CIA Director in Moscow and a Letter to Ursula von der Leyen
The visit by CIA Director John Ratcliffe to Moscow on 25 August was another signal that US and European intelligence services are taking seriously the possibility of Russian aggression against the Baltic states. It was Ratcliffe’s first visit to Russia since taking office. The previous visit by a CIA director — then William Burns — to Moscow was in 2021 and was intended to dissuade Russia from invading Ukraine.
American and European media, citing their own sources, claimed that Ratcliffe held meetings with FSB chief Alexander Bortnikov and Foreign Intelligence Service director Sergei Naryshkin, during which he warned the Kremlin against escalating against NATO members and urged it to begin negotiations with Ukraine, as Russia’s army and economy are being depleted.
Prior to the visit, The Wall Street Journal published an article, citing US intelligence, saying that Russia could carry out a limited invasion of one of the NATO countries as early as this autumn. Other media outlets also reported the existence of relevant intelligence, citing diplomats from the Baltic states.
In addition, Radio Free Europe/Radio Svoboda reported that on 30 July European Commissioners from the Baltic states, Poland and Finland wrote a letter, addressed to European Commission President Ursula von der Leyen, about the deteriorating security environment amid an increasing frequency of airspace violations and drone incursions.
Russia’s Sabotage Campaign and How Europe Is Preparing to Defend Itself
Throughout August and early September, a whole series of acts of sabotage inspired by Russia took place across Europe.
On 4 August in Germany, at Leipzig Airport, a drone was discovered that was attempting to strike a Ukrainian An-124 transport aircraft.
On 7 August in Poland, a Russian citizen was detained who, on instructions from Russian intelligence, was preparing to kill a Ukrainian businessman.
On 10 August in Bulgaria, a powerful explosion occurred at a plant producing artillery shells.
On 13 August, an explosion occurred at a plant in Italy that produces ammunition and rocket fuel. The same day, an explosion took place in the port of Rotterdam at an energy company facility, leading to the suspension of operations at several oil-refining enterprises.
On 15 August in Estonia, three Latvian citizens were detained on suspicion of setting fire to a defence company building.
On 25 August in Slovakia, local police foiled an attempted arson attack on a drone factory owned by a Ukrainian company.
On 31 August, a factory caught fire in Poland that produces components for Ukrainian drones.
In parallel, Russia began threatening the United Kingdom after Prime Minister Andy Burnham announced on 24 August a decision to share Storm Shadow long-range missile production technologies with Ukraine. Russian Foreign Ministry spokesperson Maria Zakharova said London “will not be able to avoid responsibility” and that “the response to Ukrainian strikes using British weapons on Russian territory could be any UK military facilities in Ukraine and beyond”. The UK government has already warned British defence-industry enterprises of the threat and is expanding security measures.
Also on 24 August, a report by the Congressional Research Service revealed that in April 2026 specialised submarines of the Main Directorate for Deep-Sea Research of Russia’s Ministry of Defence surveyed critical underwater infrastructure in UK waters in preparation for future sabotage.
It is likely these actions were the reason ten member states of the Joint Expeditionary Force (JEF) (the United Kingdom, the Netherlands, Denmark, Finland, Iceland, Norway, Sweden, Latvia, Lithuania, Estonia) signed a memorandum of intent to create “multinational maritime forces” that would serve as a “complement to NATO”.
The UK government has also stepped up civil-defence planning in view of the growing threat of Russian attacks on critical infrastructure. The largest exercises in the country’s history to counter hybrid attacks — Operation Albiston Shadow — are already scheduled for 2027. Finland is also conducting the largest civil-population exercises in its history, rehearsing scenarios involving missile threats and attacks on energy facilities.
At the end of August, Sweden began moving warships, including Visby-class corvettes, Gripen fighter jets and personnel to Finland to ensure the latter’s territorial integrity. The countries also agreed to deepen co-operation in detecting and combating drones. Drones have repeatedly crossed into Finland from Russia.
