Russia Rehearsing Tactics Along NATO’s Baltic Frontline
Executive Summary:
- Drones originating from Russia entered Latvian airspace on May 7. Irrespective of whether the drones are Russian or Ukrainian, the threat against the Baltics is a result of Russia’s ongoing war against Ukraine.
- Russia is using the Baltic frontline of the North Atlantic Treaty Organization (NATO) to rehearse airspace incursions and provocations while remaining below the threshold of open military confrontation.
- NATO’s ability to respond to repeated probing in the Baltic states will shape whether Moscow’s methods expand elsewhere in NATO, as they have already done with targeting of subsea critical infrastructure.
On May 7, several drones originating from Russia entered Latvian airspace. One crashed at an oil storage facility, while Latvian authorities continued efforts to locate another drone believed to have fallen in Rēzekne municipality (Delfi; Latvian Public Media, May 7). Latvian defense officials chose not to intercept the drones due to concerns over civilian safety and critical infrastructure (Latvian Public Media, May 7). The Latvian president and prime minister said that the drone incidents are a consequence of Russia’s war against Ukraine, while the origin of the drone is not yet confirmed (The Baltic Times; Latvian Public Media, May 7).
The Baltic states are on the frontline of North Atlantic Treaty Organization (NATO) defense. Moscow is trying to test and pressure NATO capabilities on this frontline without triggering a clear military response. As they are NATO members, a clear act of military aggression against the Baltic states would trigger Article 5, which stipulates that an attack against one ally is considered an attack against them all (NATO, April 4, 1949). The May 7 drone incident fits a broader pattern of activity that has intensified since Russia launched its full‑scale invasion of Ukraine. The NATO Air Policing mission in the Baltic region scrambled three times within a single week to identify and escort Russian military aircraft operating near Baltic airspace. On April 29, the mission intercepted two Russian SU-24 bombers and a TU-134 aircraft in a separate incident on the same day. On May 1, the mission intercepted and escorted two Russian SU-24M aircraft (LRT, May 4; United24Media, May 5). In all cases, the Russian aircraft either had their transponders switched off, lacked a flight plan, or were not maintaining radio communication with the regional air traffic control center (Lithuanian Ministry of National Defense, May 7). The Russian Ministry of Defense described the flight as routine and compliant with international rules (TASS, April 20).
The repeated incidents reflect a deliberate pattern of Russian pressure on NATO’s frontline. Moscow ultimately views the Baltic region as a key battleground in its broader conflict with the European Union and NATO, expanding from its war against Ukraine, and it considers the Baltic Sea “a potential theater of military operations” (see Jamestown Perspectives, May 27, 2025; see EDM, September 4, 2025).
NATO air defenses are vulnerable irrespective of whether the drones are Russian, involved in strikes against Ukraine, or Ukrainian involved in strikes against Russia. In March, drones originating from Russia crashed across all three Baltic states’ territories, including one that struck a power station in Estonia (Estonian World; LRT, March 25). During the 2025 Christmas period, Polish air defense services intercepted and escorted a Russian reconnaissance plane away from international waters of the Baltic Sea (Polskie Radio, December 25, 2025). The Lithuanian government has recognized that military actions on NATO’s border are more frequent and increasing due to Russia’s ongoing war against Ukraine (LRT, March 25).
Rehearsing such tactics in the Baltics before implementing them elsewhere presents real threats to NATO members beyond the frontline. On April 9, U.K. and Norwegian authorities announced the disruption of a Russian military operation aimed at surveying subsea fiber-optic cables in the North Atlantic (Euronews, April 9). During the operation, a Russian attack submarine operated in and around British waters while other specialist vessels conducted nefarious activity near critical underwater infrastructure (U.K. Government, April 9). Russia has been testing this tactic in the Baltic Sea and the Arctic since at least 2021 (see EDM, February 5, 2025). In January 2025, the Silver Dania, a Russian-crewed cargo ship, was detained by Norwegian authorities for suspected acts of sabotage after reports that a fiber-optic cable linking the Swedish island of Gotland to Ventspils, Latvia, had been damaged (see EDM, February 5, 2025). Russia and the People’s Republic of China (PRC) appear to be collaborating on undersea infrastructure sabotage operations. In October 2023, damage was reported to at least three major undersea infrastructure items in the Baltic Sea, including the Balticconnector Pipeline, a 77-kilometer-long (47.8-mile-long) undersea pipeline in the Gulf of Finland connecting Finland and Estonia. Both the Russian nuclear-powered cargo ship Sevmorput and the Hong Kong-flagged Newnew Polar Bear (formerly the Baltic Fumar) were operating near the locations of the damaged pipeline and cable segments, and departed together (see China Brief, February 14, 2025). In November 2024, two Baltic undersea communications cables were cut, with indications that the PRC vessel Yipeng-3 was acting under the instructions of an unidentified Russian intelligence figure (see China Brief, February 14, 2025).
