ANALYSIS
Anatomy of an alarm: Russian drones, an anonymous source and two stories without proof
September 2026
The facts
On the morning of 24 September a Spanish newspaper reported that Russia was preparing a drone attack against Italy, France or Spain, launched from merchant ships in the Mediterranean. Within hours the story had spread across Europe, and by evening two of the three governments named had denied it. The next day another newspaper, in Italy, used it as proof of the opposite: not Russia, but a NATO ally was supposedly fabricating false alarms to drag us into war.
This piece does not set out to decide who is right about Moscow. It tries to do something simpler and rarer: to set what is documented next to what is not, and to apply the same yardstick to two opposite narratives.
On 24 September 2026 El Mundo, in an article by Xavier Colás, wrote that US intelligence had allegedly shared with some European governments a warning about a possible Russian drone operation against Spain, France or Italy. According to the paper, a CIA report had circulated among European foreign ministries in August, shortly after CIA Director John Ratcliffe's surprise visit to Moscow on 25 August. The trip is documented; what was discussed has not been made public.
The scenario described is precise: Gerbera drones about two metres long, with a range of up to 600 kilometres and 4-5 kilos of explosive, hidden in containers on commercial ships and launched 200-300 kilometres off the coast — not to destroy, but to shut down a port or an airport for a few hours. Two sources are cited: anonymous sources linked to the Lithuanian Ministry of Defence, and “several defence analysts” who say they know of the report. No document has been shown.
How governments responded
In Italy, Defence Minister Guido Crosetto wrote the same day that the alarm “helps no one and has no confirmation whatsoever”, urging people not to pour “more fuel on the fire”. On 25 September he was blunter: “It doesn't exist, we have no knowledge of it, and neither do the other governments mentioned.” Foreign Minister Antonio Tajani said there was “no confirmation” and that Italians should not fear Russian military attacks.
In France, on the evening of 24 September, live on TF1 and France 2, President Emmanuel Macron said “we can deny this information”: the CIA had not informed France. In the same interview, however, he called the situation “worrying” and said it was credible that France could suffer an attack like the one in Leipzig, discussed below.
The Spanish Ministry of Defence, contacted by Euronews, did not comment. There are no public statements from either the CIA or the Lithuanian government. NATO Secretary General Mark Rutte said the Russian threat “exists and is long-term” and asked Europeans to stay calm.
In short: nobody has shown the report cited, and two of the three governments named as recipients say they never received it.
The context: what is documented
The alarm did not come out of nowhere. In the preceding weeks there had been real incidents in Europe, and very different ones.
Leipzig, 4 August 2026. On the evening of 4 August, at Leipzig-Halle airport, a drone was found near a Ukrainian cargo aircraft carrying, according to Germany's Federal Prosecutor, “professional explosives and a detonator”. The device did not explode. A cargo plane forced to abort its landing struck an object in flight, presumably a second drone. There were no casualties. On 6 August the Federal Prosecutor took over the investigation, describing a “serious attack” on transport infrastructure, without naming suspects or states.
On 1 September Interior Minister Alexander Dobrindt and Foreign Minister Johann Wadephul formally attributed the attack to Russia. According to Dobrindt, “taken together, police investigations, the patterns of the offences and intelligence findings establish Russian responsibility”. It is worth separating, however, what in this attribution is public and what is not.
The description of the device is public. Dobrindt said the drone's configuration, components, explosive and triggering technique match known Russian operations, and pointed to the high technical level and the use of “low-level agents” to shield those behind them as typical features. These are indications of method, not direct proof of who gave the order.
Other elements have circulated only in the press, from anonymous sources. A US intelligence source told ABC News on 26 August that the explosive and the drone's structure were “typical” of the GRU, Russian military intelligence. ZDF reported two suspects with links to Russia, now at large. German media wrote about DNA traces allegedly leading to a 2024 attack at the same airport, without official confirmation.
The decisive part remains classified: the intelligence findings cited by the government, the identity of the person believed to be linked to Russian services, the investigation files. Security sources told ARD that “not everything can be made public while the network behind the attempt is still active”. No arrest has been confirmed. Moscow rejects everything: Russia's foreign intelligence service accused Berlin of drawing conclusions “without even waiting for the preliminary results of the investigation”, and Putin spoke of fabricated evidence.
The attack, then, is proven. Russian responsibility is asserted by a government that states its basis, but that basis is not public and cannot today be verified from outside. There may be a legitimate reason of investigative confidentiality; the fact remains that, for now, the public has to trust it. We had already written this on this site at the time, in an opinion piece on 2 September.
