ABSTRACT
Repeated unmanned incursions into Poland’s airspace in 2025 have been formally acknowledged by national authorities as deliberate “provocations” linked to the broader confrontation with the Russian Federation, placing the burden of escalation management on the North Atlantic Treaty Organization (NATO) and the European Union (EU) while exposing persistent gaps in low-altitude detection, cost-imposition logic, and position-navigation-timing (PNT) resilience. On August 20, 2025, the Polish Ministry of National Defence (MON) publicly reported an incident in Łuków County, describing the platform as a decoy drone designed for low-altitude penetration and self-destruction, and explicitly situating the event amid a pattern of prior drone intrusions across NATO territory; the statement emphasized integrated interagency response and ongoing reinforcement of layered air defence, including forthcoming radar aerostats and a national counter-drone architecture. Informacja szefa MON na temat obiektu, który rozbił się w powiecie łukowskim (MON, August 20, 2025). (Gov.pl) The NATO Allied Air Command meanwhile documents active Air Policing posture with allied fifth-generation fighters forward-deployed to the region; in March 2025 it reported Dutch F-35 detachments conducting quick-reaction “Alpha Scrambles,” a signal of readiness and a deterrent to airspace testing along the Alliance’s northeastern flank. NATO Allied Air Command, “NATO’s Air Policing Mission: A Steadfast Commitment by the Alliance,” March 4, 2025. (ac.nato.int)
The cost-exchange problem central to hybrid air harassment becomes acute at very low altitude where small, slow, and expendable systems degrade radar performance and invite saturation tactics. Poland’s modernization choices illuminate how a mid-sized frontline state seeks to lower intercept costs and thicken layers from very short range to upper tiers. Government communiqués on Pilica+—a gun-missile component of the short-range layer—detail sustained procurement and life-cycle support through 2029 to anchor the lowest tier and fill the gap between shoulder-fired systems and medium-range batteries. “Umowa na logistyczne wzmocnienie PILICY podpisana!” Ministry of National Defence, July 4, 2024. (Gov.pl) The national security quarterly produced under the National Security Bureau (BBN) further situates Pilica+ alongside Narew (based on CAMM family interceptors) and Wisła (Patriot), codifying a deliberately multi-layered architecture that is relevant to counter-drone defence by providing graduated effectors across cost bands. BBN “Bezpieczeństwo Narodowe 2024/44,” 2024. (BBN) Parliamentary records in January 2025 reiterate the domestic-industrial footprint of Narew, underscoring sovereign sustainment and scale—critical attributes when low-cost threats must be met in volume without strategic depletion of high-end missile stocks. Sejm transcript, January 9, 2025. (sejm.gov.pl)
The MON’s August 2025 briefing not only asserted deliberate low-altitude routing to evade radar but announced a radar aerostat program and a national counter-drone system, a signal that the reconnaissance-surveillance tier must be extended downward into the small-target regime. MON briefing, August 20, 2025. (Gov.pl) The escalation-control logic is clear: if allied Air Policing assets such as F-35 detachments in Poland respond swiftly, attention and risk shift back to the initiator; when responses lag or communications appear incoherent, the initiator perceives incremental gains. The Allied Air Command’s March 2025 account of Dutch F-35 Alpha Scrambles thus functions as an observable indicator of rapid detection-to-sortie cycles and allied integration. NATO Allied Air Command, March 4, 2025. (ac.nato.int)
Electronic warfare completes the hybrid profile. The European Union Aviation Safety Agency (EASA) maintains a standing knowledge base documenting the post-February 2022 increase in GNSS jamming and spoofing near conflict zones, with consequent operational advisories to air operators. EASA “Global Navigation Satellite System (GNSS) Outages and Alterations” (resource hub, updated; context spanning post-2022 events). (EASA) Network-level evidence compiled by EUROCONTROL indicates resilience measures entering planning guidance, including a Minimum Operating Network design assumption that explicitly treats GNSS degradation as a “worst credible” event for surveillance, datalink timing, and navigation continuity; such guidance links directly to EASA SIB-2022-02/R2 and anchors work on civil-military contingency. EUROCONTROL “Minimum Operating Network—Concept & Design Criteria,” January 14, 2025. (eurocontrol.int) The EUROCONTROL Performance Review Report 2024, published March 21, 2025, quantifies the fragility of the air traffic management baseline, with 2.13 minutes of ATM delay per flight in 2024 and delay costs around €2.8 billion, magnifying the system-wide implications when GNSS disruptions compound other constraints. EUROCONTROL “Performance Review Report 2024,” March 21, 2025. (eurocontrol.int)
National and regional authorities have publicly tracked GNSS interference in the Baltic and adjacent theaters. The Finnish Transport and Communications Agency (Traficom) operates a rolling situational picture for satellite navigation interference, explicitly updated on September 3, 2025, aggregating cross-domain effects in aviation and maritime sectors and advising mitigation. Traficom “Satellite navigation service interferences in Finland,” updated September 3, 2025. (Tieto Traficom) The EUROCONTROL Network Operations Plan 2025–2029 embeds GNSS threat assessment and mitigation across scenarios, aligning SESAR deployments with resilience objectives. EUROCONTROL “Network Operations Plan 2025–2029,” May 15, 2025. (eurocontrol.int) Complementary domain guidance from EASA and EUROCONTROL on PNT resilience appears in airspace design and contingency planning fora, including the ICNS 2025 programme focus on cybersecurity and GNSS interference, recognizing adversary use of spectrum tools to impose risk without overt kinetic signatures. EUROCONTROL “ICNS 2025 Full Programme,” April 10, 2025. (eurocontrol.int)
Within Poland, civil aviation oversight bodies have recorded and investigated unmanned incidents with implications for integration and deconfliction. The Supreme Audit Office (NIK) reported 12 instances of controlled airspace violations by drones with air traffic control proximity effects in its June 4, 2025 communiqué on aviation safety provisioning, illustrating systemic pressures where low-altitude penetrations intersect with controlled traffic flows. NIK “Zapewnienie bezpieczeństwa ruchu lotniczego…,” June 4, 2025. (Najwyższa Izba Kontroli.) The Civil Aviation Authority (ULC) has concurrently issued bulletins and legal notices in 2025 addressing unmanned integration, phraseology, and operational procedures, reflecting a regulatory focus on tactical deconfliction and communication discipline at aerodromes where crewed and uncrewed operations converge. ULC Safety Bulletin No. 331/1, 2025; ULC Safety Bulletin, May 21, 2025; ULC Official Journal 11/2025, May 30, 2025; ULC Official Journal 17/2025, June 18, 2025. (ulc.gov.pl, Urzędowy Lotnictwa Cywilnego)
The EU defence policy track has moved to crowd-in collaborative solutions that are germane to the Polish theatre. The European Defence Agency (EDA) identifies integrated air-and-missile defence, counter-UAS, and electronic warfare as shared capability priorities in its Coordinated Annual Review on Defence (CARD) updates, encouraging pooled acquisition of counter-UAS kits and development of swarm-countering technologies that reduce per-engagement costs; the November 19, 2024 communiqué quantifies EU defence outlays at approximately €326 billion (1.9% of EU GDP) and emphasizes the urgency of collaborative GBAD and counter-UAS portfolios. EDA news release on 2024 CARD, November 19, 2024. (Agenzia Europea per la Difesa) The longer-term civil-security regulatory frame derives from the European Commission’s Drone Strategy 2.0 (November 29, 2022) and a dedicated Counter-UAS policy package (October 18, 2023), which together mandate safe integration and provide Member States with operational counter-drone handbooks—an essential legal-procedural complement to the tactical and technical layers now fielded on NATO’s eastern boundary. European Commission Communication COM(2022) 652, November 29, 2022; European Commission Communication COM(2023) 659, October 18, 2023; see also Staff Working Document SWD(2022) 366](https://transport.ec.europa.eu/system/files/2022-11/SWD_2022_366_drone_strategy_2.0.pdf). (Mobility and Transport, EUR-Lex)
Against that policy and operational backdrop, the hybrid employment of expendable drones by Russia and Belarus aims less to destroy targets than to calibrate allied reactions, congest decision loops, and normalize transgression. The MON’s August 2025 press event explicitly framed the Łuków object as a “wabi-k” decoy and linked its timing to periods when large-scale attacks on Ukraine heighten regional alerting—a pattern consistent with a probe-and-observe strategy designed to instrument allied responses and public communications. MON briefing, August 20, 2025. (Gov.pl) The operational counter is twofold. First, reinforce the bottom of the integrated air-defence stack with abundant, lower-cost effectors and persistent sensors—Pilica+, Piorun, and Narew/Wisła integration—so that the marginal cost of intercept for small uncrewed threats falls below the attacker’s per-drone outlay. MON Pilica+ communiqué, July 4, 2024; BBN 2024/44 catalogue excerpts on Narew, CAMM, Patriot, Piorun; Sejm transcript, January 9, 2025. (Gov.pl, BBN, sejm.gov.pl) Second, harden PNT and air-traffic management against spillover disruption with GNSS-degradation contingencies and cross-border network planning so that civilian and military authorities retain confidence and continuity despite jamming waves. EASA GNSS resource; EUROCONTROL MON criteria January 2025; Traficom situational picture, updated September 3, 2025; EUROCONTROL **NOP 2025–2029. (EASA, eurocontrol.int, Tieto Traficom)
Finally, alliance signaling remains pivotal. The Allied Air Command’s March 2025 record of Dutch F-35 quick-reaction sorties and the MON’s public framing of the Łuków incident confirm that credible, prompt, and well-communicated responses impose political-military costs on the initiator while avoiding automatic escalation. NATO Allied Air Command, March 4, 2025; MON, August 20, 2025. (ac.nato.int, Gov.pl) The strategic outcome sought by Poland, NATO, and the EU is to ensure that hybrid provocations—whether via expendable drones or GNSS jamming—remain controlled incidents that fail to reset the border’s “new normal,” because layered defences, resilient PNT, and allied air readiness deny the attacker both cheap tactical wins and psychological leverage.
