Part I — Situation overview

German Foreign Minister Johann Wadephul and Interior Minister Alexander Dobrindt announced in Berlin on Tuesday 1 September 2026 that, according to the federal government’s conclusion, Russia is responsible for the Leipzig drone attack of 4 August. In the security zone of Leipzig–Halle airport, among Ukrainian cargo aircraft, a drone was found fitted with almost 800 grams of Semtex plastic explosive and an ignition device; the device did not explode because of a faulty detonator, and according to investigators a second drone may have struck a cargo aircraft standing nearby. Ten days later, according to the German press, a third drone, also loaded with explosives, was found near the airport. According to Dobrindt the perpetrators used devices and methods known from other Russian hybrid operations — the drone configuration, the components, the ignition technology and the explosive — and this is confirmed by intelligence findings. The announcement did not remain a speech: from 18 September Berlin is closing the Russian consulate general in Bonn, terminating the agreement that allows the Russian House in Berlin to operate, tightening entry rules for Russian citizens, proposing that further Russian individuals be placed on the EU sanctions list, and increasing pressure on the Russian shadow fleet. The Russian ambassador was summoned to the foreign ministry. Moscow called the accusation absurd, and Vladimir Putin accused Germany of planting evidence — he did not substantiate his claim.

On the day of the announcement, at around eight o’clock on Tuesday morning, the Turnow-Preilack substation in Brandenburg — which feeds into the grid the output of the state’s largest power plant, the Jänschwalde lignite block — was attacked with improvised explosive devices. At least one device exploded, several transmission lines were damaged and supply was interrupted for a short time; there were no injuries, and supply to the region did not fail. Both the grid operator 50Hertz and the plant operator LEAG confirmed the attack. The two cases together show the pattern that matters from MIAK’s point of view: the target is not a military object but critical civilian infrastructure — a freight airport and a high-voltage substation.

The Hungarian stake is twofold, and neither strand is abstract. One is procedural: according to Ursula von der Leyen’s announcement, the preparation of further sanctions will continue at the next foreign affairs council under the Irish presidency, and the adoption of an EU sanctions legal act requires a unanimous decision of the Council — that is, a Hungarian vote too. The other concerns capability: Leipzig airport is a hub of NATO’s SALIS (Strategic Airlift International Solution) programme, the base of that heavy airlift capability which Hungary too does not maintain independently but draws on through an alliance programme. The Hungarian equivalents — Ferenc Liszt airport, the MAVIR substations, the nodes of the energy grid — have no dedicated counter-drone capability today. MIAK’s reading: the German case is not primarily a security-policy news item but a capability diagnosis. Attribution — the official naming of the party responsible for an attack — is in itself a policy capability: it requires intelligence capacity, sharing with partner services, and a legal-communications procedure that makes the conclusion defensible in public. In Hungary the existence of none of these conditions is documented.

Part II — Foundations in the literature

Three authors provide the frame in which the German step and the Hungarian task can be interpreted. According to the basic proposition of Carl von Clausewitz (Prussian military theorist, author of On War), war is the continuation of politics by other means. That is, sub-threshold violence is not a technical question either, but a question of the relationship between political aim and military instrument: the Leipzig drone is not an act of war, but it is a political message, and it must be answered as such. The work Essence of Decision by Graham Allison and Philip Zelikow (American political scientists, authors of the classic decision analysis of the Cuban missile crisis) points out that the intelligence conclusion is itself an organisational product. When a service regards something as “certain enough” is a procedural and organisational question, not simply a function of the quantity of evidence. And Henry Kissinger’s volume World Order (German-born American diplomat and foreign policy thinker, former US secretary of state) records that every international order rests on two pillars — commonly accepted rules that define the limits of permissible action, and a balance of power that enforces restraint where those rules break down. These three together give the basis of MIAK’s proposal: in the absence of a rule, attribution becomes a political decision, and political attribution neither deters nor is predictable. The detailed treatment of the literature — author by author, with quotations — can be found in section 6.4 Literature in detail.

