EU capitals scramble to define response protocols for potential mass-casualty hybrid attacks

Key points

• EU ambassadors met in restricted formats to discuss protocols for a major hybrid attack resulting in multiple casualties, a scenario considered increasingly likely by officials.
• Recent incidents, including an explosives-laden drone at Leipzig airport and a suspicious fire at a Polish Starlink station, have accelerated these preparations.
• Commission President Ursula von der Leyen is pushing for an 'emergency security protocol' and a 'European Security Council' to be included in the upcoming European Security Strategy.
• Critics, including some member states and analysts, argue that new EU mechanisms may duplicate NATO’s functions or conflict with existing crisis tools like the Integrated Political Response (IPCR).
• Concerns over secure communications and potential leaks, exacerbated by past incidents involving Hungarian officials, have led some capitals to restrict sensitive intelligence sharing to NATO channels.

Background

This development follows a series of EU initiatives in late 2026 to address Russian hybrid threats. In September, EU foreign ministers pledged unity behind Germany after the Leipzig attack and discussed 1,600 new sanctions against Moscow’s military-industrial complex. Simultaneously, the EU began drafting an 'emergency security protocol' to coordinate responses to sabotage below the threshold of armed aggression, aiming to fill perceived gaps in defense structures. These efforts come amid a broader surge in incidents, including airspace violations and cyberattacks, which officials argue require faster, more coordinated civilian and political responses than traditional military alliances can provide.

How outlets are covering it

POLITICO highlights the internal EU friction, noting that while some officials fear a 'nightmare scenario' of mass casualties, others worry that new protocols like von der Leyen’s 'emergency security protocol' will duplicate existing tools like the IPCR or create confusion with NATO. CEPA’s Skip Davis argues that NATO’s eastern flank readiness is robust, with forward forces capable of self-defense without waiting for council decisions, and that the risk of a 'freeze' in response is low due to pre-committed reinforcement plans. CBN emphasizes the tangible threat, citing Polish officials who state that daily drone and sabotage incidents are testing NATO’s defenses and that Poland has accelerated its defense spending to 5% of GDP. Denison Forum, while focusing on spiritual and moral dimensions, notes that these attacks are designed to fracture alliance unity and test commitment to Article 5, urging a response that combines defensive capability with moral resolve. The divergence lies in the perceived urgency and mechanism: EU officials see a need for new civilian coordination, while NATO-focused analysts and some EU critics argue existing military and political tools are sufficient if properly utilized.

Why it matters

The outcome of these debates will determine whether the EU can respond cohesively to a potential mass-casualty event without duplicating or conflicting with NATO’s military response. If protocols are unclear or communication channels are insecure, it could delay critical decisions during a crisis, potentially undermining deterrence. Conversely, a well-defined division of labor—NATO handling military deterrence and the EU managing civilian response and political coordination—could strengthen Europe’s resilience against hybrid threats and signal unity to Moscow, which, according to analysts, does not distinguish between the two organizations when assessing threats.

What to watch

The EU is expected to finalize its 'European Security Strategy' in early November, which will likely include the proposed 'emergency security protocol' and 'European Security Council.' Member states will continue to debate the scope of these mechanisms, with some pushing for reliance on existing tools like the IPCR. Meanwhile, NATO and the EU will likely engage in further discussions to clarify the division of labor in response to hybrid attacks, aiming to avoid confusion and ensure a rapid, coordinated response if a mass-casualty event occurs.