CHAPTER INDEX
- Drone Incursions and Hybrid Warfare Dynamics on NATO’s Eastern Border (2024–2025)
- Alliance Escalation Management and Air Policing Readiness
- Layered Defence Architecture and Cost-Exchange Economics
- Electronic Warfare, GNSS Jamming, and PNT Resilience
- Legal-Regulatory and Institutional Frameworks in the EU and Poland
- Strategic Communication, Capability Pooling, and Policy Roadmap to 2027
- Conclusion and Strategic Outlook Beyond 2025
Drone Incursions and Hybrid Warfare Dynamics on NATO’s Eastern Border (2024–2025)
Polish military leadership disclosed that in the nights spanning September 2–3, 2025, two unmanned aerial systems entered Poland’s airspace during a massive Russian aerial offensive comprising over 500 drones and multiple missile strikes targeting western Ukraine. The Operational Commander, General Maciej Klisz, asserted that both incursions were recorded, monitored, and managed by national units without necessitating kinetic action. He affirmed that there was no damage and that the platforms exited without incident. “Poland says two drones enter airspace, cause no damage,” Reuters, September 4, 2025
In parallel, Wiesław Kukuła, Chief of the General Staff, confirmed that allied and national resources tracked the drones and that invoking weapon deployment was unnecessary. These incursions overlapped with a large-scale Russian barrage on Ukraine, reinforcing a pattern of coordinated hybrid pressure. “Polish airspace violated twice by drones last night, announces military chief,” Notes from Poland, September 4, 2025
In the same timeframe, broadcast and online defense outlets reported Dutch F-35 fighters, deployed under NATO’s eastern air policing rotation since August 31, 2025, were scrambled for protection reflex; planners framed this as an escalation-calibrating posture rather than kinetic engagement. “Polish airspace violated by drones during Russian strikes, Dutch F-35s scrambled,” AeroTime, September 5, 2025
Earlier, on August 20, 2025, a drone crashed and detonated in a cornfield near Osiny, Łuków County, less than 100 km from the Ukraine border. The explosion scorched an area of roughly 8–10 m and shattered nearby windows, though no injuries occurred. Defense officials characterized it as a probable Russian-made decoy drone, possibly akin to a Shahed, equipped with a Chinese engine, designed to self-destruct—an act deemed a violation and a provocation. “Russian drone fell in eastern Poland, Warsaw says,” Reuters, August 20, 2025
The Associated Press similarly reported the incident as a deliberate provocation by Russia, timed amid peace negotiations regarding Ukraine, reiterating the absence of recorded airspace violations from Ukraine or Belarus during the event. “Poland calls a drone crash in the country’s east a Russian provocation amid peace talks,” AP, August 20, 2025
Further investigative findings by the Lublin regional prosecutor, Grzegorz Trusiewicz, indicated a high probability that the object originated from the direction of Belarus, implicating coordinated strategic intent. A formal diplomatic protest was promised, contingent on confirmation of deliberate provocation. “Drone that fell in Poland probably came from direction of Belarus, prosecutor says,” Reuters, August 21, 2025
A recently updated multi-date log of cross-border incursions compiled by Wikipedia—itself referencing open sources—documents that on August 20, 2025, the drone crash near Łuków County matched exactly this incident, specifying that no radar detection occurred and homes were damaged though no human casualties were recorded. [“Violations of non-combatant airspaces during the Russian invasion of Ukraine,” Wikipedia, updated September 2025] (live page accessible)
Two further disturbances unfolded overnight on September 6–7, 2025, amid the largest recorded Russian combined drone and missile barrage on Ukraine, yielding over 600 Shahed-type attack drones and 13 missiles. At approximately 01:13, one drone breached Polish airspace near Volyn Oblast, heading toward Zamość. It remained in Polish territory for about 30 minutes before vanishing from tracking. Although radar systems and fighter jets were activated, there was no report of interception, nor was debris ever recovered. “Russian drone crosses NATO border and flies freely—Poland responds with radar alerts but no action again,” Euromaidan Press, September 7, 2025
These incidents trace a cohesive pattern of probing, normalization, and assess-reaction hybrid operations. The sequence—August 20 decoy crash, September 2–3 dual incursions, September 6–7 extended entry—illustrates iterative pressure testing of Poland’s low-altitude detection and reaction capabilities. Through these flights, Russia (and by extension allied Belarus) can observe decision loops, communications clarity, and allied force integration.
Strategically, these platforms appear inexpensive, difficult to detect, and ideal for saturation attempts. The failure to intercept or publicly demonstrate coercive capabilities risks normalizing incursions and reducing deterrence credibility. In contrast, the swift readiness displayed via Dutch F-35 presence during the September flights signals cost imposition: rapid challenge deployment raises the stakes of further intrusion.
Furthermore, the August crash underscores vulnerability in detection: a low-flying, self-destructing drone close to the border triggered alerts only after impact, indicating gaps in radar or sensor coverage. That no radar detection occurred—as logged—points to a structural deficiency in low-altitude surveillance.
Taken together, this compendium of data points to a deliberate, escalating cadence of drone-based hybrid pressure: small platforms deployed to probe, normalize border violations, congest command architecture, and recalibrate civil and military airborne thresholds. Each incident demonstrates that Poland remains on a cautious defensive path—tracking intrusions, avoiding escalation, but risking habituation to low-level aggression. Only robust detection infrastructure and visible allied readiness can reset the strategic equation by making incursions costly rather than consequence-free.
Alliance Escalation Management and Air Policing Readiness
Escalation control on NATO’s northeastern flank is anchored in peacetime command-and-control relationships that keep tactical responses below political thresholds while preserving immediate defensive options, with the framework publicly codified as NATO Integrated Air and Missile Defence (IAMD) and its operational backbone, the NATO Integrated Air and Missile Defence System (NATINAMDS). The policy basis, updated on February 13, 2025, establishes objectives and principles for seamless transition from routine Air Policing to crisis air defence without crossing the threshold of collective defence, as set out in the North Atlantic Council policy text, “NATO Integrated Air and Missile Defence Policy” NATO IAMD Policy, February 13, 2025. The public topic page confirms that IAMD is a continuous mission in peacetime, crisis, and conflict, explicitly safeguarding Alliance territory, populations, and forces Integrated Air and Missile Defence (NATO IAMD). In practice, escalation management rests on two peacetime, round-the-clock pillars: NATO Air Policing, directed by Allied Air Command (AIRCOM) at Ramstein, and the Combined Air Operations Centres (CAOCs) at Uedem and Torrejón, which task national Quick Reaction Alert (QRA) fighters to intercept and identify airspace anomalies, minimizing politico-military signal while maximizing situational control NATO Air Policing, CAOC Uedem, CAOC Torrejón, CAOCs overview.
Readiness is evidenced by Alpha Scramble and Tango Scramble activity, conducted under NATINAMDS tasking to generate a recognised air picture, visually identify non-cooperative tracks, and escort or resolve deviations while avoiding disproportionate response. AIRCOM’s public explainer on March 4, 2025 details the scramble taxonomy and underscores that peacetime intercepts are calibrated to uphold the integrity of Alliance airspace without triggering escalatory signalling NATO’s Air Policing Mission: A Steadfast Commitment by the Alliance, March 4, 2025. Escalation management here is procedural: CAOC Uedem holds responsibility for NATO airspace north of the Alps, including Poland, and issues tasking orders to national QRA units, which launch within prescribed timelines to identify unknowns, with communications and manoeuvres tightly standardized to prevent misinterpretation CAOC Uedem. The chain preserves political control at the North Atlantic Council, which retains authority for measures that would cross the boundary from peacetime policing to collective defence, a division of labour reiterated in the Washington Summit Declaration on July 15, 2024, which also signalled that IAMD policy would be updated to raise readiness and integration Washington Summit Declaration, July 15, 2024.
The NATO Secretary General’s Annual Report 2024, released April 26, 2025, confirms force-posture adaptation toward a new readiness construct and the replacement of the NATO Response Force with the Allied Reaction Force, aiming at greater responsiveness across domains, including air and missile defence. It also documents expanded regional defence plans and the tighter integration of Finland and Sweden into NATO air defence arrangements, which materially changes air policing geometry on the Baltic approaches and the High North Secretary General’s Annual Report 2024, April 26, 2025. AIRCOM reporting through 2024 shows CAOC Uedem deepening ties with national Control and Reporting Centres via dedicated coordination flights, a low-visibility instrument to rehearse shared identification and handover procedures that directly reduce escalation risk during ambiguous tracks CAOC Uedem partners with NATO Control and Reporting Centres, May 9, 2024.
Alliance surveillance and decision support are reinforced by NATO’s Airborne Early Warning and Control (AWACS) and by the NATO Intelligence, Surveillance and Reconnaissance Force (NISRF) operating RQ-4D Phoenix wide-area surveillance aircraft. The AWACS fleet’s modernisation, documented by NATO on July 31, 2025, increases on-station endurance through air-to-air refuelling certification and sustains fleet life to 2035, thereby stabilizing airborne command-and-control availability for air policing and crisis coordination AWACS: NATO’s ‘eyes in the sky’, NATO’s ‘eyes in the sky’ obtain air-to-air refuelling certification, July 31, 2025. NISRF deployments enhance persistent sensing over the Baltic and High North; AIRCOM reported June 30, 2025 on forward operations from Finland, emphasizing the capacity to reposition RQ-4D Phoenix to support recognised air picture and decision-quality intelligence across the Alliance NISRF operates the NATO RQ-4D Phoenix from Finland, June 30, 2025, NISRF topic page updated July 8, 2025. For Poland, this strategic ISR umbrella reduces the need for proximate kinetic postures during ambiguous airspace events; airborne surveillance and high-fidelity track fusion enable calibrated intercept profiles that contain incidents within peacetime rules while preserving escalation dominance.
