European Commission President Ursula von der Leyen stood before the European Parliament in Strasbourg on September 16 and proposed the counter-hybrid playbook — a new mechanism for the EU to respond collectively when any of its 27 governments are hit by cyberattacks, drone incursions, or acts of sabotage. The same week, France and Slovakia blocked renewal of the routine Russia sanctions for the first time since the Ukraine invasion began — and the two failures have the exact same structural cause: unanimity.

Her proposal, which von der Leyen described as a mechanism to flank NATO’s Article 4, would allow a single EU member state suffering a hybrid attack to immediately convene all 27 governments to coordinate a European response, deter further escalation, and limit the damage. But neither the speech nor any subsequent briefing specified whether the proposed Emergency Security Protocol would override the unanimity requirement that governs EU Common Foreign and Security Policy — meaning the protocol may convene a better consultation, without guaranteeing a better outcome.

The timing of the speech gave the structural problem a live demonstration. Just the night before von der Leyen spoke, Italian Air Force Eurofighter Typhoons operating under NATO’s Baltic Air Policing mission shot down an armed drone that had entered Lithuanian airspace from Belarus near the village of Pratkunai, roughly 60 miles (97 km) west of Vilnius — the first time alliance jets had ever engaged an armed drone inside EU member state airspace. And just hours before that intercept, EU ambassadors had given themselves an unprecedented seven-day extension on the six-month renewal of individual Russia sanctions after France and Slovakia refused to proceed without removing Russian-Uzbek businessman Alisher Usmanov from the approximately 3,000-person blacklist.

Drone Over EU Airspace: What the Protocol Is Designed to Address

The Lithuania intercept was the first armed drone interception inside EU airspace, but it followed a pattern of escalating incursions across the bloc’s eastern flank throughout 2026. NATO Baltic Air Policing jets based at Šiauliai Air Base in Lithuania also shot down drones over Latvia in June and August. A July 28 incident in which a Russian-made Gerbera drone carrying approximately 2 kilograms (4.4 lbs) of explosives drifted across from Belarus and landed at Gaižiūnai training grounds in Lithuania produced a days-long search before the device was located and neutralized.

European intelligence services have catalogued more than 150 Russia-linked hybrid incidents on the continent since February 2022. These incidents have included arson attacks against defense facilities in Germany, Denmark, and Poland; foiled plots to use explosive-laden drones against civilian and military infrastructure; covert surveillance operations; and a confirmed attempt to detonate an improvised drone device at the Antonov cargo terminal at Leipzig Airport on August 4 — an incident that Germany officially attributed Leipzig drone to Russia on September 1.

Italy’s Defense Minister Guido Crosetto said the September 15 Lithuania drone “most probably” originated from Russia. Investigators noted, however, that Ukrainian military drones have also entered Baltic airspace after Russian signal jamming disrupted their targeting — a deliberate ambiguity Lithuania said remained under investigation. Russia denied involvement in the Leipzig incident and accused NATO members of fabricating hybrid-attack narratives to escalate tensions.

Von der Leyen described the incidents as “less and less hybrid and less and less threats” — a rhetorical signal that the bloc considers itself in an acknowledged adversarial relationship with Russia, whatever the legal and diplomatic vocabulary used to describe it.

What the Emergency Security Protocol Would Actually Do

Von der Leyen’s proposal centers on an Emergency Security Protocol explicitly modeled on the Article 4 consultation process, which allows any alliance member to convene consultations when it believes its security is threatened. The critical distinction is what Article 4 is not: it is not Article 5, the collective-defense guarantee that treats an attack on one as an attack on all. NATO’s Article 4 creates a political forum for discussion, not a mandatory operational response.

Under the proposed EU mechanism, one member state could trigger the protocol — convening all 27 governments to coordinate a response, deter further escalation, and mitigate impact. The protocol is described as building on the EU treaty’s mutual defense clause, Article 42.7, which obliges member states to assist another “by all the means in their power” if it faces armed aggression. That clause received new attention earlier in 2026 when an Iranian-made drone targeted a British airbase in Cyprus — an EU member state outside NATO — and EU ambassadors conducted what officials described as a Cyprus drone Article 42.7 discussion to understand what triggering it in practice would mean.

The gap von der Leyen’s proposal does not close: what happens after all 27 governments are assembled. “Europe needs its own counter-hybrid playbook consensus. We urgently need a consensus on how to respond to certain incidents: those which fall below armed aggression but clearly threaten our national security,” she said. But most decisions in the EU’s Common Foreign and Security Policy still require unanimous agreement, meaning any single government could block a joint response after the consultation concluded. Von der Leyen did not specify whether the Emergency Security Protocol would pre-authorize certain agreed responses, establish a qualified majority option for specified categories of hybrid incidents, or primarily provide an improved consultation structure.