Germany and Scandinavia Respond to Escalation — How Ukraine Can Use This Momentum to Secure Support
On 1 September, Germany officially accused Russia of attempting sabotage at Leipzig Airport using an explosive-laden drone. Chancellor Friedrich Merz announced the closure of the Russian House in Berlin and the Consulate General in Bonn, and signalled new sanctions against the shadow fleet.
Merz promised additional deliveries of IRIS-T air-defence missiles, and an expansion of strike-drone batches (Germany is to produce 5,000 units on Ukraine’s order). Berlin will also allocate an additional €250 million to Ukraine to support the restoration of the energy system.
The German government announced tougher intelligence and counter-intelligence measures regarding Russia and Russian citizens. Der Spiegel claims Berlin will deepen co-operation with Ukrainian special services, including helping to identify targets for strikes on Russian territory.
The European Commission has already stated the need to strengthen support for Ukraine in light of news from Germany and other countries. Kyiv must make the most of this momentum to secure new aid packages. Ukraine’s need for additional external financing for 2026–2029, beyond existing programmes, amounts to $146 billion, according to the Ministry of Finance. For 2027 alone, the deficit is estimated at $32.6 billion. In addition, Ukraine’s Ministry of Defence says it needs to raise $27 billion already this year in order to place orders for next year.
In the European Union’s long-term budget for 2028–2034, €100 billion ($116 billion) is earmarked to support Ukraine. This sum is clearly insufficient to meet Ukraine’s needs in security, social spending and economic recovery. Around $245 billion in Russian assets are frozen in EU jurisdictions. Of these, approximately $215 billion are held in accounts at the Belgian depository Euroclear. Most EU countries support transferring the frozen assets to Ukraine, but Belgium is demanding guarantees that, if a court decision requires the funds to be returned to Russia, the burden will be shared among EU members.
At the end of August, Spain, the Netherlands, Poland and Sweden sent a letter to the European Commission calling for work to resume on a mechanism to use frozen Russian assets to finance Ukraine. Spain’s participation was likely prompted by Russia’s involvement in fuelling the migrant crisis in July this year.
If Germany, Denmark and Norway (which is not an EU member but has a $2.2 trillion sovereign wealth fund) join these countries, and together guarantee their participation in the potential (though unlikely) return of funds to Russia by court order, Belgium will most likely agree to transfer the funds to Ukraine.
The Kremlin is doing everything it can to convince Europe of the necessity of such steps. On 1 September, an attempted act of sabotage took place in Germany at the Jänschwalde coal-fired power plant in Brandenburg: it was fired at with improvised rockets, and explosive devices were found on the premises. On 2 September, in a technical building at Augsburg railway station an unknown object detonated, and police found another that did not explode. The same day in North Rhine-Westphalia, saboteurs damaged power lines at the Rommerskirchen substation. As a result, coal units at two power plants with a combined capacity of 4.2 GW were shut down.
Denmark’s domestic intelligence service said Russia is preparing acts of sabotage against defence-industry companies linked to Ukraine, as well as sabotage against critical infrastructure. Danish counter-intelligence says the aim of potential sabotage is to disrupt arms supplies to Kyiv and to pressure politicians and society into ending support for Ukraine.
Sweden and Norway, for their part, are moving to proactive measures in response to Russia’s escalation. In early August, Sweden’s Supreme Court upheld the seizure and transfer to Ukraine of the Russian shadow-fleet vessel Caffa, setting an important precedent for the rest of Europe. The legal basis for the decision was a request by the Ukrainian prosecutor’s office. On 31 August, a Norwegian court seized the Russian ice-class research vessel Professor Molchanov to cover part of Gazprom’s debt to Naftogaz totalling about $4.2 billion.
With these actions, the Scandinavians are also responding to Moscow’s earlier aggressive moves — in particular, the cutting of underwater cables near Svalbard in 2021 and 2022, where activity by Russian research vessels was observed, and sabotage against critical underwater infrastructure in the Baltic Sea in 2023–2024.
Additional Pressure on Europe — The US Pulls Back, the Far Right Calls for “Appeasement”
On 26 August, Donald Trump publicly dismissed suggestions that the CIA director travelled to Moscow to persuade Russia not to take aggressive action against NATO member states. The US President called the visit “semi-routine” and added that one of the issues was ending the Russia–Ukraine war.