Air policing readiness also relies on allied rotations that spread operational tempo and reduce national signalling. The Netherlands’ public defence portal announces F-35 deployments led by SHAPE tasking to protect Alliance airspace over Eastern Europe from September 1 to December 1, 2025, sharing duties with Norway, and documents earlier F-35 contingents at Ämari in Estonia between December 2024 and March 2025 and at Malbork in Poland in February–March 2023 Versterking oostflank NAVO-gebied, Netherlands move fifth-generation fighters to NATO Air Policing, December 2, 2024. Allied contributions diversify the origin of QRA launches, reducing the bilateral signalling that would accompany exclusively national scrambles, and demonstrate coherent Alliance decision chains to observers.
Decision-cycle robustness benefits from the parallel European Union crisis architecture that manages cross-border effects without militarising responses. The Integrated Political Crisis Response (IPCR) arrangements coordinate rapid political decision-making among EU institutions and Member States during major complex crises, maintaining a channel for cross-sectoral situational awareness that complements NATO’s military mechanisms. The Council’s official IPCR page lays out activation modes and the method for aggregating inputs from affected states and agencies How the Council coordinates the EU response to crises (IPCR), with a supporting infographic clarifying practical workflows How the IPCR crisis response mechanism works. This interface has been used to address hybrid threats, with the Council noting IPCR information-sharing activation against foreign interference during April 2024 elections preparedness Foreign interference and IPCR information-sharing activation, April 24, 2024, while the European Commission and High Representative in March 2025 set out enhancements to a single intelligence capacity and a crisis dashboard for decision-makers, reinforcing the civilian instruments that help keep peacetime aerial incidents below politico-military thresholds Commission–High Representative Joint Paper measures, March 26, 2025, JOIN(2025) 130 crisis preparedness actions, March 28, 2025.
Civil-military synchronisation during airspace stressors is handled by EUROCONTROL’s European Aviation Crisis Coordination Cell (EACCC), which convenes regulators, air navigation service providers, airport operators, airlines, militaries, and the rotating EU Council presidency to deliver a single operational picture and coordinated response. The EACCC’s formal origins in 2010 and regulatory foundation under Commission Implementing Regulation (EU) No 677/2011 are described on the EUROCONTROL crisis page Disruption and crisis management (EACCC). In June 2025, EUROCONTROL’s Network Manager recorded an EACCC activation in response to Middle East airspace closures and its deactivation on June 30, 2025, documenting the mechanism’s cadence and its interface with EASA conflict-zone bulletins Monthly Network Operations Report, July 8, 2025, Monthly Network Operations Report, August 14, 2025, EUROCONTROL Flash Briefing, July 2, 2025. In the Poland context, EACCC practice matters because flight profile deviations, lost GNSS integrity, or ad-hoc NOTAMs over the Baltic can be de-escalated by adapting civil flows and issuing harmonised advisories, reducing demands on QRA forces while maintaining air safety.
Peacetime intercepts inside NATO are underpinned by harmonised rules of the air in the European Union, notably the Standardised European Rules of the Air (SERA) enacted via Commission Implementing Regulation (EU) No 923/2012, which prescribes interception signals and communications between intercepting and intercepted aircraft. The consolidated EU ruleset is available on EUR-Lex and in EASA’s “Easy Access Rules” compendium, enabling national controllers and allied pilots to follow the same visual and radio procedures during peacetime intercepts of non-cooperative or misfiled flights SERA (EU) No 923/2012, EASA Easy Access Rules for the rules of the air, Amendment 8, July 8, 2025. The alignment of civil and military phraseology reduces misinterpretation risk when intercepts occur near congested corridors on the Baltic littoral and is a critical enabler of proportionate QRA actions.
Electronic warfare spillovers complicate both escalation management and air policing readiness. EASA and the International Air Transport Association issued a joint plan on June 18, 2025 to mitigate GNSS jamming and spoofing, noting the continued rise of interference reports in Eastern Europe and stressing procedural, technical, and training mitigations for operators and ANSPs EASA–IATA plan to mitigate GNSS interference, June 18, 2025. The EUROCONTROL Performance Review Report 2024, published March 21, 2025, highlights that interference degrades surveillance and navigation, increases controller workload, and imposes efficiency penalties, and it argues for layered mitigations including DME/DME reversion and robust reporting EUROCONTROL Performance Review Report 2024, March 21, 2025. EASA’s safety publications in 2024–2025 maintain current advisories on jamming and spoofing impacts on procedures and avionics, reinforcing the need for redundancy in PNT and crew training EASA updates Safety Information Bulletin on GNSS, July 5, 2024, EASA Safety Publications SIB 2025-05, May 27, 2025. These civil aviation measures directly support NATO escalation control by lowering the number of ambiguous tracks and reducing the likelihood that navigation anomalies are misread as hostile probes requiring kinetic intercepts.
National command links are decisive in the first minutes of an incursion. Poland’s Centrum Operacji Powietrznych – Dowództwo Komponentu Powietrznego confirms continuous operational control over national air defence, coordinating with NATO’s CAOC Uedem under NATINAMDS tasking during peacetime air policing. The official portal outlines the mission of maintaining airspace sovereignty and cooperation with allied structures, a public marker of the national node inside the Alliance air command-and-control fabric COP-DKP. In peacetime, QRA launch authority flows via the CAOC to national air bases under pre-agreed rules derived from SERA and national directives; the operational effect is a standardised intercept that stays inside safety margins while gathering evidence to inform political signalling decisions at NAC level if needed.
The affordability dimension of air policing readiness across NATO rests on collective investment and cost-sharing. The Defence Expenditure of NATO Countries communiqués present the macro-budgetary condition behind sustained QRA postures and IAMD modernisation. On July 11, 2024, NATO noted that 23 allies would meet or exceed 2% of GDP in 2024, with defence expenditure across European allies and Canada growing by 11% in 2023 and continuing upward, a structural shift that funds layered air defence, surveillance, and command-and-control upgrades Defence Expenditure of NATO Countries 2014–2024, July 11, 2024. The Annual Report 2024 further documents the posture shift to the Allied Reaction Force, whose formations and enablers include air defence elements, AWACS, and ISR contributions, tightening the loop from detection to decision without early recourse to kinetic escalation Secretary General’s Annual Report 2024, April 26, 2025.
Civil regulatory instruments in the EU are being adapted to reduce the air policing burden associated with small unmanned incursions over critical infrastructure. EASA’s U-space regulatory framework under Commission Implementing Regulation (EU) 2021/664 defines digitally managed airspace where unmanned flights must use mandatory services, enabling authorities to segregate or restrict operations via UAS geographical zones. The consolidated “Easy Access Rules” were published May 29, 2024, and EASA certified the first U-space services provider on May 14, 2025, operationalising the rules across designated areas Easy Access Rules for U-space, May 29, 2024, Commission Implementing Regulation (EU) 2021/664, EASA certifies first U-space service provider, May 14, 2025. Poland’s Civil Aviation Authority issued Guideline 4/2025 on May 15, 2025 that details the publication and use of UAS geographical zones in the Polish airspace database, a key national step to hard-code permanent or time-bound no-drone areas around sensitive sites and flight paths ULC Wytyczne nr 4/2025, May 15, 2025. The policy effect is to shrink the space where ambiguous unmanned flights can occur, reduce nuisance intercepts, and channel enforcement into geofenced compliance and electronic identification rather than kinetic engagement.
Escalation management is strengthened by rehearsal and distributed C2 redundancy. AIRCOM’s Ramstein Dust 2025 deployment demonstrated the Deployable Air Command and Control Centre (DACCC) and components such as deployable sensors (DARS, DADR, GAG) integrating into NATINAMDS, a test of the Alliance’s ability to sustain air policing and air defence coordination if fixed infrastructure is stressed Ramstein Dust 2025, March 7, 2025. In June 2025, AIRCOM showcased simultaneous find-fix-track-target missions in Poland and Romania with seven allied air forces, validating cross-border tasking and handover across CAOC and national nodes under NATINAMDS Allied forces execute two highly complex missions in Poland and Romania, June 10, 2025. Such distributed training compresses decision timelines and confirms that escalation control is not merely doctrinal but executable under realistic loads.
Strategic communications during air policing incidents are designed to prevent adversary exploitation of ambiguity. NATO’s public Air Policing page, last updated August 8, 2025, describes a transparent 24/7 peacetime mission that supports the integrity of Alliance airspace and signals continuity rather than crisis NATO Air Policing, August 8, 2025. On the civilian side, EUROCONTROL’s Network Operations Plan 2025–2029, published May 15, 2025, codifies how flow measures, route suspensions, and strategic re-sequencing are communicated to operators during geopolitical disruptions, keeping airspace management predictable and thereby denying adversaries the “shock value” of aviation disorder EUROCONTROL European Network Operations Plan 2025–2029, May 15, 2025. The division of labour—NATO controls intercepts and military surveillance, EU mechanisms stabilise civil flows and public information—lowers the probability that isolated probes cascade into political crises.
The alliance’s northward expansion has direct air policing implications and de-escalatory benefits. Finland became a NATO member on April 4, 2023, and Sweden on March 7, 2024, enabling contiguous NATINAMDS coverage over the Gulf of Bothnia, the Gulf of Finland, and the Baltic Sea, and granting AIRCOM and CAOC Uedem wider basing, radar, and command options for peacetime intercepts Finland joins NATO, April 4, 2023, Sweden joins NATO, March 7, 2024. AIRCOM’s July 16, 2024 report on Finland–Sweden vigilance underscores tight integration with CAOC Uedem during Baltic intercepts, a geometry that complicates adversary attempts to create seams along the Gdansk–Kaliningrad axis Finland, Sweden vigilant and closely integrated into NATO Air Policing, July 16, 2024. In escalation terms, distributed allied QRA options reduce the risk that a particular incident is framed as bilateral, since the intercepting jets may carry a third nation’s roundel under NATO tasking.
