Twenty-Eight Days to a Name

Germany proved that Russia sent the drone to Leipzig, and the proof bought almost nothing. Berlin closed a consulate, added sanctions and had its chancellor brief NATO's secretary general informally, filing nothing. Every European argument about hybrid attack assumes the hard part is knowing who did it. Leipzig is the case where knowing was achieved, and the answer was a démarche.

The drone sat at Leipzig/Halle airport on 4 August, near a Ukrainian cargo aircraft, until a police robot took it apart. A second is thought to have struck another cargo plane. A third turned up ten days later. Leipzig is a NATO logistics hub that Ukrainian Antonov transports use constantly, so the target selection required no interpretation.

Then twenty-eight days passed.

On 1 September the German government said its police investigation and intelligence findings had proved Russian responsibility. The stated basis was physical rather than inferential. The drone's configuration, its components, its explosives and its detonator were all already known from other Russian hybrid operations. Two suspects have reportedly been identified, one a Belarusian holding a Russian passport who entered on a tourist visa, the other holding Latvian and Russian passports and flying out of Berlin two days before the attack.

That is a complete attribution. It names a state, a method and two travellers with border records. Ursula von der Leyen went further in public than Berlin had, calling it military-grade material carried out by Russian operatives on European Union soil. That is close to the ceiling of declaratory language short of finding an armed attack. Mark Rutte pledged full solidarity.

Berlin then closed the Russian consulate in Bonn and the Russian House, applied sanctions and had Friedrich Merz brief Rutte informally. Consultation happened without a formal Article 4 declaration ever being filed. Moscow rejected the finding, summoned the German chargé d'affaires and shut the Goethe-Institut in three cities, which reads as a trade rather than a cost.

Every one of those measures was available to Germany on 5 August. None of them required the twenty-eight days.

Lithuania's foreign minister Kestutis Budrys said the operative thing while standing beside the result, that Russia sees no political cost in hybrid operations against European allies. He was describing the case that had just proved attribution is achievable. Critics inside Germany called the response weak. Berlin's own account is that it is holding out for a coordinated European package.

Three more attacks landed within forty-eight hours. Power lines failed in Brandenburg and North Rhine-Westphalia on 1 September, taking five generating units offline, with launching devices recovered from a field. Incendiary devices were thrown at a Rohde & Schwarz construction site in Munich late on 2 September, at a firm building secure military communications and counter-drone systems that partnered with a Ukrainian electronic-warfare company in May. Bavarian police detained two Bulgarian nationals nearby. Herbert Reul, running the western investigation, says two possibilities are live, a foreign state and left-wing extremism.

Those three have no author yet, and it is tempting to read the anonymity as the point. Resist that. The attributed attack produced a consulate closure. Deniability is a convenience here. The one incident Europe fully solved cost Moscow a consulate and three cultural institutes, which is roughly what the three unsolved ones have cost.

What the restraint actually is remains open. It could be deliberate escalation management by a government that does not want the ladder climbed on its watch. It could be exactly what Berlin says, patience while a slower and heavier European package assembles. Or the alliance may simply hold nothing proportionate between a summons and Article 4, and the informal telephone call is what a missing rung looks like from the outside.

Two things will separate those readings. Watch whether Bergheim gets a name around 29 September, at the same twenty-eight day interval Leipzig took, since a second attribution that lands in an empty response would settle a great deal. Watch whether the coordinated European measures Berlin is waiting for arrive before the next incident does.