Part III — MIAK’s concrete proposal

MIAK proposes three measurable measures: an EU initiative, a domestic capability audit and a procedural protocol. All three should be carried out even if the Hungarian decision on the September sanctions package finally goes either way — the position is not about the concrete vote but about the framework in which the vote can be grounded.

3.1 A Hungarian initiative for an EU minimum standard of attribution (at the next foreign affairs council)

Hungary should propose that the Union work out a simple, written set of requirements on the level of proof at which a sabotage or hybrid operation can be classified as state-sponsored. The set of requirements must contain at least four elements: which types of evidence are acceptable (technical examination, modus operandi, confirmation by partner services), how many independent sources must concur, within what deadline the conclusion has to be drawn, and in what form it has to be communicated to the public. The essence of the proposal is a shift in the question: what should be decisive is not whether a member state politically wants to name the party responsible, but at what level of proof it must. This is in Hungary’s interest in two directions. Regulated attribution makes the sanctions cycle predictable, to which domestic adaptation of energy imports and corporate planning can adjust; and it also protects Hungary from having non-existent responsibility imputed to it on political grounds. The relevant MIAK programme point is KP7, which describes the foreign policy crisis-management protocol.

3.2 A counter-drone audit of Hungarian critical infrastructure (fixed in a government decision, with a 180-day deadline)

The Government should order a counter-drone screening of critical infrastructure and fix a deadline for it. The audit should extend to at least three sets of facilities: airports used for international and also for military purposes, high-voltage substations, and the network nodes of energy supply. The screening should give a numerical answer to four questions per facility: is there working drone detection; how much time elapses between detection and intervention; which body is entitled to intervene, and is there trained, available personnel for this; and finally, what is the cost of making good the missing capability. The Government should lay the aggregate result — without facility names, in aggregated form — before the competent committee of the National Assembly. This is an extension of MIAK’s programme point D5: the cybersecurity strategy already contains a compulsory annual audit of critical infrastructure operators, but the physical drone threat is today not part of the audit’s subject matter. The EU directive on the security of network and information systems (NIS2) treats the energy sector as an “essential entity” — it is worth fitting the audit to this existing framework rather than making it a separate procedure.

3.3 A public attribution and communication protocol for Hungarian incidents (within 90 days)

A written procedure should be prepared for the case in which a similar sabotage affecting critical infrastructure occurs in Hungary. The protocol should set out who speaks and at what level of proof; within what time the first situation assessment has to be completed; which bodies take part in forming the conclusion; and in what form the public communication is made. MIAK’s programme point KP7 provides a ready structure for this: the crisis protocol prescribes a situation analysis within six hours, at least three alternative courses of action within twenty-four hours, and monitoring of implementation. The existence of the protocol has two benefits. First, it prevents contradictory government statements from being made in a live situation — the German example was precisely about two ministers stepping forward at the same time, with the same content, agreed in advance. Second, it connects to MIAK’s programme point HV11, on strategic communication and information defence: credible, documented attribution is itself the best protection against disinformation.

A single thought links the three proposals: against hybrid threats, deterrence consists not of instruments but of predictability. In Clausewitz’s sense, sub-threshold violence is attractive to the perpetrator because the political response is uncertain — the attacker counts on the attacked party being unable to decide what happened, or not daring to say it. MIAK’s programme point HV8, deterrence on the principle of “victory without battle”, identifies precisely the clarification of the automaticity of responses as the third element of credible deterrence. The attribution rule is therefore not legal formalism but an instrument of deterrence: if it is known in advance what follows from what, the return on the operation falls.

Part IV — Expected effects and risks

Dimension Expected effect Risk
Foreign policy The Hungarian sanctions position becomes predictable for allies and for the market; the reason for the decision can be documented The initiative may be left without partners if the large member states insist on the present case-by-case practice
Defence and law enforcement The capability gap in critical infrastructure becomes known in figures The result of the audit is uncomfortable: gaps made public may themselves provide targeting information, so aggregation is indispensable
Economy Energy import structure and corporate procurement can adjust to a plannable sanctions cycle A stricter common standard of proof may slow responses, which works against deterrence in the short run
Domestic politics The procedural framework depoliticises the debate: it is about evidence, not intention If the protocol is introduced in the middle of a concrete case, it necessarily looks like taking sides in that case

