---

Discussion

Red Velhouse:

Let’s start with Kallas’s warning. She described a recent increase in hybrid attacks, sabotage attempts and airspace violations, although the available reporting does not provide a complete, independently verified incident tally for all of Europe. Ann, what does grouping these events together accomplish politically?

Ann Tofado:

It turns scattered incidents into a policy problem. A drone incursion, cyber operation or suspected act of sabotage can be handled as an isolated case. Presented as a pattern, they justify intelligence-sharing, infrastructure protection, sanctions and continued support for Ukraine. The message is urgent but calibrated: Europe should treat the activity as strategic pressure without claiming that it is already facing a conventional war.

Sofia Jadler:

And “hybrid threat” is a policy category, not a legal verdict. The underlying conduct might involve cybercrime, criminal sabotage, aviation rules, sanctions law or the law governing the use of force. The legal questions remain concrete: what happened, who controlled it and what consequences followed?

Omar Seidren:

That is also the technical problem. Mixed operations can be modular: recruited intermediaries, stolen credentials, cheap drones, malware and information manipulation may be connected through timing, targets or infrastructure. But the pattern has to be demonstrated. A suspicious failure is not automatically part of a cyber campaign, and a border crossing does not reveal intent by itself.

Red Velhouse:

Moldova shows why that distinction matters. President Maia Sandu said Moldova recorded 39 airspace violations in 2026 by September 21, compared with 17 in 2025. Moldovan authorities have also reported drone flights and debris associated with Russian attacks on nearby Ukrainian infrastructure. Omar, what can investigators establish from those incidents—and what remains uncertain?

Omar Seidren:

They can establish exposure more readily than motive. Investigators can classify the object, reconstruct its route, examine debris, determine whether it carried explosives and look for links to a launch or control network. That may separate an attack aimed at Ukraine, a navigation failure or debris from a deliberate probe. Until the evidence is assembled, the same visible event can support very different explanations.

Ann Tofado:

That uncertainty creates a communications dilemma. If leaders qualify every claim, they may appear passive; if they announce certainty before showing persuasive evidence, they risk public trust. It also exposes the unequal cost of resilience. Larger North Atlantic Treaty Organization states can invest in surveillance and cyber defense, while a partner outside that alliance may need outside assistance simply to document and manage repeated incursions.

Sofia Jadler:

And for Moldova, the legal and political questions overlap without becoming identical. Repeated incursions may justify protective assistance and diplomatic action even when officials cannot prove that every flight was a deliberate attack on Moldova. The disciplined position is to respond to the risk while preserving the distinction between an incident, an attribution and a finding of state responsibility.

Ann Tofado:

That distinction matters domestically as well. Moldovan citizens can experience a war next door as a direct security issue even when their government is not a party to the war. Assistance therefore has political value beyond equipment: it shows that smaller partners are not expected to absorb repeated risks alone. But governments still have to explain that support without promising that every incident can be prevented.

Red Velhouse:

Germany offers a more specific case. Authorities attributed an attempted August drone attack at Leipzig/Halle Airport to Russia, said an explosive-laden drone was found near Ukrainian cargo aircraft and announced diplomatic retaliation. Sofia, what does that attribution enable when the intelligence basis remains undisclosed?

Sofia Jadler:

It enables a government to move from ordinary law enforcement toward state-linked consequences: diplomatic measures, coordinated sanctions and warnings to other governments. But an intelligence assessment is not a criminal conviction. Public reporting does not establish that the device detonated or caused casualties, and the underlying evidence has not been fully disclosed. The legal strategy is to make a defensible attribution while preserving room for additional proof and escalation.

Ann Tofado:

That is why public attribution has become a strategic instrument. Governments want to reduce the value of deniability without revealing sources and methods. They are balancing domestic voters, allied governments and Moscow. A credible attribution can build a coalition; an overstated one can make future warnings less persuasive.

Sofia Jadler:

There is also a distinction between the public and private case. Authorities may disclose enough to justify immediate protective measures while withholding details that would reveal sources, surveillance methods or investigative leads. That can be legally sensible, but the more severe the retaliation, the more carefully officials should test whether the undisclosed evidence supports the conclusion.

Red Velhouse:

Omar, what evidence would distinguish a deliberate escalation from dangerous spillover or opportunistic activity?

Omar Seidren:

Look for convergence rather than one dramatic clue: repeated routes or targets, coordinated timing, matching malware infrastructure, recovered control equipment, financial links, recruitment networks or behavior that serves a strategic objective. Those indicators can identify an operator or network. They still may not prove who gave the order, so technical findings are building blocks for attribution, not an automatic answer to the political question.

Sofia Jadler:

And the legal system asks a separate question: whether the conduct can be connected to a state under the applicable standard of responsibility. Governments may act before courtroom-level proof is available, particularly to protect infrastructure or impose administrative sanctions. They should distinguish an intelligence-based conclusion from a judicial finding. That preserves both credibility and legal room to maneuver.

Red Velhouse:

So what can Europe do below the North Atlantic Treaty Organization’s Article 5 collective-defense threshold? NATO says significant cyber or hybrid attacks may qualify as an armed attack, but Article 5 is not automatic.

Sofia Jadler:

The available tools include diplomatic expulsions, asset freezes, travel bans, criminal investigations, defensive measures and coordinated sanctions. The European Union has a framework for restrictive measures against destabilizing activities and has sanctioned individuals and entities tied to malicious cyber operations connected with Russia’s strategic objectives. The advantage is proportionality; the risk is that improvised responses can look like hesitation rather than policy.

