Testing the Threshold: Russian Airspace Violations, “Shadow Fleet” Incursions, and What NATO Can Do Next

Russia’s strategy of calibrated provocation has moved from the grey zone to the hazy edge of Article 5. In recent weeks, NATO capitals have confronted three overlapping patterns: unauthorised military aircraft entering allied airspace; unmarked or dubiously flagged “shadow fleet” oil tankers transiting choke points in allied waters; and law enforcement actions against sanctions evasion networks, including high-profile arrests in Denmark. Understanding these strands as a single pressure campaign clarifies the deterrent tools available—and their risks.

What has happened

Airspace incursions and drone incidents.

• Estonia reported that three Russian MiG-31s violated its sovereign airspace for roughly 12 minutes on 19–20 September 2025—an “unprecedentedly brazen” breach—triggering NATO condemnations and consultations and prompting allied air policing responses. Russia denied the violation.

• The episode followed a flurry of Russian drone penetrations over Poland and Romania and led the UK and Poland to warn they would confront or shoot down future violators.

• Germany scrambled Eurofighters over the Baltic to shadow a Russian reconnaissance aircraft the same weekend, underscoring a sustained pattern of probing flights in the region. 

• Denmark temporarily shut Copenhagen airspace after drones overflew the airport on 22 September; officials have not confirmed attribution but did not rule out Russian involvement. 

“Shadow fleet” activity in allied waters.

• A tanker in the sanctions-evading “shadow fleet”—the Marathon—entered Denmark’s exclusive economic zone (EEZ) in June; Danish patrols monitored and verified irregularities in its documentation/flagging. 

  
  

• Investigations connect this fleet to broader risks in the Baltic’s critical seabed infrastructure, where suspicious vessel movements correlate with past sabotage episodes. 

  
  

• Reporting across Scandinavia and the Baltic describes routine near-coastal transits by poorly insured, poorly maintained tankers operating with AIS gaps and opaque ownership. 

Danish sanctions enforcement and arrests.

• Denmark’s National Unit for Special Crime (NSK) conducted raids and arrests in July connected to alleged re-exports to Russia via Central Asia (including the CEO and CFO of Flügger). These cases signal a sharper Danish posture against sanctions circumvention networks that enable the shadow fleet. 

Why this pattern matters

Taken together, these are threshold tests. Aircraft test reaction times and political will; drones probe civil-aviation vulnerabilities; and the shadow fleet tests maritime governance—in particular, whether EU/NATO littorals will translate policy into port-state controls, insurance denial, and detentions that raise Russia’s logistical costs. Analysts estimate hundreds of shadow-fleet voyages monthly, carrying most of Russia’s seaborne crude/products; degrading this network affects war financing as surely as missiles degrade armour. 

What NATO members can do (with risk ratings)

1) Air and Drone Domain

• Hardened Air Policing ROE and Pre-Agreed Escalation Ladders (Low–Medium Risk).

  
  

  Standardise intercept procedures and publish red lines: time-over-territory, altitude bands, and repeat-offender penalties. Visibility improves deterrence while keeping tactical discretion. (Backed by recent allied warnings after Estonia’s breach.)

• Integrated Counter-UAS around critical hubs (Low Risk).

  
  

  Layered radars, passive RF sensing, and effectors (jamming, GNSS spoof-resilience, net-capture at airports, and kinetic interceptors where safe). Denmark’s airport incident shows the need for civil–military C2 and rapid airspace closure protocols. 

  
  

• Baltic “Drone Wall” cooperation (Low–Medium Risk).

  
  

  Shared sensor grids from Norway to Poland; common evidence standards for attribution; pooled prosecutors to handle cross-border UAS offences. Politically visible but below the threshold of force. 

2) Maritime: Shadow Fleet Pressure

• Strict Port-State Controls and Detention of High-Risk Tankers (Low–Medium Risk).

  
  

  Deny entry or arrest vessels lacking credible P&I insurance, clear flag state, class certificates, and continuous AIS. Denmark’s handling of Marathon is a template; making detentions routine raises premiums and delays turnarounds. 

  
  

• Insurance/Services Embargo Enforcement (Low Risk).

  
  

  Target the service sectors around shipping (surveyors, bunker suppliers, ship managers). Coordinated EU-Nordic guidance and penalties transform compliance from “best practice” to total prohibition. 

  
  

• Traffic Separation + “No-Darkness” Corridors (Medium Risk).

  
  

  Require continuous AIS (active ship tracking, rather than relying on ships to identify their positions) and cooperative identification in specified Baltic lanes near critical cables and wind farms, with escorted transits for flagged violators. Raises boarding encounters risk, but sharply reduces sabotage windows. 

  
  

• Targeted Seizures under National Law (Medium–High Risk).

  
  

  Where jurisdiction allows (e.g. fraudulent registration, safety violations), seize hulls tied to sanctions evasion or environmental risk. This materially disrupts the fleet but carries legal/retaliatory risk and may require tight evidentiary standards depending on the jurisdiction. 

3) Law-Enforcement & Economic Counter-Measures

• Cross-Border Sanctions-Evasion Task Forces (Low Risk).

  
  

  Scale Denmark’s NSK model—joint raids, arrests, and asset freezes targeting front companies routing goods via Central Asia or the Caucasus. Publicising arrests deters industry facilitators. 

  
  

• Beneficial-Ownership Transparency & Rapid Freezing Orders (Low–Medium Risk).

  
  

  Mandate real-time disclosure for ships entering EEZs and empower coastguards to flag discrepancies to courts within hours, allowing for immediate ship arrests. Increases compliance costs but minimises misidentification.

4) Strategic Communications

• Attribution-Forward Posture (Low Risk).

  
  

  Release radar tracks, ISR stills, and AIS histories within 24–48 hours of incidents (as Estonia did for the airspace breach) to pre-empt disinformation and sustain allied unity. 

  
  

• Cost-Imposition Narrative (Low Risk).

  
  

  Tie maritime enforcement directly to Russia’s war-financing: every detained tanker = delayed revenue; every service denial = higher freight and insurance spreads. 

Managing escalation

• Military incidents: Fighters shadowing Russian aircraft in international airspace are routine; the risk climbs when national airspace is crossed or when drones threaten civil aviation. Clear ROE and hotline use keep incidents below the kinetic threshold. 

  
  

• Maritime detentions: Legally grounded port-state actions are defensible but can prompt tit-for-tat harassment of allied shipping. Meticulous documentation and allied backing reduce exposure. 

  
  

• Law-enforcement arrests: Low kinetic risk, high strategic effect. Russia responds with propaganda and cyber harassment more than force; resilience planning for retaliatory cyber-ops is prudent. 

Bottom line

Russia is probing for seams—between civil and military airspace control, between maritime law and sanctions policy, and between national law-enforcement jurisdictions. The answer is to close the seams: publish thresholds; harden counter-UAS; turn shadow-fleet economics against itself through ports, insurance, and seizures; and scale Denmark-style prosecutions of facilitators.

Done together, these measures keep deterrence firm but proportionate: they raise Russia’s costs, shorten NATO decision cycles, and minimise the chance that the next “test” becomes a crisis.