A Scenario With a Script
Most intelligence assessments warn about capabilities. The one Denmark’s Defence Intelligence Service published last week describes a script. It warns of a “low but growing risk” that Russia will carry out a limited attack on NATO states bordering it, in the form of isolated drone or missile strikes against infrastructure used to support Ukraine. It then explains how Moscow would cover it. Russia would claim the weapons “only struck NATO territory because they were jammed by Ukraine,” or carry out a false-flag operation using Ukrainian-made drones. The head of the service, Thomas Ahrenkiel, said the point would be to “test whether NATO members are prepared to respond collectively.”
NATO’s Secretary General, Mark Rutte, responded by urging calm: Putin “is in a bad place,” and “all the response options are there.” Having response options is not the same as agreeing who to respond against.
The Rehearsal Already Happened
Stay ahead of the geopolitical week.
MD Briefing delivers expert analysis across five global fronts — the Indo-Pacific, energy, geoeconomics, European security, and the Middle East — every Monday morning. Free.
The scenario is credible because a version of it has already happened by accident. Between March and May, Ukrainian drones aimed at Russian oil ports strayed into Lithuania, Latvia, Estonia and Finland. One exploded at an oil depot in Rēzekne, 40 km from the Russian border, and Latvia’s defence minister resigned. Finland’s prime minister and Ukraine’s foreign minister both blamed Russian jamming for sending them off course. European publics now know that Ukrainian drones can land on NATO territory. Those incidents were genuine accidents, and Kyiv acknowledged them, which is exactly why the same explanation would be believed next time.
Moscow has also laid the political groundwork. In May its UN ambassador, Vasily Nebenzya, told the Security Council that Ukraine planned to launch drones from Latvia and other Baltic states, and warned that NATO membership would not protect them from retaliation. Latvia called the claim “pure fiction.” It also means that if a strike ever does come, Moscow will say it predicted it.
The Gap Between an Explosion and a Verdict
Most coverage has focused on the headline risk of a Russian strike on NATO. The design of the scenario matters more. An attack that clearly came from Russia would be the most dangerous thing Moscow could do, because it would unite the alliance around Article 5. MD has argued that Putin may want a confrontation with NATO to justify mobilisation at home. The Danish scenario suggests a more careful version: an attack that creates confusion over who is responsible and divides the allies in the process.
This works because NATO has no common way to attribute an attack. The alliance’s own texts say that “attribution is a sovereign national prerogative”, meaning each member decides for itself who is responsible. The North Atlantic Council can invoke Article 5 in response to hybrid attacks, but only by consensus and case by case. There is no common forensic process, no shared deadline for reaching a conclusion, and no rule that binds allies to one country’s findings. Europe’s track record is not encouraging. An IISS study of 144 drone incursions over Western Europe found that no European government had publicly attributed the sightings to Russia, even though many were probably launched from Russia-linked ships. After a drone packed with explosives was found at Leipzig airport in August, Germany blamed “Russian state entities,” but NATO held no Article 4 consultation. It did not hold one after the November 2025 sabotage of Poland’s railway either.
Consider what happens in the first 72 hours after a strike on a logistics hub supplying Ukraine, such as the Rzeszów airport in south-east Poland. The wreckage contains Ukrainian components, which is not hard to arrange given how many Ukrainian drones Russia has captured. Moscow says Ukrainian jamming or a Ukrainian false flag is to blame and points to Nebenzya’s May warning. Poland attributes the attack to Russia within hours. Other allies want to wait for forensic results, and governments such as Hungary’s or Slovakia’s may be reluctant to blame Moscow quickly. Consensus in the North Atlantic Council is not possible while even one ally is unconvinced. Each day without a joint conclusion makes it look as if the alliance doubts its own member.
The most important reaction may come from Washington. The Trump administration has already urged Kyiv to stop targeting Russian refineries, and this month Kyiv had to deny reports that Trump had pressed Zelensky to travel to Moscow. In an administration focused on ending the war, an attack attributed to “Ukrainian drones” would strengthen the argument that Kyiv’s long-range strikes are putting NATO at risk. The response Moscow would want is not a NATO counter-attack but US pressure on Ukraine to stop the long-range strikes, and European hesitation over sending weapons through a hub that has just been hit.
The strongest objection is that forensic analysis will settle the question. A Russian Gerbera drone is not a Ukrainian Lyutyi, and Poland identified the Russian drones in its airspace within hours in September 2025. When the evidence is clear, that is true. But the scenario is built to prevent clear evidence, by using real Ukrainian drones diverted by jamming, or captured ones launched by Russia. Even where the forensics are solid, they take days to weeks, and each ally reaches its own verdict. The spring incidents make the cover story plausible because they were exactly what they appeared to be.
Three Ways the Test Plays Out
Base case (around 55%): hybrid pressure increases, but no strike. Sabotage, drone flights, cyber attacks and ship-launched incursions continue through the winter, as the Danish and CIA warnings expect. Each incident is attributed separately by the country concerned, days or weeks later. NATO issues statements, and Moscow learns more about how slowly and unevenly the alliance reaches conclusions. The key assumption is that Putin keeps the limited-strike option in reserve while talks over Ukraine remain possible.
Downside (around 25%): a strike on an aid hub that the alliance cannot agree about. Drones hit a logistics site in Poland, Romania or a Baltic state. Wreckage points to Ukrainian drones, and Moscow blames Kyiv. The targeted state invokes Article 4, but one or two allies block a joint attribution in the North Atlantic Council, and Washington calls for restraint and presses Kyiv to limit long-range strikes. Weapons deliveries slow while the affected hub is reviewed. For readers, the exposure falls on defence logistics contractors, insurers of transit sites in the region and European defence stocks, which would move on signs of alliance division rather than on the damage itself.
Upside (around 20%): the warning leads to a joint attribution process. Allies agree before winter on a joint attribution cell with a deadline for shared findings, perhaps through the Nordic-Baltic Eight, a regional grouping of Nordic and Baltic states, rather than NATO as a whole. They also declare in advance that when Russian jamming diverts a weapon onto allied territory, Russia is responsible for the damage. That second step would remove the “Ukrainian jamming” excuse, and it would cost nothing to adopt now.
Who Did It Decides What Happens Next
The strike Danish intelligence describes is designed less to cause damage than to exploit a gap in how NATO works. The alliance can respond collectively, but it attributes attacks country by country. Moscow is preparing an attack designed to fall into that gap: the precedent of stray Ukrainian drones, Nebenzya’s claim in May, and a target that serves Ukraine. As MD has reported, the hybrid campaign is larger than governments have publicly acknowledged. Its next step is designed to leave allies arguing over who is responsible.
Watch whether any group of allies issues a joint statement on attribution before winter, especially one saying Russia is responsible for weapons it diverts by jamming. If no such statement appears, the gap Denmark identified remains open.
Article 5 depends on allies agreeing about who attacked them. Russia’s plan is to make sure they cannot.