Alongside Russia’s large-scale sabotage campaign across Europe, the United States is considering ways to reduce its military presence on the Old Continent. The Pentagon must make a final decision by 6 November. Donald Trump plans to significantly cut the US contingent in Europe, currently numbering about 80–85,000. The US President wants to “punish” European countries that did not support the US–Israeli war against Iran.
Another motive is the White House’s desire to rapidly shift responsibility for Europe’s security onto the continent’s states. Reuters reports that the Pentagon sent allies a questionnaire covering defence spending, procurement from the US defence industry, and support for US foreign-policy priorities.
The stagnation of the front line, Ukraine’s development of long-range capabilities, financial losses, structural degradation of the economy and the overall strategic dead end Russia finds itself in are forcing it to look for new paths to victory. Moscow understands that time is working against it, as European countries are rearming and preparing for a possible confrontation.
Capturing Ukraine or part of it is not Russia’s ultimate goal. That goal is rather a return to a multipolar world of great powers with their own spheres of influence. A key step towards that goal is the collapse of NATO, which would mean the absence of a collective security system in Europe. This can be achieved precisely through military aggression, the most likely target of which is the Baltic states.
Russia is counting on NATO’s de facto death by demonstrating the Alliance countries’ unwillingness to back collective security guarantees with actual entry into a war on the side of a potential victim of aggression. The United States is showing in every possible way that allies’ security is not a priority. In the event of Russian aggression, Europe’s political elites would face significant public pressure to avoid involvement in a war.
Many far-right and far-left political forces in Germany, France, Italy and Spain have long called for “appeasing” Russia through concessions at Ukraine’s expense. Moscow could facilitate such a stance by carrying out a false-flag attack — for example, using drones disguised as Ukrainian ones, or captured Ukrainian drones, to attack the Baltic states or Poland.
The high likelihood of such a scenario was effectively confirmed by statements from Poland’s Foreign Minister Radosław Sikorski and Lithuania’s Defence Minister Robertas Kaulas. Both say Russia could use Ukrainian drones to attack critical infrastructure in order to create uncertainty about the source of the attack.
The most important question in the context of possible Russian aggression against one of the Baltic or Scandinavian countries, or Poland, is whether leaders of other NATO states would be ready to provide military assistance, understanding that this could lead to a full-scale confrontation with a nuclear power.
Who Would Be First to Respond to a Russian Strike
In the Baltics, around ten thousand troops of NATO’s Enhanced Forward Presence are deployed. Besides the United States, the largest troop contributors are Canada, the United Kingdom, Germany, France, Denmark, the Netherlands and Sweden. Given the prospect of US units being withdrawn (around 650 troops in Estonia, 250 in Latvia and 1,000 in Lithuania), these states would be the first to respond to Russian aggression.
In practice, the deployment of other countries’ troops in the Baltics serves not only deterrence but also another purpose: to ensure NATO countries would be compelled to respond to the deaths of their own soldiers. Given NATO’s doctrinal shift from “deterrence by punishment” (fighting defensive battles, trading territory for time until NATO’s main forces entered the confrontation) to “deterrence by denial” (repelling the aggressor immediately at the border to avoid mass killings of civilians in the event of occupation), the likelihood of high casualties among NATO’s Enhanced Forward Presence in the event of a Russian invasion increases.
Thus, the Baltic states’ armed forces would deter a potential Russian ground offensive, hope for the participation of NATO’s Enhanced Forward Presence units in the defence, and for allies’ decisions to provide military assistance in response to aggression. The effectiveness of deterring Russian forces in the first hours and days could play a significant role in decision-making by European countries and the United States, as it did with Ukraine’s defence in February–March 2022. Russia’s objective and hope would be a rapid rout of forces on the immediate theatre of operations, so that NATO countries would face a choice: recognise the occupation of the Baltics, or be drawn into a prolonged and bloody war.
