Spoofing attacks expose alliance vulnerability as Baltic states demand action

Russian shadow warfare, a many-headed hydra of hybrid aggression, has assumed a new and pernicious form, with Moscow's highly developed electronic warfare capabilities now being employed to misdirect explosive-laden drones into NATO airspace. The latest manifestation of this threat came to light during a May 19 incident over Estonia, when a NATO jet was compelled to shoot down a device that had been diverted across the border. This, at any rate, is the conclusion of the Ukrainian government, which has attributed the breach to Russian interference rather than any error on its own part.

"Russia continues to redirect Ukrainian drones into the Baltics with the use of its electronic warfare," declared Heorhii Tykhyi, a spokesman for Ukraine's Foreign Ministry, offering an apology to Estonia and to Ukraine's "Baltic friends for such unintended incidents." Mr Tykhyi emphasised that Ukraine's military had only ever employed Russian airspace for its attacks. Similarly, on May 15, Finnish authorities directed citizens in the Helsinki region to remain indoors following suspicious drone sightings, which reports suggested may have been the result of Russian GPS hijacking. Although Moscow denies any involvement, Ukrainian officials blame an electronic warfare technique known as "spoofing" for the breach.

Russian forces are said to have begun employing GPS-deception techniques against Ukrainian drones as early as 2022, with documented spoofing efforts becoming increasingly common by 2023. It was not until March 23, however, that the first case of a Ukrainian drone breaching NATO airspace due to Russian interference was recorded, in Lithuania. Spoofing, jamming, and meaconing are three terms that fall under the umbrella of electronic interference, each posing its own distinct risks. Spoofing involves the transmission of a counterfeit signal, which is interpreted as authentic by the receiver, thereby misleading it as to its true position. Jamming, by contrast, blocks a receiver by producing a noisy signal, causing it to lose its location altogether. Meaconing, a portmanteau of masking and beacon, is a subtype of spoofing that uses real Global Navigation Satellite System signals rather than fabricated ones, but introduces a delay to mislead a system about its exact position. Whereas jamming is rather obvious in its effects, spoofing is difficult to detect, and meaconing is the most covert of the three.

Russia has been developing these techniques for years, with some methods dating back to the Cold War. In 2017, several ships in the Black Sea experienced abnormalities with their GPS position, which showed them located at an airport, an indication of spoofing efforts for drone defence. Drones have geofencing rules that prevent them from flying over airports; by changing a drone's position to an airport, the device is programmed to reroute or land immediately. Electronic interference affects more than just drones, however. Russian satellites have jammed GPS signals across Europe on at least three occasions since 2019, and while each interruption lasted less than ten seconds, the military application of this technology is broad; jamming from a satellite has significantly more range than from the ground. Experts remain uncertain of the precise aim, but whether intentional or accidental, such disruption warrants serious concern.

The Baltic states have been scrambling to counter electronic warfare, yet a widespread and reliable method of defence has yet to be implemented. Ukraine, however, is taking action to address the root cause, having launched an investigation to determine how Russia is interfering with receiver signals, while also developing drones that can fly without satellite assistance and are thus less vulnerable to hostile interference. While individual NATO states have integrated spoofing defence strategies into their national security frameworks, alliance-wide coordination for an effective solution remains a significant challenge. As long as Russia continues to avoid consequences, analysts argue, it will persist in its electronic warfare efforts.

NATO has condemned Russia's actions, but a lack of clear repercussions has thus far failed to alter the Kremlin's cost-benefit assessment. Russia's grey-zone toolkit extends beyond GPS spoofing to include cyberattacks, subsea cable cutting, and drone-induced airport closures. Shadow warfare or hybrid attacks against alliance states have more than tripled since 2023 and will undoubtedly continue to rise unless NATO acts. The logical next step, according to some observers, is for NATO members to invoke Article 4 of the alliance's founding treaty. Article 4 has been invoked seven times since NATO's founding and allows the parties to consult together "whenever, in the opinion of any of them, the territorial integrity, political independence or security of any of the Parties is threatened." Most recently, Poland and Estonia invoked Article 4 in early 2025, after Russian aircraft entered their airspace. Since then, Ukrainian drones spoofed by the Russians have breached NATO borders at least a dozen times.

If Article 4 is invoked when Russian aircraft enter NATO airspace, the question arises: why not when Russian electronic interference causes Ukrainian drones to cross NATO borders? And why not in response to persistent grey-zone operations targeting critical infrastructure, in which Article 4 has not been invoked despite the operational investments NATO has made to counter such threats? Whether or not NATO members choose to invoke Article 4, more Ukrainian drones will certainly enter allied airspace as a result of Russian interference. As Ukraine's attacks on Russia succeed, with the new offensive having struck dozens of targets up to July 24, NATO can expect Russian retaliation, and with it, spillover that further endangers member states. Given that spoofing, jamming, and meaconing are as effective as they are low-cost, they are a phenomenon that is here to stay, demanding a coordinated and resolute response from the alliance.