Poland and Baltics fortify energy sites over feared Russian false-flag drone attack

Poland and the Baltic states are sharply increasing protection around some of northern Europe’s most strategically important energy and infrastructure assets after intelligence warnings that Russia could stage a false-flag attack using Ukrainian-made drones, potentially creating uncertainty over who was responsible and testing NATO’s ability to respond collectively.

Lithuania has deployed military personnel alongside police to protect its liquefied natural gas terminal, oil infrastructure, a critical electricity connection with Poland and the Kruonis pumped-storage hydroelectric facility. Latvia has increased protection around infrastructure including the Daugava River dam near Riga and the Inčukalns underground gas storage facility, while Polish energy companies are preparing alternative gas-import routes and tightening security around strategically important energy systems.

The measures follow warnings from Lithuanian officials that Moscow may consider using captured or otherwise Ukrainian-origin drones in a staged operation intended to make an attack initially appear connected with Kyiv. Lithuanian Defence Minister Robertas Kaunas said intelligence assessments had prompted stronger protection of critical facilities, while Latvia’s Prime Minister Andris Kulbergs said the probability of a hybrid threat had increased.

Russia denies planning such attacks. Kremlin spokesperson Dmitry Peskov has described warnings about covert Russian operations as scare stories used to justify greater militarisation near Russia, while Moscow has separately accused Baltic governments of allowing Ukrainian drones to use their territory for attacks against Russia. Lithuania, Latvia, Estonia and Ukraine deny those accusations.

The central danger is therefore one of attribution as much as destruction. A drone carrying Ukrainian components or appearing to originate from Ukrainian forces could create uncertainty during the crucial hours after an attack, particularly if the target were a power line, LNG terminal, dam or gas facility inside NATO territory. Regional officials fear that uncertainty could produce exactly the political hesitation an adversary might seek.

Why are Poland and the Baltic states suddenly protecting critical infrastructure from possible drone attacks?

The immediate security escalation follows a series of intelligence warnings about possible Russian hybrid operations and increasingly frequent drone incursions around NATO’s eastern frontier. Poland and the Baltic states share borders or close geographic exposure to Russia and Belarus, while all four governments have strongly supported Ukraine since Russia’s full-scale invasion.

Lithuanian officials have gone further than issuing public warnings. Military personnel were deployed in July to reinforce police protection around the Klaipėda LNG terminal, an oil-products terminal, the LitPol electricity connection with Poland and the Kruonis pumped-storage facility. The selection of those sites reveals the nature of the perceived threat because each performs a strategically important function in Lithuania’s ability to operate independently from Russian energy systems.

The Klaipėda LNG terminal was specifically developed to reduce Lithuania’s former dependence on a single eastern gas supplier and allow natural gas to arrive by sea. Lithuania’s grid has also operated synchronously with continental Europe since February 2025, making interconnections with Poland increasingly important to Baltic electricity security.

Latvia faces a similar calculation. Its government has reinforced protection around the Daugava dam and Inčukalns underground gas storage facility, which is the only operational underground gas storage site in the Baltic states and plays an important role in regional supply security.

What does Lithuania believe Russia could do with captured or Ukrainian-made drones?

Lithuanian intelligence officials believe one possible scenario involves Russia using Ukrainian-made or captured drones to conduct an attack while creating the impression that the aircraft came from Ukraine. Defence Minister Robertas Kaunas described the concern publicly on August 6 and said such a provocation could be intended to weaken NATO cohesion and reduce support for Kyiv.

The intelligence remains an assessment, not evidence that Moscow has made a final decision to carry out an attack. Reuters reported that one Baltic intelligence official believed Russian military and domestic intelligence organisations were examining a possible false-flag operation that could be carried out shortly after approval from senior Russian leaders, potentially including President Vladimir Putin. Another regional official offered a much more cautious assessment, indicating that the warnings were serious but that an actual attack might happen soon, much later or not at all.

That distinction is important because intelligence about possible hostile planning frequently involves scenarios, capabilities and intentions rather than certainty that an operation has been authorised. Poland and the Baltic states are consequently preparing for a threat they consider plausible without claiming publicly that an attack is inevitable.

The fear is heightened by the fact that Ukrainian drones have already crossed unintentionally into NATO airspace during the war, creating exactly the kind of ambiguity a deliberate operation could potentially exploit. Kyiv has attributed some such deviations to Russian electronic warfare systems that jam or spoof navigation signals.

Why could a false-flag attack create a more difficult NATO crisis than an openly Russian strike?

An unmistakable conventional Russian attack on NATO territory would present alliance members with an extremely serious but relatively straightforward attribution problem. A drone carrying Ukrainian components, travelling along an uncertain flight path and striking infrastructure without immediately identifiable operators would create a much more complicated political situation.

