From Warning to Guarded Sites: Poland and the Baltics Prepare for a Possible Russian False-Flag Strike
Baltic Security Monitor | AnalysisUpdated: 10 August 2026, 20:00
Four days ago, the possibility that Russia could use Ukrainian drones in a provocation against the Baltic states remained primarily an intelligence warning. The response has now become physical: Lithuania has deployed troops to strategic energy facilities, Latvia has increased protection of critical infrastructure, and Poland is preparing alternative gas-supply routes while strengthening security around energy connections. The operation itself remains unproven — but regional governments are already treating the risk as serious enough to commit personnel and resources.
What Changed in Four Days
On 6 August, Lithuanian Defence Minister Robertas Kaunas said Lithuanian intelligence was examining a scenario in which Russia could use a captured or reconstructed Ukrainian drone in a provocation against the Baltic states. One possible objective, he said, would be to weaken support for Ukraine and create divisions within NATO.
At that point, the intelligence warning itself was the main development.
By 10 August, the picture had changed.
Reuters reported that Lithuania had already deployed military personnel alongside police to protect several specific strategic sites: the Klaipėda LNG terminal, an oil-products terminal, the LitPol Link electricity interconnection with Poland and the Kruonis pumped-storage power plant.
Kaunas confirmed that increased protection of critical infrastructure was being coordinated with intelligence services.
Latvia has also strengthened protection of critical infrastructure. Facilities covered by the heightened security measures include infrastructure on the Daugava River and the Inčukalns underground gas-storage facility. Latvia’s prime minister told Reuters that the probability of a hybrid threat is now higher than before.
This is therefore no longer only an intelligence assessment. Military personnel, police and infrastructure operators are already acting on it.
Poland Is Preparing for Redundancy as Well as Protection
The Polish response illustrates another dimension of the same problem.
According to Reuters, gas infrastructure operator Gaz-System is operating under increased vigilance, while Orlen is examining alternative gas-import routes in case existing supply channels are disrupted.
This matters because roughly 80% of Poland’s imported gas arrives through the Świnoujście LNG terminal and the Baltic Pipe from Norway — two routes geographically concentrated around the Baltic coast.
Separately, Poland’s electricity-grid operator and the military had already begun strengthening protection around the electricity interconnection with Ukraine in July. The connection helps support Ukraine’s power system, which has been repeatedly damaged by Russian strikes.
Poland is also already operating within a broader heightened-security framework. The BRAVO alert level remains in force nationwide until 31 August, while the higher CHARLIE level applies to designated railway infrastructure. BRAVO also covers Polish energy infrastructure located outside the country.
The latest measures therefore do not represent an entirely new security architecture. They reinforce an existing system of heightened readiness.
The Scenario Remains a Scenario
There is an important distinction between what regional governments are doing and what has been established about the threat itself.
Reuters cited an intelligence official from a Baltic state as saying that Russian military and domestic intelligence services were assessing a possible false-flag operation against infrastructure in Russia, Poland or the Baltic states using Ukrainian-made drones.
🟡 This does not establish that a specific operation has been approved or that an attack is imminent.
Another regional official quoted by Reuters expressed the uncertainty particularly starkly: such an attack could happen at any point — or never happen at all.
Moscow denies the allegations and argues that warnings about Russian covert operations are being used to justify militarisation against Russia.
The material change on 10 August is therefore not proof that a Russian false-flag operation is underway. There is no such proof publicly available.
What has changed is that several governments now regard the intelligence signals as sufficiently serious to translate warnings into practical protective measures.
The Most Dangerous Effect May Not Be the Explosion
🟡 If the scenario described by regional intelligence is genuinely under consideration in Moscow, the principal objective may not be the physical destruction of a particular terminal or electricity facility.
An attribution crisis could be considerably more consequential.
A Ukrainian-made drone — or an aircraft reconstructed using captured Ukrainian components — could potentially create hours of uncertainty over who launched it, where it came from and whether Ukraine was involved.
That interval between an incident and reliable attribution could itself have political value.
Reuters reported that regional intelligence assessments see one possible consequence as political turmoil within NATO while governments determine responsibility and decide how to respond.
For Ukraine, this creates a separate vulnerability. Even a militarily unsuccessful provocation could potentially support an information operation designed to damage trust between Kyiv and its allies.
Why These Particular Sites Matter
The infrastructure being protected is revealing.
The Klaipėda LNG terminal is one of the foundations of Baltic gas security. Inčukalns provides major regional gas-storage capacity. LitPol Link connects the Baltic and Polish electricity systems. The Polish-Ukrainian electricity connection has direct importance for the resilience of Ukraine’s damaged power grid.
These are therefore not merely expensive industrial facilities.
They are nodes where disruption could produce cross-border consequences — or, at minimum, substantial political and informational effects.
On 22 July, the energy ministers of Lithuania, Latvia and Estonia had already agreed to develop joint reserve capabilities for responding to damage to critical energy infrastructure and restoring electricity supplies more rapidly.
The latest deployment of physical security is therefore part of a broader transition from protecting individual facilities toward building regional infrastructure resilience.
Drones Are No Longer Only an Air-Defence Problem
The shift is particularly visible across the Baltic states.
Following a series of drone incidents, the defence ministers of Lithuania, Latvia and Estonia had already called for stronger layered air defence.
Estonia subsequently moved further. Legislation approved by the government in April envisaged substantially broader powers for the Defence Forces, police and critical-infrastructure operators to detect and counter drones around sensitive sites.
Military guards, police protection, infrastructure operators, alternative supply routes and intelligence coordination are now being added to that air-defence component.
🟡 This indicates a gradual erosion of the administrative distinction between counter-drone defence, counter-sabotage measures and critical-infrastructure protection. For the Baltic states, they are increasingly becoming parts of a single hybrid-defence problem.
What Would Constitute the Next Confirmation Threshold?
There is currently no public evidence that Moscow has made a decision to carry out the operation described in the intelligence warnings.
The next material threshold would therefore not be another general intelligence warning.
It could instead be the interception of a specific drone near a protected facility, reconstruction of its flight path, identification of the origin of its components, discovery of a supporting sabotage network, or publication of more specific intelligence by allied governments.
Until then, the correct assessment remains deliberately two-sided:
The false-flag scenario is unproven. The security response to it is already real.
That is what separates the situation on 10 August from the warning issued four days earlier.
Baltic Security Monitor (osint-baltic.com) — analysis of security developments on NATO’s north-eastern flank.