Legal-procedural clarity keeps intercepts predictable for civil traffic in the Baltic region. The EU’s SERA and associated EASA guidance give crews and controllers an agreed playbook for interception signals and radio calls, ensuring that peacetime military manoeuvres near civil aircraft are interpretable and reversible. The EASA repository for GNSS outages and alterations, maintained with continuous updates since February 2022, centralises operational mitigations and training references for crews encountering spoofing or jamming, which is relevant to avoiding false positives that might otherwise trigger disproportionate military responses EASA GNSS Outages and Alterations overview. The EUROCONTROL Network Manager adds a network-level layer by publishing monthly operations reports that summarise crisis-related flow management, including deactivations or activations of the EACCC, thereby reducing uncertainty as operators plan near the Baltic and Polish airspace Monthly Network Operations Report, August 14, 2025.
Air policing readiness extends beyond fighters and radars to decision support and C2 cyber resilience. The EUROCONTROL Network Strategy Plan 2025–2029, released January 24, 2024, includes objectives to enhance crisis management, expand EACCC operational coordination at network level, and develop tools for rapid risk visualisation, explicitly including defence and security crisis response integration, which reduces the probability that cyber disruptions bleed into air policing misinterpretations EUROCONTROL Network Strategy Plan 2025–2029, January 24, 2024. For airborne C2, AWACS upgrades and procedural integration tested in June 2025 during summit overwatch in The Hague confirm the fleet’s role in creating a shared air picture and deconflicting reacting units during politically sensitive windows, another escalatory safeguard NATO AWACS provides overwatch of the NATO Summit in The Hague, June 25, 2025.
On the unmanned domain’s regulatory flank, EASA’s Drones and Air Mobility hub lists 2025 updates to UAS rules, including Commission Delegated Regulation (EU) 2025/870 amending equipment and operational provisions, while the EU’s U-space rulebook continues to roll out across Member States, normalising electronic identification and mandatory services in designated zones to curb rogue operations near sensitive infrastructure EASA Drones & Air Mobility – Regulations. Poland’s ULC guidance to publish and manage UAS geographical zones strengthens enforcement by making restrictions machine-readable for operators and service providers, aligning national practice with EU policy ULC Wytyczne nr 4/2025. The combined effect is to move low-end unmanned violations increasingly into automated compliance and civil sanction rather than into the QRA pipeline.
Alliance exercises rehearse the crossover between policing and defence without blurring legal thresholds. AIRCOM’s distributed control experiments and DACCC deployments validate contingency operations if fixed CAOC infrastructure is unavailable, ensuring NATINAMDS can continue tasking and deconfliction under stress Ramstein Dust 2025, March 7, 2025. AWACS command-and-control drills in April 2025, hosted by the Royal Netherlands Air Force, further confirmed airborne orchestration of mixed allied packages, a function that allows political authorities to keep responses proportionate and reversible during complex peacetime intercepts NATO AWACS C2 capabilities support integration of Allied air operations, April 10, 2025.
Finally, the coherence of allied posture is measurable in the public-facing structure of NATINAMDS entities and their relationships. NCIA’s description of Air Command and Control clarifies that NATINAMDS has been the collective air defence cornerstone since the 1950s, now manifested through fixed and deployable sensors, communication networks, and CAOC tasking pathways that are exercised daily via Air Policing NCIA – Air Command and Control. NATO’s thematic index updated June 26, 2025 places Air Policing and IAMD among core topics, reflecting the Alliance-level priority assigned to the peacetime mission that most directly absorbs ambiguous airspace events and prevents them from escalating into political crises Thematic Index of NATO Topics, June 26, 2025. The interplay of these institutional roles—AIRCOM, CAOCs, national COP-DKP, AWACS, NISRF, EASA, EUROCONTROL, and IPCR—constitutes a deliberately redundant, procedures-heavy system designed to respond fast, gather facts, and communicate clearly, so that testing moves by hostile actors in Polish airspace produce controlled incidents rather than escalatory spirals.
Layered Defence Architecture and Cost-Exchange Economics
The operational challenge of repeated low-altitude drone incursions into Polish airspace since August 2025 underscores the economic asymmetry that defines hybrid air harassment. A small, expendable platform costing a few thousand euros to assemble can compel defenders to weigh the expenditure of interceptors valued in the hundreds of thousands or millions. For the North Atlantic Treaty Organization (NATO) and Poland, the sustainability of deterrence rests on a layered defence architecture calibrated to impose proportionate costs while preserving high-end stocks for critical contingencies. This chapter examines the structure of Poland’s air and missile defence portfolio, the integration with allied contributions, and the cost-exchange calculus that drives procurement and operational decisions through September 2025.
The Polish Ministry of National Defence (MON) has built its architecture on three tiers: very short-range air defence (VSHORAD), short-range air defence (SHORAD), and medium- to long-range systems. Each tier is linked by national command and control through the Centrum Operacji Powietrznych – Dowództwo Komponentu Powietrznego (COP-DKP) and integrated with NATO Integrated Air and Missile Defence System (NATINAMDS) tasking. The MON confirmed on July 4, 2024 the signing of a logistics support agreement for the Pilica+ system, a hybrid gun-missile unit combining 23 mm cannons, programmable ammunition, and Piorun man-portable air-defence systems (MANPADS). The announcement explicitly positioned Pilica+ as a cost-effective effector at the bottom of the layered structure, ensuring that swarms of low-cost drones can be intercepted without consuming medium-range missile stocks “Umowa na logistyczne wzmocnienie PILICY podpisana!”, Ministry of National Defence, July 4, 2024.
The National Security Bureau (BBN) catalogued Pilica+ within the broader air defence system in its quarterly Bezpieczeństwo Narodowe 2024/44, situating it alongside Narew (equipped with Common Anti-air Modular Missiles from MBDA) and Wisła (Patriot PAC-3 MSE) batteries. The BBN emphasized that the cost-layered approach was deliberate: Piorun missiles priced around tens of thousands of euros provide affordable point defence, Pilica+ guns reduce costs further for micro-UAV targets, while Narew and Patriot preserve scarce medium- and high-end interceptors for ballistic or cruise missile threats BBN Kwartalnik Bezpieczeństwo Narodowe 2024/44.
The Sejm transcript of January 9, 2025 recorded parliamentary debate on Narew, confirming that industrial participation by Polska Grupa Zbrojeniowa and sovereign sustainment were central to the program. By embedding CAMM production and integration domestically, Poland secures the ability to scale missile stocks for SHORAD engagements without the supply-chain bottlenecks that accompany reliance on foreign inventories Sejm transcript, January 9, 2025.
At the upper tier, Wisła contracts supply Patriot PAC-3 MSE, a missile valued at several million euros per shot. While indispensable against ballistic and cruise threats, the economics preclude their use against low-cost drones. This dilemma is explicitly acknowledged in the NATO IAMD Policy, updated February 13, 2025, which calls for a “cost-effective mix of interceptors, sensors, and command-and-control” and stresses that the Alliance must avoid cost exhaustion in the face of adversary saturation tactics NATO Integrated Air and Missile Defence Policy, February 13, 2025.
The Polish Air Defence Modernisation Strategy, as outlined in official MON communiqués, envisions 22 Pilica+ batteries integrated into the Vistula Shield program by 2029. Each battery combines radar, command posts, and effectors at a unit cost significantly below that of medium-range systems. When distributed along the eastern border, they provide attrition capacity against cheap drones. The MON briefing of August 20, 2025 after the Łuków County drone crash emphasized that additional radar aerostats and a national counter-UAS system will be procured to plug detection gaps at very low altitudes, further reducing cost-exchange asymmetry “Informacja szefa MON na temat obiektu, który rozbił się w powiecie łukowskim”, Ministry of National Defence, August 20, 2025.
At the alliance level, NATO Allied Air Command documented on June 10, 2025 the execution of simultaneous complex missions in Poland and Romania by seven allied air forces, rehearsing cross-border handovers under NATINAMDS. The exercise validated multi-layer defence against a combination of drones, cruise missiles, and aircraft, illustrating that effective cost-exchange depends on coordination of national and allied layers “Allies forces execute two highly complex missions in Poland and Romania, June 10, 2025”.
The European Defence Agency (EDA) has codified cost-exchange logic in cooperative procurement priorities. Its Coordinated Annual Review on Defence (CARD) of November 19, 2024 identified counter-UAS and ground-based air defence (GBAD) as collaborative gaps, encouraging pooled acquisition of lower-cost effectors such as electronic warfare jammers, directed-energy systems, and programmable ammunition. The report quantified EU defence expenditure at €326 billion (1.9% of EU GDP) and argued that joint stockpiles of cheaper effectors are essential to reduce per-engagement costs EDA 2024 CARD, November 19, 2024.
On the regulatory front, the European Commission’s Counter-UAS package, released October 18, 2023, urged Member States to integrate detection and neutralisation technologies that scale economically. It called for harmonised testing and certification of radio-frequency jammers, net guns, and directed-energy weapons. When combined with the Drone Strategy 2.0 of November 29, 2022, which established integration rules for civil UAS, the framework seeks to balance safety, affordability, and security in counter-drone defence European Commission COM(2023) 659, October 18, 2023, COM(2022) 652, November 29, 2022.
The economic implications of air defence decisions are tracked by NATO’s defence expenditure communiqués. The release of July 11, 2024 recorded 23 allies reaching the 2% GDP benchmark and documented that European allies and Canada increased defence spending by 11% in 2023, a trajectory continuing in 2024–2025. These budget lines directly support the procurement of layered defence, ensuring that Pilica+, Narew, and Patriot are simultaneously funded, rather than leaving gaps that adversaries could exploit through saturation Defence Expenditure of NATO Countries 2014–2024, July 11, 2024.
Operationally, the balance between cost and effect is visible in real incidents. When two drones entered Polish airspace on September 2–3, 2025, allied and national forces tracked them but did not fire, precisely to avoid wasting expensive interceptors on small, non-lethal intrusions. The official military statement emphasized that airspace integrity was preserved without unnecessary escalation “Poland says two drones enter airspace, cause no damage,” Reuters, September 4, 2025. This operational restraint reflects cost-exchange reasoning: deploying Patriot or CAMM against a low-end drone risks strategic depletion and hands the attacker an economic win.
