On May 19, a Romanian F-16 flying NATO’s Baltic air policing mission shot down a drone over southern Estonia, near Lake Vortsjarv. It was the first kinetic intercept of an uncrewed aircraft in a series that began in March, and within hours the explanation had compressed into a single sentence repeated across capitals and wire copy. Russia is redirecting Ukrainian drones into NATO airspace.
That sentence carries more weight than the evidence beneath it can hold. It folds three separate phenomena into one, each with a different cause, a different degree of Russian intent, and a different standard of proof. Only the political effect is shared.
The drones crossing NATO’s eastern flank fall into three categories. Russian decoys launched on purpose. Ukrainian strike drones drifting off course under jamming. And Ukrainian drones actively spoofed onto false headings. The first is a Russian operation. The third may be one. The second is a byproduct of one. The prevailing narrative erases the distinction, and Russia profits from the erasure.
The achievement on display is not a steering capability. It is the manufacture of doubt at scale, in an electromagnetic environment dense enough that no crossing can be cleanly pinned on anyone. A drone that drifts and a drone that is steered produce the same headline, the same resignation, the same question in the same voter’s mouth. Russia collects the political effect either way, and pays for almost none of it.
The series so far
The pattern is short and tightly correlated with one thing. The first incident came on March 23 in Lithuania, where debris fell on the ice of Lake Lavysas. The Centre for Eastern Studies assessed the drone had veered off course during a Ukrainian strike on the Russian oil terminal at Primorsk. Two days later, drones came down in Latvia’s Kraslava region and in Estonia, where one hit the chimney of the Auvere power station in Ida-Viru County, under 50 kilometers from Ust-Luga, which Ukraine was striking that night. On May 7, two more entered Latvia and one detonated at an oil storage facility near Rezekne. On May 18, Lithuania destroyed a drone carrying explosives in a controlled detonation after Vilnius took shelter. The next day, the Romanian F-16 fired over Estonia.
Every one of these tracked Ukraine’s deep-strike campaign against Russian oil. The Baltic export terminals at Ust-Luga and Primorsk, the points the strays kept pointing back toward, rank among the largest targets Ukraine has hit in the war, per Reuters. The drones are first a spillover of Ukrainian success, not proof of Russian marksmanship.
Three drones, three stories
The first category is unambiguously Russian. The Gerbera is a decoy, foam and plywood, under 20 kilograms, with a range near 600 kilometers, built to flood air defenses by mimicking the radar signature of a Shahed. Some carry explosives. Defense News documented two Gerbera incursions into Lithuania from Belarus in July 2025, the second recovered at the Gaiziunai military training ground with roughly two kilograms of explosives some 100 kilometers inside NATO territory. That September, a Gerbera tail section washed ashore in Latvia with serial numbers matching drones logged over Poland. No one redirected these. Russia launched them.
The second category is drift. When Russian jamming denies satellite navigation, a strike drone falls back on inertial guidance, and inertial guidance bleeds accuracy with every kilometer. Maksym Skoretsky, head of the Ukrainian Land Forces’ electronic-warfare department, told Politico that the country’s own Lima jammer pushes a target off by roughly 2,000 meters for every 100 kilometers flown. Over a long autonomous run to a point on the Baltic coast, that error compounds into a different country. Estonia’s Internal Security Service confirmed the Auvere wreckage was Ukrainian and assessed it had likely deviated from a route toward Leningrad Oblast. The jamming is Russia’s. The operating environment is Russia’s. The crossing does not prove Russian steering, because here there was none.
The third category is the contested one, and it is the one the headline rests on. Spoofing does not block the signal. It replaces it, feeding the drone false coordinates so it recomputes its own position and corrects onto a heading the attacker chose. The Telegraph, working with Finland’s Yle, located the capability in a Kaliningrad transmitter that has jammed Baltic GPS for years and now, the paper reports, first blinds a drone to its own position and then overrides it with a signal stronger than anything else the drone can hear. Ramsey Faragher, who runs the Royal Institute of Navigation, told the paper the spoofing was visible in real time in live data from the Estonian border.
