Estonia and Romania: drone spillover on two flanks in one night
About a dozen drones appeared near Estonia's border at two in the morning while Ukraine was striking a Russian Baltic port next door. One turned toward Narva and went back; another crossed into the south-east. Turkish F-16s launched, ground air defence went to alert and the public got a phone warning.
Hours later a resident found a damaged drone carrying explosives in a field in eastern Romania. Four countries responded overnight to a war none of them is in, and nobody fired a shot.
↓ Download one-page brief (PDF) ↓ Download update brief (PDF, 2 September 2026)The exchange either side of the alliance
Ukraine runs a large long-range strike into Leningrad Oblast, damaging the port at Ust-Luga; Russian air defences report intercepting 38 drones across the region, seventeen near the port. To the south, Russia strikes the Odesa axis. Both operations run within a few dozen kilometres of NATO territory.
About 02:00 - a dozen contacts on the Estonian border
Estonian air defence detects roughly a dozen drones near the border. A senior officer later says they flew parallel to Estonia's eastern frontier and Latvia's before one entered.
About 03:00 - one turns toward Narva
A drone tracks toward the border city. Estonia activates ground-based air defence, scrambles the Turkish F-16s at Amari and issues a cell broadcast to Ida-Viru and Laane-Viru counties at 03:11. The drone turns back across the Russian border without entering Estonian airspace.
About 03:30 - another crosses in the south-east
Roughly half an hour later a second drone crosses into south-eastern Estonia and stays close to the border. The warning is extended at 03:48 to Tartu, Jogeva, Viljandi, Valga, Voru and Polva. Latvia issues its own alerts over Aluksne and Ludza; Finland restricts air and sea traffic over the eastern Gulf of Finland as a precaution.
05:00 - it passes
The threat is declared over and the alert lifted around 05:30. Nothing crashed, nothing was fired, nobody was hurt.
Later that day - a live one in a Romanian field
A local resident finds a damaged drone carrying explosives outside Viisoara in Vaslui County, about 30 km from the Moldovan border. Intelligence service specialists destroy it in a controlled detonation. Once again the finder was a member of the public.
Air policing became air defence
NATO replaced Baltic Air Policing with a Baltic air defence mission following a decision at the Ankara summit, after the three Baltic presidents called for the shift in May. The Turkish detachment at Amari - five F-16s and 76 personnel from the 181st Squadron, normally at Diyarbakir - is the first rotation under the new arrangement.
Ukraine has apologised before
A Romanian F-16 on NATO duty shot down a drone over southern Estonia. Ukraine subsequently acknowledged the aircraft was its own and apologised. In March a Ukrainian drone went off course and struck a power plant chimney at Auver near Narva.
The one that was destroyed
Four allied fighters from two nations destroyed an unidentified drone over Latvia, on a morning when Finland also restricted traffic over the Gulf of Finland.
Romania's month
A drone crossed into Romania at Luncavita without appearing on radar, another came in over Moldova and was shot down, and a naval drone was destroyed near Neptun Deep.
The Estonian half of this went almost perfectly: detected at two in the morning, tracked, fighters airborne, the public warned, and it passed. The Romanian half was found by a man walking in a field. That is the third time in three weeks on this flank that the first report of a weapon on NATO soil came from a civilian rather than from a sensor.
The ambiguity of ownership is the operational problem, not the incursions themselves
Estonia was watching drones during a Ukrainian strike into Russia; Romania recovered a device during a Russian strike on Odesa. Neither has been attributed. A defender who does not know whose weapon has crossed cannot calibrate a response to it, and the precedent cuts both ways - a Ukrainian drone was shot down over Estonia in May and Kyiv apologised for it. That history is why an Estonian commander does not assume a hostile probe, and why an adversary benefits from the doubt either way.
