Following airport closures and site overflights, NATO is strengthening its C2 and C-UAS capabilities. Investigation into the maritime shadow and the allied response.
Summary
In September, Europe experienced a series of coordinated incidents involving drones over airports, energy sites, and military infrastructure in northern Germany and Denmark. Copenhagen Airport was closed for nearly four hours, with around 50 flights diverted and tens of thousands of passengers affected. At the same time, the French Navy boarded the oil tanker Boracay (formerly Pushpa) off the coast of Saint-Nazaire, suspected of belonging to the Russian “shadow fleet,” while the ship’s AIS had been cut off several times. These events come on top of the incursion of around 20 drones into Poland, the violation of Estonian airspace by MiG-31s, and the alert in Romania. Faced with this pattern of hybrid pressure, NATO is accelerating the integration of NATINAMDS, strengthening Air Policing, and rolling out more agile C-UAS capabilities. The challenge is clear: to maintain collective deterrence through rapid C2, better sensor fusion, and seamless civil-military coordination.
Overview of incidents and operational timeline
The series of alerts unfolded according to a pattern of saturation: first, nearly twenty aircraft entered Polish airspace on September 9-10, triggering a scramble and, in an unprecedented move for the Alliance, firing on unmanned aerial targets. On September 13, an alert was also issued in Romania, in the Danube area, when a drone crossed the border. On September 19, Estonia reported the intrusion of three MiG-31s that remained for about twelve minutes over Vaindloo, without a flight plan or transponder, prompting a meeting of the North Atlantic Council. Starting on September 22, a series of incidents involving drones disrupted the Nordic skies: temporary closure of Copenhagen (approximately 4 hours), technical stops at other Danish and Norwegian platforms, then a proliferation of echoes and sightings over German infrastructure in Schleswig-Holstein and Mecklenburg-Western Pomerania. In Kiel, the flyovers affected highly sensitive areas: the TKMS shipyard (submarines), a university hospital, a coastal energy site, and the Nord-Ostsee-Kanal canal. Further east, repeated sightings took place near the Navy command in Rostock and the port, while the Heide refinery, which supplies Hamburg Airport, was also mentioned in the reports. This timeline paints a consistent picture: repeated tests of reactions, observation of dual-use (civil/military) sites, and targeted disruption of air traffic. It reinforces the theory that the operators are experienced, equipped with medium-sized platforms, and capable of exploiting the “blind spots” of conventional surveillance.
Civil-military relations and the impact on commercial aviation
Airport closures remain the most visible indicator for the public. In Copenhagen, the suspension of air traffic for approximately 240 minutes led to the diversion of nearly 50 flights and disrupted the travel plans of some 20,000 passengers. Technically, the decision is simple: as long as a drone’s trajectory remains undetermined, the integrity of IFR trajectories cannot be guaranteed, hence the decision to freeze traffic. In terms of network management, EUROCONTROL’s Network Manager can reallocate slots and redirect traffic flows, but every minute lost translates into additional taxiing, fuel consumption, and delayed turnarounds. The other, less talked about effect is the mobilization of air traffic control resources: the CAOCs in Uedem and Torrejón supervise requests for assistance, temporary airspace restrictions, and the activation of specific zones to intercept without threatening civil traffic. For air navigation services, the interface with the armed forces is based on the Flexible Use of Airspace doctrine: TSA/TRA volumes are opened and closed according to tactical needs, with agile publication. Feedback from the Danish incidents shows the value of multi-sensor spectral detection around hubs, shared ATC/forces alerts, and standardized procedures for moving from a “probable” alert to a “confirmed” alert without overreacting. At the European level, effective civil-military coordination is measured in minutes: less than 10 minutes to qualify the echo; less than 30 minutes to stabilize a reconfigured network flight plan; less than 60 minutes to restore a movement rate close to nominal once the threat has been averted.
