PROFILE: Putin, master of grey zones — Russia's hybrid strategy against the Baltic states and Poland

June 26, 2026 — Latvian intelligence speaks

On June 26, 2026, Latvia's State Security Service published an intelligence warning that received less international attention than it deserved: Russia's hybrid operations targeting the Baltic states and Poland had reached a new level of intensity and sophistication. The warning documented a pattern of activities — drone incursions, GPS jamming, sabotage networks, cyberattacks, and targeted information operations — that constituted, in the assessment of Latvian intelligence, a deliberate campaign of grey zone aggression designed to test Alliance resolve without triggering Article 5.

Grey zone aggression is aggression calibrated to stay below the threshold that would legally and politically require a military response. It is the strategy of the tactically clever and the morally unscrupulous. Vladimir Putin has elevated it to an art form — pursuing the objectives of territorial pressure and political destabilization through instruments that Western democracies struggle to attribute, deter, and respond to within their existing legal and institutional frameworks. The June 26 Latvian intelligence report is a roadmap to how this art form is currently being practiced against NATO's eastern flank.

The pattern: four documented incidents

Latvian intelligence's warning contextualized the current hybrid campaign within a documented pattern of incidents spanning the past 18 months. The Estonian Auvere power plant drone incident of March 2026 — a Russian-linked drone that breached Estonian airspace and passed within kilometers of a critical energy facility — demonstrated Russia's willingness to test NATO's air defense and airspace sovereignty responses. The 19 unexplained drone incidents over Poland in September 2025, attributed by Polish intelligence to Russian or Russian-linked actors, demonstrated the same testing logic applied to a larger and more strategically significant NATO member.

Kaliningrad-originating GPS jamming, which has disrupted civilian aviation over the Baltic region with increasing frequency, and the GRU-linked sabotage network — physical sabotage operations against rail, energy, and logistics infrastructure in Baltic and Polish territory — complete the picture of a multi-domain grey zone campaign that is simultaneously escalating and deniable. Putin is telling NATO that he can reach inside Alliance territory without crossing the threshold that would require a formal military response. The message is deliberate. The restraint in sending it is strategic, not principled.

Grey zone aggression is the most intellectually demanding challenge in contemporary security analysis, because it requires holding two ideas simultaneously: that Russia is deliberately testing and violating the rules-based order, and that the evidence required for formal attribution and military response is structurally harder to assemble than the evidence for conventional military aggression. Putin has built his strategy on this evidentiary gap. Closing it — not just rhetorically but institutionally and legally — is the most urgent security task in the Baltic region.

What happened and what it demonstrated

The Auvere power plant drone incident of March 2026 was more than a navigation accident or a stray commercial drone. The Auvere oil shale power plant is one of Estonia's most critical energy facilities — its disruption would affect Estonian power generation at a level relevant to military and civilian operations alike. A drone capable of reaching Auvere from Russian or Belarusian territory, equipped with an explosive payload or a reconnaissance payload, would provide both an intelligence collection opportunity and a potential sabotage capability.

Estonian and NATO authorities attributed the drone's presence to Russian-linked actors — a judgment based on the drone's origin trajectory, its capabilities, and the intelligence context of known Russian hybrid operation patterns. The incident did not produce casualties or physical damage. It was almost certainly designed not to — the value of the operation lies in the demonstration rather than the destruction: Russia showing Estonia that it can reach its critical infrastructure, that NATO's air defense cannot intercept every penetration, and that the cost of deterring this kind of operation falls on Alliance members to bear.

The Alliance response and its limitations

NATO's formal response to the Auvere incident was measured — an expression of concern, a reference to Alliance solidarity, and consultations within the North Atlantic Council about improving airspace surveillance and response capabilities in the Baltic region. This measured response reflects the real limitations of applying the Alliance's collective defense framework to incidents that have not caused casualties and whose attribution, while assessed as Russian-linked, cannot be publicly documented to the standard that formal Alliance action would require.

The limitation is structural, not political: Article 5 requires an "armed attack," and a drone that passes near a power plant without causing damage does not straightforwardly qualify. The Alliance is therefore left responding to grey zone incidents with measures short of collective defense — enhanced surveillance, bilateral reassurance, diplomatic statements — that are less deterrent than formal military response but more defensible within the Alliance's legal framework.

The gap between what Russia is doing and what Article 5 covers is the most dangerous gap in European security right now. Russia has calibrated its grey zone operations to exploit this gap — to be present enough to intimidate and to demonstrate capability, while remaining below the threshold that would trigger the collective defense response it wants to avoid. NATO needs an Article 5 equivalent for grey zone aggression. The legal and political work to develop it has not yet been done with the urgency the situation demands.

