INVESTIGATION: NATO's Eastern Flank Under Pressure — What the Baltic Intelligence Services Told Their Allies

Introduction: A Warning from Riga

June 26, 2026: Latvian intelligence breaks its silence

On June 26, 2026, the Latvian Constitution Protection Bureau published a statement that immediately circulated through every NATO capital: "We see indications that Russia is preparing military provocations against the Baltic states or Poland." Five words were enough to shake the Alliance's eastern flank. Not a declaration of war. Not a certainty of invasion. Something more subtle, and perhaps more dangerous: a deliberately ambiguous signal of intent, calibrated to remain below the threshold of Article 5.

What follows is not a panic. It is a cold investigation into what the services know, what they are passing on, and what they are not yet saying publicly. Because the space between the warning and the proof, Vladimir Putin's Russia has been exploiting since 2014 with surgical precision.

Section 1: The Anatomy of a Hybrid Threat

What "provocations" means in the vocabulary of intelligence services

The Latvian services are not talking about invasion. They are talking about hybrid attacks: missiles, drones, operations designed to send a signal. The exact formulation passed to the Guardian by a source within a second NATO member country is unambiguous: Putin "is planning something against the Baltic states" aimed at "testing American support for the Alliance's smaller members" — Estonia, Latvia, Lithuania — in what that source describes as a desperate "roll of the dice" as Russia struggles on the Ukrainian front.

This rhetoric of desperation is significant. The Latvian intelligence services themselves specify that Russia is not capable of opening a second conventional front. What it can do is make life for Ukraine's allies sufficiently unstable that those allies reduce their support. The implicit message behind every decoy missile that flies over Warsaw or every drone that forces shelter-in-place orders in Vilnius is always the same: "You are paying a price too."

The precedents that give the warning weight

The June 2026 warning does not arrive in a vacuum. In summer 2024, networks linked to Russian services planted incendiary bombs in DHL parcels in the United Kingdom, Poland, and Germany. In September 2025, 19 Russian decoy drones crossed Polish airspace, forcing NATO to scramble fighter jets and residents of three eastern provinces to take shelter. These incidents are not accidents. They are part of a documented catalog of hybrid actions that have multiplied since the start of Russia's full-scale invasion of Ukraine in February 2022.

Polish Foreign Minister Radosław Sikorski added a chilling layer to the picture: Russia could stage a false-flag operation to justify a strike against a NATO member, citing as historical precedent the Gleiwitz incident in 1939, when Nazi Germany staged an attack to justify invading Poland. This is not a historian speaking. It is the head of Polish diplomacy.

Section 2: The Gdańsk Summit and the Voice of Donald Tusk

The Polish prime minister takes the microphone

On the evening of June 26, 2026, at a press conference after the eastern flank summit held in Gdańsk, Polish Prime Minister Donald Tusk stepped out of polished diplomacy and into candor: "We also share, without exception, the opinion that the situation is very unstable and that various types of escalation can be expected in the weeks and months to come. We want to prepare ourselves as a group of countries directly exposed to this risk." Gdańsk is not an incidental choice. This is where resistance to the Soviet empire began. Tusk knows it. The cameras know it.

Poland devoted more than 5% of its GDP to defense in 2025, the highest ratio in the entire Atlantic Alliance. This figure, provided at the NATO summit in Ankara, is not posturing. It is a budgetary response to a genuine perception of threat. When a country places 5% of its economy under the uniform, that country believes what it says.

The Ankara summit and the American question

In July 2026, NATO held its annual summit in Ankara, Turkey. For the first time in decades, all 32 allies reached the 2% of GDP threshold for defense spending. European and Canadian countries together spent $574 billion in 2025. Secretary General Mark Rutte reaffirmed that Article 5 is "unshakeable." But behind the polished communiqués, one question haunts the delegations of smaller eastern states: if Russia tests Estonia or Latvia with a limited hybrid strike, will Washington actually pick up the phone?

The anonymous source cited by the Guardian is explicit: Putin wants to test "whether the US would defend the smaller members." That sentence contains the entire Russian strategy. It also contains all the doubt that Donald Trump — who said he was "disappointed" by European allies who refused to let the American air force bomb Iran from their bases — has sown in the Alliance since returning to power.

Section 3: What Chatham House Says and What Vilnius Says

Keir Giles's analysis: Russia cannot afford to lose passively

Keir Giles, a researcher at Chatham House, one of London's most influential security think tanks, articulates the Russian logic with precision: "Moscow will seek ways to disrupt the current trend, through horizontal escalation [extending the conflict to other countries] or doing something somewhere else. We should not expect Russia to lose passively." A Western military source, also cited by the Guardian, adds: "I can't lie, this is a dangerous period."

