The failure of isolated incident responses
In July 2024, an incendiary package caught fire at Leipzig airport on July 20, followed by similar incidents in Poland and the U.K. over the next two days. German security authorities did not issue a wider warning to the aviation and logistics sectors until August 28, more than five weeks after the first incident. This delay illustrates the advantage Russia gains when individual incidents are treated separately rather than as parts of a broader campaign. The subsequent investigation established links between these incidents and a broader Russian sabotage campaign that exploited regional security vulnerabilities.
| Location | Date of Occurrence | Context |
|---|---|---|
| Leipzig airport | July 20, 2024 | Incendiary package fire |
| Poland | July 21-22, 2024 | Similar incidents |
| United Kingdom | July 21-22, 2024 | Similar incidents |
| German aviation | August 28, 2024 | Delayed sector warning |
Determining responsibility can take weeks, and governments may differ in their assessment of the available evidence as well as their opinion on the appropriate reaction. Before responsibility is confirmed, political attention may shift elsewhere, giving Russia a strategic advantage in this gray zone. Moscow can carry out a long-term campaign while European states deal with individual incidents one by one. European governments need to evaluate individual incidents in a broader context and together because a cyberattack, sabotage, or an attempt to infiltrate an intelligence network is a full-blown hybrid campaign targeted against European countries. Europe must become a harder and, above all, much more expensive target for Russia.
Changing the Kremlin’s calculation
Europe can protect its societies by improving the ability of its intelligence and security services to identify hostile networks and coordinating accountability better. European officials have grown accustomed to scenarios where a cyberattack disrupts public services and critical infrastructure, drones appear over sensitive sites, and a flood of misinformation on social media exploits societal uncertainty. European governments then investigate, share information, and release statements until another incident elsewhere grabs the headlines again. This approach is obviously not enough because Russia is confident that the cost of these hybrid attacks is a bargain, especially as consequences look spectacular in Russian intelligence reports. Repeated operations consume European resources, reveal weaknesses, and test how far Europe is willing to go.
European governments should prepare a credible set of possible consequences before another serious incident occurs. Russia does not need to know exactly what Europe will do in every situation, as strategic ambiguity has value, but Moscow must believe that Europe will respond and that the consequences will matter. If Europe allows Moscow to set the pace, future generations could rightfully ask why countries with much greater economic resources than Russia repeatedly allowed such pressure. European countries should have a set of possible responses ready that can be adapted to specific cases. If we add up the various forms of pressure Russia has exerted on European countries in recent years, future generations could rightfully ask why Europe tolerated so many things without developing a more systematic response. The main goal is to change the adversary’s calculation. Russia must ask how much an operation will cost if Europe uncovers it and holds Moscow responsible.