The main question to weigh is the relationship between speed and soundness. A strict attribution rule requiring the concurrence of several sources protects states from mistaken or political accusation, but slows the response — in the Leipzig case almost a month passed between the finding of the explosive device and the official naming. That time is not necessarily a loss: according to Allison and Zelikow’s analysis, it is precisely the checking and cross-comparison of intelligence reports that makes the conclusion reliable. The proposal tips over to the risk side if the threshold of proof is set so high that in practice it is never met — in that case the rule does not protect but provides an excuse for inaction. The right solution is therefore not a single threshold but gradation: a lower level of proof suffices for defensive and diplomatic steps (summoning the ambassador, tightening entry rules), a higher one for economic sanctions.

Part V — Measurability and summary

5.1 What is worth following? (proposed KPIs)

MIAK proposes the following performance indicators (KPIs). These are proposed indicators, not government undertakings.

  • Completion of the critical infrastructure audit. It is worth taking as a target the screening of 100 per cent of airports and high-voltage substations within 12 months, together with a cost estimate of the missing capabilities.
  • Time elapsed from detection to intervention. An aggregated value measured by facility type; MIAK’s programme point D5 sets the reduction from 72 hours to below 24 hours for critical infrastructure incidents — for a physical drone threat the relevant order of magnitude is minutes, not hours.
  • The existence and testing of the attribution protocol. A written procedure within 90 days, then at least one simulation exercise a year in which the protocol is tried out on a live situation.
  • The documentation of Hungarian sanctions votes. At every EU sanctions decision, a public, short justification of the level of proof on which the Hungarian position was based.

5.2 Summary

MIAK’s request to the government is two concrete steps. One: at the next foreign affairs council, Hungary should table the proposal to work out a minimum standard of attribution — not instead of sanctions, but as their grounding. The other: a counter-drone audit of critical infrastructure should be launched in a government decision, with a 180-day deadline. Together these two cost less than the consequence of a single missed incident, and neither requires a new institution.

Among MIAK’s foundational values, data-drivenness and predictability are at work here. Data-drivenness because the question of attribution is ultimately a question of proof: whether we hold a state responsible should not be a political preference but the result of technical examination and the comparison of sources — and this is precisely the area where MIAK’s non-ideological approach adds value. And predictability because the room for manoeuvre of a middle power derives not from its strength but from its partners and its markets knowing in advance what it will do. Whoever decides anew in every single case turns every single decision into a bargain; whoever decides according to a rule fixed in advance gives their decision weight.

Part VI — Justifications and further sources

6.1 The framing of the press, spectrum by spectrum

The framing of the European specialist press and of the large international news agencies differed strikingly on this day, and the differences are not of style but of substance.

The European policy band — Euractiv — placed the emphasis on the EU procedural consequences. It is the only outlet that linked the announcement and the attack on the Brandenburg substation in a single piece, and that quoted von der Leyen’s announcement that preparation of further sanctions will continue at the foreign affairs council under the Irish presidency. Euractiv also carried the role of Leipzig airport in the SALIS programme — this is the detail from which Hungarian involvement can be derived at all, and which is missing from the other sources.

The German public service band — Deutsche Welle — aimed at the completeness of government communication. Here can be found in the greatest detail the argument of Dobrindt and Wadephul, the list of announced measures (closure of the consulate from 18 September, termination of the Russian House contract, tightened entry rules, summoning of the ambassador), as well as the reaction of NATO Secretary General Mark Rutte and of von der Leyen. A discrepancy of dates also appears in the DW piece: in Rutte’s quoted statement 14 August appears as the date of the Leipzig attack, whereas the German official communication and the other sources concurrently give 4 August — it was the discovery of the third drone that fell ten days later.

The British and international news agency band raised the opposing position into the frame as well. The BBC piece contains Putin’s accusation that Germany planted evidence, as well as the reaction of the Russian embassy in Berlin, which called the establishment of responsibility absurd; the outlet notes that Putin did not substantiate his claim. Al Jazeera chose an explanatory format and put the emphasis on the German intelligence conclusion being based on technical correspondence. The AP News piece is one of the international reference points on the topic, but the full text of the article was not publicly downloadable.