Is Europe Ready to Counter Hybrid Aggression
At the same time, there is a high probability that potential Russian aggression would be carried out exclusively through hybrid instruments, without the use of brute force — a ground invasion. Russia may further expand its sabotage campaign against defence-industry enterprises, carry out sabotage of critical infrastructure, cyberattacks, and information operations aimed at political and social destabilisation, and use the local Russian population and the aforementioned “Ukrainian drones” for provocations.
Responsible for the niche of countering threats that do not reach the threshold for invoking Article 5 but require an immediate military response are the Joint Expeditionary Force mentioned earlier. These expeditionary forces are intended to act as a “first responder” in crisis situations, deploying forces within days and bridging the time gap until a full-scale NATO response — or, in the worst case, replacing NATO if it is paralysed due to the Alliance’s problems already described.
The JEF is developing special response protocols for “grey-zone” threats — JEF Response Options. These are packages of military measures for rapid response to a crisis, with a particular focus on hybrid threats and the protection of critical infrastructure, and they envisage coordinated deployment primarily of naval and air forces.
In December 2023, the first-ever activation of JEF Response Options took place, amid suspicion of deliberate sabotage of the Balticconnector gas pipeline between Finland and Estonia. A total of 29 vessels and 11 aircraft from JEF member countries were involved in joint patrols in the Baltic Sea to protect critical infrastructure. The second activation of the protection protocols took place in December 2024 following damage to the S-link 2 power cable and data transmission cables in the Baltic Sea. A total of 28 vessels and 6 aircraft were involved in joint patrols in the Baltic Sea.
At the same time, JEF forces can provide both rapid reaction and sustained support for operations on land. The forward element consists of special operations forces, marines and airborne units. The main intervention capability comprises aviation, mechanised, tank and artillery units, large surface ships and submarines, which require more time and resources to deploy and sustain, but provide long-term operational support and the ability to escalate.
During September–October this year, the Lion Protector 26 exercises will take place — multi-domain multinational military drills involving JEF member states. Most activities are scheduled for September and will include rehearsals for moving forces between the territories and internal waters of the Scandinavian and Baltic countries. After these exercises, the size of the UK contingent in Norway will gradually increase from one thousand troops to two thousand.
Does Europe Have Enough Will to Defend Allies, Its Own Values and Continue Supporting Ukraine
There is no doubt that the Baltic states would defend themselves in the event of any Russian aggression. Doubts begin over whether allies would come to their aid. Russia will do everything possible to undermine NATO’s already far-from-obvious readiness to guarantee collective security in practice.
In particular, Moscow will resort to further attempts at nuclear blackmail — something already being voiced by Russian propagandist Solovyov towards the United Kingdom. Finland’s President Alexander Stubb spoke on the subject, reassuring his own country’s society and Europe more broadly by insisting that China would not allow such a development. A precedent of using nuclear weapons is indeed unacceptable for Beijing, as it does not yet have a sufficient number of warheads and the infrastructure to confront the United States in this area.
However, it is clear that Russia has nevertheless decided to move towards further escalation — both in the war against Ukraine and in the still-hybrid confrontation with Europe. Putin likely interpreted Ratcliffe’s visit as a sign of weakness on the part of the United States and NATO as a whole, just as he did the visit to Moscow in November 2021 by the previous CIA director, Burns, who warned against invading Ukraine.
Further ratcheting up of tensions and likely hybrid or direct military aggression by Russia will reveal the true state of the Euro-Atlantic collective security system. For now, US behaviour indicates that responsibility for the response will fall on European countries and Canada. All that remains is to hope they are ready to defend allies and their own values.
And that Europe, under pressure from sabotage, information operations, cyberattacks, nuclear blackmail and a potential invasion, will not abandon military-technical and financial support for Kyiv in exchange for security assurances from Moscow. The Kremlin is puffing itself up, trying to project confidence amid mounting internal problems, and seeks, through escalation against the Old Continent, to break out of the stalemate in the war against Ukraine. Europe must respond as effectively as possible — expand assistance to Ukraine, impose new sanctions on Russia, and respond to provocations swiftly and firmly.