Read the full article

The absence of an intermediate defense layer in Europe's defense architecture leaves its critical infrastructure defenseless against aggression

In December 2025, Poland's power grid was attacked with data-destroying malware. The target was the communication link between renewable generation facilities and distribution operators — according to Warsaw's assessment, roughly half a million peopl e could have been left without electricity in the middle of winter.

Europe's official response came on July 13, 2026, in the form of a sanctions list covering 24 designations. Seven months elapsed between the attack and the response, and during that time not a single military mechanism was activated. This was not a breakdown of procedure — it was the procedure.

The Polish case is valuable precisely because it is so well documented. The UK and the EU named the perpetrator — FSB Center 16 — and the tool — the DynoWiper wiper malware — and the result of that attribution was sanctions against 24 individuals and entities , including three GRU leaders. All of this came seven months after the event itself.

Sweden followed the same path. In April 2026, Civil Defense Minister Carl-Oskar Bolin disclosed only in April 2026 that a destructive attack on a thermal power plant had been attempted in early 2025, explaining that the attack had been stopped by a built-in protective mechanism, not by an external response. His phrasing is worth noting: groups that had previously limited themselves to denial-of-service attacks had moved on to destructive operations against European facilities.

In general, the International Institute for Strategic Studies recorded an almost fourfold increase in attacks on critical infrastructure compared with 2023 — arson, damage to undersea cables, GPS jamming, and intrusions into operators' networks. Carnegie, in its July analysis, adds an Estonian episode to this picture: Russian-language social media and Telegram channels have been systematically amplifying the symbols and narratives of a “Narva Republic,” while discussions in Moscow have explored expanding the legal grounds for the use of force abroad to “protect” a persecuted population.

The question of why sabotage against a power plant fails to trigger any defense mechanism has an uncomfortably simple answer: nobody wants to be the first to call it an attack.

CEPA analysts conducted a tabletop exercise in April 2026 based on a scenario of hybrid interference with civil aviation.

The participants reached a conclusion that is hard to dismiss: even with civilian casualties, activating collective defense would run into three barriers — uncertainty over attribution, fear of setting a precedent, and political risk. Article 5 remains legally accessible and politically unreachable.

Formally, the alliance acknowledges this. Elisabeth Braw, in an assessment for the Atlantic Council, states directly tha t NATO is not responsible for defense against threats below the threshold of war — that responsibility lies with individual states. Her proposal is to create a coordination center for sharing gray-zone response practices. The very framing of the question shows the scale of the problem: what is being discussed is not a capability, but a venue for discussing a capability.

The Ankara Declaration, adopted on July 8, 2026, mentions hybrid threats exactly once — in a list of characteristics of the security environment, alongside "periodic shocks." The term “gray zone” does not appear in the text at all. The document, which reaffirms an ironclad commitment to Article 5 and records €70 billion in military aid to Ukraine for 2026, offers no separate framework for the class of actions that now occurs with alarming regularity.

Since the defense layer stays silent, the layer that is available takes over: law enforcement. And it is operating quite actively.

An OCCRP investigation revealed the mechanics of bottom-up recruitment: a Telegram bot linked to a channel with an audience of hundreds of thousands distributes assignments ranging from surveillance and arson attacks on military facilities to, in extreme cases, murder, with payment in cryptocurrency upon completion.

The going rate for arson reached as high as $10,000. The people carrying out the tasks are mostly local residents with no connection to Russian intelligence services beyond the chat itself. In Estonia, dozens of people have been detained in such cases, while in Latvia, Poland, and Germany cases have resulted in convictions.

The second tool is sanctions. The EU introduced its regime of restrictive measures against destabilizing activities on October 8, 2024 ; by 2026, the lists covered 80 individuals and 20 entities, and in May 2025 the regime's scope was extended to tangible assets — vessels, aircraft, real estate, and network infrastructure. The regime has been extended through October 9, 2026.

Both tools a common property: they are retrospective and personal. A criminal case establishes who is guilty after the event. A sanctions decision does the same thing, only more slowly and at a higher level. Neither one changes how the system itself behaves at the moment of impact — whether the substation keeps operating, whether anyone detects a drone over the facility, whether traffic across the bridge resumes by the end of the day. Europe has built a solid procedure for punishment but has not built an equally robust procedure for endurance.

This gap is most visible in the project that was supposed to close it. European Commission President Ursula von der Leyen announced the "drone wall" in September 2025. Ulrike Franke of the European Council on Foreign Relations stated on July 27, 2026: there is no coordinated detection line along the eastern border, and European counter-drone capabilities are largely absent from where they're actually needed.

The list of what happened over these months speaks louder than any assessment. Lithuania's president and prime minister had to take shelter over a drone above Vilnius. In Latvia, ministers resigned over the inability to respond. Romania recorded more than 40 airspace violations in the first half of 2026, and in May a drone struck a residential building in Galați — two people injured, seventy residents evacuated, the first civilian casualties on NATO territory.

The problem isn't technology. In January 2026, Poland signed a €3.5 billion contract for a national counter-drone system: 52 fire platoons, 18 command platoons, 703 vehicles, with initial readiness by the end of 2026 and full readiness by 2027. This proves that the equipment exists and can be procured. But the Baltic consortium's application for funding through the SAFE mechanism was rejected in March 2026, and the planned four-thousand-kilometer joint line has remained nothing more than a presentation.

