Hanover: staff could see the drone, the detection system could not
A drone flew around Hanover Airport for roughly two hours in the small hours, closing the runways repeatedly and hovering at one point directly over the apron. Airport workers saw it. Police patrols saw it. Air traffic control could not locate it.
The federal counter-drone equipment installed to detect exactly this registered nothing. An internal police report says hybrid activity cannot be excluded, and notes that because their sensors react to ordinary commercial drones and did not react to this one, it was probably not an ordinary commercial drone.
↓ Download one-page brief (PDF)03:44 - a freight worker looks up
An employee of a logistics company at the airport reports a drone at about 25 metres over the company's premises. It is outside the airport fence but inside the restricted airspace around the field. The southern runway is closed and traffic moved to the northern one.
Police see it too
Several police patrols spot the drone near the airport fence. Shortly before 04:00 the airport is closed completely.
A brief reopening
The drone appears to move away and is lost from view. The northern runway reopens.
04:21 - it comes back, and moves inside
The drone reappears over an airline's building and then hovers directly above the taxiway and apron - over the area where aircraft are parked and moved. All operations stop again.
04:40 to 05:20 - it leaves on its own terms
The drone is last seen over freight forwarding premises and is not seen again. The airport resumes normal operations at 05:20. Nothing was ever located, identified, tracked electronically or brought down. Six departures were delayed and one cargo flight diverted.
Why police think it was not a hobby drone
The internal report reasons that their equipment responds to ordinary commercially available drones. It did not respond here. Combined with a flight time of about two hours, that points toward something other than a consumer machine. The absence of a detection is itself being read as evidence.
Leipzig/Halle, a week earlier
An explosive-carrying drone struck a Ukrainian Antonov at Leipzig/Halle and lay on the apron for hours - see the Leipzig report. Police say it is not currently possible to say whether the two are connected.
Mechernich
Six overflights of a Bundeswehr depot that repairs Patriot air defence systems, also unattributed - the Mechernich report. Three German sites in eight days.
A thousand flights and counting
More than a thousand suspicious drone flights were logged in Germany in 2025, and the Bundeswehr has recorded hundreds of overflights of its installations since 2022. This is a volume problem as much as an incident.
Nothing was attacked at Hanover and nothing was damaged. What was demonstrated is that one operator, with one aircraft, can close a national airport for ninety minutes and leave without being identified. That is repeatable, it costs almost nothing, and on the evidence of this night there is no reliable answer to it.
A detection system that produces no alert is worse than no system, because it produces confidence
Staff saw the drone. Police saw the drone. The sensors installed to find drones reported nothing at all. An operator relying on that equipment would have concluded there was no drone. The value of a sensor is not that it exists but that its silence means something, and at Hanover its silence meant nothing. Any organisation with counter-drone equipment should ask what class of aircraft it actually detects and what it would miss.
The inference the police drew is the most useful line in the file
Their reasoning is that the equipment reacts to commercial drones, did not react here, and the flight lasted about two hours - so this was probably not a consumer machine. That is a legitimate inference and it should not be inflated into an attribution. A longer-endurance, less common airframe is consistent with a deliberate operator; it is also consistent with an unusual enthusiast. Neither is established.
Hovering over the apron is the detail that separates nuisance from probing
A drone drifting past a perimeter is one thing. A drone that leaves, returns twenty minutes later, and positions itself directly above the taxiway and apron is behaving purposefully. That is where aircraft are parked, fuelled and serviced - and it is exactly where the explosive drone at Leipzig came down a week earlier. It is a realistic possibility that this was deliberate reconnaissance or harassment rather than error.
The economics are the reason this continues
Ninety minutes of closure at a major airport, six delayed departures and a diverted freighter, for the price of one small aircraft and an operator willing to stand in a field. No attack is required and no law need be broken beyond the airspace restriction. It is almost certain that drone disruption of European airports continues while that exchange rate holds.
Attribution is absent and the pattern is not a substitute for it
Three German sites in eight days invites an obvious inference. Police have explicitly declined to connect this to Leipzig, and no actor has been named for any of them. The honest position is a cluster of unattributed incidents with a common method, which is a reason to investigate and to harden, not a finding about who is responsible.
Set this beside Leipzig/Halle a week earlier, where a drone carried an explosive charge onto the apron and was found hours later by a member of staff. Here nothing was carried and nothing was left. The common factor is that in both cases the aircraft did what it came to do and the detection systems contributed nothing.
- Establish what your counter-drone equipment can actually see. The system at Hanover produced no alert while people watched the drone. Ask your supplier, in writing, which airframes and control links the system detects and which it does not.
- Treat human sightings as the primary sensor. Every detection in this incident came from a person - a freight worker, then police patrols. Staff need a number to call, a reporting format and the confidence that reporting a possible drone is welcome.
- Plan the closure decision in advance. The disruptive effect here came from the ground stop, not the drone. Who decides, on what threshold, and how operations resume should be agreed before the night it is needed, because the operator is relying on that decision being slow and cautious.
- Watch for return behaviour. A drone that leaves and comes back twenty minutes later is behaving differently from one that drifts through. Reporting should capture the pattern across a night, not just the first sighting.
- Protect the apron as the likely objective. This drone positioned itself over the taxiway and apron, and at Leipzig a week earlier that is where the explosive device came down. Aircraft on stand are the asset.
- Do not let a supplier assessment stand in for a test. The industry association had described Germany's counter-drone position as exceptionally strong shortly before this happened. Confidence in a system should rest on trials against the threat, not on the fact of procurement.
- https://gulfnews.com/world/europe/hanover-airport-disrupted-by-drone-week-after-leipzig-explosives-find-1.500637767
- https://united24media.com/world/german-police-suspect-state-interference-after-drone-disrupts-hanover-airport-21588
- https://english.nv.ua/nation/hanover-airport-shuts-down-over-drone-sighting-50631807.html
- https://news.liga.net/en/politics/news/germany-has-seen-its-second-drone-incident-at-an-airport-and-police-devices-failed-to-respond-der-spiegel
Compiled from open-source reporting for professional security discussion. The incident is unattributed. No operator has been identified, no suspect arrested and no claim made, and police have stated it is not currently possible to say whether it is connected to the earlier incident at Leipzig/Halle. The reference to possible hybrid activity comes from an internal police report as described in reporting, and is a statement that it cannot be excluded rather than a finding that it occurred. The inference that the aircraft was not an ordinary commercial drone is the reasoning of investigators, not an established fact. The account derives substantially from Der Spiegel and from AFP and dpa wire reporting. Details may be revised as the investigation continues. This is a protective-security lessons-learned assessment, not an operational account.