, damage to undersea cables, airspace violations, and the weaponization of migration flows. Moscow consistently rejects all of these accusations.
On September 18, 2026, Emmanuel Macron convened the leaders of parliamentary parties, candidates in the 2027 election, and intelligence chiefs in a secure crisis room at the Élysée Palace. After the meeting, he said that the Russian hybrid threat to Europe and France had intensified in recent weeks and emphasized that Paris possessed documented and attributed cases of physical hybrid operations. “I have instructed the government to prepare a plan to protect our critical infrastructure,” the president said. According to information leaked to French television networks, intelligence services expect large-scale attacks to peak by the fall of 2027, whereas earlier assessments had placed the threat closer to 2030. I treat leaks of this kind cautiously: they serve the interests of both the intelligence services and the Élysée Palace. Nevertheless, the fact that the assessment has moved forward by three years is significant.
Why the Kremlin Does Not Need a Major War With NATO
Now to what European rhetoric tends to rush through almost under its breath.
On August 30, a NATO representative told Western media that the alliance saw no immediate threat of a direct Russian attack while simultaneously noting an increase in Russian hybrid activity. It was the most important sentence in the entire September information storm, and almost no one quoted it.
Moscow’s calculation is clear. A direct attack on a member of the alliance would mean war with a bloc whose European members and Canada, according to the Ankara Summit declaration, increased investment in core defense requirements by more than $139 billion in 2025 alone. At the same summit on July 7–8, 2026, new arms purchases worth more than $50 billion were announced. Decisions taken in The Hague in 2025 commit the allies to reaching 5 percent of GDP by 2035, with 3.5 percent allocated to core military spending. Since April 2023, Russia’s border with the alliance has lengthened by more than 800 miles because of Finland’s accession, Sweden joined NATO in March 2024, and the Baltic has effectively become an internal sea of the alliance. Germany’s 45th Armored Brigade is being deployed in Lithuania, the first permanent German military formation stationed abroad since World War II.
At the same time, Russia is waging a resource-intensive war against Ukraine, which remains the priority for its armed forces and its budget. Opening a second front against an adversary with many times Russia’s economic strength before finishing the first would be rational in only one circumstance: absolute confidence that the opponent would not respond. The Kremlin has no such confidence.
What it does have are tools below the threshold of war, and they are cheap. A drone costs tens of thousands of dollars; the interceptor missile used against it costs hundreds of thousands, and sometimes millions. An arsonist recruited through a messaging application can be hired for the equivalent of a monthly salary. Every such incident forces Europe to spend billions on air defense and on protecting cables, railways, ports, and power grids. From the standpoint of conflict economics, the asymmetry favors Moscow, at least in the short term.
A series of minor incidents also allows the reaction to be calibrated. If the alliance responds to a drone that damages a warehouse with nothing more than a statement, the next drone can be sent closer to the target. If the response is severe, there is always the explanation of a “technical error” and the option of stepping back without losing anything. Classical deterrence theory has a name for this: salami slicing. No individual slice is worth a war, but eventually there is no salami left.
Useful Fear: Why Europe Benefits From Loud Warnings
An honest analysis requires acknowledging an uncomfortable reality for European capitals. Alarmist rhetoric about the threat also serves their own interests.
Governments need to explain to voters why defense budgets are rising amid deficits and social problems. France is living with a deficit that has long exceeded the Maastricht threshold of 3 percent of GDP, while the 2027 presidential election is approaching. The September 18 meeting at the Élysée Palace took place against the backdrop of a sharp rise in energy prices. National Rally leaders Marine Le Pen and Jordan Bardella issued their own statement the very next day, and the external threat is rapidly becoming part of the domestic political struggle. Poland, whose military spending exceeded 4 percent of GDP in 2025 and remains the highest in the alliance relative to the size of its economy, has an interest in keeping the issue at the center of allied attention.
Washington is another factor. The Trump administration is demanding that Europeans assume greater responsibility for their own defense, while the Pentagon’s review of the U.S. military presence in Europe is visibly unsettling allies on the eastern flank. As early as the fall of 2025, the United States announced a reduction in its rotational presence in Romania. The final Ankara declaration consisted of only six paragraphs and was the shortest in at least a quarter century; for the first time, it did not specify the location of the next summit. For people who read NATO documents professionally, that is a louder signal than any speech.