Russia is rehearsing threats and tactics against NATO by generating and exploiting vulnerabilities across the alliance’s Baltic frontline under real operating conditions. Moscow can maintain deniability in its Baltic operations so long as its war against Ukraine continues. With the threat entrenched along NATO’s frontline, Moscow’s continued ability to derail meaningful negotiations with Ukraine creates space to extend these tactics further.
Facts Only
Drones originating from Russia entered Latvian airspace on May 7.
One drone crashed at an oil storage facility in Latvia.
Latvian authorities did not intercept the drones due to civilian safety concerns.
The Latvian president and prime minister linked the incidents to Russia’s war against Ukraine.
NATO Air Policing missions scrambled three times in one week to intercept Russian aircraft near Baltic airspace.
Russian aircraft involved in these incidents often had transponders off or lacked flight plans.
Russia described its flights as routine and compliant with international rules.
In March, drones from Russia crashed in all three Baltic states, including one striking an Estonian power station.
In December 2025, Polish air defenses intercepted a Russian reconnaissance plane near the Baltic Sea.
The U.K. and Norway disrupted a Russian operation surveying subsea fiber-optic cables in April.
A Russian attack submarine and specialist vessels were involved in the subsea operation.
In January 2025, a Russian-crewed cargo ship was detained for suspected sabotage of a fiber-optic cable.
Damage to the Balticconnector Pipeline in October 2023 was linked to Russian and Chinese vessels.
Two Baltic undersea communications cables were cut in November 2024, with a Chinese vessel implicated.
Executive Summary
Full Take
The strongest version of this narrative highlights Russia’s systematic testing of NATO’s resolve along its Baltic frontline, using drones, aircraft incursions, and subsea sabotage to probe vulnerabilities without crossing the threshold of outright war. The pattern is clear: Moscow employs deniable tactics—such as drones of ambiguous origin or transponder-less flights—to pressure NATO while avoiding Article 5 triggers. The collaboration with China in targeting undersea infrastructure adds a layer of complexity, suggesting a coordinated effort to disrupt Western critical systems. However, the narrative risks overemphasizing intent without definitive evidence of direct Russian state involvement in every incident. The repeated framing of these actions as "rehearsals" implies a strategic escalation, but the source material does not confirm whether these are coordinated trials or opportunistic provocations.
Root cause: This reflects a paradigm of hybrid warfare, where Russia exploits gray-zone tactics to erode NATO cohesion. The unstated assumption is that NATO’s reluctance to respond forcefully emboldens further aggression—a dynamic echoing Cold War-era brinkmanship. The implications for human agency are significant: Baltic states face constant pressure, while NATO must balance deterrence with avoiding escalation. The second-order consequences include normalized violations of sovereignty and the potential for miscalculation leading to broader conflict.
Bridge questions: How would NATO’s response change if drone origins were definitively traced to Russia? What evidence would shift the assessment from "provocation" to "preparation for war"? Are there alternative explanations for the subsea cable incidents beyond state-sponsored sabotage?
Counterstrike scan: If this were part of a coordinated influence campaign, the playbook would involve amplifying ambiguity (e.g., drone origins) to sow division within NATO and portray Russia as an unstoppable threat. The actual content aligns with this pattern by emphasizing vulnerability without definitive attribution, but it stops short of outright disinformation. The focus on NATO’s dilemmas rather than verifiable Russian actions could serve to undermine alliance confidence.
Patterns detected: ARC-0024 Ambiguity (exploiting uncertainty in drone origins), ARC-0043 Motte-and-Bailey (framing incidents as both isolated and part of a broader strategy).
Sentinel — Human
The text exhibits high analytical coherence and specific sourcing, consistent with human-driven geopolitical analysis, although it displays the structural fluency achievable by advanced language models.