An Italian SAMP/T in Estonia
Italy has sent one of its SAMP/T air-defence batteries, Europe’s most capable home-built system, to Estonia as part of NATO’s Eastern Sentry mission. At home, its defence minister, Guido Crosetto, says Italy will not be able to defend its own airspace independently until 2031. Last week Spain’s El Mundo reported that the CIA had warned Madrid, Paris and Rome that Russia was preparing drone attacks from merchant ships in the Mediterranean. Crosetto dismissed the report as “completely unsubstantiated.”
He may be right about the specific plot. But the map tells a different story. Europe has moved its air defences east, while the risk has also moved south.
Two Sentries, No Third
Stay ahead of the geopolitical week.
MD Briefing delivers expert analysis across five global fronts — the Indo-Pacific, energy, geoeconomics, European security, and the Middle East — every Monday morning. Free.
After Russian drones crossed into Poland in September 2025, NATO launched Eastern Sentry, adding fighters, frigates and air defence along its eastern border. It had already set up Baltic Sentry in January 2025 to protect undersea cables. Nothing similar exists for the Mediterranean. Europe’s main joint air-defence buying programme, the European Sky Shield Initiative, now has 24 members, including Greece and Portugal. Spain, Italy and France are not among them. Paris objected that it relies too heavily on non-European equipment and leaves out the Franco-Italian SAMP/T. NATO’s only standing mission in the Mediterranean, Operation Sea Guardian, deals with maritime security, not air defence.
The reported threat is small. The Gerbera is a cheap decoy-and-strike drone with a range of about 600 km, a 2.5-metre wingspan and a payload of a few kilos. According to the report, the drones would be hidden in containers and catapult-launched from vessels in international waters. The alert itself rests on a single newspaper report citing an anonymous Lithuanian intelligence source.
Where Three Threats Meet
Most coverage treats the CIA story as a one-off scare and asks whether it is true. The better question is why a threat like this would be aimed at the south at all. The answer is that the Mediterranean is the only part of Europe’s neighbourhood where three separate threats overlap, and each makes the others harder to handle.
The first is Russia’s hybrid campaign, meaning sabotage, drone flights and other deniable attacks short of war. It now works from the sea. The International Institute for Strategic Studies found that a large share of 144 documented drone incursions over Western Europe were likely launched from Russia-linked vessels, many of them from the “shadow fleet” of tankers Russia uses to move sanctioned oil. The Mediterranean is full of such ships. France has already had to board one flying a false flag in March. Denmark’s intelligence service warned last week that Moscow may attack infrastructure supporting Ukraine and make it deniable by blaming Ukrainian electronic warfare. MD has reported that the campaign is larger than governments have acknowledged. A ship-launched drone over a Spanish port fits that pattern exactly.
The second is the Iran war. It has already reached European soil in the Mediterranean. On 2 March, an Iranian-designed Shahed drone launched from Lebanon hit a hangar at RAF Akrotiri in Cyprus. France, Greece and Spain rushed ships and air defences to the island. Further south, the Houthis now control Yemen’s Red Sea coast and have closed the Bab el-Mandeb to Saudi tankers, threatening the shipping route that runs through Suez into the Mediterranean. Proxies with Iranian drones already operate along the eastern and southern entrances to the sea.
The third is Russia’s move into Libya. After Assad fell in Syria, Moscow lost its secure Mediterranean ports. It has since shifted operations to Libya, where the US National Geospatial-Intelligence Agency says Russia is building up six air bases, from Al-Khadim near Benghazi to Maaten al-Sarra in the desert south. These bases host MiG-29 fighters, air defence systems and drones. The agency’s assessment is direct: the build-up maintains “a military presence along NATO’s southern flank.” As MD has noted, Libya is also Moscow’s gateway to the Sahel, which allows it to put pressure on migration routes into Europe, a lever with obvious political uses in Rome.
Taken together, these threats reach Europe’s least-defended large states just when their relations with Washington are weakest. Spain refused to let the US use its bases at Rota and Morón for strikes on Iran and closed its airspace to them. Italy turned away US aircraft from Sigonella in Sicily. Trump threatened Spain with trade sanctions. These governments are therefore both more exposed to Iran-linked retaliation and less likely to get US air-defence support if something happens.
The strongest objection is that NATO has its priorities right. Russia launches hundreds of drones a night at Ukraine, while a Gerbera carries a few kilos. Moving scarce Patriots from Poland to Sicily because of one newspaper report would be a mistake. That is correct as far as it goes: the east faces far more fire. But a hybrid attack is meant to cause fear and political damage, not destruction. A single drone hitting a port in Valencia or a Sicilian refinery would matter less for the damage done than for when it happened. Spain, France and Italy all hold national elections in 2027, and all have electorates that are tired of the war. The south does not need to be defended as heavily as the east. It needs to be defended to at least some degree, and at present it largely is not.
Three Ways the South Is Tested
Base case (around 55%): harassment without a strike. Unexplained drone sightings over Mediterranean ports, refineries and bases increase through the winter. They cause temporary closures and sensational headlines but no confirmed attack. National governments add counter-drone units at key sites, and France expands naval patrols. Nothing is done at alliance level. The key assumption is that Moscow values deniability more than a visible hit. The likeliest early targets are LNG terminals and refineries, where even brief disruption is costly.
Downside (around 25%): a symbolic strike and a split alliance. A ship-launched drone hits an energy or military site in Spain, Italy or southern France. Russia denies it, pro-Russian channels blame Ukraine or Algeria, and the vessel is out of reach in international waters. Madrid and Rome ask for NATO consultations, but Washington, still at odds with both over Iran, responds slowly. The attack succeeds politically before anyone can prove who launched it. For readers, the exposure is to Mediterranean port operators, LNG terminals and refineries, and insurers of Mediterranean shipping.
Alternative (around 20%): a Southern Sentry. The CIA report prompts the kind of joint response the Polish incursion did in 2025. NATO or a group led by France and Italy launches a Mediterranean mission that combines maritime interdiction, boarding suspect ships and airborne early warning, and brings SAMP/T and Sky Shield systems together for the first time. The south would then gain a coordinated defence before anything has actually hit it, which Europe has rarely managed. France is the country to watch: it has the naval strength and the political motive, having led the response in Cyprus in March.
The Flank Nobody Is Watching
NATO built Eastern Sentry and Baltic Sentry after Russia struck first. The Mediterranean is repeating that pattern. Russia’s maritime hybrid campaign, Iranian-designed drones and new Russian air bases in Libya all point towards Spain, Italy and southern France. These are the large allies with the weakest air defences and the most strained relations with Washington, and they are also outside Europe’s main joint air-defence programme.
The thing to watch is whether a Mediterranean mission appears on the agenda of NATO’s next defence ministers’ meeting, or whether France and Italy put forward one of their own. The first boarding of a suspect ship in the Mediterranean on drone-related grounds would be the other clear sign.
Europe has defended its eastern flank because it was attacked there. In the south, it still has the chance to act before an attack, and that chance will not last long.
