The 2025 European NATO Drone Incursion Wave

Theoretical Alignment

This file substitutes "Man-Made / Hybrid Warfare" for both the Psycho-Social/Mundane and Extraterrestrial categories because no party involved — not NATO, not any national government, not independent investigators — has ever suggested an exotic origin for any object in this wave. The genuine open question is not what kind of phenomenon this is, but which specific incidents within the wave reflect real hostile drone activity versus misidentification, false alarms, or public panic following a confirmed real incursion. This site includes the case because it meets the archive's UAP criteria on its own terms: the individual drones involved in most incidents outside Poland remain formally unidentified as to operator and origin, a defining characteristic of a UAP case even where the broader phenomenon (drones, not exotic craft) is not in question.

Background

The wave began against the backdrop of Russia's ongoing invasion of Ukraine and a documented pattern of "hybrid warfare" activity — sabotage, cyberattacks, and disinformation short of open conflict — that European intelligence services had already attributed to Russia in the years prior. That pattern had a specific, already-institutionalized precedent by the time the drone wave began: a string of undersea telecommunications and power cables in the Baltic Sea had been damaged or severed since Russia's full-scale invasion of Ukraine began in February 2022, incidents Western officials and analysts increasingly linked to Russia's "shadow fleet" of aging, sanctions-evading oil tankers allegedly dragging anchors across cable routes. NATO's Allied Command Operations responded by launching Operation Baltic Sentry on January 14, 2025, combining maritime patrols, aircraft, and naval drones from multiple member states to protect undersea infrastructure; NATO later reported the operation cut its average response time to a suspected sabotage incident from roughly seventeen hours to about one hour between January 2025 and January 2026. The drone wave that began that September, in other words, arrived at a moment when NATO's northern and eastern members already had a live, standing apparatus and a working assumption for interpreting ambiguous incidents near their coastlines and borders as possible Russian hybrid activity — a framework that shaped how quickly officials reached for a hostile explanation once drones began appearing over airports and bases, for better or worse.

The wave also coincided with Russia's large-scale Zapad-2025 joint strategic exercises with Belarus, held in September 2025 near NATO's eastern border, and with a documented pattern of near-continuous Russian missile and drone bombardment of Ukrainian territory. On the night of September 9–10, 2025, Polish Prime Minister Donald Tusk reported that 19 to 23 drones, flying primarily out of Belarus, entered Polish airspace during one such large-scale Russian missile and drone assault on Ukraine. Polish and allied aircraft shot down at least three of the drones, marking the first time Russian drones had been shot down over NATO territory. Poland invoked NATO's Article 4 consultation mechanism, and NATO Secretary General Mark Rutte called it "the largest concentration of violations of NATO airspace" the alliance had seen. Denmark, meanwhile, held the rotating presidency of the Council of the European Union for the second half of 2025, meaning the wave's most politically charged incidents — the closures at Copenhagen Airport — occurred while Denmark was hosting EU leaders for an informal European Council summit, and while its national government carried heightened diplomatic visibility across the continent.

