Warrants, Not Arrests: Bulgarian Court Moves the Starlink Arson Case Forward, but Not Its Biggest Question

A Sofia court has approved European arrest warrants for two German citizens accused of torching satellite antennas near the Bulgarian capital. It is the first judicial step in the case. It does not say who commissioned the attack, or whether it is linked to similar incidents in Poland.

Baltic Security Monitor | Material Update — MODERATE
Snapshot: 20 October 2026, 14:00 (EEST)

What happened

A court in Sofia has approved European arrest warrants for two German nationals suspected of setting fire to antennas at the Plana Teleport satellite communications facility south of the Bulgarian capital. The decision was taken on 19 October. Reuters reported it citing a court spokesperson, and the Associated Press independently reported the prosecutors' account.

The arson itself took place on 9 October, in the night before the 10th. The 19 October decision is therefore a legal development in a known case, not a new incident.

According to Bulgarian prosecutors, the suspects entered the country from Serbia via the Kalotina border crossing in a German-registered vehicle and left for Serbia within hours. The indictment says three antennas were destroyed, two partially damaged and three more affected. Both suspects were charged in absentia. The warrants can be appealed. No arrest has been confirmed, and no one has been convicted.

What changed since 14 October

The public picture in mid-October looked different. The fire was first made public by opposition MP Ivaylo Mirchev, and Prime Minister Rumen Radev confirmed the incident in parliament on 14 October while declining to give details, citing the investigation. At that point the reported toll was 11 of 17 antennas, and the perpetrators were described as two masked men. The head of the State Agency for National Security (DANS), Plamen Tonchev, spoke of sabotage.

Three things are new: a court decision, a route through Serbia, and a different count of affected antennas in the indictment (3 + 2 + 3, against 11 of 17 in early reports). The gap is not necessarily a contradiction. The early figure came from a politician rather than investigators, and "destroyed", "damaged" and "affected" may describe different degrees of harm. A reliable final figure will have to come from a verdict or an official damage assessment.

What is not established

• Where the suspects are, and whether any has been detained.
• Who commissioned or financed the attack. None of the available sources names an organiser.
• Foreign state involvement. It has not been shown publicly. An opposition MP has floated a Russian link, but that is a political statement, not an investigative finding.
• A link to the Starlink ground station fire at Wola Krobowska, Poland, on 23 September. In that case, according to Polish Prime Minister Donald Tusk, two Turkish nationals were detained in Germany on 12 October. No common organiser or network between the Polish and Bulgarian episodes has been established.

Similar methods are not proof of a common perpetrator. Two arsons at Starlink sites within three weeks in different countries justify testing a coordination hypothesis. They do not justify treating it as confirmed.

Why it matters for Ukraine and the Baltic region

Satellite communications nodes are critical infrastructure. The facility near Sofia has been reported to serve, among others, Ukrainian military users, and Starlink underpins communications and control for part of Ukraine's drone fleet. There is added context: on 14 October Ukraine's armed forces said SpaceX had restricted the military version of the service, causing some drones to lose connection. Physical attacks on ground infrastructure land on top of a vulnerability that already exists at the service level.

For NATO's northeastern flank the significance extends beyond Bulgaria. Poland funds part of Ukraine's Starlink use and was the target of the first incident. How quickly Sofia's case turns into cross-border criminal action is a measure of how fast European law enforcement can convert sabotage into a prosecutable case.

BSM analysis: the notable feature of this ruling is the mechanism, not the charge. A European arrest warrant turns suspicion into an instrument valid across the EU. But the suspects left for Serbia, which is outside the EU, so enforcement will depend on where they are now. A warrant shows that the system is willing to act. It does not guarantee a result.

What would count as a new material development

• A confirmed arrest of at least one suspect.
• Official attribution: a public statement by investigators or government naming a commissioning party.
• A documented link to the Polish case.
• A new incident against Starlink or other satellite communications nodes in EU or NATO states.

Conclusion

The Bulgarian case has cleared a procedural milestone but remains silent on the question Kyiv, Warsaw and Tallinn are watching: who is behind it. Until a first arrest or an official attribution, the accurate frame is an investigation into sabotage with no established principal.

A warrant without an arrest establishes that a crime was committed, not that the culprits have been found.

Sources

1. Reuters, 19 October: https://www.internazionale.it/ultime-notizie-reuters/2026/10/19/bulgarian-court-approves-arrest-warrant-for-two-germans-over-starlink-fire
2. Associated Press, 19 October: https://apnews.com/article/bulgaria-starlink-arson-suspects-germany-4fd7c426befbf98a7e361d0156a3509f
3. TVP/PAP, 19 October: https://www.tvp.info/96012241/bulgaria-podpalenie-starlinka-w-sofii-europejskie-nakazy-aresztowania-dwoch-19-latkow
4. Berliner Zeitung (dpa), on the first reports of 14 October: https://www.berliner-zeitung.de/article/starlink-brandanschlag-bulgarien-polen-sabotage-10495274
5. Meduza, 14 October: https://meduza.io/en/news/2026/10/14/masked-intruders-set-fire-to-11-starlink-antennas-in-bulgaria

Baltic Security Monitor (osint-baltic.com) — an analytical publication on security on NATO's northeastern flank.
All OSINT coefficients are calculated by an automated indexing system based on open sources.