Denmark Says Russia May Strike NATO to Split the Alliance

Denmark’s Defence Intelligence Service said on Sept. 24 that Russia may try a limited military attack on a NATO country in the coming months. Director Thomas Ahrenkiel told reporters the aim would be to divide the alliance, not to seize a member state.

Denmark Warns of a Strike Built to Split NATO

The unclassified report, issued in Danish and English by Forsvarets Efterretningstjeneste, states a low but growing risk of limited attack against one or several NATO countries that border Russia. It says that shot could come even while the war in Ukraine goes on, and even before Russia has the forces for a regional war.

Ahrenkiel put the political target in one line at the Copenhagen briefing that accompanied the paper.

The aim is not to take over the country, but to divide NATO.

Thomas Ahrenkiel, Director, Danish Defence Intelligence Service, Copenhagen press conference

The written assessment is just as blunt. A limited military attack “would be a desperate move on Russia’s part,” it says, and the purpose would be “to redirect European resources away from supporting Ukraine and to sow division within NATO, should the alliance fail to agree on a collective response.”

That is a different warning from the one that travelled on Friday. The document still finds no sign that Moscow is preparing an outright invasion. It calls an invasion highly unlikely. It also says it can no longer rule one out, and that assembling the forces would likely take at least six months and would be hard to hide.

What a Limited Russian Attack Would Look Like

The service sketches three limited options and keeps a full invasion in a separate box. Each limited option is built to look like an accident, a Ukrainian mistake, or a local security job, so that NATO has to argue about the facts before it argues about force.

HOW DDIS SKETCHES THE SHOTS

The Institute for the Study of War has been gaming a similar gray-zone probe on the Estonian side of the line, a limited incursion designed to break Article 5 by making allies hesitate rather than by holding ground. DDIS is now saying the same logic could show up as a missile or a drone before it shows up as a column of troops.

Russia, the Danish paper adds, is likely to fire only if it judges that the strike will not produce a collective NATO war. It also says Moscow is probably unsure where that line sits. The risk, as Copenhagen writes it, is that the Kremlin decides the allies will not answer together, “especially if Russia assesses that the United States cannot or will not support the European NATO countries in a potential war against Russia.”

NATO Still Will Not Say Where Article 5 Begins

That uncertainty is not a Russian invention. NATO’s own public guide says an armed attack is judged case by case, and that significant cyber operations and hybrid attacks may amount to armed attack. Allies have said so at recent summits. They have invoked the clause only once, after the Sept. 11, 2001 attacks on the United States.

The treaty still leaves each member to take “such action as it deems necessary,” which may include armed force and may not. The attacked ally also has to want the help. That wording was a US demand in 1949, and it is the gap a limited strike is designed to walk through.

We will never talk about what exactly is triggering Article 5. That ambiguity is there, and it will stay there.

Mark Rutte, NATO Secretary General

Rutte said in mid-September that Moscow is “clear-eyed” about the real trigger even if the alliance will not publish it. He also said responses below that line will not always be public or tit for tat. Keir Giles, an associate fellow at Chatham House, has described the same problem in plainer language: what counts as Article 5 has a fuzzy boundary.

Alliance officials, speaking as European leaders spent mid-September warning of drones and missiles in the next few months, have said they see no imminent threat of attack and have not rewritten NATO’s formal threat picture. Lithuanian Foreign Minister Kęstutis Budrys said public warnings of a possible foreign-flag operation matched intelligence that had been around since July, and he treated the speeches as a message to Moscow not to gamble that Article 5 would fail. Those two lines can both be true. A limited strike is not an imminent invasion. It is a test of whether 32 capitals will call the same incident an armed attack on the same afternoon.

Poland Treats a Starlink Fire as Hybrid War

On the night of Sept. 23, firefighters were called around 9 p.m. to a satellite ground station in Wola Krobowska, about 50 km south of Warsaw. The site is run by Exatel, the Polish state telecom company, and carries Starlink traffic through Poland, including links used in Ukraine. The fire damaged power gear and a generator. No one was hurt. Officials said the station was back up and that no internet outage followed.

Deputy Prime Minister Krzysztof Gawkowski, who also holds the digital affairs brief, called it sabotage aimed at a station “crucial for the security and continuity of internet services in Ukraine.” He told TVP the pattern fit “this new Russian doctrine of attack” and “the next phase of hybrid warfare.” He stopped short of a formal attribution. Prime Minister Donald Tusk, asked the same day, said he disliked labelling a fire as sabotage versus an accident without certainty, then added that “it looks bad.”

WHAT WE KNOW

• The site: An Exatel ground station at Wola Krobowska that routes Starlink traffic, including toward Ukraine.
• The damage: Power infrastructure and a generator were hit; the station returned to service and no injuries were reported.
• The investigators: Poland’s Internal Security Agency, ABW, and the police opened a case.

WHAT IS UNCONFIRMED

• The cause: Firefighters have looked at deliberate ignition and at an electrical short; both remain on the table.
• The culprit: Warsaw has not publicly proven who lit it, and Moscow has not commented on this fire.