This framing is essential. Russia does not have the resources to open a conventional front against the Baltics. But the pressure Ukraine is exerting on it — 200 drones over Moscow in a single night in late June 2026, a refinery ablaze, black oil raining on the capital — that pressure needs a release valve. The eastern flank of NATO is that valve.

The Lithuanian nuance: no sign of a large-scale attack

On June 29, 2026, the Lithuanian Ministry of Defense added an important nuance to the Latvian warning: "There are currently no signs that Russia is preparing a large-scale military attack against the Baltic states, but the threat level of sabotage against critical infrastructure on Lithuanian territory remains high." This statement, published by Ukrainska Pravda, does not contradict Riga. It clarifies the scale: not invasion, but arson, cyberattacks, acts of sabotage against power grids, ports, fuel depots.

Polish intelligence chief Paweł Szota raised the possibility of using "little green men" — Russian soldiers without insignia — as a provocation vector in the Baltic states, a scenario directly recalling the technique used in Crimea in 2014. Latvian services also note that Russia could file complaints with the International Court of Justice against the Baltic states, thereby constructing a legal narrative preceding a potential aggression.

Section 4: The NATO Multinational Brigade in Latvia

Canada in the lead — a physical presence, not symbolic

In Latvia, the NATO-led multinational brigade commanded by Canada has reinforced its posture well beyond a simple threshold effect. Canadian Colonel Kris Reeves, the commanding officer, told Defense News on May 12, 2026 with effective understatement: "Right now I have a brigade; there is nothing on the other side of the border that can eliminate this brigade." This statement is not bravado. It is a tactical assessment published in a context of mounting tension.

The physical presence of allied troops on Baltic soil is the most concrete response to the hybrid threat. An attack against a Canadian unit in Latvia is no longer an abstract test of Article 5 — it is an attack on Canadian soldiers on an ally's soil. The political distinction is fundamental. This is the logic of forward deterrence that NATO has deployed since the 2022 invasion.

Eastern Sentry program and the drone wall

In September 2025, following the massive violations of Polish airspace, NATO Secretary General Mark Rutte announced the formation of the Eastern Sentry program, designed to deter further Russian incursions. In November 2025, new American anti-drone systems were deployed on the eastern flank. Member countries also began developing a "drone wall" — a chain of detection, tracking, and interception — along their borders with Russia and Belarus. In 2026, Lithuania devoted 5.38% of its GDP to defense, the highest ratio in the Alliance.

These figures say something that diplomatic communiqués dare not put quite so plainly: the members closest to Russia believe the threat. They are not pretending. They are paying.

Section 5: Belarus in the Equation

Lukashenko reinforces border infrastructure

On June 25, 2026, Ukrainian President Volodymyr Zelensky signaled that Belarus was completing new military infrastructure at its border with Ukraine: road networks, ammunition storage sites, fuel depots. This development is distinct from the Baltic threat, but it fits the same picture: Alexander Lukashenko, under growing Russian influence, is transforming his territory into an operational staging area for a possible extension of the conflict.

On the same June 22, 2026, Zelensky signaled that Belarusian relay stations used to guide Russian drones against Ukraine had stopped operating after he issued an ultimatum to Minsk: dismantle the equipment or face Ukrainian strikes. A Belarusian Telegram channel claimed the equipment had been dismantled to "avoid interfering with hazel grouse nesting sites." Russia has its own register of unintentional comedy.

Section 6: What the Services Are Not Yet Saying

The limits of the warning — few concrete details

The Guardian notes that the warnings in circulation have few supporting details — unlike the precise warnings published by the CIA and MI6 before the full-scale invasion of Ukraine in February 2022. No date. No named target. No identified unit. This lack of granularity can mean two things: either the services see general preparations without a specific plan yet finalized, or they have more but cannot declassify it without compromising their sources.

Western authorities have not publicly presented any evidence that a Russian provocation is imminent. Lithuania even took care to emphasize that reports about the threat "aim to escalate the situation in the Baltic states" — acknowledging that the warning itself may be part of Russia's intimidation strategy. This is not naivety. It is analytical rigor: measuring what is known, what is inferred, and what one refuses to amplify.

Russian intelligence tells the boss what he wants to hear

Latvian services raise an additional concern, reported by Ground News: Russian intelligence institutions are telling Putin what he wants to hear, creating a risk of irrational decisions as the war in Ukraine enters its fifth year. This drift of services toward confirming the leader's biases is well-documented in authoritarian regimes. It means that the Western deterrence logic — "if you strike a NATO ally, here is what will happen to you" — could reach Putin's desk distorted, filtered by advisers who have learned that the boss does not like bad news.

