← All Incident Reports
Incident report · Espionage
Shaping activity - Probing

Évegnée: drones over the arsenal

A European arms maker reported a sharp rise in drones over its Belgian rocket factory - part of a wave of unexplained overflights across the continent. It can detect them but, by law, can neither jam nor down them. The origin is unconfirmed. The lesson is the gap between a known threat to critical infrastructure and the legal authority to act on it - a gap that, as the incursions escalated, drew UK, French and German counter-drone teams onto Belgian soil.

↓  Download one-page brief (PDF)
Who
Operator: unconfirmed. Origin was officially unattributed; of the wider wave of drones over Europe that month, some over Poland and Romania were of Russian origin, while others were harder to identify. Reporting party: Thales Belgium. Casualties: none.
What
A significant increase in uncrewed aerial vehicles (UAVs) overflying a defence manufacturer's facilities, reported publicly by the company.
Where
Thales Belgium's plant at Évegnée Fort, in the Liège region of eastern Belgium, licensed to assemble and store explosives for 70 mm rockets.
When
Reported early October 2025; the wider Belgian drone crisis escalated through November 2025, when airport closures drew allied counter-drone support.
Why
Not established. The overflights of a plant producing air-defence munitions - most of its output bound for Ukraine - fit a pattern of drone activity over European defence and military sites; the intent and operator here are unconfirmed.
How
Repeated overflights the company can detect with installed systems, but which - by Belgian law - it may not currently jam or shoot down.
What happened
1

A site that matters

Thales Belgium assembles and stores explosives for 70 mm rockets at Évegnée Fort and, with Herstal, makes missiles usable against drones - most of the current production destined for Ukraine.

2

Rising overflights

The company's director, Alain Quevrin, reports significantly more drones over the plant than a few months earlier - part of a wave of sightings over Poland, Romania, Germany, Norway and Denmark that month.

3

Detection without authority

Thales says it has installed detection systems and holds jammers that could block control signals or bring drones down - but that current law does not permit their use, and a downed drone could fall on people.

4

A call for rules

Quevrin calls on Belgium and other states to define the response process clearly, including where responsibility sits between police and companies - “the process needs to be clarified.”

5

A continental problem

The overflights sit alongside 15 drones over the Belgian military base at Elsenborn, Danish airspace violations that closed Copenhagen Airport, and NATO's stand-up of its Eastern Sentry air-defence effort.

Impact
Operational & safety
No casualties or reported damage, but a live safety and continuity risk to a plant that stores explosives and supplies air-defence munitions to Ukraine.
Intelligence
Persistent overflights of a defence-industrial site offer an operator, whoever it is, imagery and pattern-of-life on production and defences.
Reputational & political
An exploitable demonstration that a NATO member's defence industry can be surveilled from the air while the law leaves the operator unable to respond.
Adversary gain
For any hostile actor, a low-cost way to probe, intimidate and map a critical supplier - with deniability handed over by the difficulty of attribution.
A continent-wide wave
Sep 2025

Denmark

Unidentified drones violate Danish airspace; Copenhagen Airport closes for close to four hours.

Sep-Oct 2025

Eastern flank

Russian military drones violate Polish and Romanian airspace; other sightings over Germany and Norway are harder to attribute.

Oct 2025

Elsenborn

Around 15 drones are reported over the Belgian military base at Elsenborn, near the German border.

Nov 2025

Allied counter-drone support

After drones close Brussels and Liège airports and overfly Belgian bases and the Doel nuclear plant, the UK deploys an RAF Regiment counter-drone unit to a base in Namur, with France and Germany also sending counter-drone support; countermeasures are ongoing.

The overflights of Évegnée are one node in a wider pattern of drones over European defence and military sites through late 2025. Attribution is often the hard part; the exposure of critical infrastructure to cheap aerial surveillance is not in doubt.

Assessment
1

The threat is known; the authority is not

The gap here is legal and procedural, not technical. A defence manufacturer can see and could counter the drones but may not lawfully act - the risk lives in that gap between capability and authority.

2

Critical infrastructure is a standing target

A plant that stores explosives and arms Ukraine's air defence is an obvious object of surveillance and intimidation. Sites of this kind should assume persistent aerial interest and plan for it.

3

Attribution should not gate the response

Origin is unconfirmed and may stay so. Detection, hardening, deconfliction with police, and a clear legal framework for response are needed whether or not a state is ever named.

The comparison worth making

This is the mirror image of the Polish and Romanian incursions: there the state could act but the threat was fleeting; here the threat is persistent but the operator may not lawfully act. Both point the same way - clear rules, layered detection, and a rehearsed response agreed before the next overflight, not during it.

What should carry
  • Close the authority gap - operators and states should pre-agree who may detect, jam or down a drone over critical infrastructure, and under what law.
  • Treat defence-industrial sites as standing targets - assume persistent aerial surveillance of plants that store explosives or supply the war effort.
  • Layer detection and passive protection - counter-uncrewed-aerial-system (C-UAS) sensing, screening of sensitive areas, and control of what can be seen from above.
  • Deconflict with police and military early - a standing liaison and a clear response process, so the first overflight is not the first conversation.
  • Do not wait on attribution - harden and prepare on the pattern of activity, not on a confirmed operator.
Sources

Compiled from open-source reporting for professional security discussion. The origin of the drones overflying the site is unconfirmed and officially unattributed at time of writing. This is a protective-security lessons-learned assessment, not an operational account.