Changing of the Guard, Phantom Bombs: Security Watch, 6 November, 20:00

France will take over air defence of Rzeszów-Jasionka, the main hub for Western aid to Ukraine, from 1 January 2027. On the same day, a wave of hoax bomb threats jumped from airliners to European newsrooms, and Hungarian Gripens escorted passenger jets three times in one morning on NATO orders.

Baltic Security Monitor | Material OSINT Update
Slot: 6 November 2026, 20:00 EET · 2 MATERIAL UPDATES · 1 HIGH · 1 MODERATE · uncertainties 🟡 6 · 🔴 0

Tonight's two stories show two different modes of European security. At Rzeszów the mode is long-range planning: allies hand responsibility for a critical asset from one to the next, months in advance. Over Hungary and on RTÉ's airwaves the mode is reaction to a cheap attack that needs no explosives at all to scramble fighters and empty newsrooms. The first mode is already scheduled into mid-2027. The second is still answering events as they come.

🔴 1. France takes over the Rzeszów-Jasionka shield

Materiality: HIGH · NATO / air defence / Ukraine logistics

Speaking to reporters in Warsaw on 6 November, French Ambassador Étienne de Poncins said France would take charge of air defence around Rzeszów as part of NATO from 1 January, the first time French equipment will be used for the task. Poland's Defence24 placed the handover on 1 January 2027.

The ambassador said French systems would operate alongside US-made Patriots, giving the allies a chance to test how the two work together. He gave no end date. The hub is currently covered by Dutch Patriots, with Sweden deploying its own next month.

Paris has not named the system. SAMP/T is the obvious guess, but it is unconfirmed, and BSM does not treat it as fact.

BSM analysis: The overlap matters more than the date. Sweden's contingent of around 100 troops and a Patriot unit arrives on 1 December with a mandate running to the end of 2026, and Stockholm is already preparing an extension through the first half of 2027. The likely January picture is therefore French command of the area's air defence working with Swedish Patriots, which is why the ambassador spoke of joint operation rather than replacement. Rzeszów has now passed through American, German, Dutch, Swedish and soon French hands. What began as a stopgap has become a standing architecture that allies pass along. For the Baltic states this is a useful template: multinational air defence of a single critical node, with different national systems learning to fight in one network. Ports and rail hubs in the region will need exactly that.

The French system type, unit size and mission length remain unknown, and NATO has yet to confirm the arrangement formally.

🟡 2. Phantom bombs: from airliners to newsrooms

Materiality: MODERATE · hybrid threats / aviation security

On 6 November, Ireland's RTÉ and Bulgaria's Nova TV received emailed bomb threats signed "Mikhail Andropov" under the heading "Message to the West." The author claimed to lead the group behind this week's threats to airliners. RTÉ evacuated its Dublin campus, and some programming was replaced by music and a recorded message for hours. Sky said it had also received a security threat, and the Irish government said Virgin Media, Newstalk and the Irish Independent were targeted too. No device was found anywhere.

The aviation strand continued in parallel. Hungarian Gripens escorted three airliners in one morning: Brussels to Sofia, and two departures from Prague bound for Bucharest and Cyprus. Defence Minister Romulusz Ruszin-Szendi said NATO then ordered air patrols near the Hungarian-Romanian border, which Reuters described as the first reported involvement of the alliance.

Scale deserves perspective. Eurocontrol counted threats against 14 flights on Thursday, about 0.05% of the roughly 26,300 flights in the European network that day. Every aircraft landed safely.

BSM analysis: "NATO involvement" here is not escalation. A quick-reaction pair launched on an ALPHA SCRAMBLE, followed by patrols, is standard Air Policing procedure, and Hungary did the same with a Wizz Air flight on 2 November. What is genuinely new is the change of target. Moving from aviation to media suggests the aim is attention and a sense of continent-wide menace rather than transport itself. The "Andropov" signature, and a subject line echoing a Soviet-era biography, look like deliberate symbolism, and symbolism serves any author: a state, or someone imitating one. There is no state attribution. Spain's foreign minister called it probable psychological warfare, which is an assessment, not an established finding.

For the Baltic states and Poland the lesson is practical. The attack costs a few emails; the response costs evacuations, inspections and fighter sorties. A region dense with critical infrastructure and its own record of hybrid incidents should expect ports, rail or energy to be next on the list.

It is still unknown who sent the emails or whether the aviation and media threats share a source, and no technical analysis of the messages has been made public.

On watch

• Latvian drones. One drone provisionally identified as Russian, another as Ukrainian. No final technical assessment yet.
• Baltic Sea security. Risks to infrastructure and shipping persist; no new incident this cycle.
• Patriot / PURL. What counts now is signed contracts and delivered systems, not new announcements.
• European infrastructure sabotage. Awaiting court-tested attribution and technical findings in earlier cases.
• EU funding for Ukraine. Not counted as MATERIAL again without confirmed disbursement.

Bottom line

The evening of 6 November drew an unusually clean line. Where Europe plans ahead, it already has a rota six months out: the Netherlands, Sweden, France. Where it reacts, it still pays more than the attacker. Rzeszów is shielded by Patriots. No Patriot stops an email signed "Andropov."

Baltic Security Monitor (osint-baltic.com) — an analytical publication on security along NATO's northeastern flank.
Materiality assessments are produced by an automated open-source monitoring system.