Center for Strategic Studies of Eurasia

    Commentary · Oct 2, 2026

    NATO's eastern flank has rewritten its shoot-down rules around sensors, not intent

    A Russian Mi-8 spent 42 seconds and 300 metres inside Polish airspace on 23 September. Poland and NATO have answered a year of such incidents by loosening identification rules rather than the threshold for force.

    Security & DefenceEurope & Russia
    Experience the vibrant Warsaw skyline at sunset, reflecting beautifully in the river.
    Maciej Cisowski / Pexels
    Contents

    Key takeaways

    • A Russian Mi-8 entered Polish airspace from Kaliningrad north of Braniewo at 11:08 on 23 September 2026, about 300 metres deep for 42 seconds; Poland scrambled fighters and the Operational Command said Russia was "once again testing the readiness of our air defence" (Euronews, Notes from Poland).
    • At the NATO summit in Ankara on 8 July 2026 allies agreed to convert the Baltic air policing mission, launched in 2004, into an air defence mission, giving pilots a wider mandate that includes destroying "objects that pose a threat", Lithuanian President Gitanas Nausėda said (Reuters, LRT).
    • Poland's new air-defence procedures took effect on 1 October 2026, replacing the peacetime requirement for visual identification of a target with positive identification from radar and other sensor data and information passed by Ukraine; the change needs no new legislation (Notes from Poland).
    • On the Kh-101 cruise missile that crashed in Lublin province on 30 July 2026, Prime Minister Donald Tusk said there was no indication Poland was deliberately targeted, while Deputy Defence Minister Cezary Tomczyk called it "a provocation, an intention, an alliance test" (TVP World, Kyiv Independent).

    A Russian Mi-8 helicopter crossed from Kaliningrad into Polish airspace north of Braniewo at 11:08 on 23 September 2026, flew about 300 metres in and left after 42 seconds. Poland's Operational Command tracked it on radar, scrambled fighters and held ground assets on standby, then said "the nature of the incident indicates that Russia is once again testing the readiness of our air defence." By any physical measure it was trivial. It also illustrates the problem that pushed Warsaw and NATO to rewrite their engagement procedures this year: detection was never the gap, and intent cannot be established in the time available. The answer both reached is to lower the identification bar rather than the threshold for using force.

    Incidents that can be filed as accidents

    The Mi-8 was the first publicly reported case of a Russian military helicopter crossing Poland's land border. A day earlier, Deputy Prime Minister and Defence Minister Władysław Kosiniak-Kamysz said Polish fighters had intercepted a Russian Il-20 reconnaissance aircraft about 40 km from the Polish coast. The Operational Command reported that interceptions of Russian aircraft along the eastern flank had risen by more than 250 percent; the Euronews report carrying the figure gives no comparison period.

    Earlier incidents are harder to file. On 30 July a Russian Kh-101 cruise missile came down in a field between Tarnawa-Kolonia and Tokary in Lublin province, leaving a crater about ten metres wide; prosecutors said it carried a "significant amount of explosive material". Reported distances inside Poland range from about 80 km to roughly 100 km. Polish F-16s were scrambled at 03:40 and the object dropped off radar six minutes later.

    September sharpened the ambiguity. On 13 September a Russian drone struck the locomotive of a Kyiv–Warsaw passenger train about 2 km from the Polish border, and a second hit a truck some 800 metres from Polish territory near the Dorohusk–Jagodzin crossing; Poland's operational command activated defence and reconnaissance systems but recorded no violation of Polish airspace. Two days later an Italian Eurofighter flying NATO's Baltic mission shot down an explosive-carrying drone that had entered southern Lithuania from Belarus — the first drone downed over Lithuanian territory. Italian Defence Minister Guido Crosetto said it "most probably came from Russia"; Lithuanian Defence Minister Robertas Kaunas said examination was needed before that could be said clearly. Earlier in 2026 NATO jets had downed suspected stray Ukrainian drones over Estonia and Latvia. The Baltic pattern is the same: on 1 September Latvia issued a red alert over Alūksne municipality and the air-policing mission scrambled jets, while Estonia tracked about ten drones near its border during a Ukrainian attack on Russia and, its air force commander said, "the Estonian fighter jets did not have to open fire."

    Warsaw has no single reading of intent

    Polish officials have not converged. On the Kh-101, Prime Minister Donald Tusk said there was no indication Poland had been deliberately targeted, noting that the military had been "ready to shoot down the missile if it had continued on its flight path". Deputy Defence Minister Cezary Tomczyk read it as "a provocation, an intention, an alliance test", while conceding on intent that "we don't know, and if we do find out, it will mainly be through intelligence." He said about 20 of roughly 70 missiles fired that night had at some point been heading towards Poland.

    Tusk's wider argument is that the ambiguity is itself the instrument. Addressing parliament on 17 September he said "Russia's plan, according to intelligence, also includes hybrid drone and missile strikes against countries supporting Ukraine, including Poland," aimed at weakening "NATO member states' motivation to apply appropriate NATO regulations in the event of aggression". He cited intelligence from allies including the United States and Ukraine. Moscow denies targeting NATO states.

    What changed is identification, not the threshold

    Two procedural changes followed. At the NATO summit in Ankara on 8 July, allies agreed to convert the Baltic air policing mission, launched in 2004 for three states that fly no fighters of their own, into an air defence mission, giving pilots a wider mandate including destroying "objects that pose a threat", Lithuanian President Gitanas Nausėda said, adding that the environment is "not a totally peaceful" one. Estonian Foreign Minister Margus Tsahkna said it gave "greater flexibility and faster response to air threats". It sits alongside Eastern Sentry, launched in September 2025 after Poland invoked Article 4 over what NATO called the largest concentration of violations of allied airspace.

    Poland then moved nationally. On 28 September the defence ministry said new procedures were ready, effective 1 October, replacing the peacetime requirement for visual identification with positive identification drawn from radar and other sensors, absence of an IFF response, speed and trajectory, and information passed by Ukraine. Tomczyk called it "not less identification, but a different way of conducting it: faster and based on data from multiple sources". It sits at military level and needs no new legislation.

    Neither change makes engagement automatic, the part most easily misread. NATO's stated position, as Secretary General Mark Rutte put it in September 2025, is that decisions "are taken in real time, are always based on available intelligence regarding the threat posed", and that "SACEUR, our Supreme Allied Commander, has the overall prerogative and responsibility."

    What this solves, and what it leaves

    The reforms buy speed and widen the evidence base; they do nothing for attribution. A commander who can act on radar data rather than a visual pass gains minutes against a jet-powered drone and nothing against the political problem Tusk described, because a 42-second helicopter pass or a single stray airframe can still be presented as an error afterwards. Poland's complementary signal — Tusk said the government would consider further air-defence aid to Ukraine, including Patriots — pushes the interception line eastwards rather than answering the violations. Faster rules carry their own exposure: a shoot-down decided on sensor data over populated ground will eventually be judged on a case that proves to have been a genuine accident.

    What to watch

    • Whether the 1 October Polish procedures produce a shoot-down over Polish territory, and how Warsaw evidences that decision afterwards.
    • Whether NATO or the Operational Command publish intercept figures pinning down the "more than 250 percent" rise and the period it covers.
    • Further Kaliningrad-origin incidents: the Mi-8 was the first helicopter crossing of Poland's land border, so a repeat would mark a pattern.
    • The EU flagships: the European Drone Defence Initiative and Eastern Flank Watch were to reach "initial capacity – by end 2026" under the Commission's readiness roadmap.

    Sources

    Related publications