Complete Timeline

Date	Event
Sept. 9–10, 2025	19–23 Russian drones (later identified in part as Gerbera-type decoys) enter Polish airspace overnight from Belarus; Dutch F-35s, Polish F-16s, and German Patriot batteries respond, and at least three or four drones are shot down. Poland invokes NATO Article 4.
Sept. 12, 2025	NATO launches Operation Eastern Sentry, deploying fighter jets, air-defense systems, and naval assets from Denmark, France, Germany, Italy, the UK, Spain, and other member states to reinforce the eastern flank.
Sept. 22, 2025	Copenhagen Airport closes for nearly four hours after "two to three large drones" are reported in controlled airspace; PM Mette Frederiksen calls it "the most serious attack on Danish critical infrastructure to date." Oslo Gardermoen Airport also briefly closes.
Sept. 24, 2025	Aalborg and Billund airports temporarily close; further sightings reported near Sønderborg, Esbjerg, and Skrydstrup military base. Denmark raises national police readiness to its highest level since the 2015 Copenhagen terror attacks.
Sept. 25–26, 2025	Drones reported over critical infrastructure sites in Schleswig-Holstein, Germany — including a Thyssenkrupp shipyard facility, a hospital, and a state parliament building — with wingspans reportedly up to eight meters, per Germany's federal interior minister. Karup Air Base, Denmark, also reports a multi-hour sighting.
Sept. 27–28, 2025	Norway's Ørland Main Air Station, a key NATO base, reports drones for roughly two and a half hours; Norwegian police log "five to six possible drones" simultaneously over Brønnøysund Airport.
Oct. 2–3, 2025	Munich Airport suspends operations on two consecutive nights — the first stranding roughly 3,000 passengers, the second nearly 6,500 — after police patrols confirm sightings near both runways.
Oct. 16, 2025	EU Commission President Ursula von der Leyen and foreign-affairs chief Kaja Kallas outline a proposed European "drone wall" (European Drone Defence Initiative) in a defense policy roadmap presented to the European Parliament.
Oct. 31–Nov. 2, 2025	Berlin Brandenburg Airport closes for roughly two hours; Bremen Airport briefly suspends operations; drones are first reported over Kleine Brogel Air Base, Belgium.
Nov. 1–3, 2025	Drones observed over Kleine Brogel, Leopoldsburg, and Marche-en-Famenne air bases on consecutive nights; Belgian Defense Minister Theo Francken describes a two-phase pattern and calls it a "spy operation."
Nov. 6, 2025	Gothenburg-Landvetter Airport (Sweden) and Brussels Airport briefly close; three drones reportedly overfly the Port of Antwerp.
Nov. 9, 2025	Liège Airport closes for about an hour; three drones are reported over the Doel nuclear power station; the United Kingdom announces it will send counter-drone personnel and equipment to assist Belgium.
Nov. 13, 2025	Francken tells the Belgian parliament that France, Germany, and the United States have offered technical and operational counter-drone assistance.
Nov. 19, 2025	Germany's cabinet, under Chancellor Friedrich Merz, approves draft legislation authorizing the Bundeswehr to use weapons and jammers domestically against drones threatening critical infrastructure, a break from Germany's traditional bar on military action inside its own borders.
Night of Nov. 21–22, 2025	Dutch ground forces fire on up to ten drones over Volkel Air Base, a suspected U.S. nuclear weapons storage site, between roughly 7 and 9 p.m.; none are brought down or recovered.
Nov. 27, 2025	Further drone activity reported near Volkel and Eindhoven Air Base in the Netherlands.
Nov. 28, 2025	Dutch newspaper Trouw reports that of roughly 60 drone sightings across 11 countries between August and November, only four (Poland, Romania, Moldova) involved confirmed Russian drones, and many others were false alarms with scant hard evidence of Russian involvement.
Dec. 1, 2025	Drones are spotted north of Dublin during Ukrainian President Volodymyr Zelenskyy's landing at Dublin Airport; an Irish naval vessel separately observes drone activity over the Irish Sea.
Dec. 4, 2025	Five drones overfly Île Longue, France's ballistic-missile submarine base in Brittany, around 7:30 p.m.; French marines deploy a jammer rather than firearms, per public prosecutor Frédéric Teillet, and the drones are neither downed nor recovered.
Feb. 27, 2026	Germany's Bundestag passes amendments to the Air Security Act granting the Bundeswehr authority to intercept, jam, or shoot down drones domestically at police request.
June 25, 2026	Copenhagen Police close their nine-month investigation into the September 22 incident, with Chief Superintendent Søren Thomassen stating they "cannot demonstrate that there was drone activity in and around the airport."
July 2–4, 2026	A report from the International Institute for Strategic Studies (IISS), tracking roughly 144 suspected European drone sightings from 2024–2026, concludes Russian "shadow fleet" vessels likely served as launch platforms for at least some incursions, partially updating the wave's earlier, more skeptical evidentiary picture.

The Confirmed Incident: Poland

The Poland incursion stands apart from every other event in this wave as the wave's one unambiguously confirmed case. Drone wreckage was recovered on Polish and Romanian territory, formally examined, and attributed to Russian military drones launched amid a broader missile and drone assault on Ukraine. NATO's air response, Poland's Article 4 invocation, and the subsequent launch of Operation Eastern Sentry on September 12 all rest on this single, well-documented event.

The incursion unfolded over roughly seven hours, from around 23:30 CEST on September 9 to 06:45 CEST on September 10. Estimates of the total number of drones that crossed into Polish airspace varied by source, from 19 up to 23; Polish presidential advisor Marcin Przydacz put the confirmed figure at 21. The drones entered from Belarus, having been deflected in part by Ukrainian electronic-warfare countermeasures deployed against the broader Russian missile-and-drone barrage aimed at Ukraine that night. Debris and drone locations were subsequently documented across a wide swath of Polish territory, from eastern border villages such as Wyryki-Wola, Czosnówka, and Wohyń to sites in south-central Poland (Czyżów, Mniszków, Nowe Miasto nad Pilicą) and as far north as Korsze in Warmia-Masuria; one drone reportedly penetrated as far as the Gdańsk region, more than 700 kilometers from the Ukrainian border.

Polish F-16s scrambled alongside Dutch F-35 Lightning IIs, which downed the majority of the intercepted drones; an Italian airborne early-warning aircraft, a Belgian Airbus A330 aerial tanker, and German Patriot air-defense batteries also took part in the alliance-wide response, with German Patriots tracking drone paths at heightened alert. Between three and four drones were confirmed destroyed by the time the incursion ended; by September 12, seventeen individual drones had been identified across the incident sites, with further wreckage — including a Gerbera-type decoy drone built partly from polystyrene rather than plywood — still being recovered by mushroom foragers and demining crews as late as March 2026. Investigators, including Lublin's Regional Prosecutor's Office, found no explosives or warheads aboard any recovered airframe, consistent with the drones' identification as low-cost Gerbera decoys rather than strike munitions; that finding did not, in the assessment of NATO and allied governments, make the incursion less deliberate, since decoy drones are typically flown specifically to saturate and probe air defenses. The only reported property damage came not from a drone itself but from a Polish Air Force AIM-120 AMRAAM missile that struck a residential roof in Wyryki-Wola without detonating; no one was injured, and no other casualties were reported anywhere along the incursion's path.