The Danish paper, published the next morning, had already described the shift it thinks is under way. Until recently, it says, Russian hybrid hits in the West were mainly meant to frighten the public and weaken support for Ukraine. Moscow has “increasingly begun to directly seek to prevent support from reaching Ukraine,” including sabotage against defence firms and against rail moving military kit. A fire at a Starlink node that feeds Ukrainian terminals sits in that second category, whether or not this particular blaze is ever pinned on a named service.

Lithuania Hosts Germany’s Unfinished Deterrent

If the limited attack DDIS has in mind is a ground probe rather than a missile, the first NATO troops in the way on the Lithuanian side are German. Panzerbrigade 45, the Lithuania Brigade, is commanded by Brigadier General Christoph Huber and is being built as a permanently based heavy formation, not a rotating battlegroup.

The German defence ministry said on Sept. 14 that almost 80 percent of the brigade’s posts are filled, and that those posts have been filled by volunteers. It put the fill rate of the slice already in Lithuania at about 92 percent. Defence Minister Boris Pistorius said the brigade will still reach full combat readiness by the end of 2027, with around 4,800 soldiers and 200 civilian staff on the ground.

That end-state is not the force that exists this autumn. In June the brigade ran its first major fight on Lithuanian soil, the Freedom Shield exercise in Lithuania, which brought together about 2,900 troops, about 2,400 of them German, and about 800 vehicles from eight NATO states at Pabradė. Huber has used those drills to fold drones into a tank brigade’s ordinary work, shooting with them and against them.

A limited Russian raid that stays below a clear invasion would land on a deterrent that is real, visible, and still growing. That is an awkward place for Article 5. The tripwire is in place. The full brigade is not. A fight over whether a deniable probe “counts” would begin while Germany is still moving battalions, families, and a new training town at Rūdninkai toward a 2027 completion date.

Moscow Is Under Pressure and Hunting a Window

The part of the Danish paper that cuts against the invasion-scare reading is the section on how the Ukraine war is going. “Russia is under more pressure than it has been at any other point during the war against Ukraine,” it says. Ukrainian long-range strikes are doing more damage inside Russia. Russian gains in Ukraine remain marginal against heavy losses. The service sees no prospect of a major Russian breakthrough there over the next six months, and it still thinks President Vladimir Putin will not drop his core war aims.

Skeptics who heard the Thursday headlines treated that pairing as a joke: a Russia that is exhausted in Ukraine and somehow ready to hit NATO. The document’s own answer is uglier. Because the conventional war is stuck, and because Western guns and money are what keep it stuck, Copenhagen thinks Putin may try to change the trajectory by hitting the supply system and the politics behind it. Hybrid first. A limited military attack if the hybrid path is not enough.

WHAT COPENHAGEN SAYS COMES NEXT

• More hybrid, more harm: Attacks against the West and NATO become more frequent and carry greater consequences than before.
• Cyber: Destructive operations that could cripple critical societal functions.
• Sabotage: Physical attacks that carry a high risk of casualties, not only symbolic arson.
• Denmark itself: The domestic security service, PET, has already warned that Russia is planning sabotage on Danish soil against defence companies.
• The Baltic Sea: On Sept. 14 a Russian frigate off Gedser fired flares at a Danish military helicopter, which DDIS calls the most serious such incident involving Danish units.

The paper also cites the foiled drone plot at Leipzig/Halle Airport, which German authorities say Russia planned over several months. Leipzig is a logistics node for cargo linked to Ukraine. That is the same target set as a Starlink dish south of Warsaw: not a capital, not a brigade headquarters, the plumbing that keeps Ukraine in the fight.

This Winter Falls Outside the Five-Year War Plan

On Feb. 9, 2025, DDIS published clocks for three kinds of war. Those clocks assumed the Ukraine fighting ends or freezes, Russian forces keep growing while the West does not match that pace, and Moscow judges that the United States will not back European allies. The new paper says those clocks still stand, and then it writes a shorter one beside them.

THE CLOCKS INSIDE THE DANISH REPORT

1. Feb. 9, 2025: DDIS says that, on those conditions, Russia could wage a local war in a bordering country in about six months, pose a credible regional threat in the Baltic in about two years, and be ready for large-scale war on the European continent in about five years.
2. Sept. 14, 2026: A Russian frigate fires flares at a Danish helicopter in the waters off Gedser.
3. Sept. 23, 2026: Fire hits the Exatel Starlink ground station at Wola Krobowska; Polish ministers call it sabotage the next morning.
4. Sept. 24, 2026: DDIS updates the Russia file and says more severe hybrid attacks, or limited military attacks on a bordering NATO state, could come in the coming months even while the Ukraine war continues.

The five-year clock is a force-build story. The coming-months clock is a will story. Copenhagen is saying Russia does not need to be ready for a war with NATO in order to fire a missile at a rail yard, a port, a depot, or a satellite dish, then claim Ukraine jammed the shot. It needs to believe the alliance will spend a week arguing about attribution, air defences, and American backup, while European stocks that would have gone to Ukraine stay home.

The service still does not see the invasion many readers took from the headlines. It sees a Kremlin under strain, more willing to take risks, and interested in a strike that works only if NATO fails to agree. That is the test it has put on the calendar, and it is a test of politics first.