The difference between Poland's contract and the European wall isn't a matter of engineering — it's administrative: the EU has no procedure that turns money into deployed capability faster than the adversary can change tactics.

On the night of August 9, 2026, a Russian strike damaged the bridge over the Dniester at Maiaky on the M-15 Odesa–Reni highway. The Border Guard Service reported a temporary traffic restriction on a specific section; Moldovan customs switched two checkpoints to entry-only mode, leaving one alternative checkpoint open for exit, and multi-kilometer lines built up on the approach roads. Traffic was partially restored at 10:40 a.m.

The Institute for the Study of War assessed the strike as a shift in targeting from the maritime export corridor to the overland one — specifically aimed at halting grain shipments through the Danube ports and onward to Romania.

Europe has air defense, and it has police. What it lacks is what sits between the two. Ukraine built that layer not by design, but out of necessity.

Its foundation is distributed surveillance. The Sky Fortress acoustic network comprises roughly 14,000 sensors; a single node costs between $400 and $1,000, and the entire network costs less than two Patriot batteries. Up to 20% of targets entering the airspace are tracked using acoustic data alone, which is then fused with radar data and sent to the tablets of mobile units.

Attempts to alter the sound signatures of drones have reduced detection accuracy by only 3%. Romania is testing the system — for now as a national experiment rather than as part of a shared European architecture.

The logic here is the opposite of what governs European defense procurement. A cheap sensor doesn't need a ten-year cycle, a consortium, or coordination with industrial policy. It needs a decision to deploy it.

The second element is firepower. According to Ukraine's Ministry of Defense data, as of early May 2026, 194 units had recorded confirmed Shahed kills using interceptor drones, and since the start of the year the troops had received twice as many of these systems as they had received during all of 2025. This is not a separate elite capability but a distributed, mass-scale defensive layer in which the critical resource is not the missile itself, but the link between the sensor and the crew.

This is precisely the layer that Ukraine is now offering to its partners. The Drone Deal program, whose expansion President Volodymyr Zelenskyy outlined on April 21, 2026, envisions joint production, the construction of facilities abroad, and technology transfer; participants include Germany, Italy, Norway, Sweden, and the Netherlands, as well as Gulf states with ten-year agreements.

The president's clarification that “these are not offensive operations” is not rhetorical here but descriptive: what is actually being exported is the capacity to protect infrastructure against massed strikes — that is, precisely the intermediate layer that Europe's architecture lacks.

The third element is the least visible and the hardest to replicate, because it isn't hardware — it's a time standard. In the first half of 2026, the company DTEK restored more than 1,700 facilities as well as 1,487 power lines totaling nearly six thousand kilometers — 83% of all damaged lines. Counting repeated restorations after new strikes, power was restored to 14.5 million households.

Behind this lies an unglamorous administrative machine. The State Energy Supervision Service reports that since the start of 2026 alone, its commissions have inspected nearly 300 damaged energy facilities and drawn up 12,600 defect reports, and that more than ten thousand such inspections have been conducted since the start of the full-scale invasion. A defect report isn't a document filed away in an archive — it is operational input for planning materials, crews, and the sequence of repair work.

Resilience of this kind is not a budget line for infrastructure, nor a communications campaign the population's readiness. It is operational discipline: who deploys, within how many hours, with what stock of equipment, and on whose decision.

An idea that is now gaining traction in European discussions is graduated automatic consequences: a pre-defined package of measures that is triggered by the fact of an incident, without a separate round of political bargaining each time. Carnegie proposes exactly this approach, along with the creation of a hybrid operations cell for the eastern flank.

The problem is that automaticity has two preconditions, and both of them are operational. The first is rapid attribution, since a consequence cannot be triggered until the source has been established. The seven-month delay in the Polish case is not merely a legal complication — it reflects the absence of a system capable of operating at the tempo of the event itself. The second is that the target has to withstand the strike itself; otherwise, the automatic response merely documents a loss. Without these two conditions, graduated consequences will speed up not protection, but the issuing of a sanctions letter.

The Estonian episode shows where delay leads. The "Narva Republic" narrative doesn't need missiles or saboteurs — it only needs time, and a system in which every episode produces an investigation rather than an immediate defensive capability.

If Moscow does indeed expand the legal grounds for "protecting" its compatriots, what will prove decisive will not be the text of Article 5, but whether Europe's system can withstand the first wave of strikes on its infrastructure without being paralyzed.

Europe's discussion is still built around thresholds: what counts as an attack, when to activate collective defense, which incident merits consultations. That's a conversation law. Ukraine's answer to the same question lies in a different plane entirely: the layer between air defense and the police is not built through a decision a threshold, but through a decision tempo — how much a sensor costs, how many minutes it takes for a unit to deploy, how many hours it takes to restore traffic across a bridge.

These parameters require neither the consensus of 32 states nor a new article in a treaty. They require recognition that defense against what is already happening in Europe is measured not in declarations, but in hours.

Ihor Petrenko, Founder of the United Ukraine Think Tank, PhD in Political Sciences