September 2025: a month that should have produced more alarm

The 19 drone incidents over Polish territory in September 2025 — attributed by Polish intelligence to Russian or Russian-linked actors — represent the largest documented grey zone aerial penetration of NATO airspace in the current period. Poland is not Estonia — it is a country of 38 million, a major NATO contributor, the primary logistics corridor for Western military support to Ukraine, and a country that has been investing more of its GDP in defense than any other NATO member. Russian grey zone operations targeting Poland carry different strategic implications than operations targeting smaller Baltic states.

The September 2025 incidents occurred in a period of particular sensitivity: during an active Ukrainian operational phase, while Polish logistics infrastructure was processing significant volumes of military equipment for Ukraine. The timing suggests that the drone operations were intended not only to test Polish airspace responses but to generate intelligence about the logistics infrastructure whose disruption would directly impact Ukrainian military resupply. Grey zone operations against Poland are, in part, operations against Ukraine.

Poland's response: investment and public acknowledgment

Poland's response to the September 2025 incidents was more public and more specific than most Alliance responses to grey zone provocations. Prime Minister Donald Tusk made explicit public statements acknowledging the drone operations and their attribution to Russian actors, refusing the diplomatic ambiguity that might have allowed the incidents to be officially characterized as accidents or navigation errors. This public acknowledgment served multiple purposes: it contributed to deterrence by making the attribution public, it built domestic political support for continued defense spending, and it sent a direct message to Moscow that Warsaw was tracking its operations and naming them.

Poland's defense investment — at 4% of GDP, the highest in NATO — includes specific funding for air defense systems, counter-drone capabilities, and airspace surveillance designed to address exactly the kind of grey zone aerial penetration that the September 2025 incidents demonstrated. Poland is building the defensive infrastructure that grey zone deterrence requires. It is doing so faster than any other European NATO member, and under more direct operational pressure.

Tusk's public attribution of the September 2025 drone incidents was a political act of courage — naming what was happening rather than managing it through diplomatic euphemism. In a strategic environment where grey zone aggression depends on the victim's ambiguity, naming it clearly is part of the deterrence response. Poland is developing a model of public grey zone accountability that other Alliance members should observe and adopt. The refusal to pretend it isn't happening is the beginning of an adequate response.

Disrupting civilian infrastructure without violence

Kaliningrad — Russia's Baltic exclave between Poland and Lithuania — has been the source of systematic GPS jamming affecting civilian aviation, maritime navigation, and logistics operations across the Baltic region with increasing frequency. GPS jamming is a grey zone tool par excellence: it causes real disruption and real cost (diverted flights, compromised navigation, degraded logistics efficiency) without causing the physical casualties that would trigger formal military or legal responses.

The civilian aviation disruption has been the most publicly visible effect. Multiple airlines operating in the Baltic region have reported GPS interference severe enough to require alternative navigation procedures and in some cases flight route changes that add cost and time to regional aviation. The International Civil Aviation Organization (ICAO) has documented the jamming pattern and raised it through diplomatic channels with Russia — which has, predictably, denied responsibility while continuing the operations.

The military dimension of GPS warfare

The military dimension of Kaliningrad GPS jamming is more significant than the civilian disruption it causes. GPS-dependent weapons systems, drone navigation, and military logistics all rely on GNSS signals that can be degraded by jamming at sufficient power levels. By normalizing GPS jamming in the region — establishing it as a persistent background condition rather than a specific operational event — Russia reduces the calibration accuracy of GPS-dependent systems that NATO members in the region would use in an actual conflict.

NATO has responded by increasing attention to GPS-independent navigation alternatives — inertial navigation systems, encrypted military GPS (which is harder to jam than civilian signals), and tactical communication systems that are less GNSS-dependent. These adaptations are underway but incomplete. Kaliningrad's GPS jamming is a long-term capability degradation operation that compounds over time the longer it continues without a decisive response.

We have normalized GPS jamming over the Baltic to a degree that should alarm more people than it currently does. Airlines reroute, file complaints with ICAO, and continue flying. Military planners adapt their procedures and continue training. The jamming continues. Each month it continues without consequence, Russia learns that it can operate this grey zone tool without cost. The absence of cost is itself a message about Western resolve. I am not sure enough people in European capitals have fully processed this message.

Operations against infrastructure and logistics

Latvian intelligence's June 2026 warning identified an active GRU-linked sabotage network operating across Baltic and Polish territory — a network responsible for physical interference with rail infrastructure, energy facilities, logistics hubs, and communication systems. The documented operations include suspicious fires at freight facilities, interference with rail signaling systems, and the disruption of logistics operations that support Western military supply chains for Ukraine.