European anxiety therefore serves several purposes at once: deterring Moscow, mobilizing allies, preparing the public for higher spending, and keeping the Americans engaged. Political self-interest does not eliminate the threat. A smoke detector that its manufacturer advertises too loudly can still go off because there is actual smoke.
The Weak Link Is Not the Border. It Is Consensus
NATO’s main vulnerability is not the roughly 40-mile Suwałki Gap between Belarus and the Kaliningrad region. It lies in the chamber of the North Atlantic Council, where decisions are made unanimously.
Thirty-two states must reach the same political conclusion about an event whose origins the adversary has deliberately made disputable. For Estonia or Lithuania, a drone over their territory is an existential matter. Portugal or Spain may see the same event as alarming news from the other end of the continent. Governments whose domestic politics are built around skepticism toward support for Ukraine will receive a convenient opportunity to demand additional evidence, delay the wording of a final statement, and tell their voters that the alliance must not allow itself to be dragged into someone else’s war over a single fallen drone. According to reports from Bratislava, Slovak Prime Minister Robert Fico indicated on September 18 that his country would not assist NATO in the event of a war with Russia. Even if the statement was taken out of context, Moscow heard it without the footnotes.
A hybrid operation derives its value precisely from the number of questions it creates. The longer allies search for answers behind closed doors in Brussels, the more information about the actual depth of their solidarity is obtained by the side that created those questions. Who launched the aircraft? Is the evidence sufficient? Does Article 5 apply? Should the response be military, or should it stop at the expulsion of diplomats? Every question means a day, sometimes a week, of deliberation, and every such debate publicly reveals the boundaries of solidarity. In this sense, the ideal incident for the Kremlin is one after which the alliance does not so much respond as argue.
What Happens Before Spring: Four Testable Forecasts
Analysis without testable forecasts becomes commentary, so I will put four assessments on the record with specific dates.
First. By March 31, 2027, there will be at least one incident in which a Russian or unattributed drone or missile causes material damage on the territory of Poland, Romania, Slovakia, or one of the Baltic states. Moscow will either deny involvement or describe the event as an accident connected to strikes against Ukraine.
Second. Article 5 will not be invoked through the end of 2027 despite any such incidents. Article 4 consultations are more likely than not to be requested at least once by the end of March 2027.
Third. By December 31, 2026, the Kremlin will not announce a new open wave of mobilization modeled on 2022. The expanded post-election window will be used differently: through contract recruitment and budgetary decisions rather than through a measure that once again sends hundreds of thousands of men beyond Russia’s borders.
Fourth. By February 1, 2027, NATO or the European Union will announce either an expansion of Operation Eastern Sentry or a new anti-drone mechanism for the eastern flank with dedicated funding. The response will be defensive and technical rather than political.
If the first forecast comes true by spring and the second does not, then my entire analysis will have been wrong, and I will acknowledge that publicly. The question to which I have no answer is this: how many accidents in a row is the alliance prepared to keep calling accidents?
The Line Being Moved an Inch at a Time
The Russian elections do not trigger anything. They merely close a domestic political cycle at a moment when the war against Ukraine continues, the defense industry is operating at expanded capacity, Europe is rearming in haste, and the division of responsibility between Washington and European capitals has become the subject of open bargaining.
Publicly available evidence does not support the conclusion that a direct Russia-NATO war is imminent in the coming months, and the alliance itself is not saying that it is. The expansion of hybrid activity, however, is supported by abundant evidence: arson, rail sabotage, damaged cables, drones over airports. Confusing these two statements means either frightening the public with a war that is not taking place or reassuring it in circumstances where an adversary is already at work.
The real risk this coming winter looks modest, and that is precisely what makes it dangerous. Moscow does not need to cross the red line. It only needs to move closer to it each time, determining exactly where the allies have drawn it and how long they need to agree among themselves that it has been crossed.
Somewhere near Chełm or Dorohusk in February, a Polish air defense officer on duty will see a track on the screen moving in from the east faster than last year’s drones. He will have a few minutes. The 32 capitals will then have enough time for almost anything except the one thing that matters most: quickly agreeing on whose track it was. The Kremlin is counting precisely on that difference in time.