“Hybrid” threats and a mystery drone at the Leipzig Airport

One of the recent events that at least looks like a Russian provocation was the appearance of a drone loaded with explosives at the Leipzig, Germany airport.

Well, maybe loaded with explosives. Because some explosives were found lying on the airport runway at some distance from the drone, that was also lying on the runway. This is one of those stories on which the early reports makes you go, “Huh?”

The Guardian’s early report described it this way:

The discovery of a small drone carrying explosives at Leipzig airport, a leading shipping and military hub, set off alarm and caused flight diversions on Wednesday morning [Aug. 5]. German police deployed a bomb disposal robot to defuse and destroy the explosive device.

In public remarks on Wednesday evening, the [German] interior minister, Alexander Dobrindt, said the incident did not appear to be the work of amateurs, and that investigators were treating it as part of a “professional hybrid threat scenario”. (1)

There was also a possibly related incident at the Leipzig airport on the same day, in which a DHL cargo plane “collided mid-air ‌with an unknown object shortly after take-off from Leipzig airport, prompting ⁠an immediate unscheduled landing in Hanover.” (2)

FRANCE 24 reports: (3)

The Interior Minister (responsible for federal security matters) say it “did not appear to be the work of amateurs.” Although as described below, lethal professionalism wasn’t necessarily a part of this incident, either.

The use of the “hybrid” concept gets dodgier all the time. NATO officially defines it very broadly:

Hybrid methods of warfare – such as propaganda, deception, sabotage and other non-military tactics – have long been used to destabilise adversaries. What is new about attacks seen in recent years is their speed, scale and intensity, facilitated by rapid technological change and global interconnectivity. NATO has a strategy for its role in countering hybrid warfare and stands ready to defend the Alliance and all Allies against any threat, whether conventional or hybrid. (4)

Since one of the worst problems in US foreign policy since the Second World War has been threat inflation, a concept like “hybrid warfare” is especially slippery. Invading a country is warfare. A Pearl Harbor sneak aerial attack is warfare. Assassinating the senior leadership of a country is an act of war.

But not everything somehow connected to outright military conflict is war. War includes propaganda, sabotage, espionage, duplicitous diplomacy, and public diplomacy designed to influence domestic and foreign opinion. But putting out some false story or inventing a conspiracy theory is not war. Hacking computer systems in another country is not in itself war. Encouraging refugees to go into another country is not war. (See: Belarus and Poland, and the recent Ceuta incident with Spain and Morocco.)

And if “deception” is an equivalent of warfare, diplomats all over the world are declaring warfare on each other’s countries all the time!

There are certainly grey areas. A foreign hack of computer systems controlling nuclear missiles could legitimately be considered an act of war. Iran’s recent Lego propaganda videos are part of Iran’s broader war effort, but propaganda in itself is not war. (And in any case, we actually are at war with Iran.) Assassinating the head of state or government of another country is a classic example of a legitimate cause of war. Some actions do fall into a gray area. But not every hostile or threatening or even murderous action is a legitimate cause for war. Opting for war is still a choice. Gavrilo Princip assassinating Crown Prince Franz Ferdinand in 1914 was a legitimate justification for war in the abstract. But it didn’t work out so well for the Austro-Hungarian Empire, which disappeared from the map entirely at the end of the war. Which Germany had pushed them hard to initiate.

Considering refugee flows as acts of war is especially risky at the moment for Europe. We’ve seen in the US how the Trump Administration went back to a statute from the 1790s, the Alien Enemies Act of 1798, as its excuse for unleashing the ICE Gestapo in 2025 to beat, kidnap, and kill people who don’t look “American” enough to masked ICE goons. Some countries, including Morocco and Türkiye, do use refugees as provocations against their neighbors. But the radical right parties and sectarian groups in Europe – many actively supported by Trump and J.D. Vance as well as by Putin – try hard to use immigration in the way Trump uses it, as an excuse to exercise state terror with some old-fashioned vigilante violence to supplement it.

Government officials, journalists and politicians in democratic countries need to be especially careful of treating immigration problems as “hybrid warfare.” Democracy has enough enemies without its centrist supporters piling on to undermine it.

The Leipzig drone incident does look at least plausibly like a Russian provocation and warning signal to the EU and European NATO allies. The recent incident of a Russian missile landing and exploding in a field in Poland with no people around also legitimately raised questions about whether it was an accidental misfire of a missile aimed at Ukraine. That’s one of those things for which researchers 30 years from now may dig out solid answers about from declassified documents.

Anne Hähnig reported early today for the German Die Zeit:

Since an armed drone was discovered at Leipzig Airport on Wednesday night, many details have become known. For example, how big the drone was (a quadrocopter with the approximate dimensions of a microwave, four rotors). Where it was found (near a Ukrainian cargo plane, which is also used to transport military equipment). Or what explosives it was carrying (Semtex).