The diplomatic and military response was immediate and multinational. Polish Prime Minister Donald Tusk said the drones "posed a direct threat," and Deputy Prime Minister Radosław Sikorski called it "an unprecedented case of an attack not only on the territory of Poland but also on the territory of NATO and the EU." Ukrainian President Volodymyr Zelenskyy said the incursion "could not be called an accident." German Defense Minister Boris Pistorius said the drones "were quite obviously deliberately directed," while UK Prime Minister Keir Starmer called the incident "deeply concerning" and "an extremely reckless move," and French President Emmanuel Macron termed it "unacceptable." Russia's chargé d'affaires in Warsaw, Andrey Ordash, called the accusations "groundless," and a Russian Foreign Ministry representative claimed the drones' range could not have reached Poland from Russian territory, offering "professional discussions" with Poland's defense ministry instead. Independent defense analysts at RUSI and Sibylline assessed that the sheer scale of the incursion made it "almost certainly a deliberate act on Russia's part" rather than a stray or accidental overflight. Poland closed its border with Belarus from September 12 to 25, spanning Russia and Belarus's Zapad-2025 exercises, and maintained flight restrictions near its eastern border into December.

The Debunked Flagship: Copenhagen Airport

The incident that gave the broader wave its name and its "hybrid attack" framing, however, did not hold up under investigation. On the night of September 22, 2025, Copenhagen Police described "two to three large drones" operating inside controlled airspace, forcing a shutdown of roughly four hours; Copenhagen Police spokesman Jens Jespersen said at the time that officers avoided shooting the drones down "for safety reasons," that the drones' control site "could be kilometres away, possibly from a ship," and that "it was an actor that had the capacity, the will and the tools" to carry out the operation — language that, alongside PM Frederiksen's "most serious attack" remark, set the tone for how the incident and the wave that followed it were understood for the next nine months.

That understanding did not survive the investigation meant to confirm it. On June 25, 2026, Copenhagen Police Chief Superintendent Søren Thomassen closed a nine-month inquiry, stating at a press conference: "Overall, our conclusion today is that we cannot demonstrate that there was drone activity in and around the airport." Investigators had reviewed witness statements, photographs, video, CCTV footage, radar data, and extensive air- and maritime-traffic records; no suspect was ever identified, and the case was closed without charges. One radar system had detected an object moving at roughly 100 km/h over the Øresund Strait, but the manufacturer, the Dutch firm Robin Radar, subsequently disclosed that the specific installation at Copenhagen Airport was a bird-detection radar "not designed to detect drones." Thomassen was careful to frame the finding as an absence of proof rather than proof of absence, clarifying that police "cannot rule out that drones were present" — only that nine months of evidence review had failed to substantiate that they were. Danish investigations into several of the autumn's other reported Danish sightings reportedly reached similarly inconclusive results. This file treats the finding as directly relevant to how the entire wave should be read: the single incident most responsible for the wave's "unprecedented hybrid attack" framing, and the one that did the most to shape the political and military response across a dozen countries in the weeks that followed, rests on evidence its own investigators ultimately said they could not substantiate.

The Broader Danish and Norwegian Pattern

Copenhagen was neither the first nor the last Nordic incident. Two days after the airport closure, on September 24, Aalborg and Billund airports both temporarily closed, and further sightings were reported near Sønderborg, Esbjerg, and Skrydstrup military air base; Denmark's National Police raised nationwide preparedness to its highest level since the 2015 Copenhagen terror attacks, and the country's National Operative Staff escalated to its highest readiness posture. On September 25–26, Karup Air Base logged a multi-hour sighting beginning around 20:15 local time. Norway experienced a parallel pattern: Oslo's Gardermoen Airport briefly closed the same night as Copenhagen, Ørland Main Air Station — one of Norway's key NATO-integrated bases — reported drone activity for roughly two and a half hours on September 27, and Norwegian police documented "five to six possible drones" simultaneously over Brønnøysund Airport the following night. Sweden's Gothenburg-Landvetter Airport briefly closed in a related incident in early November. In response, NATO increased its Baltic Sea naval and air presence, and Germany deployed the air-defense frigate FGS Hamburg to waters near Copenhagen; Sweden separately offered Denmark anti-drone equipment. Danish authorities reportedly began quietly mobilizing military reservists around September 29, according to reports that later leaked to the press, and imposed a temporary nationwide no-fly zone in early October to protect an informal European Council summit that Copenhagen was hosting as part of Denmark's rotating EU presidency — meaning the drone scare and the continent's response to it were unfolding in the same city, in the same week, as a gathering of EU heads of government. Danish officials, including PM Frederiksen, publicly floated a "hybrid operation" explanation for the pattern without formally attributing it to any state, while acknowledging as early as September 28 that they had not identified a perpetrator and were pursuing "multiple hypotheses," including the possibility that drones had been launched from a vessel offshore rather than from Danish soil.

