Lithuanian intelligence believes Russia may use captured or reconstructed Ukrainian unmanned aircraft in attacks against Baltic infrastructure. Such an operation would combine a kinetic strike with electronic deception, contested attribution and pressure on NATO’s decision-making process.

Lithuania’s warning that Russia may stage attacks with Ukrainian-made drones identifies a practical vulnerability in NATO’s defence of the Baltic region: intercepting an aircraft does not automatically establish who launched it, who controlled it or which state ordered the operation.

Lithuanian Defence Minister Robertas Kaunas said on 6 August that national intelligence services believed Russia was considering using captured Ukrainian drones in false-flag provocations against the Baltic states.

Kaunas said one objective would be to make NATO hesitate and reduce its support for Ukraine. No target, timetable or detailed plan was disclosed, and the warning does not establish that Russia has approved an operation.

The scenario is nevertheless operationally plausible. Russian forces have captured Ukrainian unmanned aircraft, components and ground equipment during more than four years of full-scale war. A recovered airframe could be repaired, reconstructed or used as the basis for a vehicle retaining recognisable Ukrainian characteristics.

The principal advantage would not be technical sophistication. It would be the ability to complicate attribution during the period immediately following an attack.

A drone can carry more than one identity

The physical origin of an airframe is not the same as the identity of its operator.

Investigators examining a recovered drone would need to consider its components, explosives, navigation data, communications equipment, modifications and software. Radar tracks, electronic-intelligence records, satellite data and intercepted communications could help establish its route and probable launch area.

A captured aircraft could also be fitted with a different payload, navigation package or control system while retaining parts associated with its original Ukrainian manufacturer. The result might be an inconsistent technical picture rather than a convincing replica of an ordinary Ukrainian mission.

That might still be sufficient for a hybrid operation.

Russia would not have to maintain the deception after a full forensic examination. It would need to create uncertainty during the first news cycle, when images of wreckage and official statements are incomplete.

The problem has become more acute because genuine Ukrainian drones have already crossed NATO borders. A series of incidents since March has affected Estonia, Latvia, Lithuania and Finland.

Ukraine has attributed several deviations to Russian electronic warfare, including satellite-navigation jamming and spoofing. The aircraft had generally approached NATO territory from Russian airspace while travelling towards targets connected to Russia’s Baltic energy and transport network.

In May, one suspected Ukrainian drone exploded near an oil storage facility in Latvia. Another was destroyed over Estonia by a NATO fighter. Lithuania issued an air alert after an unidentified aircraft approached Vilnius, forcing the suspension of airport and rail operations and sending members of parliament into shelter.

Defence Matters has previously reported on Ukraine’s offer to provide counter-drone expertise to Baltic partnersfollowing the Latvian incidents. Those cases showed that even an accidental incursion can impose military, political and economic costs.

Air policing is not enough

The Baltic airspace problem is partly geographical. Lithuania, Latvia and Estonia have limited strategic depth, while several major cities, military sites and energy facilities lie within short flying distance of Russia or Belarus.

Traditional air policing was designed primarily to identify and intercept crewed aircraft. Small unmanned systems present a different target set. They may fly at low altitude, have a limited radar signature and approach infrastructure before their origin or payload has been established.

NATO has adjusted its posture. The Alliance’s Eastern Sentry air-defence activity combines fighter aircraft with surveillance radars and wider integrated air and missile-defence assets. Allied Air Command has also conducted counter-drone training over Lithuania and Latvia.

Defence Matters has examined the shift from Baltic Air Policing towards a more active air-defence mission with authority to destroy threats. The Lithuanian warning shows why interception authority is only one part of the requirement.

Baltic forces also need layered sensors capable of detecting low-flying objects, electronic-warfare systems that can identify control links, mobile counter-UAS weapons and procedures for protecting debris after an interception.

Destroying a drone may protect the immediate target, but excessive fragmentation can make attribution harder. Commanders may therefore face a trade-off between selecting the fastest method of neutralisation and preserving material needed for technical exploitation.

Attribution is part of deterrence

A limited strike against a power station, railway junction, fuel installation or military logistics site could remain below the scale normally associated with a conventional attack. Its political purpose could be to test how quickly NATO members agree on responsibility and response.

NATO’s policy on hybrid threats states that hybrid action against an ally could lead to a decision to invoke Article 5. That decision would depend on the circumstances, scale and attribution of the incident.

This gives an adversary an incentive to create uncertainty around the weapon’s origin and chain of command. Even a short dispute between allies over whether an incident was deliberate, accidental or falsely attributed could reduce the deterrent value of a rapid collective response.

Lithuania’s public warning is therefore an operational measure as well as a political statement. By identifying the proposed method before an attack occurs, Vilnius has weakened the value of Ukrainian components as an instrument of deception.

The next requirement is a common NATO attribution process capable of combining national radar data, electronic intelligence, forensic examination and intelligence reporting quickly enough to support political decisions.

On the Baltic flank, counter-drone defence can no longer be measured only by how many aircraft are detected or destroyed. It must also be judged by whether NATO can identify the operator and communicate that conclusion before the attacker exploits the uncertainty.