Everything worked in Estonia and the effect landed anyway
Detection at 02:00, tracking, a scramble, ground-based air defence activated, cell broadcasts to eight counties, and the alert lifted in three and a half hours. That is a functioning system. It still produced an air raid warning on the phones of several hundred thousand people before dawn, which is an effect available to anyone flying a cheap airframe near the border, and it costs the alliance far more to generate than it costs to provoke.
A civilian found the live one, again
The Romanian device was discovered by a resident in a field, as at Luncavita where a member of the public rang the emergency number, and as at Neptun Deep where a merchant ship spotted the approaching drone. Three times in three weeks the first report came from an ordinary person, which is a finding about coverage rather than a series of coincidences.
The mission changed name a month ago and this is what it now covers
Baltic Air Policing became a Baltic air defence mission on 1 August, at the Baltic states' own request. The distinction is not cosmetic: policing implies identification and escort, defence implies engagement. The first rotation under the new arrangement spent its night scrambling for drones it could not identify and did not fire on, which is a fair illustration of the gap between the title and the problem.
Spillover will continue while the exchange runs along these borders
The strike geography puts both campaigns within a short flight of alliance territory, the airframes are cheap and numerous, and navigation failures are routine. It is highly likely that further drones cross or fall on NATO territory while the aerial exchange continues, and likely that some carry live explosives when they do.
Set this beside Latvia on 14 August, where four fighters from two nations destroyed an unidentified drone over open ground. Same flank, same ambiguity of ownership, opposite decision. The difference between destroying an aircraft and watching it leave is a judgement made in minutes about something nobody can identify, and both nights ended without casualties.
- Expect the alert, and decide in advance what it changes. For most organisations on this flank the realistic experience is a pre-dawn cell broadcast that resolves in three hours. A standing instruction is worth more than a decision taken at 03:11.
- Brief staff that a drone on the ground may be live. The Romanian device carried explosives and was found by a member of the public. Anyone who might come across wreckage needs to know to stay back and call, not photograph it up close.
- Do not assume an incursion is hostile. Ukraine has previously acknowledged a drone downed over Estonia and apologised. Attribution on this flank is genuinely open and an assessment that assumes the worst will sometimes be wrong.
- Treat the public as part of your detection picture, deliberately. Three times in three weeks the first report came from a civilian. Communities near borders and infrastructure should know what to report and be confident it will be taken seriously.
- Plan for alert fatigue. Repeated pre-dawn warnings that resolve into nothing will erode the response they depend on. The organisations that handle this well will be the ones that decided early what a warning actually requires.
- Read the flank as one picture. Estonia, Latvia, Finland and Romania all reacted to the same night. An organisation tracking incursions country by country will keep under-counting the tempo.
- https://www.stripes.com/theaters/europe/2026-09-01/estonia-russia-ukraine-drones-22718508.html
- https://kyivindependent.com/estonia-romania-report-drone-incidents-amid-russian-and-ukrainian-aerial-attacks/
- https://www.aerotime.aero/articles/turkish-f16s-scramble-drones-estonian-airspace
- https://ukdefencejournal.org.uk/nato-jets-scramble-after-drones-enter-baltic-airspace/
- https://eng.lsm.lv/article/society/defence/01.09.2026-airspace-alert-over-in-latvias-aluksne-district.a661158/
- https://news.err.ee/1610124754/edf-drone-threat-warning-lifted-across-estonia
- https://www.newsweek.com/nato-scrambles-fighter-jets-after-drones-enter-latvia-estonia-airspace-russia-war-12389222
The first four sources above were used for the original report of 1 September 2026. The final three - Latvian Public Broadcasting, Estonian Public Broadcasting and Newsweek - were used for the update of 2 September 2026.
Compiled from open-source reporting for professional security discussion. The origin and operator of both drones are officially unconfirmed. No party has claimed either, and neither Estonia nor Romania has attributed them. The account of the Estonian incursion derives from the Estonian Defence Forces and from the air force commander speaking to public broadcaster ERR. The context of a Ukrainian strike on Leningrad Oblast and a Russian strike on the Odesa axis is reported alongside the incursions and does not by itself establish ownership of either aircraft. Timings are local. Details may be revised. This is a protective-security lessons-learned assessment, not an operational account.
