European Union foreign ministers opened talks in Brussels on Monday to turn a promised hybrid-war playbook into an operational protocol, hours after Denmark’s military intelligence service warned that Russia is likely to intensify sub-threshold attacks against NATO allies in the months ahead.
EU foreign policy chief Kaja Kallas told reporters arriving at the meeting that intelligence streams point to additional sabotage planning across the continent. “We need to be vigilant because we see in the intelligence that Russia is planning more sabotage acts,” she said, framing the day’s work as a first step toward faster coordination when a member state identifies a hybrid threat.
From speech to switch
The mechanism under discussion traces to European Commission President Ursula von der Leyen’s mid-September State of the Union address, when she pledged a new security structure that could be triggered when hybrid activity is confirmed. Monday’s ministerial session is meant to define how that “emergency security protocol” would actually connect capitals, law-enforcement agencies and NATO-facing military commands without waiting for a full summit cycle.
Euronews reported that ministers were tasked with developing the bloc’s collective response as officials across Europe cite a widening pattern of incidents below the threshold of open warfare: drone overflights near airports, fires at defense-industry sites, cyber disruptions and reports of recruitment of low-level operatives to carry out arson.
What Danish intelligence added
The political timing coincided with a fresh threat assessment from the Danish Defence Intelligence Service, published Monday, that describes Moscow stepping up hybrid campaigns with “greater consequences for the targeted countries than in the past.” The nine-page report assesses that Russia will carry out more frequent attacks against the West and NATO, including cyber strikes that could cripple societal functions and sabotage with a high risk of casualties.
Breaking Defense, which reviewed the assessment, quoted analysts warning that although a full-scale invasion of a NATO member remains unlikely in the near term, the probability of a limited military strike—such as long-range weapons against infrastructure supporting Ukraine—is increasing. The service stressed it sees no sign of Kremlin planning for an outright invasion in the coming half-year, but it noted that hybrid activity has already spiked in frequency.
Incidents on the map
Reporting citing German investigators linked Russia’s GRU to a September arson attack near Munich offices of defense contractors Rohde & Schwarz and Helsing, which supplies drones used by Ukraine, according to Frankfurter Allgemeine Zeitung accounts summarized by the Kyiv Independent. Newsweek and the Institute for the Study of War have mapped drone incursions into NATO airspace and reported sabotage in Poland, Germany and Romania as part of what analysts call an effort to normalize violations and test allied responses.
French President Emmanuel Macron said on September 18 that the Russian hybrid threat facing France had intensified and ordered preparations to protect critical infrastructure, including defense sites, against drones and cyberattacks—a sentiment now echoed at EU level.
What ministers must decide
Officials say the protocol would not replace national criminal investigations or NATO’s Article 5 deliberations, but it would standardize how evidence is shared and how public warnings are synchronized when multiple countries see related activity. Kallas and von der Leyen have argued that without that layer, Russia can exploit gaps between police services, energy regulators and military air-defense networks.
Ministers left Brussels on Monday without publishing final legal text; diplomats said drafting will continue ahead of a leaders’ meeting where von der Leyen wants the hybrid framework embedded in the EU’s broader defense agenda. For NATO’s eastern members, the immediate question is whether Monday’s diplomacy translates into quicker alerts when a drone swarm appears over an airport or when a defense subcontractor reports another fire on a construction fence.