Germany: Munich, Schleswig-Holstein, and a New Law

Germany experienced some of the wave's most disruptive and most institutionally consequential incidents. On September 25–26, drone formations were reported over multiple critical-infrastructure sites in the northern state of Schleswig-Holstein, including a Thyssenkrupp Marine Systems shipyard facility, Kiel University Medical Center, and a state parliament building; federal Interior Minister Alexander Dobrindt described some of the drones involved as having wingspans of up to eight meters, well beyond a typical hobbyist quadcopter. Munich Airport, one of Germany's busiest, was forced to suspend operations twice within 24 hours in early October: the first closure, beginning around 10 p.m. on October 2, grounded 17 departing flights and diverted 15 inbound ones, stranding nearly 3,000 passengers overnight; the second, less than 24 hours later on October 3, followed "two simultaneous confirmed drone sightings by police patrols" near the airport's north and south runways, forcing 46 cancellations or delays and disrupting roughly 6,500 passengers before operations gradually resumed the following morning. Berlin Brandenburg Airport briefly closed in a further incident on October 31, and Bremen Airport was also affected in early November. German federal authorities were notably tight-lipped about follow-up findings in most of these cases, releasing little information confirming or ruling out drone involvement in individual incidents.

The cumulative effect on German policy was significant. Defense Minister Boris Pistorius stated in early October that Germany intended to legislate a clearer legal basis for shooting down drones over German territory, and on November 19, the cabinet of Chancellor Friedrich Merz approved draft legislation authorizing the Bundeswehr — not just police — to use jammers and, in emergencies, weapons against drones threatening critical infrastructure, a genuine break from Germany's post-war constitutional norm restricting the military from operating inside its own borders except during natural disasters. The Bundestag passed amendments to the country's Air Security Act on February 27, 2026, with support from both governing coalition parties, allowing the military to intercept, jam, or shoot down drones domestically when local police request assistance because their own capabilities have been exceeded.

The Middle Ground: Belgium and the Nuclear Bases

Between these two poles sits the Belgian pattern of sightings at Kleine Brogel Air Base, which multiple officials, including Defense Minister Theo Francken, characterized as a coordinated, multi-phase surveillance operation — smaller drones first probing security-service radio frequencies, followed by larger aircraft at higher altitudes using different communications systems. Francken told reporters the pattern "resembles a spy operation — by whom, I don't know. I have a few ideas, but I am going to be careful [about speculation]," and described the first phase as "small drones to test the radio frequencies" of Belgian security agencies, followed by a second phase of "big drones to destabilize the area and people." The sightings, concentrated over the nights of November 1–3, 2025, also extended to Leopoldsburg and Marche-en-Famenne air bases; Kleine Brogel is notable within the wave for hosting Belgium's F-16 fleet, its newly arriving F-35s, and a reported stockpile of roughly 100 U.S. B61 tactical nuclear weapons, making it one of several suspected or confirmed nuclear-weapons storage sites overflown during the wave alongside the Netherlands' Volkel Air Base.

The pattern widened through November. On November 6, Brussels Airport briefly closed and three drones were reported over the Port of Antwerp; on November 9, Liège Airport closed for roughly an hour, three drones were reported over the Doel nuclear power station, and the United Kingdom announced it would send counter-drone personnel and equipment to assist Belgium. On November 13, Francken told the Belgian parliament that France, Germany, and the United States had all offered technical or operational counter-drone assistance. Belgian officials never named a responsible party. Yet later Dutch reporting (Trouw, November 28, 2025) found that many alerts across the broader wave, Belgium included, were false alarms with scant hard evidence of Russian involvement, without fully resolving whether the specific multi-night Kleine Brogel pattern — with its distinctive, technically specific two-phase signature — was among them. Belgium's installation of dedicated drone-detection systems in the weeks that followed reportedly produced a sharp drop in subsequent reported sightings, a pattern some analysts read as evidence that at least some of the earlier reports had been misinterpretations of ordinary air traffic rather than a deterred hostile campaign.