Lithuania, 15 September 2026. Italian fighter jets from NATO's air policing mission, based at Šiauliai, shot down a drone that had entered Lithuanian airspace from Belarus near the Kruonis hydroelectric plant. Lithuanian President Gitanas Nausėda said it was most likely a Russian Gerbera “intended for Ukraine”, diverted by Ukrainian electronic warfare. No damage was reported.
In Leipzig there is a real device, a target linked to Ukraine and a formal attribution based on largely classified evidence. In Lithuania there is an airspace violation that the Lithuanian president himself attributes to a course deviation caused by Kyiv, not to a deliberate attack.
The symmetry test: two stories, one yardstick
The alarmist story
The first story says: Russia is preparing an attack from the sea against Southern Europe, and the CIA has warned us. It rests on a real context of hybrid attacks and on some anonymous sources. It lacks the document, an identifiable source and confirmation from any of the governments involved; indeed, Rome and Paris deny having received the information. Its weak point is presenting as a “CIA alert” what, in the article's own words, is what an anonymous Lithuanian source says about a report nobody has seen. Many European headlines dropped the conditional.
The opposite story
The second story is Marco Travaglio's editorial in Il Fatto Quotidiano of 25 September, «“Ibrido” sarà lei», whose full text can be read on the paper's website. Here we set out all of its arguments, in the order in which they appear, with a check for each.
1. Everyone wages hybrid war. Travaglio defines it as an attack “without leaving fingerprints” and notes that it is practised by the United States, NATO, the European Union, Israel and Ukraine on one side, and China, Russia and Iran on the other. This is correct as a principle, and it is the same principle behind this site's symmetry test.
2. A TV series explains things better than the media. He cites the third season of Lioness, in which the CIA first suspects Moscow and then two allies, Ukraine and Israel. It is a rhetorical device: fiction can illustrate a hypothesis, not prove it.
3. The media present hybrid war as a Russian exclusive while waging it themselves on behalf of “friends”. This is a judgement on the information system, not backed by documented cases.
4. Every border incursion becomes a Putin “hybrid attack”, even when it comes from Ukraine and causes no deaths, injuries or damage. This is partly well founded: the Lithuanian case is precisely an incursion that the Lithuanian president attributes to an error caused by Kyiv. But the generalisation overlooks Leipzig, where the absence of casualties is due to a device that failed to explode, not to the absence of an attack.
5. “Putin is testing our defences” makes no sense, because he already knows them. This is debatable: according to a widely held reading, such probes serve not to find out where the defences are, but to measure reaction times, coordination among allies and political response. That too, however, remains an interpretation rather than an established fact, as we noted about Leipzig.
6. Hysteria makes us ridiculous or strengthens Putin. Travaglio lists Ukrainian missiles mistaken for Russian ones, flocks of birds taken for drones, flight delays read as sabotage. The episodes are not referenced in the text and would need to be checked one by one. The underlying argument — that alarmism inflates the adversary — matches the conclusion of this piece.
7. Three motives. Propping up discredited governments by justifying “censorship, annulled elections and parties outlawed”; getting hundreds of billions in military spending accepted; having an alibi to sabotage negotiations on Ukraine. These are asserted as facts, without sources. “Annulled elections” almost certainly refers to Romania: on 6 December 2024 the Romanian Constitutional Court unanimously annulled the first round of the presidential election after documents of the Supreme Defence Council were declassified. It is a contested decision, but a reasoned one, not an arbitrary one. The other two motives are legitimate political arguments, not established facts.
8. The El Mundo case. There is “no trace” of the report; the story allegedly went from a Lithuanian minister to the paper “without anyone warning the three target countries”; Crosetto denies it, while Paris, Madrid and the European Union say nothing. In substance this is confirmed: the report has not been shown, and Rome and Paris say they did not receive it. There are two inaccuracies. El Mundo refers to anonymous sources in the Lithuanian ministry, not to a minister. And Paris did not stay silent: Macron issued a denial on television on the evening of the 24th, probably after the editorial was written. Madrid, indeed, did not comment.
9. The conclusion. “Lithuania, like Ukraine, launches false hybrid alarms to wage hybrid war”, that is, to drag into war allies that have no interest in fighting Russia. This is where the argument does not hold. It moves from “an anonymous source close to the Lithuanian ministry spoke to a newspaper” to “Lithuania, as a state, is conducting a deliberate operation”. An anonymous source is not a government, and unconfirmed information is not an intentional provocation. For this conclusion the text offers no proof at all.
On the El Mundo story, then, Travaglio's scepticism is borne out by the facts. The problem is what he does with it: he asks the media for proof that he does not then provide for his own thesis.
What they have in common
The two stories perform the same operation: they take unverified information and turn it into confirmation of what their author already thought. The first derives from it an imminent Russian threat, the second an allied plot. Neither has, today, the evidence for the conclusion it draws.
