On NATO’s northeastern flank, the logic of critical infrastructure protection is changing. Poland, Lithuania, Latvia and Estonia are no longer preparing only for direct sabotage, but also for a scenario in which an attack could be deliberately disguised as a Ukrainian operation.
The focus is on dams, gas terminals, power grids, fuel storage sites, hydroelectric facilities and future nuclear infrastructure. These assets sustain everyday life, but they also underpin the resilience of NATO’s eastern flank.
A particularly sensitive risk is the possible use of Ukrainian-made drones, or their components, to create a convincing appearance of an “attack from Ukraine.” Ukrainian drones have already been found on the territory of countries in the region after straying beyond Ukraine under varying circumstances.
As Daycom has previously assessed, the principal danger of such a scenario may lie less in the physical damage caused by a single strike than in the political uncertainty it could generate inside NATO. Several hours of confusion over who was responsible could prove strategically more valuable than the explosion itself.
Security Shifts Toward a Military Footing
Lithuania has already deployed military personnel to help protect some of its most sensitive sites. Troops have reinforced police security around the liquefied natural gas terminal, an oil-products terminal, a key electricity connection with Poland and the Kruonis pumped-storage hydroelectric plant.
For Vilnius, this is not merely a symbolic show of force. It reflects a higher assessment of the threat: a scenario in which physical sabotage could be combined with an information operation designed to impose a politically useful interpretation of events before the facts are established.
Latvia has also strengthened security around critical infrastructure. Among the facilities receiving particular attention are the Daugava River dam near Riga and the Incukalns underground gas storage site, which plays a strategic role in the region’s energy security.
Concern has grown alongside a series of Russian accusations against the Baltic states. Moscow has previously alleged that they could allow Ukraine to use their territory for attacks on Russia and has warned of possible retaliation.
In Warsaw and the Baltic capitals, such statements are viewed as potentially significant because they could help establish an information narrative in advance. Once a public story about a supposed “Ukrainian threat” has been planted, a later incident can be more easily fitted into it.
The Kremlin rejects those suspicions, describing warnings about covert Russian operations as scare tactics intended to justify further militarization near Russia’s borders.
The Real Target Could Be NATO’s Response
Regional intelligence assessments have considered a scenario in which Russian military structures or intelligence services could stage an attack on infrastructure in Russia, Poland or the Baltic states using Ukrainian-made drones.
Such an operation could theoretically follow a decision at the highest political level. But this remains an assessment of a possible scenario rather than evidence of a fixed plan with a known date. The attack could come quickly, much later — or never take place at all.
That uncertainty is itself part of the pressure. A hybrid threat can produce effects even before any act of sabotage occurs, forcing governments to spend resources on security, intelligence collection, threat verification, reinforcement of vulnerable sites and contingency planning.
The most consequential impact of a possible attack might therefore emerge not at the blast site but at NATO headquarters in Brussels. If attribution were unclear, allies would first have to determine whether the incident was a Russian operation, an accidental Ukrainian strike, an act by a third party or something else entirely.
That question goes to the core of the Alliance. NATO depends not only on military strength, but on the ability of its members to reach a rapid political consensus about the nature of a threat and the appropriate collective response. A false-flag operation would be designed precisely to exploit that decision-making process.
The broader debate over the long-term U.S. role in European security adds another layer of sensitivity. The more uncertainty there is inside the Alliance over burden-sharing and political commitment, the more attractive an operation aimed at deepening those doubts could become.
Poland Protects Gas Routes and Its Nuclear Project
Poland is simultaneously reviewing the resilience of its most important energy supply routes. Orlen, the country’s leading oil and gas company, is assessing alternative gas import options in case its main channels are disrupted or temporarily unavailable.
Roughly 80% of Poland’s gas imports arrive through the LNG terminal at Swinoujscie and an undersea pipeline from Norway that reaches the coast nearby. The concentration of two crucial supply routes in the same region makes that infrastructure particularly sensitive.
The gas transmission system is already operating under heightened vigilance. Since Europe sharply reduced its dependence on Russian energy, new supply routes have become both symbols of strategic independence and potential points of pressure.
Another warning sign has emerged around Poland’s first nuclear power plant project. The state-owned developer discovered forged documents intended to mislead project stakeholders, with their origin traced broadly to somewhere east of Poland.
Security and law-enforcement agencies are investigating. The planned nuclear site is now being treated not only as an object requiring physical protection, but also as a potential target for sabotage, document forgery, information operations and attempts to disrupt management.
Protection has also been strengthened around a power connection between Poland and Ukraine that helps stabilize Ukraine’s electricity system. Military units could eventually become involved in guarding other critical infrastructure in eastern Poland.
Hybrid Warfare Without a Clear Front Line
The situation is complicated further by unexplained drone incidents elsewhere in Europe. In Germany, authorities recently found a drone carrying explosives at Leipzig/Halle Airport. Officials described the incident as a hybrid attack but did not publicly assign responsibility to any state.
Such episodes illustrate one of the main advantages of hybrid operations: they can cause enough disruption to generate a political crisis while preserving enough ambiguity to complicate an immediate response.
A conventional attack follows a relatively clear sequence — aggressor, target, strike, response. A false-flag operation disrupts that chain. Before allies can act, they must establish who was responsible and decide whether the evidence is strong enough to justify collective measures.
For Russia, the potential attraction of such a strategy would be the ability to create controlled instability without entering into an open military confrontation with NATO. That calculation could become more tempting while the war in Ukraine continues to consume significant resources and Ukrainian strikes on Russian energy and industrial sites increase pressure at home.
The political message to Europe would be straightforward: continued support for Ukraine could carry not only higher defense costs, but also greater risks to Europe’s own energy systems, transport networks and domestic security.
Yet such a strategy would carry serious risks for Moscow as well. If a provocation were quickly and convincingly attributed to Russia, the result could be the opposite of what was intended — not division within NATO, but faster reinforcement of its eastern flank and deeper military integration among allies.
That is why Poland and the Baltic states are trying to remove the most important advantage of a potential operation: surprise. Soldiers guarding gas terminals, reinforced security around dams, alternative supply routes and tighter protection of energy nodes are all intended to make sabotage more difficult and its consequences less severe.
NATO’s new defensive line no longer runs only along borders and military bases. It now passes through gas storage facilities, substations, terminals, dams, nuclear projects and information systems. Those may be the places where the Alliance has to determine whether it can identify an attack before uncertainty over who carried it out becomes part of the attack itself.