The Netherlands, France, and Ireland: The Wave's Final Months

The wave's last major incidents, in late November and December, again targeted sites associated with nuclear deterrence. On the night of November 21–22, Dutch security personnel at Volkel Air Base — one of six European bases believed to store U.S. B61 nuclear bombs — reported up to ten drones overhead between roughly 7 and 9 p.m.; ground forces opened fire but failed to bring any down, and the Dutch defense ministry stated the drones simply "left the area and were not recovered." Further drone activity was reported near Volkel and Eindhoven Air Base on November 27, prompting a further F-35 interception attempt on December 7. On December 4, five drones were detected "by technical means" over Île Longue, the Brittany peninsula base that homes all four of France's ballistic-missile submarines (Le Triomphant, Le Téméraire, Le Vigilant, and Le Terrible); French marines responded with an electronic jammer rather than firearms, according to public prosecutor Frédéric Teillet, and as with Volkel, no drone was downed or recovered. French authorities said that, at that stage, "no link with foreign interference" had been formally established. On December 1, drones were spotted north of Dublin during Ukrainian President Volodymyr Zelenskyy's arrival at Dublin Airport, and an Irish naval vessel, the LÉ William Butler Yeats, separately observed drone activity over the Irish Sea — incidents that extended the wave's geographic reach to a nation outside NATO's own membership.

NATO's Institutional Response: Eastern Sentry and the Cost Problem

Operation Eastern Sentry, launched September 12, 2025, extended a model NATO had already tested in the Baltic: rather than leaving each member state to intercept airspace violations with its own national assets, the alliance established a coordinated, alliance-wide air-defense posture along its entire eastern flank. Rutte framed the escalation bluntly: "Russia's recklessness in the air along our eastern flank is increasing in frequency." Contributing nations and assets reported in connection with the operation included two Danish F-16s and an Iver Huitfeldt-class frigate, three French Rafale fighters, four German Eurofighter Typhoons, two Italian F-35A fighters and a SAMP/T missile-defense system based in Estonia, two British Eurofighter Typhoons, and a Spanish Eurofighter Typhoon, among other member-state contributions; the operation carries no announced end date and effectively replaced the prior arrangement of individual national responsibility for eastern-flank airspace violations with continuous, collective alliance coverage.

The wave also forced a blunter strategic reckoning inside NATO about the economics of countering cheap drones with expensive interceptors. Many of the attack and decoy drones involved in incidents across the wave could be built for well under €100,000 apiece — some Gerbera-type decoys reportedly cost only a few thousand dollars — while a single NATO fighter-jet interception sortie, before any missile is even fired, can cost upward of €85,000, and the air-to-air missiles used to down a drone can run into the hundreds of thousands or millions of dollars each. One senior NATO commander was blunt that using multimillion-dollar missiles against $2,000-to-$3,000 drones was neither sustainable nor, in a sufficiently large or sustained drone campaign, ultimately winnable on cost terms alone. In response, NATO and individual member states accelerated adoption of far cheaper counter-drone interceptors: the U.S.-made Merops interceptor system, credited with destroying more than 1,000 Russian drones in Ukraine at a cost of roughly $15 million against more than $200 million in Russian drone losses, was purchased by Lithuania (48 units at roughly $15,000 per interceptor) as part of a broader NATO push to field interceptors cheaper than the targets they are built to destroy.

The wave also reopened a long-running internal NATO debate about where exactly hybrid activity like drone incursions sits relative to the alliance's collective-defense threshold. Article 4 of the North Atlantic Treaty, which Poland invoked, only obliges member states to consult when one feels its territorial integrity, political independence, or security is threatened; it carries no automatic military response. Article 5, the mutual-defense guarantee, requires a qualifying "armed attack," and NATO has since 2016 left open the possibility that hybrid activity — including cyberattacks, and by extension sabotage or drone incursions — could in principle meet that bar on a case-by-case basis, a position reaffirmed regarding cyber activity at NATO's 2023 Vilnius summit. In practice, every incident in this wave, including the confirmed Poland incursion, was handled through Article 4 consultation and an alliance-level operational response (Eastern Sentry) rather than a formal Article 5 invocation, illustrating how a state can conduct sustained, low-level military probing against NATO territory without triggering the treaty's core collective-defense guarantee — and, critics of NATO's posture argued at the time, without incurring costs remotely proportionate to a member state's own certainty that hostile military drones had crossed its border and been shot down over its own soil.

The EU's Drone Wall Proposal

The wave also produced a parallel, non-NATO institutional response from the European Union. On October 16, 2025, European Commission President Ursula von der Leyen and the EU's foreign-affairs chief Kaja Kallas presented a defense policy roadmap to the European Parliament proposing a "drone wall," formally the European Drone Defence Initiative (EDDI), intended to give the EU its own layered detection and counter-drone capability along its eastern and northern borders. Kallas emphasized that the initiative was meant to sit alongside, not duplicate, NATO's own efforts: "We are not doubling the work that NATO is doing; actually, we are complementing each other," and separately argued that "drones are already redefining warfare. Having drone defenses is no longer optional for anyone." The roadmap targeted an initial operational capacity by the end of 2026 and full operational status by the end of 2027, though the proposal drew open skepticism from some EU capitals wary of institutional overlap with NATO and of the cost of standing up a parallel European detection network. France, Germany, and the United Kingdom separately deployed personnel and equipment to assist Belgium directly during the worst of the November sightings, while the United States offered "technical and operational assistance," according to Francken's November 13 statement to the Belgian parliament.

The Technical and Evidentiary Debate: How Many Drones Were Real?