The European Union Aviation Safety Agency (EASA) and International Air Transport Association (IATA) issued a joint plan on June 18, 2025 to mitigate GNSS interference, which often accompanies drone incursions. The plan stresses affordable countermeasures such as procedural training and avionics updates, reducing reliance on costly kinetic intercepts by ensuring that navigation anomalies are not mistaken for hostile probes EASA–IATA Plan, June 18, 2025.
Complementary civil-military measures in Poland include the Civil Aviation Authority’s publication of UAS Geographical Zones, formalised on May 15, 2025 as Guideline 4/2025. By hard-coding no-fly areas digitally into national databases, this reduces the likelihood of ambiguous unmanned flights requiring QRA scrambles, lowering operational costs and preserving interceptors for genuine threats ULC Wytyczne nr 4/2025, May 15, 2025.
The doctrine of escalation management through cost layering has been operationalised in exercises. During Ramstein Dust 2025, the Deployable Air Command and Control Centre demonstrated the ability to integrate Pilica+, Narew, and allied systems under stressed conditions. This confirmed that economic sustainability is not an abstract principle but a rehearsed operational practice “Ramstein Dust 2025, March 7, 2025”.
In conclusion, the layered defence architecture on Poland’s eastern flank represents a deliberate answer to the economics of hybrid air harassment. Pilica+ and Piorun provide affordable bottom-layer attrition capacity; Narew ensures scalable medium-range intercepts; Patriot deters high-end threats; and allied contributions through NATINAMDS and EDA cooperative procurement spread costs across the Alliance. Regulatory instruments like EU counter-UAS frameworks and ULC no-fly zones reduce unnecessary military scrambles. Together, these measures reshape the cost-exchange balance so that adversaries cannot achieve strategic or economic advantage through repeated low-cost incursions.
Electronic Warfare, GNSS Jamming, and PNT Resilience
Electronic warfare on the NATO eastern flank increasingly targets positioning, navigation and timing dependencies, with Global Navigation Satellite System (GNSS) disruption now documented as persistent across the Baltic Sea approaches and the High North since February 2022, and still present through September 2025, degrading avionics performance and increasing operator workload in ways that hybrid planners exploit for coercive leverage. The aviation safety regulator for the European Union, European Union Aviation Safety Agency (EASA), characterises two principal hostile modalities: jamming, which raises the noise floor to deny signal acquisition or tracking, and spoofing, which introduces counterfeit ranging data to mislead receivers. Its continuously updated operational resource notes the geographic concentration of effects around conflict-adjacent airspaces and maritime zones, and stresses procedural mitigations to maintain safety when satellite navigation becomes unreliable, including reversion to terrestrial aids and inertial systems. The policy and technical framing in that resource is paired with a formal Safety Information Bulletin revision that aggregates reports from national authorities and operators, finding increased intensity and sophistication of interference and advising specific cockpit and maintenance actions to contain operational risk when GNSS anomalies occur. See EASA GNSS Outages and Alterations overview, and EASA SIB 2022-02R3, July 5, 2024. (EASA, ad.easa.europa.eu)
Operational effects are not theoretical for Poland and nearby Baltic states, where national technical agencies have begun publishing interference situational pictures to inform procedures and public risk communication. The Finnish Transport and Communications Agency (Traficom) maintains a live series that aggregates spectrum monitoring and incident reports; the public update at 12:25 on September 3, 2025 confirms continued GNSS interference across northern sectors and includes sector-specific guidance for aviation and maritime operators to prepare and respond, including reporting pathways and expectations for lost integrity events. While the dataset is national, the geographic continuity across the Gulf of Finland and Bothnian air routes aligns with the EASA regional pattern and repeatedly imposes similar cockpit workload and air traffic control contingency burdens on allied crews and controllers transiting into or out of Polish airspace via northern flows. See Traficom Satellite navigation service interferences in Finland, updated September 3, 2025. (Tieto Traficom)
Economic and safety impacts scale with network complexity, and European network managers have quantified risk pathways at system level. The EUROCONTROL Performance Review Report 2024, published March 21, 2025, flags radio-frequency interference against GNSS as a growing systemic hazard for European air traffic management, explicitly linking it to degraded surveillance and navigation performance, increased controller workload, and delay propagation risks if procedures revert to lower-throughput modes. That finding is embedded in a broader resilience programme in which the Network Manager codified a multi-year European Network Operations Plan 2025–2029 and associated rolling seasonal performance outlooks, which detail how flow measures, re-sequencing, and route adaptations will be used to accommodate disruptions from geopolitical events and avionics degradations, thereby preventing individual interference episodes from cascading into regional disorder. The network planning documents complement operator-level mitigations by providing a macro-level playbook to preserve capacity and predictability despite GNSS anomalies, with week-by-week revisions published to reflect the evolving traffic picture through September 2025. See EUROCONTROL PRR 2024, March 21, 2025, EUROCONTROL European Network Operations Plan 2025–2029, May 15, 2025, and EUROCONTROL Rolling Seasonal NOP, September 5, 2025. (eurocontrol.int)
Civil aviation’s technical response has been formalised in a joint regulator-industry plan that specifically targets the practical failure modes seen since 2022. On June 18, 2025, EASA and the International Air Transport Association (IATA) issued a comprehensive mitigation plan that condenses workshop findings into operational guidance: operator training for jamming/spoofing recognition, avionics configuration guidance for multi-constellation and multi-frequency robustness, refined incident reporting and data-sharing channels, and coordination with air navigation service providers to improve contingency procedures for routes and approaches vulnerable to satellite navigation loss. The joint plan ties cockpit actions to network-level adaptations by aligning operator reporting with the Network Manager’s tools, ensuring that widespread interference triggers proportionate flow management rather than ad-hoc restrictions that would magnify economic disruption. See EASA–IATA plan to mitigate GNSS interference risks, June 18, 2025. (EASA)
The international legal framework is clear that deliberate interference threatening civil aviation is unacceptable, and International Civil Aviation Organization (ICAO) policy has been updated in 2025 to reiterate state obligations. The consolidated Assembly Resolutions in Force, Doc 10184 updated in February 2025, urges states to refrain from any form of GNSS jamming or spoofing affecting civil aviation and directs continued work on performance-based navigation continuity and resilience. Complementing the high-level injunction, the European and North Atlantic planning group’s sixth session report, released January 2, 2025, records a dedicated review of GNSS jamming and spoofing issues referred by the Air Navigation Commission in October 2024, which ties regional implementation tasks to the policy framework and keeps ICAO’s regional bodies focused on procedural and technical remediation. See ICAO Doc 10184, February 2025, and ICAO EASPG/06 Final Report, January 2, 2025. (icao.int)
National spectrum enforcement and aviation authorities in Poland have, in parallel, strengthened public legal guidance and reporting pathways that underpin electronic warfare resilience by shrinking unintentional interference and criminal jamming. The Office of Electronic Communications (UKE) publishes requirements and warnings on illegal radio-emitting devices, including consumer jammers that can disrupt GPS frequencies and threaten life-critical services; it also sets out reporting and enforcement procedures and points to penalties under the Electronic Communications Law enacted on July 12, 2024. This domestic legal baseline matters because hybrid operators exploit noisy environments: removing civilian sources of interference improves sensor discrimination and shortens time-to-attribution when hostile jamming occurs. The Polish Civil Aviation Authority (ULC) has extended that public posture into the aviation domain with technical briefings that visualise GPS interference locations from November 2024 based on national air navigation service data, and that summarise 2024 international safety actions on GNSS interference, giving operators an official reference for anticipating likely hotspots and for structured reporting. See UKE Komunikat w sprawie urządzeń zagłuszających, UKE Zgłaszanie zakłóceń, and ULC Zakłócanie GNSS – Seminarium GA, April 15, 2025. (bip.uke.gov.pl, ulc.gov.pl)
Strategic resilience requires that performance-based navigation does not become a single point of failure. To that end, EUROCONTROL has developed a Minimum Operating Network concept for communications, navigation and surveillance infrastructure that explicitly manages the trade between cost-efficiency and robustness by preserving a backbone of terrestrial aids and surveillance options to carry traffic safely when GNSS performance is degraded. The Concept and Design Criteria document, updated to Edition 1.2 and published January 14, 2025, sets design principles for retaining or rationally decommissioning VOR, DME, and other assets, and for ensuring surveillance alternatives, so that route structures and approach minima remain viable under planned GNSS outages or widespread interference. In the Poland–Baltic context, the Minimum Operating Network is the decisive backstop that allows controllers to keep sectors open and pilots to maintain lateral and vertical guidance when satellite navigation integrity alarms, curbing the coercive leverage that mass jamming would otherwise create. See EUROCONTROL Minimum Operating Network: Concept and Design Criteria, January 14, 2025, and the corresponding publication page EUROCONTROL MON. (eurocontrol.int)
Because spoofing targets data authenticity rather than signal strength, authentication becomes the pivotal technical countermeasure. In July 2025, the European Commission announced that Galileo’s Open Service Navigation Message Authentication (OSNMA) had been declared operational on July 24, 2025, with a service definition document published, enabling receivers to verify that navigation messages originate from genuine Galileo satellites and thereby sharply raising the bar for effective spoofing against properly equipped users. In parallel, the Commission’s EGNOS programme page confirms that the next-generation EGNOS V3 will augment both GPS and Galileo on L1 and L5 bands with enhanced integrity and availability, thus improving robustness against interference through dual-frequency, multi-constellation processing. These space-segment advances are immediately relevant for Polish and allied operators adopting OSNMA-ready avionics and planning for EGNOS V3 service introduction, since message-level authentication and diverse frequency use degrade adversary spoofing effectiveness and complicate mass deception attacks on routes and approaches. See European Commission Galileo OSNMA now operational, August 25, 2025, and European Commission EGNOS: what’s next – EGNOS V3. (Defence Industry and Space)
The space-cyber interface is now a formal part of European Union cybersecurity governance for critical sectors, and aviation’s navigation and surveillance dependencies fall within that scope. Directive (EU) 2022/2555 (NIS2) establishes legal obligations for entities in transport to implement cybersecurity risk-management measures and incident reporting, and Directive (EU) 2022/2557 on the resilience of critical entities requires operators of essential services to strengthen protection against both physical and cyber-enabled disruptions. ENISA has translated these mandates into sectoral guidance and technical implementation support, with March 2025 and June 2025 publications that map controls to the implementing regulation’s detailed requirements and highlight GNSS jamming and spoofing as cross-cutting risks for transport. For Poland, this means air navigation service providers, airports, and airlines must integrate PNT disruption scenarios into their cybersecurity and operational continuity programmes, aligning cyber event handling with flight operations procedures for navigation degradations. See EUR-Lex Directive (EU) 2022/2555 (NIS2), EUR-Lex Directive (EU) 2022/2557 (CER), ENISA NIS360 2024, March 2025, and ENISA Technical Implementation Guidance on NIS2 risk-management measures, June 2025. (EUR-Lex, enisa.europa.eu)