The maritime route, screen ships, and AIS cut
The seizure of the oil tanker Boracay (formerly Pushpa) by the French Navy off the coast of Saint-Nazaire has turned the spotlight on the “shadow fleet”: misdeclared ships, changes of identity and flag, opaque itineraries, and practices to circumvent sanctions. The Boracay was carrying approximately 750,000 barrels (≈ 119,000 m³) of crude oil, equivalent to more than 119 million liters, while at times having disabled its AIS transmissions. The suspicion is simple: a ship stationed near air routes and strategic sites can host antennas, serve as a data relay, or even as a launch/launching base for assisted take-off platforms. The fact that Copenhagen was disrupted while suspicious maritime traffic was crossing the North Sea and the Baltic Sea fuels the hypothesis of “sea-air” synchronization. There are counterarguments: the short range of commercial multicopters, their sensitivity to coastal winds and rain, and the need for precise guidance to avoid suppression zones. But these limitations disappear when modified systems are considered: fixed-wing carriers, hand-launch, discrete radio frequencies, directional antennas, and inertial navigation coupled with visual landmarks. At sea, detection is more difficult: the electromagnetic noise of dense traffic better masks emissions, and the distance from the coast reduces the density of land-based sensors. The most telling weak signal remains the shutdown of AIS near sensitive areas; this is never proof in itself, but becomes conclusive when it coincides with aerial anomalies.
The operational response: NATINAMDS, Air Policing, and C-UAS
On the ground, the Alliance is strengthening its passive (RF, EO/IR, acoustic) and active (low-speed/high-frequency radars) detection networks around hubs and strategic sites. In the air, Air Policing remains the everyday tool: 24/7 QRA, scramble coordinated by CAOCs, and systematic warning of non-cooperative aircraft. Below the radar, efforts are focused on C-UAS: multi-sensor detection, probabilistic identification, and graduated neutralization (directional jamming, net capture, C-UAS laser, kinetic effects under safety constraints). Target times are now quantified: < 5 minutes to confirm contact, < 10 minutes to engage in non-lethal neutralization in airport areas, < 20 minutes for kinetic action in militarized areas (excluding third parties). On the C2 side, the objective is to merge sensors into an immediately actionable Recognized Air Picture, with automatic correlation and a single track. Integration with NATINAMDS ensures ground-to-air continuity and coordination with higher layers (AWACS, naval sensors, ground-to-air defense radars). Recent incidents have provided concrete indicators: rate of merged tracks without human intervention, correlation latency, false alarm rate, and “plan-to-action” time for response teams. It is unrealistic to expect perfect security; the real performance criterion becomes the speed of observation-decision-action, including when the adversary seeks to saturate the system with clusters of slow and difficult-to-observe objects.
Strategic consequences: hybrid risk and collective deterrence
Politically, the increase in overflights and incursions is aimed as much at perception as at the balance of power. Closing a major European airport for four hours does not cause major material damage, but instills the idea of widespread vulnerability. The Alliance cannot be content with a defensive response; a credible response requires a combination of controlled transparency (factual information on incidents), targeted reinforcement (patrols, deployable radars, AAW frigates for cover), and costs imposed if attribution is confirmed (logistical sanctions on ships linked to the “shadow fleet,” seizures, port restrictions). On the military front, the Baltic states requested consultations under Article 4 after the MiG-31 episode. On the doctrinal side, air force chiefs have, since 2024, made AirC2 modernization a top priority: automated operations plans, more streamlined operator interfaces, network cybersecurity, and an exercise-feedback learning loop. The figures speak for themselves: more than 400 alert takeoffs were recorded last year around the European theater, with the trend remaining stable in early 2025. The next step is clear: consolidate the chain of evidence (sensors, imagery, RF traces), improve attribution within political deadlines, and show that hybrid coercion does not “pay.” Capitals that deny the link between air incidents and screen ships are missing the point; the real question is how quickly a European coalition can neutralize clandestine assets while maintaining freedom of civil overflight. It is on this ability to deal with ambiguity that the strength of collective deterrence will be judged.
Live a unique fighter jet experience