U.S. intelligence: Putin orders wider covert sabotage campaign inside NATO states
U.S. intelligence assessments say President Vladimir Putin has ordered an expanded covert sabotage campaign in NATO countries, starting with a failed explosive-drone attack on Germany’s Leipzig airport and spreading to targets tied to defence suppliers, communications and shipping.
U.S. intelligence agencies believe Russia is stepping up a covert sabotage effort across NATO territory, using drones and other means to probe and disrupt infrastructure far from the front lines in Ukraine.
According to these U.S. assessments, the current campaign began with a failed explosive-drone attack on Leipzig airport in Germany in August. Since then, the effort has widened to include operations against military suppliers, communications infrastructure and commercial shipping linked to NATO states. Russian military intelligence is alleged to be coordinating the activity with the aim of disrupting European support to Ukraine and unsettling vital logistics and energy routes.
The Leipzig case has already prompted unusual contingency planning in Berlin. The Wall Street Journal reported that aides to German Chancellor Merz said Germany would have considered invoking NATO’s Article 5 collective-defence clause if the drone attack had caused mass casualties. That discussion remained hypothetical because the attack failed. Even so, it shows how a single successful strike on civilian infrastructure could quickly force the alliance into an argument over whether an incident qualifies as an armed attack on one member.
Under Article 5, an armed attack against one NATO country is treated as an attack against all, and allies consult on their response. That doesn’t automatically mean military action, but it does open the door to joint measures that can include sanctions, cyber operations or deployments. The fact that aides raised the possibility over an airport incident tied to a drone suggests that the bar for considering such a step is lower than many assumed.
The targets described by U.S. intelligence fit a pattern of pressure on NATO support networks rather than on military units in the field. Military suppliers handle ammunition, spare parts and equipment destined for Ukraine. Communications infrastructure includes fibre-optic cables and switching points that carry alliance traffic. Commercial shipping underpins trade and energy flows. Disrupting or threatening these nodes can slow deliveries, raise insurance costs and inject uncertainty into planning without openly crossing into declared hostilities.
For workers in these sectors, the risk shows up in tightened security at factories, ports and relay stations that previously saw themselves as distant from any battlefield. A fire or explosion that once might have been written off as an accident now has to be examined for possible foreign direction.
Strategically, this kind of campaign operates in the grey zone between peace and open war. Each incident forces governments to decide whether an explosion or drone sighting is simple criminality, a technical failure or state-backed sabotage that might merit an alliance response. A series of events that all stop just short of a clear red line can still produce cumulative strain.
The Leipzig airport episode highlights how quickly that strain can sharpen. Had the explosive drone detonated in a crowded area and killed large numbers of civilians, domestic pressure in Germany for a strong answer would almost certainly have surged, narrowing the government’s room for caution.
Signals that would suggest this covert contest is entering a more dangerous phase include European security services publicly tying more incidents to Russian-linked actors; NATO members revising their guidance on when sabotage of infrastructure could be treated under Article 5; and visible upgrades to protection around airports, arms factories, ports and key communications nodes that now sit within what U.S. intelligence describes as Russia’s expanded target set.
Sources
- OSINT