Europe has spent years drawing a distinction between war and everything that falls short of it. That distinction is becoming increasingly difficult to defend.
A drone carrying explosives was found near a runway at Germany’s Leipzig/Halle Airport in August, close to a Ukrainian cargo aircraft. After an investigation, German authorities concluded that Russia was responsible. Moscow denies the accusation. European Union foreign-policy chief Kaja Kallas said the incident bore the “hallmarks of state-sponsored terrorism.” However, Moscow denies this and Putin has called the evidence planted.
The drone failed to cause the catastrophe it might have produced. That should not make the incident easier to dismiss. It should make Europe more determined to understand what it represents. The most dangerous mistake Europe can make now is to judge Russian aggression solely by the number of people killed or buildings destroyed.
Russia’s alleged campaign against the West increasingly operates in the gray space between peace and conventional warfare. It can involve drones, cyberattacks, sabotage, espionage, arson, disinformation and attacks against critical infrastructure. The objective is not necessarily to provoke an immediate military response. It is to create fear, uncertainty and political division while keeping each individual incident just ambiguous enough to complicate retaliation.
That strategy is working precisely because Europe has struggled to decide what, collectively, it means. Consider the significance of Leipzig/Halle. The airport is a major European cargo hub and has been used by Ukrainian aircraft. A drone carrying explosives appearing near a Ukrainian cargo plane therefore cannot reasonably be viewed as an ordinary security breach. German officials say the operation was connected to Russian state actors and fits a broader pattern of hybrid operations. This is an allegation, but if this is correct, Moscow was not simply targeting an aircraft. It was testing Germany.
Some questions come to mind: How quickly can European authorities detect a hostile drone? How vulnerable are major airports? How effectively do intelligence services share information? Most importantly, what happens when Europe believes Russia has crossed a line? The answer so far has been cautious. Germany plans to close a Russian consulate and take additional diplomatic measures. European governments are considering further sanctions and restrictions. Those actions are justified, but they raise a larger question: Are they sufficient to deter the next operation?
Europe cannot afford to discover the answer through trial and error. A missile strike on a NATO country would almost certainly provoke a massive response. A drone near an airport is different. A damaged electrical substation is different. A suspicious fire at a facility supporting Ukraine is different. A cyberattack is different. Individually, these incidents can be dismissed as manageable. Collectively, they form something much more serious: a sustained campaign designed to make Europeans question the cost of opposing Russia. That is why the response cannot consist solely of announcing another sanctions package after every incident.
Europe needs to make its critical infrastructure dramatically harder to attack. Airports, power grids, telecommunications networks, railways, ports and military logistics facilities need stronger counter-drone defenses and surveillance. Intelligence agencies need greater ability to identify the people who carry out these operations, including the intermediaries and criminal networks that may serve as proxies. European governments need to coordinate their responses before the next crisis occurs, not afterward. There is also a political dimension that cannot be ignored.
Hybrid warfare is particularly effective in democracies because its ultimate target is not always infrastructure. Sometimes it is public confidence. If European citizens begin to believe that supporting Ukraine inevitably means exposing their own communities to attacks, Russia does not need to defeat Europe militarily. It only needs to convince Europeans that resistance is too expensive.
That is the strategic calculation European governments must defeat. Yet deterrence requires credibility, and credibility requires evidence. Germany should therefore disclose as much of its evidence connecting the Leipzig operation to Russia as national security permits. Moscow’s denials should not automatically invalidate German intelligence. Neither should governments expect citizens and allies to accept extraordinary accusations without explanation.
The objective should not be escalation for its own sake. Europe does not need another war. It needs to make clear that avoiding war does not mean accepting aggression. That distinction matters. The lesson of Leipzig is not that Europe should immediately retaliate militarily against Russia. It is that the threshold for European action cannot be defined only by whether a Russian operation succeeds in producing mass casualties. A bomb that fails to explode can still be a warning. A drone that misses its target can still reveal vulnerability. An attack that causes no deaths can still be part of a strategy to undermine a continent. Europe has spent too long debating whether these acts constitute war.
The more useful question is whether they intend to weaken European security. If the answer is yes, Europe must respond accordingly. The future of European security may not be decided by a single dramatic invasion. It may instead be determined by whether democracies allow dozens of smaller attacks to become normal. They must not.