Russia Weighs Drone False Flag

Lithuanian defence minister Robertas Kaunas said on Wednesday that military intelligence has indications Russia is considering a false-flag strike on Baltic critical infrastructure using captured Ukrainian-made drones (LRT, Kyiv Independent). He was careful about the limits of the warning: Lithuania is "observing the planning moment", but there is no decision by Russia to act, no known date, and no certain immediate threat (15min, BNS). For Malta, far from the Baltic border but inside the same NATO and EU machinery, the point is not the drone itself. It is whether allies can prove quickly enough who fired a weapon before the politics starts to wobble.

How a Ukrainian-looking drone buys Moscow time

Imagine a drone hitting a power substation in the Baltics. Emergency crews find wreckage carrying Ukrainian markings. News agencies report a "Ukrainian drone". Within hours, the argument shifts from "who launched it?" to "was Ukraine responsible?" By then, Moscow would already have achieved part of its aim.

Kaunas set out the mechanism. Ukraine's drone campaign against Russian territory means Moscow has obtained Ukrainian drones and components, either intercepted in flight or recovered from crash sites. Russia could use those parts to assemble a weapon that looks Ukrainian (LRT, AeroTime). The purpose would be to muddy the origin, deny Russian involvement, and force NATO into an argument over attribution before allies can coordinate a response.

Recent incidents on NATO's eastern flank show how large that gap already is. Romanian F-16s scrambled twice against drones near the Danube Delta, detecting and responding before anyone could establish who sent them (Adevărul, RBC Ukraine). Proper attribution means proving origin through radar tracks, debris analysis, allied intelligence-sharing and reconstruction of the launch point, not reading markings off wreckage (DW). Frontline states can detect and scramble quickly. Proving who launched the drone takes longer.

The proof problem

Lithuania has sent soldiers to guard the Klaipėda LNG terminal, the LitPol Link electricity interconnector and the Kruonis pumped-storage plant (tv3.lt). Its foreign ministry has asked NATO and the EU to strengthen surveillance, counter-drone systems and infrastructure resilience across the eastern flank (Delfi). The European Commission's July 2026 guidance under the Critical Entities Resilience Directive, the EU law requiring member states to protect essential infrastructure, now covers drone attacks and hybrid threats (European Commission). EU law can push states to harden targets. It cannot decide who attacked them.

That is where the problem becomes political. NATO's Article 5, the collective defence clause invoked only once after 9/11, requires agreement among allies (NATO). EU foreign-policy sanctions require unanimity, so one government can block them (Council of the EU). Both systems need confidence before governments publicly name Russia. A false-flag strike is designed to delay that confidence long enough for unity to fray.

Finnish coverage drew a useful historical parallel: the "Mainila shots", a 1939 Soviet border provocation that worked not because it was credible, but because it put a false story into circulation before the truth could catch up (Yle). In a drone incident, the speed of attribution may matter more than the neatness of the evidence.

In the two Slovak outlets covering the Lithuanian warning, the doubt Moscow would want to create did not take hold. Both treated the intelligence as a Russian threat, not as a reason to question Ukraine (Aktuality.sk, Denník N). That consensus exists today. Whether it survives the first confused hours after a strike, when debris looks Ukrainian and social media moves faster than forensic teams, is the issue Lithuania is forcing NATO to face.

NATO has troops, jets and infrastructure plans on the eastern flank. What the public record exposes is the vulnerable interval between wreckage, proof and political agreement. Lithuania has named the gap. No ally has yet put forward a protocol to close it.