Germany has formally blamed Russia for an explosives-laden drone found at Leipzig airport, and the EU is discovering it has no answer that is neither useless nor a war

The device that has forced a reckoning in Brussels this week was found on 4 August, sitting near a Ukrainian cargo plane at Leipzig/Halle Airport. It was a drone carrying explosives. It was defused before it functioned. Nobody was hurt, no aircraft was damaged, and for four weeks the incident was one more entry in a long and deliberately ambiguous ledger of things going wrong across Europe.

What changed on Tuesday was not the event but the attribution. The German government stated formally that Russia was responsible, announced it would shut down a Russian consulate among other measures, and thereby did something no EU member state had previously done with a device of that kind: named the state, in public, without hedging.

Why the attribution is the news

European Commission President Ursula von der Leyen was explicit about the significance. "Leipzig marks a new escalation on European Union soil directly attributed to Russia," she said in Brussels, describing an operation involving "military-grade material carried out by Russian operatives on European Union soil."

Hybrid warfare works precisely because attribution is hard and slow. A factory fire, a cut cable, a damaged substation, a drone that could plausibly be a hobbyist's — each incident individually admits of an innocent or unprovable explanation, and the accumulated effect is a state of low-grade disruption that never crosses the threshold at which anyone has to do anything. Formal attribution collapses that ambiguity, and in doing so it creates an obligation to respond that ambiguity had been suppressing.

The target choice sharpens it further. Leipzig/Halle is one of Europe's largest air freight hubs and a major artery for material moving toward Ukraine. A drone placed beside a Ukrainian cargo aircraft there is not harassment of a general kind; it is an attempt to interdict a supply line inside the European Union.

It is clear that it has all the hallmarks of state sponsored terrorism. The question is: what do we do about this.

That was EU foreign policy chief Kaja Kallas, speaking to reporters before chairing a meeting of the bloc's foreign ministers in Ireland. Her second sentence is the honest part, and it is where the week's difficulty lives.

The response menu, and why it is short

The EU has already imposed almost two dozen sanctions packages on Russia since the full-scale invasion, hitting more than 3,000 officials, oligarchs and entities including banks, energy companies and drone manufacturers. Kallas said the bloc was already preparing travel bans and asset freezes on a further 1,600 people. Hundreds of vessels in the so-called shadow fleet — ageing tankers moving Russian oil outside the sanctions regime — have been designated. Russian diplomats have been summoned across the continent and, repeatedly, expelled.

France, Belgium and the Netherlands summoned Russian ambassadors over Leipzig. French Foreign Minister Jean-Noël Barrot said Paris wanted sanctions on more shadow-fleet ships and that "we won't allow an act of such gravity without consequences." Von der Leyen spoke of "cutting deeper in Russia's war chest."

Every one of those instruments is a variation on something already tried. That is the structural problem, and it is not a failure of imagination. Between diplomatic and economic measures, which Moscow has now absorbed for four years, and military ones, which risk direct conflict with a nuclear-armed state, there is very little middle ground. EU members, most of them NATO allies, are unwilling to occupy it. Lithuania's Foreign Minister Kestutis Budrys put the consequence plainly: Russia evidently sees no political cost in its hybrid operations against European allies.

The consulate closure Berlin announced illustrates the ceiling. Expelling diplomats and shutting missions imposes a real cost on intelligence collection, because official cover is genuinely useful and hard to replace. But it is a cost that has already been imposed repeatedly across Europe since 2022, and each round leaves less to expel. The instrument degrades with use, and there is no version of it that reaches the people who actually assembled and placed a drone.

The pattern around it

Leipzig did not arrive alone. In Germany in the twenty-four hours around the announcement, two separate attacks on electricity substations were reported. Near Bergheim in North Rhine-Westphalia, power lines were deliberately damaged; five generating units went offline across two coal-fired stations, and police recovered six launching devices from a field. Interior Minister Herbert Reul said the attack was deliberate and that investigators were weighing two possibilities: sabotage directed by a foreign state, or left-wing extremism. In Brandenburg, high-voltage lines near the Jänschwalde plant were damaged early on Tuesday and explosive devices were later found at a substation.