NATO’s former spokesperson Oana Lungescu was direct in her skepticism: “Protocols and playbooks already exist in both organizations,” she said, questioning whether the EU version would actually deter Russia. Nathalie Tocci, director of Rome’s Istituto Affari Internazionali, offered a more calibrated assessment: the European Security Council format “would presumably instill a greater sense of trust and shared destiny among its members,” but consensus would presumably still be necessary.

Sanctions Paralysis: The Proof Case for the Protocol’s Structural Problem

The proof that the unanimity problem is not theoretical arrived the same week as the speech. France and Slovakia demanded Fridman delisting too — refusing to renew the routine six-month extension of individual Russia sanctions — targeting nearly 3,000 individuals and entities — unless Usmanov was removed from the list.

France’s stated rationale was a “national security issue” connected to international partners who had requested Usmanov’s delisting — a formulation that, according to reporting by Meduza citing EUobserver sources, referred to an Azerbaijan prisoner-release deal involving France. The French government declined to elaborate publicly.

The result: ambassadors resorted to a seven-day extension — an outcome described by EUobserver as unprecedented since Russia’s full-scale invasion of Ukraine began — buying time until September 22 for continued negotiations. The episode illustrated precisely what analysts had warned about von der Leyen’s earlier calls for unified EU hybrid response: even the most straightforward Russia-related measures fail the unanimity test when one or two member states decide their interests lie elsewhere.

The Emergency Security Protocol, if implemented without a structural change to decision-making rules, would face exactly the same dynamic. Consultation is not action. Convening is not response.

European Security Council: A New Format, Unanswered Scope Questions

Von der Leyen also announced plans for a European Security Council that would bring EU leaders together with partners from outside the bloc: the United Kingdom, Canada, Norway, and Ukraine. Canada’s inclusion as what would amount to the EU’s first associate security partner would represent a significant deepening of transatlantic ties beyond NATO — and drew an immediate reaction from US President Donald Trump, who suggested allowing Canada into EU security structures could constitute a potential “hostile act” warning.

The practical form of the Council remains undefined. EU Defence Commissioner Andrius Kubilius indicated it might operate in variable formats — EU-only sessions for some agenda items, broader configurations for others. “Doctrines and institutions, which were created during peacetime, are not fit any more for the purpose,” Kubilius said, endorsing the broader reform agenda. Ukraine’s seat at the council table — while its EU membership candidacy proceeds — signals that Kyiv is to be treated as a continental security stakeholder rather than only a recipient of European support.

Cyber Capabilities as Strategic Military Enablers: A Doctrinal Shift

The speech contained what may prove to be its most consequential long-term element: the classification of EU cyber capabilities as a “strategic enabler” on a par with fighter aircraft, precision missiles, and air-to-air refueling. Von der Leyen announced a European Instrument for Strategic Enablers — a new funding and coordination mechanism covering air and missile defense, strategic transport, space systems, and cyber operations — to be built in alignment with NATO.

This classification follows NATO’s 2016 Warsaw Summit decision to recognize cyberspace as an operational domain alongside land, sea, and air — but it marks the first time the EU’s executive body has proposed offensive and defensive cyber capabilities as a category of collective military investment equal to kinetic assets. The timing is significant: the announcement comes after the EU AI Act Digital Omnibus created the world’s first comprehensive AI governance framework under von der Leyen’s Commission, and after the 2025 Digital Omnibus proposal delayed some AI Act obligations while simplifying cybersecurity reporting requirements. Von der Leyen has now moved her Commission’s posture from AI regulation to AI and cyber as instruments of national security — a substantive doctrinal evolution.

Commissioner Kubilius had previously warned that €500 billion to replace US military assets in Europe following any American retrenchment would be required (approximately $575 billion USD). The parameters of the new strategic enablers instrument — including how it addresses that gap — are expected to be elaborated in the forthcoming European security strategy, which was originally scheduled for the third quarter of 2026 but has been pushed to October.

Freyja and Patriot: Missile Defense at Scale

Von der Leyen reaffirmed EU support for the Freyja anti-ballistic missile program, the European and Ukrainian joint air defense system launched in Paris on July 13, 2026, at a meeting of the Coalition of the Willing. The founding coalition comprises Ukraine and nine European partners — France, Germany, Italy, the United Kingdom, the Netherlands, Norway, Denmark, Sweden, and Spain — along with NATO, the EU, and leading European defense companies including Hensoldt, Eurosam, Leonardo, Thales, and Saab. Ukraine’s defense company Fire Point, manufacturer of the FP-7.x interceptor missile, leads the industrial effort, with a prototype targeted for first half of 2027.

