As drone incursions to NATO rise, alliance keeps treading carefully

A drone came down in Romania on Thursday, the latest of dozens of incursions into allied airspace this year. The alliance’s documented response points towards hardened national defences rather than any wider role in Ukraine as it battles Russian forces.

A drone crossed into Romanian airspace about 13 km east of Galați at 03:21 on Thursday 20 August and crashed three minutes later in an uninhabited area roughly 4 km north-east of Grindu, in Tulcea County, according to the Romanian Ministry of National Defence. Two Spanish Air and Space Force F-18s on NATO air policing duty and a Romanian IAR-330 SOCAT helicopter were airborne; a RO-Alert warning went to residents at 03:20; the air alert ended at 03:52. No casualties or damage were reported.

The ministry did not state the drone’s origin. European capitals are asking whether the accumulation of incidents of this kind is pushing NATO towards a broader military role in eastern Europe and Ukraine, or away from one.

The evidence available today points to the second answer, and for reasons that have less to do with resolve than with attribution, capacity and American policy.

The pattern is documented

Romania’s figures establish the scale. of incursions. In a press release dated 30 June 2026, the defence ministry recorded more than 100 Russian attacks on Ukrainian targets near the Romanian border since 2022, and 29 unauthorised incursions of Russian drones into Romanian airspace. A ministry statement in late July put the 2026 figure alone at 18 incursions.

The tempo has since sharpened. Romanian F-16s shot down drones on 24, 25 and 26 July — the first interceptions of the war by Romanian pilots — after which Bucharest summoned the Russian ambassador and expelled a Russian diplomat. On 16 August a Spanish F-18 destroyed a drone that had entered from Moldova about 24km north of Galați, the fourth downed over Romania this year. In late May, a Geran-2 drone struck an apartment block in Galați and injured two people.

Poland’s record is similar. On 30 July an object Prime Minister Donald Tusk described as almost certainly a Russian Kh-101 cruise missile crashed near Tarnawa-Kolonia in Lublin province, leaving a crater about 10 metres across. Moldova, which is not in NATO, logged three airspace incidents in nine days to 18 August, including an explosion in a cornfield near Tălmaza.

Alongside this is another category. The International Centre for Counter-Terrorism has attributed at least 151 hostile operations in Europe to Russia since February 2022, counting only cases where completed investigations permit confident attribution. On 13 August, Tusk said Polish services had detained a Russian citizen on 7 August who had been recruited to kill a dual American-Ukrainian national in Warsaw — the first such plot against a US citizen on NATO territory, he said. Two days earlier, a Congressional Research Service report catalogued sabotage, assassination, GPS jamming and airspace violation as a single campaign.

Salami slicing works

The tactic’s defining feature is that each slice is individually deniable and individually insufficient to justify a response. The Congressional Research Service describes this as exploiting “the escalation gap” — deliberately blurring war and peace to constrain the target’s options.

The recent Italian ammunition plant explosion is another example of ambiguity. Maybe it was an accident, maybe not. But one that could serve Russian interests. A fire in the powder-pressing department at KNDS Ammo Italy’s Colleferro plant, near Rome, was followed by a large explosion on 13 August. Around 24 workers were on site; none were hurt. The Velletri prosecutor’s office opened a file against persons unknown, and Italian reporting indicates investigators have since examined possible links to an explosion at an arms plant near Belica in Bulgaria three days earlier. Defence Minister Guido Crosetto said on 17 August that nothing indicated anything other than an internal problem at the plant, adding that there was no need to invent blame for a state already conducting hybrid warfare. Opposition politicians Carlo Calenda and Filippo Sensi have asked the government to report to parliament.

Nothing has been established.

What the alliance has actually built

NATO’s institutional answer to the September 2025 Polish incursion was Operation Eastern Sentry, launched on 12 September 2025 with no end date, pooling allied fighters, air defences and counter-drone systems from the High North to the Black Sea. It was explicitly confined to NATO territory. The European Union’s parallel projects, the European Drone Defence Initiative and Eastern Flank Watch, target initial operating capability by the end of 2026.

All are about defensive hardening inside allied borders. None extends help to Ukraine.

The trend at national level runs the same way. Romania legislated in 2025 to permit shoot-downs; Lithuania authorised peacetime engagement; six European allies have declared they will use force to defend their airspace. Authority is being pushed down to capitals, not up to Brussels.

Three constraints on any wider role

The first constraint on NATO is threshold discipline. Poland’s response to 19 drone incursions in September 2025 was Article 4 consultation, not Article 5. Romania was reported in May 2026 to be considering Article 4. NATO has stated that hybrid attacks could in principle trigger Article 5, but the practice has been consistent: consult, reinforce, decline to characterise incidents as armed attack.

The second is Washington. The 2026 US National Defense Strategy describes Russia as a “persistent but manageable threat to NATO’s eastern members” and assigns European allies primary responsibility for Europe’s conventional defence. In October 2025 the United States ended the rotation of a brigade with elements in Romania, Bulgaria, Slovakia and Hungary, cutting its Romanian presence from about 1,700 troops to roughly 1,000. The chairs of both congressional armed services committees opposed the decision. Secretary General Mark Rutte publicly played it down.

The third is arithmetic. Overnight into 20 August, Russia struck Kyiv and the surrounding region with ballistic and cruise missiles and drones, killing at least 14 people by Thursday morning and damaging a children’s hospital and a school; officials revised the toll upwards during the day. Ukraine’s air force reported 168 drones and 46 cruise or air-to-ground missiles, and stopped publishing ballistic missile counts earlier in the month. President Volodymyr Zelensky attributed the casualties to a shortage of Patriot interceptors, scarcer since the Iran war. An alliance that cannot resupply Ukraine’s existing air defences is not positioned to extend its own umbrella over Ukrainian territory.