Perhaps the most consequential open question raised by this case is not whether Russia has waged hybrid warfare against NATO states — the Baltic cable-sabotage pattern and the confirmed Poland incursion both establish that it has — but how many of the dozens of individual "drone" sightings that made up the broader September-to-December wave actually involved real, hostile aircraft. The evidentiary record here is unusually well-documented for a UAP-adjacent case, because two independent outlets conducted systematic after-the-fact tallies rather than relying on impressions built up incident-by-incident in real time.

The Dutch newspaper Trouw's November 28, 2025 analysis, drawing on the specialist tracking platform Dronewatch, found that of roughly 60 reported sightings across 11 countries between August and November 2025, only four — all in Poland, Romania, or Moldova, all bordering Ukraine — involved confirmed Russian drones identified through recovered debris or a confirmed shoot-down. A more granular Dronewatch tally of 61 discrete incidents between September 9 and November 27 categorized the outcomes as follows: three cases were confirmed Russian military drones; three more were confirmed hobbyist or tourist drones with no hostile connection; fourteen cases turned out, on investigation, not to involve a drone at all — misidentified police helicopters over Brussels Airport, cargo aircraft, ordinary helicopters, bright stars mistaken for lights over Billund and southern Limburg, and in one case a Norwegian oil platform mistaken for a vessel; and the remaining 41 cases — two out of every three sightings in the tally — yielded no evidence at all of a drone's origin, meaning investigators could neither confirm nor rule out that a real, unidentified drone had been present. In other words, 55 of the 61 incidents analyzed, or roughly 90 percent, produced no confirmation of hostile or illegal drone activity, even though a comparable share of the underlying public alarm and official rhetoric across the wave treated hostile activity as the default assumption. Dronewatch's analysts drew an explicit comparison to the 2024 New Jersey/Northeast drone panic in the United States, in which the FBI fielded thousands of reports and ultimately concluded that the great majority reflected misidentified conventional aircraft rather than a coordinated threat.

That skeptical picture was itself partially revised by later reporting. A July 2026 report from the International Institute for Strategic Studies (IISS), compiled from open-source tracking and interviews with European defense and intelligence officials, mapped roughly 144 suspected drone sightings across Europe between 2024 and 2026 — a larger and longer-running dataset than the Trouw/Dronewatch tally — and concluded that Russian "shadow fleet" vessels, the same aging tanker fleet already implicated in Baltic Sea undersea-cable sabotage, likely served as launch platforms for at least some of the drone incursions. The IISS breakdown found that roughly 48 percent of the tracked sightings occurred over military facilities, 18 percent over civilian airports, and 26 percent over critical infrastructure such as ports and energy sites, a distribution its authors argued was more consistent with deliberate reconnaissance of high-value targets than with the essentially random distribution one would expect from mass misidentification of ordinary air traffic. Reconciling the two reports is less a matter of one being right and the other wrong than of them measuring different things: the Trouw/Dronewatch analysis is a rigorous case-by-case evidentiary audit that correctly found most individual incidents unproven, while the later IISS assessment is a pattern-level judgment about the wave's most defensible subset of well-documented incidents — concentrated at military and nuclear-linked sites, several with the same multi-phase, frequency-probing signature Belgian officials described at Kleine Brogel — that argues real, sustained Russian probing activity was mixed in among the much larger volume of noise, rather than that the entire wave was either wholly genuine or wholly manufactured panic.

A further layer of the technical debate concerns intent even where activity is accepted as real: Ukrainian officials, drawing on their own years of experience under Russian drone and missile bombardment, argued publicly that the wave represented deliberate testing of NATO's detection and response capabilities and of the alliance's political will to respond, rather than incidental spillover from the war. Some Western drone-warfare analysts pushed back on that reading for at least part of the wave, suggesting that a subset of incursions — particularly drones that briefly clipped NATO airspace near the Ukrainian and Belarusian borders during large Russian strikes on Ukraine itself — may reflect navigational error, jamming-induced course deviation, or simple operational spillover from a massive nightly bombardment campaign rather than a deliberately targeted probe of a specific NATO airport or base. Both readings can be true simultaneously for different incidents within the same wave: a border-adjacent, single-drone stray near Poland's frontier during a mass Ukraine strike is a materially different kind of event from five drones flying a deliberate pattern over a French nuclear submarine base 1,500 kilometers from the nearest fighting, even though both were reported under the same "European drone incursion" umbrella at the time.

Key Figures

The Five Observables Assessment

Applying the Five Observables framework, with the caveat that this case concerns conventional drone technology rather than a claimed anomalous craft:

Assessment: This case scores low on the Five Observables framework by design, since it concerns identifiably conventional drone technology; its inclusion in this archive rests entirely on the unidentified status of the specific operators involved in most incidents outside Poland, not on any anomalous performance characteristics.

