Testing Article 5: Why Poland and Lithuania Are Warning of Russia’s Next Move

For the Kremlin, according to the Polish assessment, that uncertainty could be the point.

Why NATO's Eastern Allies Are Speaking Publicly

Intelligence warnings are normally most valuable when they remain confidential. Poland and Lithuania are taking a different approach, using public statements to narrow Moscow's room for manoeuvre before any suspected provocation occurs.

Budrys's confirmation matters because it establishes that Warsaw's concerns are shared rather than confined to a single government. Countries hosting allied forces in the Baltic region are working from the same intelligence picture. Their warnings also serve a diplomatic purpose: preparing other NATO governments for incidents that may be difficult to classify in the first hours after they occur.

The timing is significant. On October 26, defence ministers from France, Germany, Italy, Poland and the United Kingdom described Russia as the most acute and enduring threat to Euro-Atlantic security. Their joint declaration specifically addressed airspace violations, sabotage and hybrid operations.

The statement places the concerns of NATO's eastern members within a broader European assessment. It also gives political weight to the argument that relatively small security incidents should not automatically be treated as isolated accidents.

Earlier, on October 5, EU foreign policy chief Kaja Kallas had warned of a sharp increase in Russian hybrid attacks, attempted sabotage and violations of European airspace.

None of these warnings establishes that a particular future strike will occur. Their immediate purpose is deterrence. By describing a possible Russian operation in advance, allied governments hope to make an eventual claim of accidental involvement less persuasive.

That strategy carries a complication. Public intelligence assessments may strengthen allied readiness, but they also raise expectations that governments will respond consistently when an incident takes place.

The Problem With an Attack That Looks Like an Accident

Article 5 of the North Atlantic Treaty is frequently presented as an automatic guarantee of military protection. Its actual operation is more complicated.

An armed attack against one ally is considered an attack against all. Yet each member determines what measures it considers necessary, including whether military force is appropriate. In ambiguous circumstances, establishing the nature of an incident can become as politically consequential as deciding how to respond.

This is the vulnerability Tusk has identified.

A drone that crosses into Poland or Lithuania could be an intentional Russian probe, a malfunctioning aircraft or equipment displaced by electronic warfare. Those possibilities demand different responses, even when the immediate security risk appears similar.

The Baltic states have encountered precisely this difficulty.

On September 15, Lithuanian President Gitanas Nausėda identified a drone entering from Belarus as a Russian Gerbera decoy. NATO intercepted and destroyed the aircraft. Its identification provided a relatively clear basis for assessing the incursion.

Other episodes have proved less straightforward.

Lithuania issued an air alert on October 18 after detecting a suspected drone approaching from Poland. Its defence minister proposed a joint investigation with Warsaw.

Six days later, Latvian forces recovered wreckage from a foreign unmanned aircraft in a forest in the Alūksne region. Investigators suspect it may have entered Latvian airspace during the October 18 alert.

Latvian Defence Minister Andris Sprūds has acknowledged one possible explanation: the aircraft may have been Ukrainian, damaged over Russian territory and subsequently carried into Latvia. Its origin remains unconfirmed, with criminal and military investigations continuing.

Such distinctions are essential. Earlier incidents involving Ukrainian drones or air-defence equipment displaced by Russian electronic warfare have already complicated airspace monitoring across the region.

Treating every unidentified aircraft as a deliberate Russian attack would risk serious miscalculation. Dismissing every unexplained intrusion as accidental could be equally dangerous.

Moscow would not need to resolve that dilemma. It would only need NATO governments to disagree over it.

Eastern Sentry Changes the Military Calculation

NATO's response is increasingly visible in the deployment of aircraft, surveillance systems and air defences along its eastern flank.

Eastern Sentry, launched in September 2025 after repeated Russian drone and aircraft incursions, has developed into a more substantial defensive framework during 2026. Allies are rotating additional fighter jets, airborne early-warning aircraft, refuelling and transport assets, and air-defence systems through the region on four-month cycles.

This marks a departure from an approach centred primarily on air policing.

Traditional air policing is designed to identify and intercept aircraft violating or approaching protected airspace. The threat now confronting NATO is broader. Small unmanned aircraft, decoys and missiles can create multiple simultaneous alerts, while electronic interference complicates efforts to establish their origins and movements.

The additional assets are intended to improve detection, coordination and response. They also provide commanders with more options before an incident develops into a larger confrontation.

Latvia is pursuing its own complementary measures. Its planned integrated drone wall along the eastern border combines radar, interception capabilities and command systems to strengthen protection against low-altitude threats.

The Alūksne investigation illustrates why these investments matter. Determining where an unidentified aircraft originated is only part of the problem. Security authorities must also establish whether it was detected early enough, whether warning systems operated properly and whether neighbouring countries received the information needed to respond.

For Poland and the Baltic states, stronger surveillance is therefore both a military necessity and a means of reducing political uncertainty.

Better evidence cannot eliminate disagreement between allies. It can, however, make deliberate ambiguity harder to sustain.

Europe's Hybrid Incidents Are Becoming a Collective Security Question

The concern extends beyond the Baltic borders.

A collaborative investigation published by the European Broadcasting Union on October 23 examined hundreds of suspected Russian-linked hybrid incidents across 17 European countries between April 1 and October 15.

The investigation did not establish direct Russian responsibility in every case, an important qualification when considering the scale of the threat.

Nevertheless, the range of incidents under examination illustrates how European security concerns have expanded beyond conventional military activity.

Recent reporting by Reuters and Politico has addressed an attack on a merchant vessel in Bulgarian waters, an attempted arson attack against a Polish facility providing Starlink services to Ukraine, a maritime drone near Romanian gas infrastructure and a disrupted plot targeting the chief executive of a German defence manufacturer.

These cases differ considerably in method, location and the strength of available attribution. They cannot simply be treated as components of a single proven operation.

For European governments, however, they present related problems. Protecting military installations is insufficient if infrastructure, commercial shipping, defence industry personnel and communications services are also vulnerable.

The challenge becomes particularly acute when individual incidents appear too limited to justify a major response but collectively impose growing security costs.

A state confronting repeated suspected sabotage must devote investigative resources to each case. Air-defence forces must respond to alerts even when aircraft subsequently prove harmless. Governments must decide how much intelligence to disclose without compromising their sources.

Over time, the burden of maintaining vigilance can itself become a strategic disadvantage.

The Political Threshold Moscow May Be Testing

The Warsaw and Vilnius warnings indicate that frontline governments want NATO to confront this problem before a serious incident forces an immediate decision.

Eastern Sentry strengthens the alliance's ability to identify and intercept threats. Public intelligence disclosures seek to reinforce the political agreement needed to interpret those threats.

Neither measure entirely settles the question of Article 5.

A clearly attributable armed attack would present NATO with a more familiar collective-defence decision. An isolated drone strike involving uncertain responsibility, limited damage and competing explanations could generate a prolonged dispute over whether the treaty's threshold had been crossed.

That dispute is precisely what Tusk believes Russia may seek to provoke.

There is a further difficulty. NATO must preserve the distinction between genuine accidents and hostile operations while ensuring that an adversary cannot exploit that distinction indefinitely.

The stronger military presence along the eastern flank may make incursions more difficult. It does not automatically determine how 32 governments will respond to a contested event.

Poland and Lithuania are attempting to address that political vulnerability through warning, shared intelligence and a common description of the threat. The October 26 declaration by Europe's five major defence powers gives that approach wider support.

Yet a future incident could still leave allied governments facing conflicting evidence, pressure for an immediate response and concern about escalation.