Latvia's part of the night now has times, an alert level and a public instruction attached to it, and on the Latvian broadcaster's account at least one drone was a single track that both countries alerted for in turn. Estonia's foreign minister has put the alliance response on the record. Three NATO members were on air-defence alert in one night and the two Baltic alerts were not independent of each other.
1. Latvia's alerts have times, a level and a public instruction
Latvian Public Broadcasting reports an orange airspace alert in Aluksne district issued at 03:37 and lifted at 04:17, and a second alert covering Ludza district: two separate alerts overnight. Orange denotes a confirmed threat in Latvian airspace requiring immediate action by the public. The original report recorded Latvian district alerts without times, without a level and without noting that there were two.
2. One track, two countries
Latvian Public Broadcasting, citing Estonian Public Broadcasting, reports that the drone behind the Aluksne alert crossed into Estonia before turning back into Russian territory. The original report set the Estonian and Latvian responses side by side as parallel national reactions to a shared picture. On this account they were consecutive reactions to the same aircraft.
3. Fighters were scrambled for two allies, not one
The original attributed the scramble to Estonia, with Turkish F-16s from Amari. Latvian Public Broadcasting records NATO Baltic Airspace Patrol Mission fighters scrambled to intercept over Latvia, and the UK Defence Journal describes fighters scrambled after drones entered the airspace of two alliance members. Whether that was one scramble covering both tracks or two is not stated in either account.
4. Estonia is on the record, at ministerial and command level
Foreign Minister Margus Tsahkna wrote on X, quoted by Estonian Public Broadcasting: "NATO reacted swiftly and exactly as planned. The Alliance is vigilant and ready to protect Allied territory." Colonel Uku Arold said drones had breached Estonia's airspace, moving parallel to the eastern border before entering it. The Estonian warning ran from about 03:00 to 05:30 and reached eight counties.
5. The origin is characterised, and still not attributed
Estonian Public Broadcasting attributes the drones to Ukrainian operations and notes that earlier Estonian alerts followed Ukrainian attack drones straying off course, often under GPS jamming, while striking Russian oil infrastructure. That is a characterisation by the affected state's broadcaster, not a formal attribution. No state has been accused of a deliberate incursion, and the origin of the Romanian device is still open.
6. What has not changed
No casualties, no damage, no weapons discharged, and nothing crashed on Estonian or Latvian soil. The Romanian device was still found by a member of the public and destroyed in a controlled detonation. No state has been formally accused. The original assessment that the effect of the night landed on the population rather than on any target stands, and the update strengthens rather than alters it.
Two alerts on one track is a thinner picture than two alerts on two
A single airframe that produces a public alert in one country, crosses into a second and then leaves generates the same national-level response as three separate incursions would, from one aircraft. That is a cheap effect and it does not require anyone to intend it. It also means a count of alert events overstates the number of objects, and an organisation reading these nights as a tally of incursions will over-read the scale and under-read the efficiency.
Orange is a public instruction, and that is the effect that landed
The Latvian level carries a requirement for the public to act, not merely to be informed, and it ran for forty minutes in the middle of the night alongside cell broadcasts to eight Estonian counties. The original report identified the population as where the effect landed. The times now available make that concrete: two national publics were placed under instruction between about 03:00 and 05:30 by drones that hit nothing.
Where this now sits
The characterisation by Estonian state broadcasting, and the ministerial statement framing the response rather than the origin, together make it unlikely that a formal attribution of deliberate incursion follows for the Baltic tracks of this night. It remains highly likely that further drones cross or fall on NATO territory while the aerial exchange continues along these borders, and a realistic possibility that a future night again produces alerts in two allied states from a single track.
The original report of 1 September 2026 appears above this section and has not been altered. Sources used for this update are the final three in the source list above.