This is, paradoxically, the most destabilizing factor in the situation: not that Putin is rational and planning coldly, but that he may be receiving distorted information about the real costs of his options. The autumn of 2022 showed that sudden reversals on the Ukrainian front — the Kharkiv breakthrough — had led the West to fear a Russian nuclear riposte. Escalation does not always stem from strategy. It sometimes stems from panic.

Section 7: Russia's History of Provocations as Doctrine

From Crimea to DHL parcels — a continuity of methods

The warning of June 26, 2026 must be read within the continuity of a doctrine that Russia has never truly concealed. In 2014, the "little green men" in Crimea. In 2016–2017, disinformation operations in Western elections. In 2022, the full-scale invasion that CIA and MI6 had announced precisely and that several European governments refused to believe until the final days. In 2024, incendiary bombs in DHL parcels. In 2025, the 19 decoy drones over Poland. Each incident tests a response. Each response informs the next incident.

Russia does not withdraw lessons — it refines them

Between each cycle of provocations, Russian methods evolve. The incendiary bombs of 2024 in DHL parcels were more sophisticated than the cyberattacks of 2016. The 19 decoy drones of September 2025 over Poland were bolder than anything Moscow had attempted in a NATO member's airspace since the end of the Cold War. This is not a repetition of the past. It is a learning curve. Each operation tests a response. Each response informs the next.

This learning dynamic is documented by several European services. Russia observes how each incident is handled — legally, diplomatically, in the media — and calibrates the next to stay within the blind spots of the allied response. It is an engineering of ambiguity, conducted methodically for more than a decade.

Poland's civilian intelligence chief, quoted by RBC-Ukraine, frames the doctrine plainly: "Russia systematically shifts 'red lines' and tests NATO responses. As the Alliance responds primarily politically, the cost of such provocations remains low for Moscow, thus encouraging further escalation." It is a blunt admission of the structural limits of deterrence by declaration.

Section 8: Ukraine Under Pressure — The Direct Connection

The long war and its effects on the eastern flank

The threat against the Baltics and Poland is directly linked to the dynamics of the Ukrainian front. In late June 2026, Ukraine strikes Moscow with nearly 200 drones in a single night — black oil raining on the Russian capital, a refinery ablaze. These long-range Ukrainian successes exert pressure that Putin can neither ignore nor absorb indefinitely without reaction. The Baltic warning is the hidden face of that dynamic: when blocked on the eastern front, one looks for a release valve to the west.

This connection is documented: the Guardian notes that fears of escalation in the West have "always been linked to the growing pressure being placed on Russia." In autumn 2022, after the Ukrainian counter-offensive at Kharkiv, the West feared a nuclear riposte. There was none. But the signal was clear: a regime under pressure looks for exits. The exits are not always militarily rational.

Section 9: What NATO Can Do — and What It Cannot

The structural limits of hybrid defense

NATO has perfectly calibrated conventional responses to a full-scale invasion. For hybrid warfare, it is more complicated. Is a drone that crosses Poland without identifiable markings an act of war? Does a bomb in a postal parcel trigger Article 5? These questions have no clear legal answer, and that is precisely why Russia keeps asking them. The Eastern Sentry program, the drone wall, the forward presence in Latvia, the multiplied NATO exercises — all of this strengthens conventional defense. None of it resolves the problem of war below the threshold.

The partial solution is transparency. When Latvian services publish their warning, when Poland names the false flag before it happens, when Lithuania publishes its statistics on Russian GPS transmitters from Kaliningrad — they are stripping Russia of the ambiguity space it is trying to exploit. Naming the weapon before it strikes partially disarms it.

Section 10: Invisible Weapons — Cyberattacks and Critical Infrastructure

Undersea cables, power grids, transportation

Since 2022, the Kremlin has intensified operations against critical infrastructure across Northern and Eastern Europe. Undersea fiber-optic cables severed in the Baltic Sea. Railway networks disrupted. Port computer systems targeted. These incidents, documented by the European Union Agency for Cybersecurity (ENISA) and national services, leave no blood. They leave paralyzed economies, anxious populations, and governments forced to respond without being able to officially attribute responsibility at the speed public opinion demands.

Latvia, Estonia, and Lithuania have all suffered waves of cyberattacks attributed to groups linked to Russian services since the start of the full-scale invasion. In Lithuania, authorities have linked networks associated with Russian intelligence to several sabotage plots and deliberate fires targeting logistics and commercial infrastructure. These actions remain below the threshold of war. They nonetheless create a real, measurable cost for the societies concerned.

Section 11: Norway, the High North, and the Arctic Dimension

A threat that extends beyond the classic eastern flank

Russian hybrid pressure is not confined to the land border with the Baltics and Poland. Norway has reported an increase in espionage activities and potential sabotage operations against its energy infrastructure in the Arctic. Airlines and European authorities are recording recurring episodes of electronic interference, notably on official flights near the Russian border. The airspace of the High North has become, like that of the Baltics, a laboratory where Russia tests the limits of Western tolerance.