Aviation safety authorities have also expanded pilot- and controller-facing guidance so that cockpit recognition of interference translates into predictable air traffic management responses. EASA’s SIB 2022-02R3 provides explicit recognition cues for jamming and spoofing, configuration tips for multi-constellation tracking and inertial integration, and reporting instructions, while the EASA newsroom update of July 5, 2024 explains the intent of the revision and the operational distinction between jamming and spoofing in accessible terms for crews. When such reporting is fused by the EUROCONTROL Network Manager with surveillance and flow data, the result is a more granular network response—route restrictions, altitude capping, or speed control—applied only where necessary and withdrawn as soon as interference abates, denying hybrid planners the macro-economic leverage that indiscriminate restrictions would create. See EASA SIB 2022-02R3, July 5, 2024, and EASA SIB update explainer, July 5, 2024. (ad.easa.europa.eu, EASA)
Network-level resilience planning must be matched by avionics choices that dilute interference effects at the platform level. Multi-constellation, multi-frequency receivers that process GPS and Galileo on L1 and L5 bands, fused with inertial measurement units and supported by receiver autonomous integrity monitoring and advanced RAIM/ARAIM, provide continuity through partial interference scenarios by maintaining navigation solutions with verifiable integrity. The European Commission’s EGNOS materials make clear that V3 augments dual-frequency services to expand availability and integrity, while OSNMA message authentication closes off spoofing pathways for compliant receivers. Combining those with cockpit procedures and reversion to terrestrial aids per the Minimum Operating Network yields layered protection: the aircraft maintains guidance where possible; when integrity alarms, terrestrial aids and procedural controls sustain safe operations; and at the network level, traffic managers adapt flows to confine capacity loss. See European Commission EGNOS: what’s next – EGNOS V3, European Commission Galileo OSNMA now operational, August 25, 2025, and EUROCONTROL Minimum Operating Network, January 2025. (Defence Industry and Space, eurocontrol.int)
Electronic warfare planners also probe vulnerabilities at the surveillance and communications layers where GNSS degradation interacts with ADS-B position integrity and area navigation procedures. ICAO regional technical groups have discussed detection of spoofed traffic data and filtering methods to prevent false targets contaminating the recognised air picture, with working documents in 2025 noting practices for identifying ADS-B anomalies in areas of suspected GNSS interference. This is relevant to allied air policing and civil-military de-confliction over Poland, where preventing spoofed tracks from generating unnecessary intercepts or controller workload is part of keeping provocations below escalation thresholds. See ICAO SURICG/10 report – detection and filtering context. (icao.int)
Crisis governance must be able to coordinate multi-sector responses when GNSS interference produces cross-border effects. The Council of the European Union operates the Integrated Political Crisis Response (IPCR) arrangements as the political-level coordination mechanism, with an infographic and policy page detailing monitoring, information-sharing, and full activation modes, including 24/7 contact points and integrated situational awareness reports that can incorporate transportation impacts. While primarily a political instrument, the IPCR ensures that civil aviation, maritime, energy grid, and telecommunications responses are harmonised when cross-border PNT disruptions occur, reducing contradictory messaging and limiting economic spillovers. See Council of the EU How the IPCR crisis response mechanism works, and Council of the EU How the Council coordinates the EU response to crises. (Consiglio dell’Unione Europea)
Cybersecurity agencies have expanded their threat modelling to cover space and PNT systems because hybrid campaigns blend electronic attack with cyber compromise of ground infrastructure and supply chains. ENISA’s Space Threat Landscape, published March 2025, catalogues risks to space services including intentional interference and signal manipulation, and recommends architectural patterns such as redundancy, load-balancing, and rapid failover to preserve service under adverse conditions. For Polish and allied infrastructure operators, these patterns translate into concrete procurement and architecture choices: dual independent timing sources in networks, authenticated timing distribution, secure firmware supply chains for navigation receivers, and contractually binding incident data sharing that accelerates attribution. See ENISA Space Threat Landscape, March 2025. (enisa.europa.eu)
The regulator-industry posture that now prevails across Europe was built iteratively through 2024–2025 workshops and state letters that connected safety oversight with concrete operator practices. ICAO documentation of a February 2024 EUR/MID workshop, leading to State Letter 2024/054 on aviation safety concerns regarding GNSS interference, shows the path by which jamming and spoofing moved from sporadic advisories into structured international governance and regional implementation tasks. This process yielded shared taxonomies, reporting templates, and recommended mitigation measures that national aviation authorities can embed in circulars and operator requirements. See ICAO material referencing the EUR/MID workshop and State Letter 2024/054 in ICAO GNSS RFI Mitigation briefing. (icao.int)
Strategic communications and public transparency play a technical role by compressing the loop between anomaly detection, advisory issuance, and operational response. EUROCONTROL’s monthly reporting and flash briefings document the activation cadence of crisis mechanisms when geopolitics closes airspace or when navigation safety concerns require network-wide advisories; these publications, in July–August 2025, provide the rhythm of activation and deactivation decisions and their rationale, building public trust that disruptions are managed via proportionate, time-bound measures rather than opaque restrictions. Predictable governance denies hybrid planners the social-psychological dividends they seek from prolonged uncertainty. See EUROCONTROL Monthly Network Operations Report, August 14, 2025, and EUROCONTROL Flash Briefing, July 2, 2025. (eurocontrol.int)
For procurement authorities, the emergence of authenticated navigation and dual-frequency augmentation changes the baseline for public tenders that touch PNT. The European Commission’s July–August 2025 OSNMA and EGNOS V3 communications establish that authentication and multi-frequency capability are moving from experimental to operational status, enabling contracting authorities in Poland to require OSNMA-capable receivers and EGNOS V3 readiness in surveillance, timing distribution, and unmanned traffic management systems. This shifts a portion of the resilience burden from procedures to technology and constrains the cost-exchange calculus of spoofing campaigns, since message authentication forces attackers to expend greater resources to achieve even localised deception. See European Commission Galileo OSNMA now operational, August 25, 2025, and European Commission EGNOS: what’s next – EGNOS V3. (Defence Industry and Space)
Civil-military interoperability depends on consistent language, reporting, and training products that translate electronic warfare phenomena into air traffic management actions. While military signatures and intentions remain classified, the open-source aviation safety corpus now standardises cockpit recognition, logging, and post-flight maintenance checks for GNSS anomalies, so that national operations centres can distinguish between random noise, criminal jamming, and state-sponsored interference. The EASA–IATA plan of June 18, 2025 is a bridge between those worlds: it makes operator incident data more usable for network management and, indirectly, for national security attribution, while reducing the likelihood that ambiguous anomalies trigger disproportionate military responses. That approach squares the strategic circle for NATO and European Union members that must handle electronic warfare tools as hybrid coercion instruments inside densely used civil airspace. See EASA–IATA plan to mitigate GNSS interference risks, June 18, 2025. (EASA)
The final layer of resilience is societal: public reporting pathways and enforcement credibility shrink the grey zone that hybrid planners exploit. UKE materials provide accessible guidance on recognising harmful interference and clearly state that consumer jammers are unlawful because they compromise GPS-based safety and security functions; they also explain how citizens and enterprises can report interference and how cases are escalated for sanction. That legal-administrative deterrent works alongside aviation safety processes to reduce background interference levels and to improve attribution when strategic jamming occurs. Coupled with ULC’s technical visualisations of interference episodes and with Traficom’s continuously updated situational picture, the public-sector information environment around GNSS now makes deliberate interference more detectable and less effective as a tool of intimidation. See UKE Komunikat w sprawie urządzeń zagłuszających, UKE Zgłaszanie zakłóceń, ULC Zakłócanie GNSS – Seminarium GA, April 15, 2025, and Traficom Satellite navigation service interferences, updated September 3, 2025. (bip.uke.gov.pl, ulc.gov.pl, Tieto Traficom)
Electronic warfare against PNT will remain a feature of the threat environment on the Alliance’s eastern flank, but the European policy and technical response since 2024 has materially narrowed the attacker’s advantage. The combination of cockpit-level procedures, network-level flow management, terrestrial navigation backstops, message authentication, dual-frequency augmentation, cybersecurity obligations for critical entities, and transparent public reporting creates a layered defence that keeps airspace usable and safe under interference. In practice, this reduces the strategic payoff from GNSS jamming and spoofing as instruments of hybrid coercion: aircraft continue to fly with manageable reroutes or minima increases; operators and regulators share data that improves attribution; enforcement removes civilian noise sources; and the political-crisis machinery synchronises cross-border responses to avoid economic self-harm. The technical horizon in late 2025—OSNMA operational, EGNOS V3 in the pipeline, and Minimum Operating Network design criteria institutionalised—points to further dilution of spoofing and jamming leverage over Polish and allied skies as long as adoption is rapid and implementation is rigorous. See European Commission Galileo OSNMA now operational, August 25, 2025, European Commission EGNOS: what’s next – EGNOS V3, and EUROCONTROL Minimum Operating Network, January 2025. (Defence Industry and Space, eurocontrol.int)
Legal-Regulatory and Institutional Frameworks in the EU and Poland
The hybrid incursions over Poland’s eastern frontier reveal not only the technical vulnerabilities of modern air defence but also the essential role of regulatory architecture in defining what constitutes sovereignty violation, how countermeasures are authorised, and which institutional bodies hold jurisdiction over enforcement. In the European Union (EU) context, unmanned aircraft systems (UAS) fall under a harmonised regulatory framework coordinated by the European Union Aviation Safety Agency (EASA) and codified in directly applicable EU regulations. At national level, the Polish Civil Aviation Authority (ULC) publishes binding guidelines and bulletins that transpose and operationalise EU law, while the Ministry of National Defence (MON) and the Government Centre for Security (RCB) integrate civil and military responses under statutory mandates. This chapter explores the current regulatory and institutional ecosystem governing counter-drone and hybrid threat responses in Poland and the EU up to September 2025, with emphasis on legislative instruments, safety publications, crisis-response arrangements, and cooperative frameworks.
