Intelligence services in Latvia, Lithuania and Poland have issued some of the most specific warnings of the war: that Russia is preparing to manufacture a border incident — potentially involving small special-forces teams — and then present it as a NATO attack, in a calculated attempt to paralyse the alliance's Article 5 collective-defence guarantee.
A converging warning from three intelligence services
According to the warnings, Latvia's Defence Intelligence and Security Service has released a statement saying it holds intelligence indicating that Russia is preparing to send small special-forces units across the border with NATO. Lithuania's and Poland's intelligence services say they have obtained similar intelligence reports, and they go further: in their assessment, Moscow is preparing a false-flag operation — engineering a fake attack on itself and framing it as a NATO strike against Russia.
The logic is brutally simple. Article 5, NATO's collective-defence clause, is triggered when an ally is attacked. If a NATO member can be made to look like the aggressor, the guarantee falls into a grey zone. The Kremlin would then exploit that ambiguity to divide allied capitals over how — or whether — to respond to a Russian follow-up attack.
Independent reporting backs the broader pattern. Reuters reported in August that Lithuanian intelligence believes Russia is considering using captured Ukrainian-made drones to stage provocations against the Baltic states. Defence Minister Robertas Kaunas said openly: "We are talking about a false flag operation, using a false Ukrainian drone... One of the goals is for NATO to waver and decrease support to Ukraine." President Gitanas Nauseda has said intelligence points to Russian planning against infrastructure, and security around energy and transport sites has been tightened. Reuters also reported that Poland, Latvia and Estonia have joined Lithuania in hardening dams, power plants and gas infrastructure against sabotage. The Kremlin's spokesman Dmitry Peskov dismissed the warnings as "scare stories".
Incidents are already piling up in the Baltic
The warnings are not abstract. On September 19, Estonian radars detected three Russian MiG-31 interceptor jets crossing into Estonian airspace near Vaindloo Island in the Gulf of Finland. According to Estonia's military, the jets penetrated roughly nine kilometres into Estonian airspace and remained there for about twelve minutes — with no flight plans filed, their transponders switched off, and no contact with air traffic control. Italian F-35 fighters on the Baltic Air Policing rotation scrambled from Ämari Air Base and intercepted the intruders; Prime Minister Kristen Michal said NATO jets forced them to flee. Estonia invoked Article 4, which convenes allied consultations on a security threat, and NATO Secretary General Mark Rutte praised the response as "quick and decisive".
Days earlier, Denmark summoned Russia's ambassador after a Russian frigate fired two signal flares towards a Danish military helicopter conducting routine photographic monitoring in international waters near Gedser. The Danish Armed Forces said one flare passed close to the aircraft; Foreign Minister Lars Løkke Rasmussen called the incident "unacceptable", while Prime Minister Mette Frederiksen described it as part of a pattern of increasingly confrontational Russian behaviour aimed at sowing fear and discord. Moscow's ambassador countered that the Danish helicopter had carried out provocative manoeuvres — a denial that fits the very script the intelligence services warn about.
What Moscow stands to gain
A manufactured border incident would serve two Kremlin goals at once. Militarily, it would test how fast NATO makes decisions when the facts are murky. Politically — and this is the point Lithuanian officials keep stressing — it would be designed to make the alliance waver in its support for Ukraine. As Defence Minister Kaunas put it, one of the goals would be for NATO to decrease support to Kyiv.
European intelligence leaders are reinforcing the message. Poland's Prime Minister Donald Tusk has told parliament that assessments point to possible Russian drone or missile strikes on NATO member states, framed to suggest that Article 5 commitments are weaker than claimed. France's President Emmanuel Macron has described those warnings as credible. Czech security chief Michal Koudelka has said Russian plans could include limited incursions or false-flag operations "within months rather than years".
None of this means an attack is imminent — even the intelligence services stress these are assessments of intent, not timetables. But the direction is unmistakable: Moscow is probing the Baltic frontier harder than at any point since its full-scale invasion of Ukraine, and NATO's eastern members are preparing as if the test is coming.
Watch our latest video coverage here: https://www.youtube.com/watch?v=0aP5308hFq8