Intelligence Warns of Russian Sabotage, Europe Prepares Emergency Protocol
European Union Foreign Policy Chief Kaja Kloas has warned that intelligence information suggests Russia is allegedly planning further acts of sabotage in Europe. This warning is prompting EU member states to accelerate discussions on new security mechanisms to confront hybrid attacks that remain below the threshold of open warfare.
“We must remain vigilant because we see in intelligence information that Russia is planning more acts of sabotage,” said Kallas upon arriving at a meeting of EU defence ministers in Brussels on Monday (28/09/2026).
According to Kallas, such attacks are aimed at disrupting European democracy, fracturing societies, and intimidating European nations into reducing support for Ukraine. She stated that these threats must be anticipated before they escalate into a larger crisis.
Kallas’s warning has provided new urgency to the discussions among EU ministers in Brussels. They have begun discussing what is referred to as the Emergency Security Protocol, a mechanism that would allow member states to quickly coordinate responses when facing hybrid attacks.
The idea was previously introduced by European Commission President Ursula von der Leyen as a sort of “European Article 4”. However, the mechanism being designed in Brussels is not intended to replace or duplicate NATO’s defence mechanisms.
NATO’s Article 4 allows a member state to request consultations when its territorial integrity, political independence, or security is deemed threatened. In contrast, the EU mechanism is aimed at determining which instruments can be utilised when a country faces aggression that does not reach the category of an armed attack.
“The emergency protocol is more about what tools can be used during aggression that is not armed aggression, which falls below the threshold of Article 5,” Kallas said following the meeting.
Threats Below the Threshold of War
This distinction is vital because Europe faces threats that cannot always be categorised as conventional military attacks. Sabotage, cyberattacks, arson, disinformation operations, interference with critical infrastructure, and drone incursions can cause security impacts without foreign troops openly crossing borders.
Since Russia launched its full-scale invasion of Ukraine in February 2022, EU officials have noted an increase in hybrid attacks against European nations. Kallas previously noted that this series of incidents is becoming bolder and more dangerous, while Russia has denied numerous allegations of involvement in sabotage operations in Europe.
Concerns have intensified following several incidents in recent weeks. One of the most prominent was an alleged drone attack at Leipzig/Halle Airport in Germany, which the German government linked to Russia.
NATO has also increased intelligence sharing following several incidents suspected to be related to Moscow, including alleged sabotage and hybrid warfare activities. Supreme Allied Commander Europe (SACEUR) General Alexus Grynkewich stated that the alliance remains vigilant in the face of these developments.
Denmark even predicts that Russia will increase its hybrid warfare against the West and NATO in the coming months. Danish defence intelligence assessments suggest such actions could include cyberattacks, small-scale drone or missile operations, and operations designed to disguise the identity of the perpetrators. Russia has denied these assessments, accusing Western nations of escalating tensions.
For Brussels, this pattern presents a complex problem. An action may be serious enough to threaten a nation’s security, yet fail to meet the threshold of an armed attack that would trigger NATO’s principle of collective defence. It is within this “grey zone” that the European Union seeks to establish its new mechanism.