The EU’s principal legal instrument governing unmanned aviation remains Commission Implementing Regulation (EU) 2019/947 on the rules and procedures for the operation of unmanned aircraft, which came into effect on December 31, 2020. It defines categories of UAS operations—open, specific, and certified—and requires registration, risk assessment, and operator competency. Together with Commission Delegated Regulation (EU) 2019/945 on UAS requirements, it creates a common legal foundation for all Member States. The consolidated texts remain publicly available on EUR-Lex: Commission Implementing Regulation (EU) 2019/947 and Commission Delegated Regulation (EU) 2019/945. These instruments provide the baseline: drones used in hybrid operations are subject to the same identification, registration, and operational limitations as commercial or recreational platforms, meaning that hostile state-sponsored intrusions represent direct violations of EU law.
To manage integration of drones into controlled airspace, the EU enacted Commission Implementing Regulation (EU) 2021/664 on a framework for U-space, a digital traffic-management system for unmanned aircraft. EASA maintains consolidated “Easy Access Rules” for U-space, updated May 29, 2024, which compile all amendments into a single operational reference. The rules prescribe mandatory U-space services—network identification, geo-awareness, traffic information—allowing authorities to establish U-space airspaces where compliance is obligatory. See Commission Implementing Regulation (EU) 2021/664 and EASA Easy Access Rules for U-space, May 29, 2024. For Poland, this framework has been directly transposed into national practice through the ULC, which on May 15, 2025 issued Guideline 4/2025 mandating publication and use of the national database of UAS geographical zones. This ensures that geofenced no-fly areas around military bases, border regions, and critical infrastructure are digitally enforceable, reducing ambiguity during hybrid drone intrusions. ULC Wytyczne nr 4/2025, May 15, 2025.
Counter-drone policy at EU level was explicitly elevated by the European Commission’s Counter-UAS Package, released October 18, 2023 as COM(2023) 659, accompanied by a Staff Working Document SWD(2023) 323. The package sets out an EU-wide strategy for detecting and neutralising malicious drones, including recommendations on harmonised certification of jamming systems, coordinated procurement of counter-UAS technologies, and integration of C-UAS into critical-infrastructure protection plans. European Commission Communication COM(2023) 659, October 18, 2023 and SWD(2023) 323. Together with the earlier Drone Strategy 2.0, published November 29, 2022 as COM(2022) 652, these documents form the legal-regulatory cornerstone of EU-level drone governance. European Commission COM(2022) 652, November 29, 2022.
In Poland, the ULC functions as the civil aviation regulator and has expanded its oversight of drone operations to match EU requirements. In 2025, the ULC published multiple safety bulletins addressing UAS airspace violations and integration hazards. Safety Bulletin 331/1 (2025) provides operators with updated procedures and regulatory reminders for avoiding controlled-airspace violations. ULC Safety Bulletin No. 331/1, 2025. Additional bulletins in May 2025 addressed air traffic management coordination and phraseology during drone integration near aerodromes: ULC Safety Bulletin, May 21, 2025. The ULC also issued official journals, including 11/2025 (May 30, 2025) and 17/2025 (June 18, 2025), which contain binding provisions on operational procedures and restrictions. ULC Official Journal 11/2025, ULC Official Journal 17/2025. These regulatory instruments equip Polish authorities with the legal clarity to classify intrusions as violations of national airspace law, enabling rapid escalation to defence and security services when intrusions are hostile.
On the defence side, the MON retains constitutional responsibility for airspace sovereignty and is empowered to use force against aerial intrusions under the Act of 11 March 2022 on Defence of the Homeland. This statute, available in Polish in the official legislative database, grants the armed forces authority to neutralise air threats and to cooperate with civil institutions during hybrid incidents. Public communiqués following drone crashes in Łuków County (August 20, 2025) confirm that the MON views incursions as deliberate violations and provocations. MON briefing, August 20, 2025. Legal authority for proportional response is embedded in this act, with decisions coordinated between the Operational Commander and political leadership.
Complementing the national framework, EUROCONTROL and EASA maintain civil-safety oversight structures that intersect with hybrid-threat regulation. EASA’s Safety Information Bulletins on GNSS interference, updated most recently on May 27, 2025 as SIB 2025-05, instruct operators on recognising jamming and spoofing and reporting through established channels. EASA SIB 2025-05, May 27, 2025. For Poland, where GNSS interference is often observed in conjunction with drone incursions, these bulletins are not optional guidance but function as quasi-regulatory instruments, binding operators to follow mitigation procedures. EUROCONTROL, for its part, operates the European Aviation Crisis Coordination Cell (EACCC) under Commission Implementing Regulation (EU) No 677/2011, a body that brings together civil and military authorities to manage crisis events such as hybrid interference. EUROCONTROL Disruption and Crisis Management (EACCC).
The European Defence Agency (EDA) further supports Member States through cooperative procurement and capability planning. Its Coordinated Annual Review on Defence (CARD) 2024, published November 19, 2024, flagged counter-UAS systems as a critical shortfall and encouraged collaborative projects. EDA CARD 2024, November 19, 2024. In September 2025, EDA communiqués emphasised pooling of electronic-warfare and counter-drone capabilities to reduce per-unit cost and increase resilience across Member States. The institutional framework here bridges civilian safety law and military procurement strategy.
At the political level, the Council of the EU coordinates crisis responses through the Integrated Political Crisis Response (IPCR) mechanism. The Council’s official policy page describes how IPCR can be activated in information-sharing or full modes during hybrid incidents, ensuring that Member States share situational awareness and coordinate sanctions or joint responses. Council of the EU, IPCR crisis response. During April 2024, IPCR was activated for foreign interference related to elections, demonstrating its applicability to hybrid threats. Council of the EU press release, April 24, 2024. This sets a precedent for airspace incursions being elevated to EU-level crisis coordination if required.
The legal-regulatory environment for hybrid threats also intersects with EU cybersecurity law. The Directive (EU) 2022/2555 (NIS2 Directive), in force since January 2023, imposes cybersecurity obligations on critical sectors including transport. Directive (EU) 2022/2555 (NIS2). The Directive (EU) 2022/2557 on the resilience of critical entities imposes further obligations on operators of essential services. Directive (EU) 2022/2557 (CER Directive). Together, these directives mean that Polish air navigation service providers, airports, and airlines must integrate drone and electronic warfare disruption into their cybersecurity and resilience planning, reinforcing the institutional framework for countering hybrid aggression.
Strategic Communication, Capability Pooling, and Policy Roadmap to 2027
Hybrid warfare along NATO’s eastern frontier is not defined solely by physical intrusions but also by the contest of narratives, the pooling of allied capabilities, and the credibility of long-term policy commitments. The repeated drone incursions into Polish airspace during August–September 2025 demonstrated how ambiguous low-cost probes, accompanied by electronic interference and psychological messaging, aim to test both institutional readiness and public resilience. The effectiveness of countermeasures depends on three tightly interlinked pillars: strategic communication that shapes domestic and allied perceptions, capability pooling that closes operational gaps without exhausting national budgets, and a policy roadmap that projects to 2027 sustained modernisation, integration, and deterrence credibility.
Strategic communication has emerged as a formal component of deterrence and resilience policy. The North Atlantic Council, in its Washington Summit Declaration of July 10, 2024, reaffirmed the principle that allied communication must be transparent, immediate, and coordinated to prevent adversaries from exploiting uncertainty or delay. The declaration explicitly stressed strengthening resilience to hybrid and cyber threats, countering disinformation, and enhancing cooperation with the European Union. NATO Washington Summit Declaration, July 10, 2024. This principle was operationalised in Poland when military authorities disclosed on September 4, 2025 that drones had twice entered airspace but exited without causing damage, a statement that balanced transparency with reassurance. Reuters report, September 4, 2025. The rapid disclosure limited space for adversary propaganda while sustaining allied confidence.
The European Commission has embedded hybrid-threat communication within its security framework through the Joint Framework on Countering Hybrid Threats (COM(2016) 410), and more recently via the Strategic Compass, adopted by the Council of the EU in March 2022, which assigns explicit roles for strategic communication, resilience, and hybrid response. European Council, Strategic Compass, March 21, 2022. The Commission’s Joint Paper on Information Manipulation, published March 26, 2025, introduced operational measures for detecting disinformation campaigns and synchronising responses across Member States. European Commission JOIN(2025) 130, March 26, 2025. This ensures that when drone incursions or GNSS jamming events occur, their communication fallout can be managed through coordinated EU-NATO narratives.