Von der Leyen also confirmed a new Ukrainian payment request for “several billion euros” for air defense costs, including Patriot PAC-3 interceptor missiles. Ukraine has faced a documented shortage of Patriot interceptors as Russia has intensified ballistic missile strikes on Kyiv and Odesa.

Does the Protocol Add up to Deterrence?

The question Europe’s allies and adversaries are now evaluating is whether the sum of these proposals — a consultative hybrid-attack trigger, an expanded security council format, a cyber-enablers instrument, and a missile-defense commitment — constitutes a credible deterrent, or an improved architecture for discussions that may still produce no agreed response.

Von der Leyen’s case rests on cumulative signaling: that Europe is willing to name what it is facing, build the institutional infrastructure for a collective response, and commit defense investment at a scale previously unthinkable. “Cyberattacks and sabotage, arson and drone incursions — they are ramping up every day,” she said. “Our systems were made for a different world.”

The skeptic’s case rests on the week’s own evidence. The EU entered September 2026 unable to extend routine Russia sanctions without an unprecedented procedural workaround. An improved alarm bell is genuinely useful. But until the EU resolves whether any member state can veto a response after the alarm sounds, what von der Leyen has proposed is a mechanism that can convene a meeting — not one that can end one with a decision.

Frequently Asked Questions

What is the EU counter-hybrid playbook, and how is it different from what the EU already has?

Von der Leyen’s proposed Emergency Security Protocol would allow any single EU member state that suffers a cyberattack, drone incursion, or act of sabotage to immediately convene all 27 EU governments for a coordinated response. The EU cyber frameworks and NIS2 — including the NIS2 Directive, the Cyber Solidarity Act, and the EU Cyber Rapid Response Team — operate through existing EU institutions and do not provide a dedicated political trigger for collective action when a state-sponsored hybrid incident occurs. The new mechanism is explicitly modeled on NATO’s Article 4 consultation process, which allows NATO members to request urgent consultations. The critical open question is whether the protocol would require unanimous agreement to take action after the consultation — if so, it adds speed to the meeting, but not necessarily to the response.

What was the Lithuania drone incident, and why does it matter for European security?

Shortly after midnight on September 15, NATO Baltic Air Policing jets — Italian Eurofighter Typhoons based at Šiauliai Air Base — intercepted and shot down a drone that had entered Lithuanian airspace from Belarus near the village of Pratkunai, roughly 60 miles (97 km) west of Vilnius. The intercept was the first time alliance fighter aircraft had shot down an armed drone inside EU and NATO member state territory. The drone’s origin remained under investigation at the time of reporting, though Italy’s defense minister described it as “most probably” Russian. The incident illustrates the operational challenge the Emergency Security Protocol is designed to address: armed drone intrusions from Belarus that arrive without warning, require immediate military response, and are deliberately difficult to attribute.

Why did France and Slovakia block EU Russia sanctions, and what does it reveal about the Emergency Security Protocol?

France joined Slovakia in demanding that Russian-Uzbek businessman Alisher Usmanov be removed from the EU sanctions blacklist before the routine six-month renewal could proceed. France cited a “national security issue” linked to international partners — reportedly Azerbaijan in connection with a prisoner-release deal. The result was an unprecedented seven-day extension rather than the intended six-month renewal. The episode is directly relevant to the Emergency Security Protocol because both operate under the same legal architecture: EU Common Foreign and Security Policy requires unanimity for most measures, meaning any single government can block a collective response. A protocol that convenes all 27 governments cannot guarantee that all 27 governments will agree to act — the same structural veto that paralyzed sanctions applies inside any consultation the protocol might trigger.

What is the Freyja missile defense system, and how does it relate to the EU’s strategic enablers proposal?

Freyja is a joint European anti-ballistic missile system launched in Paris on July 13, 2026, by a ten-nation coalition: Ukraine and nine European founding members — France, Germany, Italy, the UK, the Netherlands, Norway, Denmark, Sweden, and Spain. Ukraine’s defense company Fire Point is developing the FP-7.x interceptor missile, with German defense company Hensoldt providing the TRML-4D radar. Companies including Eurosam, Leonardo, Thales, and Saab are also involved. The system aims to provide a lower-cost alternative to the US-made Patriot system. A prototype is targeted for the first half of 2027. Von der Leyen’s proposed European Instrument for Strategic Enablers would create a formal EU funding and coordination mechanism aligned with NATO to develop capabilities including air and missile defense — under which Freyja-type investment would fall. The underlying strategic rationale: EU Defence Commissioner Andrius Kubilius estimated that replacing US military assets in Europe would cost €500 billion to replace US military assets (approximately $575 billion USD).