Legal commentary
International law does not regulate what newspapers write. It does, however, address very precisely the question at the heart of this affair: when can an attack be said to be the work of a state?
Every state has complete and exclusive sovereignty over the airspace above its territory: a customary principle, restated in Article 1 of the 1944 Chicago Convention. In its 1986 judgment in Nicaragua v. United States, the International Court of Justice held that unauthorised overflight directly infringes the sovereignty of the state overflown. The drone shot down over Lithuania is therefore an objective violation; establishing who is responsible, if the drone was diverted by a third party's electronic warfare, is another matter.
Article 2(4) of the United Nations Charter prohibits the threat or use of force against the territorial integrity of another state. An explosive attack on an airport, if attributed to a state, at the very least violates territorial sovereignty and the principle of non-intervention; whether it also amounts to a “use of force” is debated among scholars.
The crux, in hybrid warfare, is attribution. Under Article 8 of the International Law Commission's Articles on State Responsibility (2001), the conduct of persons or groups is attributable to a state if they act on its instructions, or under its direction or control. That is exactly what has to be proven when intermediaries are used precisely so as to leave no fingerprints.
And the proof has to be solid. In the Corfu Channel case (1949) the International Court of Justice accepted indirect evidence only on condition that it leaves “no room for reasonable doubt”. In Bosnia and Herzegovina v. Serbia (2007) it required, for charges of exceptional gravity against a state, evidence that is “fully conclusive”.
These standards apply to a court, not to a newspaper or a minister. But they indicate a measure, and that measure must be applied to everyone. On Leipzig, Germany has stated a basis, but the decisive part remains classified: today that attribution can be verified only in part, and will be fully verifiable only through a trial or the publication of the files. El Mundo's alarm and the “false Lithuanian alarm” thesis, by contrast, point to no verifiable basis at all.
Editorial judgement
Hybrid war thrives on ambiguity: its purpose is to confuse, and every unverified alarm does it a favour, whichever direction it goes. Those who amplify a threat they cannot prove spread fear and make the adversary look more powerful than it is. Those who dismiss everything as invention blind themselves to real attacks, like the one in Leipzig.
We are not asking for the public to be kept in the dark: the right of citizens to receive information, protected by Article 19 of the International Covenant on Civil and Political Rights, applies in crises too. We are asking for something else: that those who communicate, governments and newspapers alike, always say clearly what is established, what is suspected and what is unconfirmed. And that an accusation against a state come together with its basis, not before it.
There is also a political question, which we state as our own position. A climate of constant alarms makes diplomacy harder, and makes it more costly for any government to sit down at a table. We believe that Europe's security also depends on negotiation, and that negotiation needs verified facts, not fears. The tools to reduce ambiguity exist, from technical deconfliction channels to a shared attribution mechanism within the OSCE, as we wrote in July. None of the actors in this affair, on either side, should pursue their aims through ambiguity.
Related pieces: Hybrid war, hidden evidence: escalation on two tracks · How Europe could end up at war without choosing it · Anatomy of an interview: the American plan, Zelensky and a defeat presented as inevitable
Sources: Il Fatto Quotidiano — the El Mundo story (24/9) · Euronews — El Mundo's sources, Rutte, Spanish Defence (24/9) · Il Sole 24 Ore — Crosetto (24/9) · Il Post — Crosetto (24/9) · Adnkronos — Crosetto and Tajani (25/9) · Sky TG24 — Macron on TF1 and France 2 (24/9) · Euronews — Macron · CNN — Ratcliffe in Moscow (25/8) · German Federal Prosecutor — statement of 6/8 · Al Jazeera — German attribution (1/9) · Stuttgarter Nachrichten — the evidence cited by the government · ABC News — US intelligence source (26/8) · ZDF — the two suspects · ComplexDiscovery — public and classified evidence · Euronews — the DNA trail (11/8) · LRT — Nausėda on the downed drone (16/9) · Il Fatto Quotidiano — Marco Travaglio's editorial (25/9) · Agenzia Nova — the Romanian Constitutional Court · ICJ — Nicaragua v. United States, 1986, §251 · ILC — Articles on State Responsibility, 2001 · ICJ — Corfu Channel, 1949 · ICJ — Bosnia and Herzegovina v. Serbia, 2007, §209
Verification note: the CIA report cited by El Mundo has not been made public by any party; all information about its content comes from anonymous sources. The evidence supporting Germany's attribution of Leipzig is largely classified: what is reported here is what was public as of 27 September 2026. Travaglio's editorial is not reproduced in full for copyright reasons; quotations are brief and for the purpose of criticism.