In Poland, Prime Minister Donald Tusk said a fire at a combat drone factory in Skarżysko-Kamienna, about 140 kilometres south of Warsaw, was deliberate arson and sabotage; arson has not been ruled out in a separate factory fire in Lublin. There have been drone incursions into Estonia and Latvia. Spain has publicly accused Russia of using disinformation to encourage migrant crossings from Morocco into its Ceuta exclave.

NATO Secretary General Mark Rutte tied the strands together, citing increased risk from drones and missiles crossing into countries on the alliance's eastern flank alongside "malign activities targeting our territory directly, whether it is fires set in factories producing defence equipment for Ukraine or indeed the Russian hybrid attack in Leipzig." He said the alliance stood "in full solidarity with Germany."

Reading that list together is the point, and it is also the trap. Individually, several of these incidents have plausible non-state explanations — Reul's own investigators are weighing left-wing extremism at Bergheim, and industrial fires happen in factories. Collectively they describe a tempo of infrastructure disruption across Germany, Poland and the Baltic states that no European government has a benign account of. The intelligence problem is that a campaign designed around deniability produces exactly this evidentiary picture whether or not it is a campaign, which is why formal attribution has been so slow in arriving.

Moscow's position, and the case for caution

Russia rejects the German findings. President Vladimir Putin said Berlin was seeking to distract from its own failings and from voter dissatisfaction, and that any proof offered "has been planted." That denial is not evidence of anything, but the difficulty it creates is real: hybrid attribution rests on intelligence that governments are generally unwilling to publish, which leaves domestic audiences to take the accusation on trust at exactly the moment they are being asked to accept costs.

There is a serious argument for restraint that is not merely timidity. Escalation in a hybrid campaign is cheap for the party with fewer inhibitions and expensive for the party with more infrastructure to protect. Europe has vastly more exposed substations, cables, ports and freight hubs than Russia has assets within reach of European retaliation. A tit-for-tat logic favours the side with less to lose, which is why Germany's own formulation — that it is "not at war" but has become a "daily target" — is uncomfortable rather than incoherent.

German Foreign Minister Johan Wadephul said Berlin had carefully prepared its response "and now Russia must live with these consequences," while calling on Moscow to show readiness for negotiations over Ukraine. British Foreign Secretary Ed Miliband, attending the EU meeting alongside officials from Ukraine, Canada, Norway, Switzerland and Iceland, framed the campaign as an attempt "to divide us in Europe and to deter us from our support for Ukraine."

Spain's contribution to the ministers' meeting showed how quickly the frame can fracture. Foreign Minister José Manuel Albares accused unnamed EU partners of echoing Russian and Israeli disinformation about migrant crossings into Ceuta, and insisted that "the land borders of the south of the EU are as important as the eastern borders." His underlying complaint is that a bloc which treats hybrid pressure as an eastern-flank problem will fund an eastern-flank answer. Since dividing the response is the campaign's stated objective, that argument is difficult to have and impossible to avoid.

What is actually being decided

Alongside the sanctions discussion, the EU is moving money. The bloc has agreed to lend Ukraine €90 billion, and von der Leyen said Kyiv had requested billions more specifically to pay for PAC-3 air defence interceptors. Work is under way on a joint Europe-Ukraine anti-ballistic missile defence project. Those are the responses that change a physical fact rather than a diplomatic one.

The durable point from this week is not that Europe has run out of sanctions. It is that Leipzig has moved the argument from whether Russia is running a sabotage campaign on EU territory to what a response short of war is supposed to accomplish. Von der Leyen promised the bloc would not merely maintain pressure but increase it. The four weeks between the drone being defused and the government naming who put it there suggest how carefully that increase is being measured.

This report is based on statements made on 1 and 2 September 2026 by the German federal government, European Commission President Ursula von der Leyen, NATO Secretary General Mark Rutte, EU foreign policy chief Kaja Kallas and EU foreign ministers meeting in Ireland, as reported by the BBC, the Associated Press and the Guardian. Responsibility for the Bergheim and Jänschwalde substation incidents and the Polish factory fires has not been established; German and Polish authorities describe those investigations as open. Russia denies involvement in the Leipzig incident.