That is the strongest open-source case that the redirection is deliberate. It is also where the evidence runs out. Faragher observed spoofing in the environment. He did not produce a recovered drone’s navigation log showing an injected track that ends in Estonia, and no one else has either. The step that would convert the presence of spoofing into proof that a particular drone was walked there on purpose is absent from the public record.
The doubt is not coming from cranks. Jaak Tarien, former commander of the Estonian Air Force, told ERR that Russia cannot easily hijack Ukrainian drones and that the share it manages to mislead is probably under 10 percent. His reasoning matters as much as his number. He describes Ukraine’s long-range drones as semi-autonomous, navigating by terrain and inertial movement and correcting on GPS only occasionally, a design built to survive the exact jamming Russia runs. A drone that leans less on satellite is harder to drift and far harder to walk to a chosen point. The international-law analysis at Just Security reaches the same fork from the other side. Spoofing can deliberately redirect a drone. Jamming only blocks it and is far less controllable. Which one produced any given crossing is unresolved, and on open-source evidence it cannot be resolved.
The cheapest weapon on the flank
This is what the ambiguity buys. Russia does not have to fly a Ukrainian drone into Latvia to get the effect of having done so. It already runs the densest electronic-warfare belt in Europe out of Kaliningrad, and the strays fall out of that environment on their own. When they land, Russia’s foreign intelligence service supplies the narrative. Hours before the Estonia shootdown, the SVR claimed Latvia had agreed to host Ukrainian drone units at five military bases and warned that Riga’s decision-making centers were known to Moscow. Latvia denied it. The denial is the trap. A government explaining why its skies are not open to Ukraine is a government on the defensive, in its own parliament, on Russia’s chosen subject.
It works, and Latvia is the proof. The Rezekne strike cost the country its defense minister within three days, when Andris Spruds resigned after Prime Minister Evika Silina said he had lost her confidence and the public’s. His party walked out of the coalition. Silina resigned on May 14, and on May 28 the Saeima seated a new four-party government under Andris Kulbergs, tilted rightward with Spruds’s Progressives shut out. The drone that began this damaged some empty oil tanks and injured no one. The payload that mattered was political, and it went off in Riga, not Rezekne.
That is why NATO’s counter-drone debate is aimed slightly past the target. The Atlantic Council and others are right that fighter jets are an absurd answer to a foam airframe, and that the flank needs layered low-altitude detection and cheaper interceptors. All true, all insufficient. Interception addresses the drone; the weapon is the attribution gap. A drone downed over Estonia still has to be identified, its origin fixed, its intent judged, and the finding pushed to the public faster than Russian messaging fills the silence. Lithuanian radar did not even register the March 23 object until after it had crashed. Until attribution moves at the speed of the news cycle, every clean interception leaves open the question that decides the politics, which is the question Russia is asking.
The clean case
The contrast arrived on May 29. A Russian Geran-2, part of an overnight barrage against Ukrainian ports on the Danube, crashed into a ten-story apartment block in Galati and detonated, injuring two. It was the first time in nearly four years of Russian airspace breaches that a drone hurt anyone on Romanian soil. Within a day, Bucharest summoned Moscow’s ambassador, declared the Russian consul in Constanta persona non grata, and moved to shut the consulate. NATO condemned Russia by name. The drone was Russian, the warhead was Russian, the launch was Russian, and the cost fell on Russia inside 24 hours. In the Baltic the origin stays contestable, and the cost falls the other way, on the government that failed to stop the drone or on the ally whose war supplied it. The difference between Galati and Rezekne is not the drone. It is whether anyone can prove who sent it.
The gap that hardening cannot close
The uncomfortable part is that hardening the flank does not close the gap. Better sensors and cheaper interceptors cut the physical damage. They do nothing about the fact that a drone bled off course by jamming, a drone walked off course by spoofing, and a Russian decoy launched on purpose all arrive over Estonia looking identical, and that Russia pays only for the last while collecting on all three. The problem on the eastern flank is not how to stop the drones. It is how to deter a campaign whose ammunition is indistinguishable from an ally’s own weapons, and whose real warhead is a question you cannot answer fast enough to defuse.