NATO’s collective-defence system does not mechanically trigger military action whenever an explosion occurs inside an allied country. Governments would first seek to determine what happened, who was responsible, whether the incident was deliberate and how serious the attack was before deciding on an alliance response.

A false-flag operation could exploit that investigative period. Different governments might initially interpret the evidence differently, while manipulated social-media material, forged documents or coordinated disinformation could deepen uncertainty before forensic analysis establishes the aircraft’s actual origin.

One intelligence official told Reuters that the principal objective of such an operation might therefore be political chaos at NATO headquarters rather than destruction of a particular facility. The calculation would be that ambiguity about attribution could generate disagreement between European members and the United States over whether and how to respond.

That scenario remains hypothetical, but it explains why infrastructure protection and rapid forensic attribution are becoming increasingly connected parts of NATO deterrence.

Why are Lithuania’s LNG terminal and electricity links particularly sensitive targets?

Lithuania spent years restructuring its energy system to reduce strategic dependence on Russia, which makes facilities such as Klaipėda and LitPol Link important beyond their commercial value.

The Klaipėda LNG terminal allows Lithuania and regional customers to import natural gas by sea rather than relying on pipeline supplies from the east. Its operator describes the terminal as infrastructure explicitly developed to safeguard national energy security and diversify gas supply.

Electricity carries similar strategic significance. Lithuania, Latvia and Estonia disconnected from the Russian-controlled electricity system and synchronised with continental Europe in February 2025. Lithuania’s transmission operator Litgrid describes that change as a major step towards energy independence, while LitPol Link with Poland now forms a crucial physical component of the Baltic connection with the continental European grid.

Kruonis pumped-storage hydroelectric infrastructure adds another layer of resilience because facilities of this type help balance fluctuations between electricity generation and demand. Protecting it alongside gas and electricity import infrastructure suggests Lithuania is planning against an operation intended to create cascading disruption rather than merely damage one isolated installation.

An attack would not necessarily need to produce prolonged blackouts to have strategic value. Temporary disruption combined with uncertainty about responsibility could generate political pressure, emergency expenditure and public anxiety while forcing governments to divert military and security resources towards domestic infrastructure.

Why is Poland preparing alternative gas routes and strengthening protection around energy networks?

Poland’s energy system represents another potentially attractive target because the country has aggressively moved away from direct dependence on Russian fossil fuels while becoming an important logistics and energy corridor supporting Ukraine and the wider region.

Reuters reported that Orlen is analysing alternative gas-import routes in case its principal infrastructure becomes unavailable. Around 80% of the company’s imported gas currently arrives through the Świnoujście LNG terminal and an undersea pipeline carrying Norwegian gas to Poland, according to a person familiar with the company’s operations. Gaz-System, which owns major transmission infrastructure, is operating with heightened vigilance.

Poland’s electricity network has also increased protection around an interconnection with Ukraine that helps stabilise the Ukrainian grid. The Polish grid operator and a military unit began strengthening security around that infrastructure in July, and the operator expects military assistance eventually to extend to other critical sites in eastern Poland.

The logic mirrors the Baltic response. Energy assets are valuable not simply because destroying them could interrupt electricity or fuel supplies, but because they connect countries that have deliberately integrated their energy security with Ukraine and Western Europe.

A successful sabotage operation could therefore produce several effects simultaneously: physical disruption, economic cost, political anxiety and pressure on governments to reduce support for Kyiv.

Why have forged documents linked to Poland’s nuclear programme raised additional concern?

The threat environment is not restricted to explosive drones.

Polskie Elektrownie Jądrowe, the state-owned company developing Poland’s first nuclear power plant, has discovered forged company documents intended to confuse stakeholders. The company said the material could be traced to somewhere east of Poland and that it was cooperating with security services and law enforcement while monitoring the planned nuclear construction site for sabotage and other risks.

The episode illustrates how hybrid operations can combine physical and informational methods. A fabricated document may seem less serious than an explosive drone, but convincing false material could disrupt contracts, generate public fears about nuclear safety or create confusion among suppliers and local communities.

Combining misinformation with a physical event could be even more destabilising. False documentation appearing shortly before or after an infrastructure incident might complicate attribution or encourage conspiracy theories while authorities are still establishing basic facts.

That possibility helps explain why Poland and the Baltic states increasingly treat cybersecurity, disinformation, drone defence and physical infrastructure protection as parts of the same security problem.

How do recent mystery drone incidents across Europe change the security calculation?

The difficulty of identifying small drones has already become visible across Europe. Aircraft linked to the Ukraine war have entered the airspace of neighbouring states, while unexplained drone activity around airports and sensitive facilities has repeatedly forced authorities to investigate whether incidents were accidental, criminal or connected with state-backed operations.

