A calibrated provocation. That is the only lens through which to view the incident that unfolded over Lithuania this morning, when Nato jets scrambled to intercept a formation of unidentified drones originating from Belarusian airspace. For those of us who track threat vectors and strategic pivots, this is not a random occurrence. It is a deliberate probe of the alliance's response timelines, a test of the readiness of the Baltic air policing mission, and a clear signal that Moscow continues to exploit the grey zone between conventional warfare and denial of responsibility.
The drones, described by Lithuanian defence sources as 'small, low-observable platforms' likely of the Orlan-10 variant, penetrated Lithuanian airspace near the Suwalki Gap. This is the strategic corridor that connects the Baltic states to Poland, a chokepoint that senior Nato planners have repeatedly identified as the most likely flashpoint for a Russian incursion. The incursion lasted approximately 15 minutes before the UAS (Unmanned Aerial Systems) turned back, having achieved their objective: they were detected, they forced a response, and they collected electronic intelligence on Nato radar coverage and reaction protocols.
The scramble of Eurofighter Typhoons from the Šiauliai Air Base was textbook. Yet the very predictability of the response is a vulnerability. Russian doctrine, as I have briefed in classified settings, is built on the OODA loop (Observe, Orient, Decide, Act). By observing our reaction, they refine their own operational plans. The specific flight paths of the drones, the altitude windows, the electronic signatures they emitted: all of these feed into a data set that will be used to calibrate future, potentially hostile, operations.
Let us be clear about the strategic context. This incident comes 48 hours after the Polish government announced a significant increase in defence spending to 5% of GDP, and coincides with the final phase of Nato's Steadfast Defender exercises. The Kremlin does not believe in coincidence. The incursion is, in effect, a signal: 'We see your exercises. We can reach your airspace. Your reaction times are known.'
Cyber warfare analysts should also pay close attention. Reports from Lithuanian cyber defence units indicate a concurrent spike in probing activity against critical infrastructure networks, including power grid substations and air traffic control systems. This is the classic Russian approach: a physical action in one domain synchronised with an electronic attack in another. The drones may have been collecting geolocation data to validate SIGINT (signals intelligence) gathered from previous cyber intrusions.
What are the material implications? The Baltic air policing mission currently operates with a rotational force of approximately four to six fighter jets. In a genuine crisis, that is insufficient. The Suwalki Gap could be closed by a combined arms battalion in less than six hours. Air defence coverage in the region remains porous against low-altitude slow flyers, a vulnerability that this incursion has once again underlined.
The alliance must now consider a hardening of its air defence posture. This means not merely more fighters, but a layered system incorporating ground-based counter-UAS systems, directed energy weapons, and electronic warfare suites capable of jamming command links. The rhetorical response from Brussels will be measured, but the operational reality is that we are engaged in a live-fire exercise of strategic signalling. The next incursion may not involve drones. It may involve a 'border clarification' by Russian Spetsnaz or a cyber attack that takes down the Lithuanian energy grid.
The chess move has been made. The alliance must now calculate its countermove, and it must do so without the luxury of assuming that Moscow is bluffing.
