Making Sense of the Recent Alarm Bells over the “Deteriorating Security Situation” in Europe

This past week, users on X resorted to AI chatbots to explain ominous warnings from their own governments.

On 18 September, Switzerland's Federal Council opened a post with the words, "In response to the deteriorating security situation." It announced the adoption of Switzerland's 2026 Security Policy Strategy, but despite its largely routine content, the post went viral, drawing more than 29 million views.

One reply with over a million views tagged the Swiss government, the defence department and Grok, asking how exactly the Swiss security situation was deteriorating. This reply among many others showed that readers could not tell what had changed or what had prompted the post.

The strategy itself is no more dramatic. It described the international security situation as increasingly unstable and volatile, with major-power rivalries intensifying and the international order growing weaker.

Within a day it was running under headlines about world war. Replies claimed the enemy was already inside the gates. One read that if Switzerland of all places was strengthening its military, something was about to go down. Another asked why posts from every country in Europe were suddenly talking about preparations for war. A fourth suggested European governments were deliberately keeping information from their citizens, and doing it to prevent panic.

Together, the replies reflect the same suspicion: Europe's governments know something their citizens don't.

The suspicion is somewhat understandable because over the last week, five of Europe's most senior security voices have described the same broad threat environment, in strikingly similar terms.

NATO Secretary General Mark Rutte said the alliance faces the "most dangerous and complex security environment in a generation." Von der Leyen said the week's incidents were not isolated but part of a broader pattern of Russian aggression testing Europe's readiness and resolve. Kaja Kallas, the EU's foreign policy chief, set out a five-point plan to respond to these threats. Macron said the threat facing Europeans, and the Russian hybrid threat in particular, had intensified in recent weeks. Then Switzerland.

Read together, the statements can look like evidence of a shared private warning. Placed in context, they look different.

Similar language, different contexts

First off, Switzerland's 2026 Security Policy Strategy was not written this month. The Federal Council decided to develop it in June 2024. It opened the consultation on 12 December 2025, announcing it with the phrase "deteriorating security situation" that day. The consultation ran to the end of March 2026. On 18 September the Federal Council took note of the results and approved the text. Switzerland usually produces a document like this every four to ten years, and the last one came in 2021. A progress report is due in 2028.

So the chilling warning was the last step of a two-year process, announced with phrasing the government had already used nine months earlier.

The other four had distinct timeframes.

Von der Leyen spoke on 16 September in her State of the European Union address, an annual event. Rutte spoke the same day at the Ditchley Foundation's Annual Lecture, and his core message was about money: without more investment, collective defence would not be credible. He was addressing a British audience after meeting the UK prime minister, praising Britain's spending pledges and pressing for them to continue. Macron spoke on 18 September after meeting party leaders and candidates for the 2027 presidential election.

Each speaker also had a policy to sell. Von der Leyen's initiatives reflect a push by European officials to take more responsibility for the continent's security amid doubts about relying on the United States, and analysts warned the proposals could duplicate NATO structures. Kallas's plan calls for sanctions, visa limits for Russian citizens and AI tools against disinformation. She has also voiced concern that parties which downplay the Russian threat are gaining ground.

This helps explain why some of the statements came together; mid-September is when European institutions deliver their set-piece speeches. Recent events, however, gave the warnings a sharper tone.

Recent incidents

On 1 September, Germany blamed Russia for an attempted attack at Leipzig/Halle Airport in August using a drone laden with explosives, and announced it would shut a Russian consulate. The drone was found near a Ukrainian aircraft. Germany's interior minister called an armed drone inside an airport a new threat scenario. Russia dismissed the accusations as a "fabricated provocation."

The same day, the Turnow-Preilack substation in Brandenburg, one of the region's most critical high-voltage nodes, was hit. Rockets carrying conductive material were fired into extra-high-voltage lines. Investigators found at least ten rockets. Officials called it sabotage, but no one has publicly assigned blame.

On 15 September, a NATO jet shot down a drone over Lithuania, the first time that had happened in its airspace. Authorities said further investigation was needed on origin and purpose, though two senior officials said it was likely carrying explosives. It most likely entered from Belarus, and the explosive device was detected and neutralised. The same day, Denmark confirmed a Russian frigate had fired two flares at a Danish military helicopter photographing the vessel in international waters. The flares came within metres of the aircraft. Two days earlier, a Russian drone struck a railway line near the Ukraine-Poland border shortly after senior visiting officials passed through.

On 17 September, the warning became more specific. Polish Prime Minister Donald Tusk told parliament that intelligence indicated Russia could stage drone or missile strikes against European countries supporting Ukraine, including Poland, and then present them as accidents. He said the aim would be to weaken NATO's willingness to defend the state affected. This did not establish that an attack was imminent, but it identified a specific scenario European governments were preparing for: using ambiguity to test how the alliance responds.

This phrasing is nothing new

The phrasing itself shouldn't raise too many alarm bells, because European leaders have described the security environment in generational terms since 2022. Kallas, then Estonia's prime minister, called it the most alarming situation in thirty years in September 2022. Switzerland's intelligence service said in July 2025 that the situation was deteriorating year by year.