Evidence Assessment

Why "Disputed"

This case is rated Disputed because it genuinely contains both a confirmed, high-certainty event and a prominent, later-undermined one within the same continuous wave, and this file declines to average that tension away in either direction. The Poland incursion is not disputed — it is a matter of recovered physical evidence and formal attribution. The Copenhagen incident, by contrast, is now formally undermined by the very police investigation tasked with confirming it, and the broader wave includes a documented pattern of false alarms running as high as 90 percent of individually audited incidents.

This file does not rate the case as Debunked because the Poland incursion alone establishes that real, hostile drone activity against NATO airspace did occur during this period, because several other incidents (Kleine Brogel's multi-phase pattern in particular, and the cluster of sightings at nuclear-linked sites more broadly) have not been formally resolved either way, and because the later, more comprehensive IISS review found a targeting pattern across the wave's better-documented incidents that is difficult to dismiss as pure coincidence or panic. It does not rate the case as Credible or Verified because the single incident most responsible for the wave's public alarm and "hybrid attack" characterization has since been directly contradicted by official investigators, and because the large majority of individually audited sightings across the wave were never substantiated at all. A case combining one confirmed act of war, one formally retracted flagship incident, and dozens of unresolved reports in between is, by this archive's own standards, close to the textbook definition of Disputed rather than either extreme.

Observer Credibility & Occupational Profile

This case's observers span an unusually wide range of institutional credibility within a single file: on one end, military radar operators and recovered physical evidence in Poland provide genuinely strong, verifiable confirmation; on the other, some airport and public sightings that generated national "hybrid attack" alarm were later found by the responsible police investigation to lack demonstrable supporting evidence. Between those poles sit observers of intermediate reliability — police officers and airport security staff across Germany, Belgium, Norway, and the Netherlands who made good-faith visual identifications under night-time, high-stress conditions, sometimes corroborated by a second independent observer (as at Munich, where two separate police patrols confirmed simultaneous sightings near opposite runways) and sometimes not. This file treats the case as a clear illustration of why institutional source alone (a national government, a police force, a military) does not guarantee a claim's ultimate accuracy — both the initial alarm and the later retraction in the Copenhagen case came from official government sources, and the same pattern (initial confident hostile-activity framing, later walked back or left unresolved) recurred across multiple countries rather than being unique to Denmark.

Historical Precedents & Archive Matches

This case is comparable to other drone-swarm incidents in this archive involving military and critical infrastructure sites, including the New Jersey/Northeast Drone Wave and the 2019 Navy Destroyer Drone Swarm, both of which similarly combined genuine unresolved sightings with significant public speculation exceeding the confirmed evidentiary record. Dronewatch's own analysts drew an explicit comparison between this wave and the New Jersey/Northeast case in particular, noting that both episodes saw a large volume of individual reports investigated by a capable institution (the FBI in the American case, national police forces in the European one) that ultimately could confirm hostile or unlawful activity in only a small fraction of incidents, while public and political alarm during the event itself ran well ahead of the confirmed evidentiary record in both cases. The parallel is not exact — this wave contains one incident (Poland) with a confirmed hostile state actor and recovered military hardware, which the New Jersey wave never did — but the underlying dynamic, in which a single credible early incident lowers the public and institutional threshold for interpreting subsequent ambiguous sightings as hostile, recurs across both files.

Material Analysis

The case's physical evidence is sharply divided by location: confirmed drone wreckage was recovered and formally examined in Poland, while no physical material has been recovered from any other national incident within the wave, including the high-profile Kleine Brogel, Copenhagen, Volkel, and Île Longue incidents. The Polish wreckage record is itself unusually rich for this archive: seventeen individual drones had been identified by September 12, 2025, additional fragments continued to surface through debris searches in Wodynie and Biała Góra, and a further Gerbera-type airframe was recovered as late as March 12, 2026, in a lignite mine roughly 170 kilometers west of Warsaw — a recovery timeline stretching across six months that underscores how physically extensive the incursion actually was on the ground, independent of any single contested sighting. By contrast, every other national military response documented in this wave — Dutch ground fire at Volkel, French jamming at Île Longue, repeated Belgian and German patrol confirmations — failed to bring down or physically recover a single drone, leaving those incidents to rest entirely on visual, radar, or electronic-detection evidence rather than hardware.

The Conventional Explanation Candidate: A Mix of Genuine Russian Hybrid Activity and Public Panic/Misidentification

The leading, and this file's assessed, explanation is not a single unified theory but a layered one: a confirmed, deliberate Russian drone incursion into Poland created a genuine security shock that plausibly motivated additional real Russian probing activity at other NATO sites (particularly the multi-phase Kleine Brogel pattern and the cluster of sightings at nuclear-linked bases), while simultaneously lowering the public and institutional threshold for reporting ordinary aircraft, birds, satellites, and other conventional objects as hostile drones across the wider region. This layered reading is not merely this file's editorial compromise; it is closest to where the two major independent evidentiary reviews — Trouw/Dronewatch's skeptical, case-by-case audit and the IISS's later pattern-level shadow-fleet assessment — actually converge, once their different methodologies and scopes are accounted for.