All in all: there is no substantive difference between the bands as to the facts; the difference is in what they regard as the essence of the news. From the point of view of Hungarian policy, the most important element — the sanctions procedure requiring unanimity, and the SALIS connection — appears only in the European policy framing, which in itself indicates why it is worth following this band too in one’s news consumption.

6.2 Facts and data

Item Data Source
Time of the finding of the Leipzig drone evening of 4 August 2026 German official communication, DW / BBC / Euractiv, 1–2 September 2026
Explosive found on the drone almost 800 grams of Semtex, with an ignition device Euractiv, 2 September 2026
Why it did not explode faulty detonator BBC, 1 September 2026
Further devices a second drone presumably struck a cargo aircraft; a third drone was found ten days later BBC / DW, 1–2 September 2026
Role of the airport concerned arms delivery hub towards Ukraine; base of NATO’s SALIS programme, with four Antonov freighters Euractiv, 2 September 2026
Time and place of the Brandenburg attack 1 September 2026, approx. 8:00, Turnow-Preilack substation, next to the Jänschwalde lignite block, approx. 100 km south-east of Berlin Euractiv / AFP, 2 September 2026
Consequence of the Brandenburg attack at least one explosion, several damaged transmission lines, short supply outage, no injuries statement of 50Hertz and LEAG, Euractiv, 2 September 2026
Announced German measures closure of the Russian consulate general in Bonn from 18 September; termination of the agreement on the Russian House in Berlin; tightened entry rules for Russian citizens; proposal for further sanctions listings; increased pressure on the shadow fleet; summoning of the ambassador DW / Euractiv / BBC, 1–2 September 2026
Procedural requirement of the EU sanctions decision unanimous decision of the Council EU treaty framework

6.3 Policy dimensions

  • Foreign policy (programme points) — the crisis-management protocol, which sets out who speaks and at what level of proof (programme point ID: KP7), as well as the experience of multilateral security building and confidence-building measures (programme point ID: KP20);
  • Defence (programme points) — clarification of the automaticity of responses as an element of deterrence (programme point ID: HV8) and strategic communication, information defence (programme point ID: HV11);
  • Digitalisation and AI regulation (programme points) — the compulsory annual audit of critical infrastructure, which MIAK would extend to the physical drone threat as well (programme point ID: D5).

6.4 Literature in detail

6.4.1 Carl von Clausewitz: On War

Clausewitz’s best-known proposition is in the present case not rhetorical decoration but an analytical instrument:

“War is therefore not merely a political act, but also a real political instrument, a continuation of political commerce, a carrying out of the same by other means.”

In the continuation of the quotation Clausewitz also explains that the weaker the motives and tensions behind a war, the less the military and the political aim coincide — the military instrument in such cases is directed not at the annihilation of the other party but at producing a political effect. This is precisely the logic of a hybrid operation. The Leipzig drone is not an attack in the military sense: it destroyed nothing, nor was it designed to start a war. Its purpose is political — to demonstrate that the route of arms deliveries to Ukraine is vulnerable, and that this has a cost. Two conclusions follow from this for Hungarian policy. One is that the response too must be political rather than primarily military: the German measures (closure of the consulate, tightened entry rules, sanctions proposal) are exactly of this kind. The other is that such operations are worth it to the perpetrator precisely because the political response of the attacked party is uncertain — the attribution rule removes this uncertainty, and with it reduces the return on the operation.

📖 Source: Carl von Clausewitz: On War

6.4.2 Graham Allison – Philip Zelikow: Essence of Decision

One of the most durable findings of Allison and Zelikow’s analysis of the Cuban missile crisis is that an intelligence conclusion is not a single brilliant insight but the result of an organisational process. The book describes how the report of a key Cuban source arrived at the processing centre in the company of “a great many inaccurate and even deliberately false reports”, which had to be checked and compared one by one before being sent to Washington — and that this processing took days or weeks. The authors add to this that the tendency of individual organisations to “do what they know how to do” is reinforced if there is no full view of the activity of the other organisations.

