Russia weighs a Ukrainian-drone false flag

Lithuanian defence minister Robertas Kaunas said on Wednesday that military intelligence has information Russia is considering a false-flag strike against Baltic critical infrastructure using captured Ukrainian-made drones (LRT, Kyiv Independent). The warning was carefully bounded: Lithuania is "observing the planning moment," but Russia has not decided to act, no date is known and no immediate threat is certain (15min, BNS). The warning matters because it names a NATO weakness: proving who launched a weapon fast enough for allies to respond together.

How a Ukrainian-looking drone buys Moscow time

Picture a drone hitting a power substation in the Baltics. First responders find wreckage stamped with Ukrainian markings. News agencies report a "Ukrainian drone." Within hours the political question shifts from "who launched it?" to "was Ukraine responsible?" and Moscow's objective is met before investigators reach the site.

Kaunas explained the mechanics. Ukraine's drone campaign against Russian territory means Moscow has acquired Ukrainian drones and components, intercepted in flight or recovered from crash sites. Russia could assemble a Ukrainian-looking weapon from those parts (LRT, AeroTime). The aim: confuse the origin, deny Russian involvement and force NATO into a dispute over who launched it before allies can coordinate.

Recent incidents on NATO's eastern flank show how wide that gap already is. Romanian F-16s scrambled twice against drones near the Danube Delta, detecting and responding before anyone could establish who sent them (Adevărul, RBC Ukraine). Serious attribution (proving who launched it) requires radar tracks, debris analysis, allied intelligence sharing and launch-point reconstruction, not just markings on wreckage (DW). Frontline states can detect and scramble. Proving the origin takes far longer.

The proof problem

Lithuania has deployed soldiers to guard the Klaipėda LNG terminal, the LitPol Link electricity interconnector and the Kruonis pumped-storage plant (tv3.lt). Its foreign ministry has asked NATO and the EU to strengthen surveillance, counter-drone systems and infrastructure resilience across the eastern flank (Delfi). The European Commission's July 2026 guidance under the Critical Entities Resilience Directive (the EU law requiring member states to protect essential infrastructure) now covers drone attacks and hybrid threats (European Commission). But EU law can push states to harden targets. It cannot tell them who attacked.

That question runs into how NATO and the EU actually decide things. NATO's Article 5 (the collective defence clause, invoked only once, after 9/11) requires political agreement among allies (NATO). EU foreign-policy sanctions require unanimity, meaning any single country can block (Council of the EU). Both need confident proof before governments will point at Russia. A false-flag strike works by delaying that proof long enough for political cohesion to crack.

Finnish coverage drew a telling parallel: the "Mainila shots," a 1939 Soviet border provocation that succeeded not because it was convincing but because it planted a false narrative faster than the truth could spread (Yle). Speed of attribution matters more than quality of evidence.

In the two Slovak outlets covering the Lithuanian warning, the doubt Moscow would hope to seed did not appear. Both treated the intelligence as a Russian threat rather than a reason to question Ukraine (Aktuality.sk, Denník N). That consensus holds today. Whether it survives the first confused hours after a strike, when wreckage looks Ukrainian and social media moves faster than forensic teams, is the question Lithuania is forcing NATO to confront.

NATO has soldiers, jets and infrastructure plans on the eastern flank. On the public record, its exposed weakness is the hours between wreckage, proof and political agreement. Lithuania has named the gap. No ally has yet proposed a protocol to close it.