The Copenhagen Radar Problem

The disclosure that Copenhagen's key radar contact came from a system designed to detect birds, not drones, is a concrete, specific mechanism by which a real security scare can generate false institutional confirmation without any actual drone being present. It also illustrates a broader technical weakness that ran through much of the wave: most airports and even many military installations across the affected countries lacked purpose-built, drone-specific detection radar in September 2025, meaning the vast majority of sightings depended on unaided visual observation at night, a notoriously unreliable basis for confidently distinguishing a small unmanned aircraft from a bird, a star, a distant airliner, or a helicopter. Belgium's subsequent, reported drop in sightings after installing dedicated drone-detection equipment supports the inference that at least part of the wave's volume reflected a genuine detection-technology gap rather than a genuine drone gap.

Genuine Probing Activity Elsewhere

This file does not extend the Copenhagen finding to the entire wave: the Kleine Brogel pattern's described two-phase structure (frequency-probing followed by larger aircraft) is a specific technical signature that fits deliberate reconnaissance more than misidentification, and remains formally unresolved rather than debunked. The IISS's July 2026 finding that a large share of the wave's best-documented sightings clustered specifically over military facilities and critical infrastructure, rather than being evenly spread across all types of locations, points the same direction: a genuine, if numerically small, core of deliberate Russian activity sitting inside a much larger volume of false alarms and misidentification generated by the atmosphere that core activity created.

A Mix of Genuine Russian Hybrid Activity and Public Panic/Misidentification — Plausibility Rating: PLAUSIBLE, PARTIALLY CONFIRMED

Related Cases

Further Reading — Recommended Literature

DISCLOSURE: Some links above are affiliate links. If you purchase through them, OverClassified receives a small commission at no additional cost to you. This helps support independent research.

Essential Viewing

Sources

• "2025 European drone sightings," Wikipedia. Read online →
• "2025 Russian drone incursion into Poland," Wikipedia. Read online →
• "Operation Eastern Sentry," Wikipedia. Read online →
• "After Months of Investigation: No Evidence of Drones Over Copenhagen Airport," Dronewatch Europe. Read online →
• "NATO Shoots Down Russian Drones Over Poland," CNN. Read online →
• "Surge of Mystery Drone Incursions Targets Europe's Military Nerve Centers," The Washington Times. Read online →
• "Belgium Suspects 'Spy Operation' in Drone Flight Near Nuclear Air Base," Defense News. Read online →
• "Drone Incursions in Belgium Spark Probes, NATO-EU Response," Arms Control Association. Read online →
• "Denmark Reports 'Hybrid Attack' as Drones Shutter Major Airport," Al Jazeera. Read online →
• "Eastern Flank Watch and European Drone Wall," European Parliament Think Tank. Read online →
• "EU Discusses 'Drone Wall' to Protect Airspace From Russian Violations," Al Jazeera. Read online →
• "Drones Seen Over Belgian Military Base for Third Night, Minister Says," BBC News. Read online →
• "Police Unable to Prove Drones Over Airport," The Copenhagen Post. Read online →
• "61 European Drone Sightings Analysed: Here's What We Know," Dronewatch Europe. Read online →
• "Majority of Reported Drone Incidents in Europe Not Linked to Russia — Trouw," The Moscow Times. Read online →
• "Russia Waged a Drone Campaign in Europe and Likely Launched Drones From Shadow Ships, Report Says," ABC News. Read online →
• "Munich Airport Resumes Operations After More Drone Sightings Halted Flights," Al Jazeera. Read online →
• "Dutch Military Opens Fire on Unidentified Drones Over Volkel Air Base," NL Times. Read online →
• "France Probes Mystery Drone Flight Over Nuclear Sub Base," France 24. Read online →
• "Germany Empowers Military to Shoot Down Drones in Emergencies," Bloomberg. Read online →
• "NATO Says Baltic Sentry Helped Slash Russian Undersea Infrastructure Sabotage, Cut Response Time to One Hour," United24 Media. Read online →
• "NATO Nations Size Up an Interceptor-Drone Bazaar Where Low Price Is Everything," Defense News. Read online →
• Graff, Garrett M. UFO: The Inside Story of the US Government's Search for Alien Life Here—and Out There. Avid Reader Press, 2023.
• Kean, Leslie. UFOs: Generals, Pilots, and Government Officials Go on the Record. Harmony Books, 2010.
• Greenewald, John, Jr. Inside The Black Vault: The Government's UFO Secrets Revealed. Rowman & Littlefield, 2019.
• Hynek, J. Allen. The UFO Experience: A Scientific Inquiry. Da Capo Press, 1998 (orig. 1972).
• Peebles, Curtis. Watch the Skies! A Chronicle of the Flying Saucer Myth. Smithsonian Institution Press, 1994.
• "File: F-16 AF Belgium Sanicole 2007 flying P1020648 (50852999882).jpg," Jim van de Burgt, CC0/public domain. View file →