Ann Tofado:

The political test is consistency. Sanctioning every incident may make the response predictable but diluted; waiting for perfect evidence may allow deniability to do its work. The European Union and NATO also have different strengths: the European Union can use sanctions, regulation and resilience policy, while NATO contributes military planning and deterrence. A credible strategy has to coordinate those roles rather than treating them as interchangeable.

Sofia Jadler:

Coordination determines whether proportionality looks deliberate or merely hesitant. A government can respond in stages: protect the target, investigate, share an attribution assessment, impose targeted restrictions and reserve stronger measures for evidence of repetition or direction. That sequence does not eliminate uncertainty, but it makes the legal theory of the response visible to allies and potential challengers.

Omar Seidren:

Technology can make that sequence faster. Networked radar, passive sensors, acoustic detection, flight-path analysis and shared incident databases can improve detection and preserve evidence. Cyber monitoring can identify unusual access patterns, and AI may help sort large volumes of information, including foreign information manipulation. None of that is an oracle: false positives around airports or power systems are costly, and automated censorship would be a terrible substitute for judgment.

Omar Seidren:

The hard engineering problem is interoperability, not merely buying more sensors. Countries may record timestamps, flight paths and forensic findings in incompatible formats, or classify information at levels partners cannot access. AI can flag an unusual route or repeated digital signature, but the result matters only if investigators can compare it across borders and preserve a chain of evidence. Otherwise Europe gets many clever alarms and one very lonely database.

Red Velhouse:

European officials also distinguish covert pressure from an imminent conventional attack on NATO. Estonia’s foreign minister said Russia did not appear capable of or prepared for such an assault, while Lithuanian officials warned that hybrid pressure could expand geographically. Ann, how should policymakers hold those assessments together?

Ann Tofado:

By recognizing that different forms of pressure have different costs and purposes. Russia may lack the capacity or willingness for a direct attack while still benefiting from disruption, intimidation and political division. The challenge is to raise the cost of covert activity without describing every incident as the opening move of an invasion. That middle position also matters for Ukraine: if hybrid pressure reduces European willingness to provide support, coercion has achieved a political result without a conventional attack.

Sofia Jadler:

It also preserves legal options. Calling every incident an act of war creates expectations of a military response; treating everything as ordinary crime may ignore state responsibility and collective-security concerns. A disciplined response can identify what is known, impose lawful consequences and reserve further measures if the evidence develops. It is less dramatic than declaring a final legal position, but strategically it is often stronger.

Red Velhouse:

That leaves a practical question for viewers: what should they watch next?

Ann Tofado:

Watch whether governments turn attribution into a repeatable policy rather than a one-off statement: new European Union sanctions, protection for Moldova and other exposed partners, intelligence-sharing and continued support for Ukraine. The political question is whether attention and coalition unity last when incidents remain ambiguous and below the threshold of mass casualties.

Omar Seidren:

Also watch the quality of the evidence. Faster detection, preserved forensic data and secure information-sharing can shape future decisions more than a dramatic announcement. AI can assist with pattern recognition, but humans still determine whether a pattern is meaningful and what response is justified. The glamorous part is often the model; the decisive part is whether institutions can share reliable data before the next incident.

Red Velhouse:

Europe’s challenge is to convert a broad warning into measured, credible action. The key tests are whether investigators produce stronger evidence in cases such as Leipzig, whether Moldova receives practical protection, whether the European Union and NATO coordinate their distinct tools, and whether sanctions, resilience and support for Ukraine can be sustained without uncontrolled escalation. Sources and references for this discussion are available with the episode at Factolio.com.

---

Sources and References

These sources supported the factual material used in this discussion. Factolio’s panel discussion is AI-generated from researched evidence and is written in original language.

1. Reuters, republished by MarketScreener — Russia puts lives at risk across Europe with hybrid attacks, Kallas says (NEWS)
2. Presidency of the Republic of Moldova — Message by President Maia Sandu following the National Security Council meeting (PRIMARY)
3. Moldovan Ministry of Internal Affairs — Three incidents recorded following Russian attacks on Ukrainian port infrastructure (PRIMARY)
4. German Federal Government — Reactions to the hybrid attack at Leipzig/Halle Airport (PRIMARY)
5. Associated Press — Germany blames Russia for attempted drone attack at Leipzig airport (NEWS)
6. Council of the European Union — Council adopts conclusions on advancing the EU’s capacity to counter hybrid threats (PRIMARY)
7. Council of the European Union — Hybrid threats / Russia: EU statement condemning persistent hybrid campaigns (PRIMARY)
8. European External Action Service — EU action on countering hybrid threats (PRIMARY)
9. Reuters, republished by Investing.com — Europeans warn of rising Russian sabotage but see no imminent NATO attack (NEWS)
10. European External Action Service — Exposing Russia’s malicious cyber ecosystem: EU adopts its biggest cyber sanctions package (PRIMARY)
11. European Union — Council Implementing Regulation (EU) 2026/1714 on cyber-attack sanctions (PRIMARY)
12. European External Action Service — Kaja Kallas statement to the European Parliament on Russia’s hybrid attacks (PRIMARY)
13. Council of the European Union — Russia’s hybrid activities: EU sanctions (PRIMARY)
14. Council of the European Union — EU framework for restrictive measures against destabilising activities (PRIMARY)
15. NATO — Collective defence and Article 5 (PRIMARY)
16. European Journal of International Law — Cyber Attribution: Technical and Legal Approaches and Challenges (ANALYSIS)
17. Chatham House — Holding state-sponsored hackers and other cyber proxies to account (ANALYSIS)
18. European Parliament Legislative Observatory — Resolution on hybrid warfare and protection of EU territorial integrity and critical infrastructure (PRIMARY)
19. President of the Republic of Moldova — Moldova’s airspace violations and defense requirements (PRIMARY)