On the night of May 29, two Russian drones crossed into Romanian airspace, flew roughly 18km (11 miles) into NATO territory, and struck a residential building in the city of Galați. Two people were injured, and a large fire swept through the neighborhood.
The incident was reported as an accident, an unintended consequence of Russian strikes on Ukrainian Danube ports located close to the border.
But focusing solely on the intent, or its absence, in individual events risks missing the bigger picture. The incident was only the latest in a growing series of “accidents” in which Russian military activity has spilled onto NATO territory since the 2022 full-scale invasion of Ukraine. The larger picture reveals a Kremlin now so busy launching attacks that lethal consequences against NATO member states are inevitable, and accepted as a reasonable risk by Russian leaders.
Romanian authorities have recovered Russian drone debris on multiple occasions, and Romanian and NATO fighter jets are regularly scrambled during Russian attacks near the border. Romanian intelligence has also warned of Moscow-linked sabotage and hybrid operations aimed at testing critical infrastructure and probing NATO defenses.
And Romania isn’t alone. Poland has seen repeated missile and drone incursions across its border, some of which have resulted in casualties and at least one of which was so large that it amounted to a substantial military attack. The Baltic region has also faced GPS jamming, drone incursions, and other forms of interference affecting civilian aviation and maritime traffic.
Across Europe, authorities have uncovered sabotage networks, plots targeting infrastructure, and other hybrid activities linked to Moscow. While each case is usually discussed separately and often explained by its own unique circumstances, together they point to a broader pattern of shadow warfare.
The Kremlin has spent years operating below the threshold of conventional conflict. Rather than openly confronting NATO, it has relied on sabotage, cyber operations, disinformation campaigns, disruption of democracy, border probes, airspace violations, infrastructure disruption, and covert activity.
The objective is not necessarily to cause immediate strategic damage. It is often to test reactions, expose weaknesses, create uncertainty, and normalize behavior that would previously have been considered unacceptable.
Statements by senior Russian officials have reinforced this, making debates over whether the incidents are intentional or accidental secondary to the broader pattern of behavior.
After the Galați incident, for example, Dmitry Medvedev, former Russian president, prime minister, a Putin confidante, and deputy chairman of the Russian security council, warned EU citizens that their governments had “unilaterally entered into a war with Russia” and they should not be surprised by such developments.
Such rhetoric supports an increasingly open Kremlin narrative that confrontation with Europe is both inevitable and already underway. It also supports those in the West warning that the Kremlin is engaged in a campaign rather than clumsily causing a series of mishaps.
Yet NATO still lacks a clear framework for responding to Moscow’s provocations. Some incidents result in diplomatic protests, others lead to sanctions, investigations, or military deployments, but responses vary significantly from country to country.
While member governments increasingly acknowledge the existence of Russian hybrid threats, there is no widely accepted mechanism linking a particular category of hostile action to a predictable alliance response.
NATO is being urged to stop treating sabotage of infrastructure, drone “accidents,” and cyberattacks as distinct security issues. Instead, it should recognize them as interlocking elements of Russia’s shadow warfare and develop a more decisive, unified, and coherent framework for response.
The task is not simply to react to individual provocations, but to understand how they fit into a broader pattern of Russian shadow warfare and the response they should trigger.
The Center for European Policy Analysis (CEPA) has proposed an escalation ladder, which seeks to match different categories of hostile activity with corresponding political, economic, intelligence, and military measures.
The value of such an approach would be to establish predictability, so each incident receives a clear response set out in advance to warn Russia. It would ensure Russian action doesn’t either go unanswered or escalate into an unpredictable crisis.
Russia would understand that certain actions automatically generate specific costs, NATO governments would no longer have to improvise responses on a case-by-case basis, and, most importantly, individual incidents would be viewed as part of a broader campaign rather than disconnected events.
The response to incidents like Galați would not focus on whether Russia had intentionally targeted Romania, but on how it fits into a larger pattern of Russian shadow warfare.
NATO’s response requires more than expressions of concern but a coherent framework capable of deterring the next violation before it occurs.
Sofia Slonovska is a CEPA Editorial Intern and a graduate of Bard College Berlin, where she studied politics, economics, and social thought. Ukrainian-born, her research interests include European security, Russia’s war against Ukraine, and transatlantic relations.
Europe’s Edge is CEPA’s online journal covering critical topics on the foreign policy docket across Europe and North America. All opinions expressed on Europe’s Edge are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict intellectual independence policy across all its projects and publications.