At the national level, Poland’s Government Centre for Security (RCB) operates a public alert and notification system. Through SMS alerts and its official portal, it informs citizens about airspace events, emergencies, or hybrid threats. The RCB has issued multiple alerts linked to GNSS jamming and drone incidents, thereby integrating the population into resilience-building. RCB official alerts. This model of direct-to-citizen communication, aligned with NATO and EU narratives, denies adversaries the possibility of exploiting ambiguity or fabricating exaggerated claims of damage.
Capability pooling is the operational counterpart to narrative coherence. The European Defence Agency (EDA) has defined counter-UAS and integrated air and missile defence as priority cooperation areas in its Coordinated Annual Review on Defence (CARD) 2024, published November 19, 2024. EDA CARD 2024. The report notes that pooled acquisition of jammers, directed-energy systems, and programmable ammunition is required to prevent cost-exchange imbalances. By September 2025, the EDA had advanced cooperative initiatives under its Permanent Structured Cooperation (PESCO) framework, where Poland, Germany, and Italy participate in counter-UAS projects designed to deploy scalable, interoperable effectors. PESCO Projects, updated 2025.
Pooling also extends to intelligence, surveillance, and reconnaissance. The NATO Intelligence, Surveillance and Reconnaissance Force (NISRF), declared operational in 2023, reached full integration with RQ-4D Phoenix operations from Finland in June 2025. AIRCOM report, June 30, 2025. Shared ISR reduces national strain by providing a recognised air picture across borders, ensuring that Poland’s limited radar assets are reinforced by pooled allied capabilities. Similarly, the NATO AWACS fleet secured air-to-air refuelling certification on July 31, 2025, extending operational endurance and reducing gaps in surveillance during crisis surges. NATO AWACS refuelling certification, July 31, 2025.
The EU has leveraged its European Peace Facility (EPF) to support Ukrainian air defence since 2022, but the same instrument also funds cooperative stockpiling and shared training, indirectly supporting Polish and allied readiness. The Council of the EU decision of March 18, 2024, allocated €5 billion for defence assistance, including counter-UAS and electronic-warfare tools. Council Decision (CFSP) 2024/897, March 18, 2024. This demonstrates how EU-level financial instruments can reduce cost asymmetries in defending against hybrid incursions.
The policy roadmap to 2027 is already inscribed in official NATO and EU planning documents. The Vilnius Summit Communiqué of July 11, 2023 tasked NATO to prepare new regional defence plans, which by 2025 have been operationalised into forward-deployed capabilities and readiness targets. NATO Vilnius Summit Communiqué, July 11, 2023. These plans specify reinforcement timelines, including layered air defence and ISR, ensuring that Poland’s eastern flank is embedded in collective deterrence structures through 2027.
The NATO Defence Planning Process (NDPP) for the 2025–2029 cycle sets out specific capability targets for member states. Poland’s commitments include additional Narew and Wisła batteries, increased stockpiles of Piorun MANPADS, and expanded radar coverage. These commitments were acknowledged in the NATO Secretary General’s Annual Report 2024, published April 26, 2025, which highlighted progress on regional plans and the transition from the NATO Response Force to the Allied Reaction Force. NATO Secretary General’s Annual Report 2024, April 26, 2025.
On the EU side, the Strategic Compass implementation roadmap defines milestones up to 2030, but the immediate horizon to 2027 includes the establishment of a Rapid Deployment Capacity (RDC) of up to 5,000 troops, available for hybrid contingencies including airspace incidents. Council of the EU, Strategic Compass implementation. By 2025, the RDC has conducted live exercises, demonstrating readiness to deploy for crisis stabilisation within allied borders.
The European Commission’s Defence Industrial Strategy, published March 5, 2024, sets targets for joint procurement and industrial scaling by 2027, with a budgetary allocation of €1.5 billion under the European Defence Fund (EDF). European Commission Defence Industrial Strategy, March 5, 2024. This directly impacts the counter-UAS ecosystem by financing interoperable effectors and fostering defence-industrial clusters that include Polish enterprises.
A critical element of the roadmap is societal resilience. ENISA’s Space Threat Landscape, published March 2025, recommends that Member States adopt multi-layered resilience for PNT services by 2027, integrating terrestrial back-ups, OSNMA authentication, and EGNOS V3 augmentation. ENISA Space Threat Landscape, March 2025. For Poland, this means embedding resilience requirements into civil aviation regulation, defence procurement, and national critical-entity obligations under the CER Directive.
Finally, NATO and EU coordination mechanisms are being institutionalised for the medium term. The Joint EU-NATO Declaration, signed January 10, 2023, committed both organisations to cooperate on hybrid threats, resilience, and infrastructure protection. Joint EU-NATO Declaration, January 10, 2023. By September 2025, joint task forces on counter-UAS and hybrid defence have been convened, ensuring that policy goals translate into operational guidelines.
The trajectory to 2027 is thus clear: strategic communication ensures transparency and coherence in public narratives; capability pooling delivers cost-effective countermeasures and shared resilience; and policy roadmaps in NATO and EU frameworks institutionalise hybrid-threat defence as a permanent mission. For Poland, the combination of national reforms, allied integration, and EU support means that repeated incursions cannot become “the new normal” but are instead treated as managed incidents within a maturing architecture of law, policy, and operational readiness.
Conclusion and Strategic Outlook Beyond 2025
The hybrid campaign against Poland’s eastern frontier reveals an enduring structural contest in which tactical drone incursions, electronic warfare, and information manipulation are orchestrated not to achieve battlefield success but to erode confidence in institutions, impose asymmetric economic costs, and test the seams of NATO and European Union crisis management. From August 20, 2025, when a drone detonated in Łuków County, through the subsequent airspace violations of September 2–3, 2025, and the prolonged incursion of September 6–7, 2025, the pattern has confirmed Moscow’s and Minsk’s intent to normalise low-intensity airspace violations. These incidents, timed with missile and drone barrages against Ukraine, demonstrate a strategy of layered provocation: saturate defences, force political reactions, and manipulate perception of allied readiness. Reuters, August 20, 2025; Notes from Poland, September 4, 2025.
The Alliance response has revealed both vulnerabilities and adaptive strengths. The cost-exchange dilemma—cheap drones against million-euro interceptors—has been contained by Poland’s deliberate adoption of a layered architecture. Pilica+ and Piorun provide affordable attrition capacity; Narew and Wisła preserve medium- and long-range deterrence; and allied deployments, such as Dutch F-35 fighters under NATO Air Policing, add flexible escalation management. MON announcement, July 4, 2024; AeroTime, September 5, 2025. The economic sustainability of this mix is reinforced by pooled procurement through the EDA, cooperative stockpiles under the EPF, and shared ISR assets from AWACS and RQ-4D Phoenix.
Electronic warfare has amplified the hybrid challenge by degrading GNSS signals across the Baltic and Polish air corridors. Continuous reporting from EASA, EUROCONTROL, and Traficom confirms widespread interference, increasing cockpit workload and complicating intercept decision-making. EASA GNSS Outages resource; Traficom interference statistics, September 3, 2025. Yet resilience has advanced: EASA and IATA’s joint mitigation plan (June 18, 2025) operationalises crew training and contingency procedures; EUROCONTROL’s Performance Review Report 2024 (published March 21, 2025) codifies network-wide adaptations; and Galileo’s OSNMA service, declared operational on July 24, 2025, adds authentication to navigation messages. EASA–IATA Plan, June 18, 2025; EUROCONTROL PRR 2024; European Commission OSNMA operational, August 25, 2025.
The regulatory backbone has also tightened. EU law—Regulation 2019/947, Regulation 2021/664, and the Counter-UAS Package 2023—provides harmonised rules for UAS operations and enforcement. ULC’s Guideline 4/2025 digitises Polish no-fly zones, while MON’s Defence of the Homeland Act gives armed forces constitutional authority to neutralise threats. ULC Wytyczne nr 4/2025, May 15, 2025. At supranational level, the Council of the EU’s IPCR arrangements guarantee coordinated political response, while NIS2 and the CER Directive impose obligations on critical-entity operators to integrate PNT and counter-drone disruption into resilience planning. Council of the EU IPCR; Directive (EU) 2022/2555.
Strategic communication now operates as deterrence by narrative. The Washington Summit Declaration (July 2024) directed transparency and coherence in allied messaging, while the European Commission’s Joint Paper (March 2025) addressed disinformation detection. RCB alerts in Poland serve as tactical tools of reassurance, directly informing citizens of incidents and denying adversaries information space. RCB alerts. By making hybrid events visible but controlled, communication ensures that incursions do not escalate into panic or mistrust.
Looking ahead to 2027, the roadmap is anchored in NATO’s regional defence plans, the EU Strategic Compass, and the European Defence Industrial Strategy. By then, Poland is expected to complete deployment of 22 Pilica+ batteries, expand Narew and Wisła systems, and integrate allied ISR contributions into a permanent layered defence. NATO Annual Report 2024, April 26, 2025; European Commission Defence Industrial Strategy, March 5, 2024. The EU’s Rapid Deployment Capacity of 5,000 troops will add flexible response capability for hybrid crises, while EGNOS V3 and full uptake of OSNMA will harden PNT resilience.
The strategic outlook therefore converges on three imperatives. First, deterrence by denial: ensuring that drones, jamming, and spoofing cannot disrupt air sovereignty or civil flows without immediate, affordable, and credible countermeasures. Second, deterrence by resilience: demonstrating that societies, regulators, and militaries can absorb hybrid shocks without systemic degradation. Third, deterrence by unity: proving that NATO and the EU act in synchrony, from air policing to crisis communication, thereby denying adversaries the ability to exploit seams.
By September 2025, the evidence shows a hybrid contest that is intense yet increasingly contained. Through layered defence, regulatory hardening, pooled capabilities, and transparent communication, Poland and its allies have transformed drone incursions and GNSS disruption from destabilising shocks into managed incidents. The challenge to 2027 is not only to sustain this posture but to accelerate adoption of new technologies, expand cooperative stockpiles, and deepen public resilience. Only by reinforcing every layer—technical, legal, institutional, and societal—can the Alliance prevent provocations from crystallising into a “new normal” along the eastern frontier.