Reuters reported that German authorities recently discovered a drone carrying explosives at Leipzig/Halle Airport. German Interior Minister Alexander Dobrindt characterised that incident as a hybrid attack but did not publicly identify who was responsible. Russia has denied suggestions in German political and media discussion that Moscow was behind the incident.

Events like these create precisely the attribution problem northern NATO countries are worried about. Small unmanned aircraft can be assembled from commercially available components, modified repeatedly and operated without the obvious national markings associated with conventional military aircraft.

Forensic investigators may eventually determine where components were manufactured or how software was configured, but those discoveries do not always establish immediately who launched the aircraft. That gap between explosion and attribution can become politically significant during a crisis.

Why has Lithuania accelerated investment in counter-drone and short-range air defence systems?

Lithuania’s response is not limited to guarding individual facilities with soldiers. The Defence Ministry is also seeking additional counter-drone and short-range air-defence technology as the country adapts to the rapidly evolving threat from low-cost unmanned aircraft.

On August 7, Defence Minister Robertas Kaunas discussed potential purchases of counter-drone systems and short-range air-defence equipment with South Korea’s ambassador. Lithuania is examining systems capable of responding rapidly to small aerial threats and has separately sought closer counter-drone cooperation with the United States.

The challenge is partly economic. Using an expensive conventional surface-to-air missile against every small drone would be difficult to sustain, particularly if an adversary deliberately launches inexpensive decoys to exhaust defensive resources.

Countries therefore need layered systems combining radar, electronic warfare, guns, interceptor drones and conventional missiles. Critical facilities such as gas terminals and power plants may eventually require specialised local defence rather than depending entirely on national systems designed primarily to counter aircraft and ballistic threats.

What are the key takeaways from Poland and the Baltic states’ warning over possible Russian false-flag attacks?

• Poland, Lithuania, Latvia and Estonia are strengthening security around critical infrastructure after intelligence warnings that Russia could consider a false-flag operation using Ukrainian-made or captured drones. Russia denies planning covert attacks and says the warnings are politically motivated scare stories.
• Lithuania has deployed military personnel to help protect its Klaipėda LNG infrastructure, oil facilities, electricity connection with Poland and Kruonis pumped-storage plant, reflecting concern about attacks capable of disrupting several parts of the energy system.
• Latvia has increased protection around major infrastructure including the Daugava River dam and Inčukalns underground gas storage facility, with Prime Minister Andris Kulbergs saying the likelihood of a hybrid threat has increased.
• Polish energy company Orlen is assessing alternative gas-import routes, while Gaz-System has increased vigilance around infrastructure carrying LNG and Norwegian gas into Poland.
• Poland’s future nuclear power plant developer has reported forged company documents that it says could be traced to somewhere east of Poland, adding an information-warfare dimension to concerns about physical sabotage.
• Regional officials fear the most disruptive outcome of a false-flag attack could be uncertainty over attribution and political disagreement inside NATO rather than the physical destruction caused by a single drone.
• Intelligence assessments do not establish that an attack has definitely been authorised or will occur. One regional official cautioned that despite serious warnings, an incident could happen soon or never materialise.
• The Baltic response is accelerating investment in counter-drone and short-range air-defence capabilities, with Lithuania discussing additional systems with partners including South Korea and the United States.

Why the real NATO test may begin before anyone knows who launched the drone

The most consequential feature of the warning from Poland and the Baltic states is that the feared operation would be designed around ambiguity. Conventional deterrence works best when governments can identify an attacker quickly, assess the scale of aggression and decide collectively how to respond. A drone carrying Ukrainian characteristics and striking NATO infrastructure could deliberately make each of those steps harder.

That is why the defensive preparations now extend beyond guards around power plants. Lithuania is strengthening counter-drone capability, Latvia is protecting infrastructure that supports regional energy security, and Poland is examining alternative supply routes while security agencies investigate forged documents around its nuclear programme. The common objective is resilience: ensuring that an attack cannot generate a national crisis even before attribution is established.

Russia strongly disputes the premise underlying these preparations and argues that Western governments repeatedly invoke covert Russian threats to justify military expansion. That denial means any future incident would immediately become an information battle alongside the physical investigation, with governments facing pressure to present evidence rapidly enough to maintain public and alliance confidence.

The next major security challenge for NATO’s eastern flank may consequently look very different from the invasion scenario that dominates traditional defence planning. It could begin with a small drone, damaged infrastructure and several hours of uncertainty over who was responsible. Poland and the Baltic states are now preparing on the assumption that those hours could determine whether an isolated incident remains manageable or develops into a much larger alliance crisis.