This observation has two practical consequences for today’s situation. One is that the roughly one-month turnaround time of the German attribution is not slowness but the natural time requirement of the process — MIAK’s proposal recognises this in the gradation of levels of proof. The other is that attribution capability is an organisational question: if in a country there is no fixed procedure between the body carrying out the technical examination, the intelligence services and the ministry responsible for diplomatic statements, then the conclusion will either not be reached or will not be defensible. The protocol proposed in point 3.3 would make good precisely this organisational gap.

📖 Source: Graham Allison – Philip Zelikow: Essence of Decision — Explaining the Cuban Missile Crisis

6.4.3 Henry Kissinger: World Order

In his introduction on the nature of international order, Kissinger places the duality of legitimacy and power at the centre:

“Any such system bases itself on two components: a set of commonly accepted rules that define the limits of permissible action, and a balance of power that enforces restraint where rules break down.”

Hybrid warfare is a difficult case precisely because it circumvents both components. It does not openly violate the rules, because the perpetrator formally remains unknown; and it does not challenge the balance of power, because it stays below the threshold. In Kissinger’s frame, therefore, the attribution rule is not a technical detail but the restoration of order itself: the situation becomes interpretable again in terms of “permissible” and “not permissible” action by the fact that the perpetrator can be named. If, however, attribution remains a case-by-case political decision, then the rule is not commonly accepted but occasional — and in Kissinger’s sense that is the erosion of order, not its defence. Point 3.1 of MIAK’s proposal targets this gap: the minimum standard does not make attribution harder, it makes it common.

📖 Source: Henry Kissinger: World Order

6.5 International comparison

Several European initiatives already exist for the institutionalisation of attribution, and they are instructive for the Hungarian proposal. The Union’s cyber diplomacy toolbox already contains a graduated ladder of responses to malicious cyber activity, but it does not bind member states as to the level of proof at which they have to name the party responsible — the decision remains political throughout. In the Baltic region ten countries have set up a joint working group on hybrid threats, which carries out joint assessment of incidents against maritime infrastructure; this format essentially creates the organisational conditions of attribution, but does not fix the standard. In the case of energy grid incidents Germany has also reached for the instrument of a reward for information, which provides an incentive on the evidence-gathering side. The missing link is the same in every case: there is no written requirement, applying equally to every member state, on when the party responsible must be named. This is the gap into which a Hungarian initiative can meaningfully fit — and which requires not a great-power position but a procedural proposal.

Foreign policy

  • KP7 — Foreign policy crisis-management protocol
  • KP20 — Lessons of the Helsinki process, multilateral security building

Defence

  • HV8 — Deterrence on the principle of “victory without battle”
  • HV11 — Strategic communication and information defence

Digitalisation and AI regulation

  • D5 — Cybersecurity strategy

Proposed new programme point: Minimum standard of attribution and counter-drone audit of critical infrastructure — for the Defence area.

6.7 List of sources

Press sources (MIAK foreign press monitor, 2 September 2026 — topic 1):

Knowledge base references (specialist books):

  • 📖 Carl von Clausewitz: On War
  • 📖 Graham Allison – Philip Zelikow: Essence of Decision — Explaining the Cuban Missile Crisis
  • 📖 Henry Kissinger: World Order

MIAK internal materials:

  • MIAK policy area: Foreign policy (programme points; programme point ID: KP7, KP20)
  • MIAK policy area: Defence (programme points; programme point ID: HV8, HV11)
  • MIAK policy area: Digitalisation and AI regulation (programme points; programme point ID: D5)
  • MIAK foreign press monitor, 2 September 2026 — topic 1, score: 90/100

Supplementary public data sources:

  • Directive (EU) 2022/2555 of the European Parliament and of the Council (NIS2) — risk management and incident reporting obligations of critical sectors
  • NATO SALIS (Strategic Airlift International Solution) programme documents
  • The Union’s consolidated sanctions list; Eurostat data on the origin of energy imports

Generation metadata