Several individuals linked to this network have been arrested in Baltic states and Poland over the past 18 months — arrests that have provided intelligence about the network's structure, recruitment methods, and operational objectives. The arrested individuals have been a mix of Russian intelligence officers operating under commercial cover and locally recruited agents from the Russian-speaking diaspora and from individuals with financial or personal vulnerabilities that made them susceptible to GRU recruitment.

Recruitment targeting and counter-intelligence

The GRU's recruitment methodology for Baltic and Polish sabotage networks reflects a systematic targeting of specific vulnerability categories. Individuals with financial difficulties, criminal records, ideological alignment with Russian political positions, family connections to Russia or Belarus, and professional access to critical infrastructure are the primary recruitment targets. The GRU's patience in cultivating these individuals — sometimes over years before activating them for specific operations — reflects the long-term operational investment that grey zone warfare requires.

Baltic and Polish counter-intelligence services have invested significantly in detecting and disrupting these recruitment operations — with notable success in the arrest record, but with the honest acknowledgment that every arrest represents an operation that was detected, and that the number of undetected operations is unknown by definition. Grey zone warfare's most uncomfortable feature is that success is invisible and failure is what gets counted.

Counter-intelligence work against GRU recruitment networks is unglamorous, patient, and absolutely essential. The Baltic intelligence services — built from scratch after 1991 by people who had lived inside Soviet intelligence structures and knew exactly what they were defending against — are among the most capable in the world relative to their size. Their work is protecting not only their own countries but the entire Alliance logistics infrastructure that sustains Ukraine. This work deserves far more public recognition than it receives.

Threatening language as a grey zone tool

Dmitry Medvedev — the former Russian President now serving as Deputy Chairman of the Security Council — has become the primary voice of Russian nuclear and escalatory rhetoric directed at NATO's eastern flank. His statements targeting the Baltic states and Poland with specific territorial threats, nuclear references, and historical revisionism serve a specific grey zone function: they create an ambient atmosphere of threat that conditions Baltic and Polish public discourse, generates domestic political pressure in those countries, and tests Alliance members' willingness to respond to rhetorical aggression with diplomatic cost imposition on Russia.

Medvedev's rhetoric is calibrated to be deniable as official Russian policy — he speaks in a personal capacity, using informal channels, with language that can be characterized as the opinion of a private individual rather than a state position. This deniability is the grey zone quality that makes it simultaneously effective as intimidation and difficult to formally attribute and respond to as a state action. The intimidation works because it is credible given Russia's behavior. The deniability serves Russia by preventing the response that credible threats should logically generate.

The deterrence calculus of rhetorical threats

Whether Medvedev's rhetoric actually deters Baltic and Polish policy — whether it causes those governments to moderate their support for Ukraine, their defense investments, or their advocacy within NATO — is the key question for assessing its effectiveness. The available evidence suggests it does not: Baltic defense spending has continued to increase, Polish support for Ukraine has remained unconditional, and NATO's eastern flank has moved toward greater military presence rather than the restraint that Russian deterrence rhetoric aims to produce.

The failure of Medvedev's rhetoric to deter Baltic and Polish behavior is itself strategically important evidence — it demonstrates that the countries most directly targeted by Russian grey zone aggression are the least susceptible to the deterrence logic those operations are designed to create. Fear, for these countries, produces resolution rather than restraint. Russia consistently underestimates this dynamic, and consistently suffers the strategic consequences of its underestimation.

Medvedev threatens and the Baltic states build more air defense. Russia jams GPS and Poland increases defense spending. Russian sabotage networks are discovered and Baltic counter-intelligence is strengthened. The grey zone operations are producing the opposite of their intended deterrence effect in the countries that matter most for NATO's eastern flank. This is not an accident of policy. It is the predictable result of threatening countries that have spent their entire post-Soviet existence preparing for exactly this threat.

The frank acknowledgment of exposure

Donald Tusk's statement — calling on Poland and its Baltic allies to "prepare as the most exposed group" within NATO — reflects the frank strategic assessment of a leader who has absorbed the intelligence picture without the diplomatic softening that multilateral forums tend to produce. Poland and the Baltic states are the most exposed: they share land borders with Russia or Belarus (or both), they are the primary logistics corridor for Western support to Ukraine, and they are the primary targets of the grey zone campaign documented in the June 26 Latvian intelligence warning.

Tusk's "most exposed group" framing is a call to action directed both internally — at Polish society and institutions — and externally, at NATO partners who may underestimate the threat's specific geographic concentration. It is also a statement about solidarity responsibility: the countries most exposed have the strongest legitimate claim to extraordinary Alliance support, and Tusk is making that claim explicitly rather than relying on the general language of collective defense that may not produce the specific resources the eastern flank requires.

