Two drones, two sides: Latvia names the origins, Poland locks down its border

Baltic Security Monitor | Material Update · 3 November 2026, 20:00 EET

Latvia's military has given its first preliminary origins for the two drones that violated the country's airspace in 48 hours: the first was most likely a Russian Geran, the second looked like a Ukrainian aircraft. The same day, Donald Tusk confirmed a large security operation on Poland's borders with Kaliningrad and Belarus after intelligence warned of possible sabotage. The sky over NATO's north-eastern flank is now shared by both sides of the war, while on the ground Poland is bracing for provocations that have yet to be proven.

Latvia: a Geran on Sunday, a Ukrainian-looking drone after midnight

Latvia's National Armed Forces released details of both incidents.

1 November. At 18:57 a threat was declared over the Krāslava and Ludza districts. The military tracked the aircraft and launched an interceptor drone. At 19:16 the intruder crossed back into Russia, and at 19:19 the interceptor was self-destructed rather than follow it across the border. That was the explosion residents heard. The military's assessment is that the intruder was most likely a Russian Geran-type drone. Whether it carried a warhead is unknown, and there is no wreckage, since it returned to Russia.

Night of 2–3 November. At 00:10 local time a threat was declared over the Balvi and Ludza districts. Two Latvian interceptor drones, launched from separate positions, detected the target and made an initial identification, while NATO Baltic Air Policing fighters were activated. The alert was lifted at 00:35. Initial visual identification found the aircraft similar to drones used by Ukraine's armed forces. 🟡 Its exact type and origin are not confirmed. It is suspected to have come down in Balvi district, where the National Guard (Zemessardze) is involved in an ongoing search. No wreckage has been found so far.

The military also noted that its interceptor-drone system has been in service for less than six months, with several teams on standby.

(Correction to the Material Update of 3 November, 08:00: according to the Latvian military, the second alert began at 00:10 local time on 3 November, and Latvia deployed its own interceptors as well as NATO fighters.)

BSM analysis

Two attributions in two days break the convenient "one border, one intruder" story. Two separate strands of the war cross over Latgale: Russian attack drones that enter and leave through the Russian border, and Ukrainian aircraft that have strayed off course towards Russian targets before, likely pushed by jamming. For Latvian air defence, that means responding to every target without knowing in advance whose it is.

Both assessments are preliminary. The Geran was assessed without physical debris, since it flew back to Russia. The second drone was identified only visually, from the interceptors. Neither finding shows a deliberate strike on Latvia. The real test begins when wreckage turns up in Balvi.

Poland: border operation near Kaliningrad until at least 8 November

Polish national police chief Marek Boroń announced a large security operation in the Warmia-Masuria and Podlaskie regions, which border Kaliningrad and Belarus. It began on Monday and will run until at least 8 November. Additional police and counter-terrorism units have been deployed, along with troops from the GROM special forces unit, and a dedicated command centre has been set up at national police headquarters. The stated aims are to protect the public, spot suspicious activity early and prevent attacks on critical infrastructure.

On Tuesday, Prime Minister Donald Tusk said suspicious movement had been seen near the Kaliningrad border overnight, including people carrying flashlights. A quick response, he said, may have prevented a provocation, "if that was the intention" — while conceding that this could never be fully confirmed. 🟡 By Tuesday evening, Polish authorities had published no evidence of specific sabotage plans.

Tusk said intelligence had pointed for weeks to possible sabotage or a more serious provocation against the EU, including armed individuals entering Polish territory. Polish and allied services singled out the first half of November. As early as 13 October, at a joint press conference with Lithuania's prime minister, Tusk said a conversation with NATO's Supreme Allied Commander Europe had deepened his concern about possible aircraft provocations or attacks on border crossings.

The operation follows a string of incidents Polish officials link to Russia, including an August fire at a drone and military-components factory and a September arson attack on a Starlink ground station.

BSM analysis

The geography explains the operation. Warmia-Masuria and Podlaskie flank the Suwałki corridor, the only land link between the Baltic states and the rest of NATO. Any provocation there, however small, tests not just Poland but the alliance's ability to keep its connection to Lithuania, Latvia and Estonia open.

The real news is not the flashlights but a concrete deployment with a fixed timeframe and a command structure. That is what to watch: whether the operation is extended beyond 8 November, whether arrests follow, and whether any evidence is published. With Exercise Koalicja starting on 9 November and talks in Abu Dhabi on 10–11 November, the first half of the month is exactly the window intelligence warned about.

What is established and what is not

Officially confirmed - the Latvian military's preliminary assessment: the 1 November drone was most likely a Russian Geran, and the drone on the night of 3 November looked similar to Ukrainian aircraft; - the use of Latvian interceptor drones in both incidents and NATO fighters in the second; - a Polish security operation in two regions until at least 8 November, involving police, counter-terrorism units and GROM.

Not established - 🟡 the exact type, origin and armament of both drones, and where the second came down; - 🟡 whether the overnight activity near Kaliningrad was an attempted provocation; - 🟡 which services issued the warnings and on what basis.

Conclusion

3 November closed on the north-eastern flank with two answers and several open questions. Latvia said plainly, for the first time, that its sky is crossed by aircraft from both sides of the war. Poland did not wait for proof of a provocation and put forces on the border in advance. Both responses follow the same logic: on a flank where the gap between an incident and a crisis is measured in minutes, identification has to come before something happens, not after.

A sky shared by both sides of a war, and a border guarded against the unknown, are now the working conditions for the Baltic states and Poland.

Baltic Security Monitor (osint-baltic.com) — an analytical publication on security across NATO's north-eastern flank.
Prepared from open-source monitoring; the verification status of each fact is marked in the text.