However, some crucial questions about the process so far remain unanswered. Among other things, how the armed drone got close to the Ukrainian plane in the first place, what route it took, whether it scouted out the machine or, for instance, tried to fly underneath it. (5)

According to information obtained by Die Zeit, video recordings have now been evaluated that provide information about it. This is because the majority of the airport grounds are monitored by cameras. The videos show that Leipzig escaped a catastrophe by a much narrower margin than previously known.

As quoted below, Hähning notes that there were cameras filming the area where the drone was found. But there were no radar signs, or observations by the pilots or air controllers, of a drone closely tracking the plane?

The videos show the [Ukrainian] Antonov cargo plane parked at the airport. And they apparently show that already on Tuesday evening at around 7:30 PM., an object flew directly towards this aircraft. It eventually hit one of the wings. The wings are particularly sensitive parts of the aircraft because they usually contain fuel tanks. If you want to blow up an airplane, you detonate a bomb there. However, this did not happen in Leipzig. The footage shows that the object bounced off the wing and fell to the ground. Traces on a wing of the Antonov confirm this presumed sequence of events. Why the explosive device did not explode is still unclear.

(I did a double-take on that one. On 7:30 PM Tuesday, an “object” was seen and recorded on video - but the drone itself wasn’t discovered at the airport until Wednesday evening? A simple translation can be misleading: the report reads in German “in der Nacht auf Mittwoch,” which means the night from Tuesday to Wednesday.)

The report leaves open whether the drone was following the aircraft in the air or whether it was hidden on the ground and struck first after the landing.

The drone was not discovered by chance until four hours later. Die Zeit had already reported on Wednesday that it was the bus driver of a tourist group who became aware of the device. Previous reconstructions had assumed that he had kicked the device and later fixed it to the ground. …

Camera footage, on the other hand, now shows that the drone was already on the ground when the bus driver arrived. After a short hesitation, he put his foot on it and informed the security staff. In the end, the explosive device was not found on the drone itself – contrary to what was previously known – but at some distance. It is possible that it detached itself on impact with the aircraft.

I would say that if you see a strange object that kind of looks like a drone lying randomly on the ground on or near an airport runway, walking over and kicking it probably isn’t the safest way to check it out! And the explosives were lying well away from the drone. And the drone with the explosives may have hit the plane but the explosives just fell off and didn’t detonate?

Hähning’s report continues:

For the officers of the Federal Criminal Police Office, who took over the investigation at the weekend, this results in new insights. It is now more clear how exactly the drone approached the aircraft: not carefully, but with the obvious intention of damaging it. It is also more clear what purpose it served. So far, one of the investigative hypotheses has been that it could have been meant merely as a kind of warning. Armed yes, but not intended to actually explode. (emphasis added) This hypothesis can now hardly be maintained. Leipzig Airport narrowly escaped a devastating attack.

When Federal Interior Minister Alexander Dobrindt (CSU) interrupted his vacation on Wednesday to travel to Leipzig, he avoided clear statements about who he suspects to be the culprit. But he spoke of a "hybrid attack scenario" and of "foreign powers", which is commonly read as a reference to Russia. But Dobrindt avoided explicitly naming Russia as the perpetrator. ...

So far, the investigations have not yielded any clear indications that Russia is behind the attempted attack. However, several details point to highly professional perpetrators. … That a state actor was involved in the attack – in whatever way – is … one of the investigative hypotheses that has now become more likely.

After her own description of what is known about the attack, I’m not sure that adds up to making the idea that “a state actor was involved in the attack … more likely.”

Hopefully we’ll get a more complete description at some point. But the beginning of a Russian Blitzkrieg it’s definitely not!

Notes:

(1) Cole, Deborah & Roth, Andrew (2026): Drone carrying explosives at German airport marks ‘new level of danger’, says interior minister. Guardian 08/05/2026. <https://www.theguardian.com/world/2026/aug/05/drone-german-airport-dhl-cargo-plane-collides-object-leipzig> (Accessed: 2026-10-08).

(2) DHL cargo plane lands in Hanover after mid-air collision with object, source says. Reuters <https://www.reuters.com/world/dhl-cargo-plane-lands-hanover-after-mid-air-collision-with-ob.ject-source-says-2026-08-05/> (Accessed: 2026-10-08).

(3) Bomb-disposal robot and drone with explosives discovered at Germany's Leipzig airport FRANCE 24 English YouTube channel 08/06/2026. <https://youtu.be/7F1z4HFuT3k?si=q77nxRDaSFnjmnq6> (Accessed: 2026-10-08).

(4) Countering hybrid threats. NATO website 01/29/2026. <https://www.nato.int/en/what-we-do/deterrence-and-defence/countering-hybrid-threats> (Accessed: 2026-10-08).

(5) Hähnig, Anne (2026): Das war keine Warnung, das war ein Angriff. Die Zeit 08/10/2026. <https://www.zeit.de/politik/deutschland/2026-08/drohne-leipzig-flughafen-sprengstoff-kameraaufnahmen?freebie=1e4ac99d> (Accessed: 2026-10-08). My translation to English, with emphasis added in italics.