The German general's assessment: 2029 attack possible

The June 2026 intelligence environment includes an assessment from a senior German general — reported in German defense reporting — that a Russian conventional military attack against NATO territory was possible by 2029. This assessment does not represent official NATO policy or a consensus intelligence judgment; it represents one senior officer's reading of Russian military rebuilding capacity, strategic intention signals, and the logical trajectory of Russia's current military posture if the Ukraine conflict ends without strategic defeat for Moscow.

The 2029 horizon is sobering not because it is certain — it is not — but because it defines the planning requirement: NATO's eastern flank states have approximately three years to reach a defense posture that deters a conventional military attack of the kind the German general's assessment contemplates. Three years, for military capability development and Alliance infrastructure investment, is a very short window. The grey zone campaign underway now is preparation — the testing of Alliance responses and the degradation of infrastructure — for a potential conventional military option that Russia wants to preserve even if it never exercises it.

I do not know if Russia will attack a NATO member by 2029. Neither does the German general. What I know is that the intelligence picture — the grey zone operations, the testing of Alliance responses, the military rebuilding — is consistent with a Russia that is building the option for conventional attack even as it continues the current grey zone campaign. Preparing for an option Russia is building is not paranoia. It is strategic prudence. Tusk understands this. I hope his partners in Brussels and Berlin understand it with equal urgency.

The legal and institutional gaps that must be closed

Effective deterrence of Russia's grey zone campaign requires closing the legal and institutional gaps that the campaign exploits. This means: establishing attribution standards for grey zone operations that allow timely Alliance responses without requiring the evidentiary thresholds designed for conventional warfare; developing Article 5 equivalents for hybrid attack thresholds that Russia has calibrated its operations to stay below; expanding the range of collective Alliance responses to include cyber countermeasures, economic measures, and intelligence declassification that impose costs on grey zone operations without triggering the escalation Russia uses to threaten; and resourcing Baltic and Polish intelligence and counter-intelligence operations at the scale the threat environment requires.

Each of these requirements is technically achievable within existing Alliance frameworks. None has been fully implemented. The gap between what deterrence requires and what the Alliance has built is the space in which Russia's grey zone campaign currently operates with limited cost.

The eastern flank as the learning laboratory

The Baltic states and Poland are, in effect, NATO's grey zone learning laboratory — the territory where Russia's hybrid aggression is being conducted at highest intensity and where the Alliance's responses are being developed in real time. The doctrines, legal frameworks, counter-intelligence methods, and deterrence tools that the Alliance develops in response to the June 2026 intelligence picture will determine its capacity to deter and respond to grey zone campaigns that, if Russia achieves sufficient confidence in their effectiveness, will expand to other Alliance territory.

Getting the response right on NATO's eastern flank is not only about protecting Estonia, Latvia, Lithuania, and Poland. It is about developing the institutional capacity that will protect every Alliance member against a form of aggression that Russia has perfected against Ukraine and is now deploying against NATO itself. The stakes of the laboratory are continental.

I have covered Russian grey zone operations for long enough to know that they work most effectively when their targets are divided about whether what is happening constitutes a real threat. The Baltic states have never had this division. Poland under Tusk has eliminated it. The rest of NATO is still developing its institutional response. The time pressure is real. The German general's 2029 horizon should be a planning deadline, not just an analytical curiosity. Three years is very little time to close very large gaps.

Putin's grey zone mastery: the complete picture

Vladimir Putin's grey zone strategy against the Baltic states and Poland is not improvised. It is a deliberate, multi-domain campaign — aerial testing through drone incursions, navigation warfare through GPS jamming, physical disruption through sabotage networks, psychological pressure through Medvedev's rhetoric, and the long-term preparation that all of these activities represent for a conventional military option Russia wants to preserve. The June 26 Latvian intelligence warning provides the most current documented map of this campaign. The map is detailed, specific, and alarming.

The response that the moment requires

The response this profile demands is not panic but urgency — the urgency of Alliance members who understand the pattern, who have the resources and the institutional capacity to close the gaps that grey zone aggression exploits, and who choose to act before the 2029 planning horizon transforms from a warning into a reality. Tusk knows this. The Baltic leaders know this. The German general knows this. The question is whether the rest of NATO knows it with equal clarity and equal urgency. The June 26 intelligence warning should help answer that question. The answer matters more than most of what is discussed in the Alliance's formal councils.

2029. The German general gives a timeline. That is not far away. It is three years from now. European democracies tend to act slowly, by consensus, with caution. Three years leaves no room for hesitation. Today's hybrid threat is the prelude to what Russia is planning for tomorrow.

By Maxime Marquette, columnist

Editorial stance

I am not a journalist but a columnist and analyst. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. I claim analytical clarity, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

Method and sources

This text keeps the basic distinction between verified facts and interpretive analysis. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under Sources, never here.

Primary source families used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

Secondary source families: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under Sources.

Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a critical, contextual synthesis based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.