This Arctic dimension matters because it reveals the geographic scope of Russia's hybrid strategy. It is not a localized operation against the Baltic states. It is systematic, multi-theater pressure applied across the entire northern flank of NATO. Sweden and Finland, new Alliance members, find themselves directly integrated into this dynamic, their accession having rendered obsolete any notion of protective neutrality in the face of Russian aggression.

Section 12: The Economics of the Threat — What It Costs Russia

Cost calculations and the asymmetry of hybrid warfare

A decoy drone costs a few thousand dollars. A booby-trapped DHL parcel, a few hundred. A social media disinformation operation, almost nothing. Against that: tens of millions in anti-drone systems deployed, nights of fighter scrambles at fifty thousand euros an hour, hours of emergency meetings in allied capitals, warnings that force populations to shelter. Asymmetry is the heart of the model. Russia invests little to impose massive costs on its adversaries.

This is precisely why Poland's civilian intelligence chief notes that "the cost of provocations remains low for Moscow." The antidote to this asymmetry runs along two axes: first, making reprisals costly enough that provocation loses its economic logic. Second, developing effective hybrid defenses that absorb or neutralize effects at lower cost for the Alliance. Both axes are under development, but neither is fully mature as of mid-2026.

Section 13: The Diplomatic Response — What NATO Is Preparing at Ankara

The Ankara summit as a test of cohesion

The NATO summit in Ankara in July 2026 arrives amid dual pressure: the hybrid threat on the eastern flank on one side, uncertainty about American commitment on the other. All 32 allies have reached the 2% of GDP threshold for defense, an unprecedented signal of cohesion. But Baltic delegations know that budget figures do not answer the fundamental question: if Russia strikes a critical infrastructure in Estonia or lands a drone in a Latvian city, what collective response will be activated, and within what timeframe?

Secretary General Mark Rutte's declaration that Article 5 is "unshakeable" is deliberate and public. It responds to a genuine concern. But between the declaration and the deployment, there is always a political space that the Alliance's adversaries seek to exploit. It is that space which Latvian, Polish, and Lithuanian services flagged in June 2026. Not to alarm. To compel their allies to close it.

Conclusion: What Gdańsk Says to Moscow

Deterrence through clarity

On June 26, 2026, from Gdańsk, Donald Tusk chose clarity. Not alarmism — the sober precision of a leader who refuses to pretend the situation is normal. The Latvian services had made the same choice a few hours earlier. Polish intelligence, the day after. This is not coincidence. It is coordination. A collective decision to no longer absorb the hybrid threat in silence, to name it, document it, force allies and populations to measure its reality.

The question that remains open

Will Putin test the Baltics? The services fear it. Lithuania refuses to amplify that fear. Poland is preparing for it with 5% of its GDP. NATO declares Article 5 unshakeable. And in all that space — between the warning and the proof, between the declaration and the action — Russia has been operating for years. What the services passed along is less a warning about what is going to happen than a description of what is already happening. The hybrid war has started. The question is not whether it is going to begin.

By Maxime Marquette, columnist

Columnist's transparency note

Editorial stance

This article is based on publicly available primary sources: the Guardian (June 26, 2026), the Latvian Constitution Protection Bureau, statements by Polish Prime Minister Donald Tusk, Foreign Minister Radosław Sikorski, and civilian intelligence chief Paweł Szota, the Lithuanian Ministry of Defense (June 29, 2026), and analyses from RBC-Ukraine and Meta-Defense. Defense spending figures come from the NATO summit in Ankara (July 2026). The quote from Colonel Kris Reeves comes from Defense News (May 12, 2026). I support Ukraine and NATO in this conflict. This stance shapes my framing but not my facts.

Limits

The intelligence warnings cited in this article are by definition partial: services do not publish their sources and methods. Lithuania itself noted that these warnings may be part of Russia's intimidation strategy. I do not claim to know what Putin will decide. I document what the services consider possible and what allied governments are preparing in response.

Sources

Primary sources

The Guardian — Russia preparing possible 'provocation' in Baltic states or Poland, sources say — June 26, 2026

Ukrainska Pravda — Lithuania says no signs of Russia preparing attack on Baltic states — June 29, 2026

RBC-Ukraine — NATO warned over possible threat from Russia's covert operatives — June 28, 2026

Secondary sources

Meta-Defense — Russia may be preparing provocations against the Baltic states and Poland, NATO warns — June 26, 2026

Foreign Policy — NATO Summit: The Alliance Is Not Dead — July 1, 2026

Ground News — Latvian Intelligence: Russia Plotting Possible Hybrid Attacks on Baltic States, Poland — June 28, 2026