What changed is that governments are now building stronger institutions around the assessment rather than just describing it and deploying existing resources. Von der Leyen's proposed protocol is meant for threats that are not clearly armed aggression, such as cyberattacks, severed undersea cables and attacks on critical infrastructure. Switzerland's strategy runs to 10 objectives and 46 measures. Macron ordered a national infrastructure protection plan.

Why single incidents mislead

Incidents like a damaged cable, an airport drone sighting, a warehouse fire, a cyberattack and a false online claim can look unrelated when reviewed by different agencies in different countries. They also vary greatly in severity and evidentiary strength.

That fragmented view creates a problem for intelligence analysts. Hybrid campaigns work through accumulation — each act can be cheap, limited, deniable or easy to dismiss. Together, repeated acts can raise security costs, test response times, expose weak points and are relatively effective in eroding trust in public institutions.

The Associated Press has tracked around 200 incidents of sabotage and malign activity across Europe blamed on Russia by Western officials since the invasion of Ukraine. A Congressional Research Service report from August 2026 found these attacks increasing in number and severity, and noted Russian services are running more aggressive operations that carry a greater risk of exposure.

Poland's counterintelligence reporting shows the scale of these operations. Its Internal Security Agency opened 69 espionage investigations in 2024 and 2025, the same number as in the entire period from 1991 to 2023. Forty-eight of those began in 2025. Before the invasion, the average was about five a year. The agency also reported a shift away from low-cost, one-time recruits toward more professional operations that tap organised crime networks. Some agents are being trained on Russian territory, and foreigners make up a large share of those recruited.

This widens the range of possible actors. A person near a target can be a trained officer, a criminal intermediary, an ideological supporter or a recruit given one task through an encrypted channel. The sponsor and the person carrying out the act need not share a motive or ever meet.

For intelligence teams, this means the event alone is often the wrong starting point. The better question is whether the same target type, method, intermediary, timing or narrative appears elsewhere.

Ambiguity compounds the effect

Attribution takes time. Governments need forensic evidence, intelligence reporting, legal review and agreement on what they will disclose. Public information moves far faster, mixed with speculation and deliberate falsehood.

The incident in Leipzig demonstrates this well. The drone was found on 4 August. Germany named Russia on 1 September. The story was wide open to speculation for four weeks.

That gap serves the attacker, because online accounts can fill the silence with competing stories. The later attribution rarely gets the attention of the first dramatic claim.

What happened with the Swiss post shows the same dynamic with no hostile actor needed. A routine government post, stripped of its history, generated its own significant alarm. If a planning document can do that on its own, a deliberate campaign has an easy job.

The result is a persistent asymmetry where defenders must reach a high standard before assigning blame but the attacker only needs to create doubt.

OSINT analysis can help tip the balance by documenting early evidence, comparing official statements, identifying repeated methods and showing how narratives spread.

Less is off-limits now

The targets drawing attention are clearly not limited to military bases. Recent attacks, suspected sabotage and official warnings have involved airports, railways, ports, power systems, communications, undersea cables, defence suppliers, logistics firms and technology sites.

Leipzig/Halle, the target of the attempted drone attack earlier this month, is a major freight hub and a base for support to Ukraine. It hosts NATO's Strategic Airlift International Solution, which delivers equipment to battle groups along the eastern flank. It's worth considering that the same runways serve commercial cargo and military logistics, and the same railways carry commuters and supplies. A private manufacturer can sit several steps inside a defence supply chain without ever seeing itself as a target.

This expands the area security teams must cover. It also blurs ownership of risk. Police, intelligence services, armed forces, regulators, local authorities and private firms each hold one piece.

Takeaways

I've identified a few key principles that have come out of the last three weeks.

• Date a statement before you react to it. The Swiss post was the last step of a process that started in June 2024, announced with a phrase the government first used in December 2025. Rutte was pressing for higher defence spending at an annual lecture. Von der Leyen was giving a fixed annual address. Before treating any official warning as new information, find out when it was written, what process produced it and who was in the room.
• Read what officials rule out, not just what they warn about. Tusk gave the most specific warning of the month and still told parliament there was nothing to suggest an invasion. Lithuania said the drone's origin and purpose needed further investigation while two officials briefed that it was likely carrying explosives. Those qualifiers are the most carefully drafted words in any government statement, but are also the first thing stripped out when the statement is quoted.
• Plan around the gap of attribution. Leipzig ran from 4 August to 1 September before Germany named Russia. Brandenburg still has no public attribution. If your escalation thresholds require a named actor, you have built a four-week hole into your response. Decide now what you do with a confirmed sabotage event and an unnamed perpetrator, because that is the normal case.
• Account for the danger of ambiguity. Tusk said the plan is for strikes to be called accidental, in order to weaken NATO's willingness to respond. That reframes every ambiguous incident. The question turns into who benefits from the delay in answering.

The question deserved an answer

Someone tagged their own government and an AI chatbot in the same post and asked how, exactly, the security situation was deteriorating.

Most of the answer was already public. The Swiss post reflected a long planning process, but it appeared during a cluster of incidents and sharper warnings. That combination made routine language appear to some like an alert of imminent war.

Someone will always fill the silence that comes after hybrid attacks. The difficult task facing governments responding to these incidents is to answer first, and to be right.

When they can't remove that gap between incident and attribution, they can narrow it by stating what is known, what is assessed and what remains unclear.