What evidence and developments are behind Latvian President Edgars Rinkevics’s warning that Russia’s hybrid war against Europe has already begun—including ongoing sabotage, cyberattacks, disinformation, arson, vulnerabilities in NATO’s eastern flank air defense and counter drone

Rinkēvičs’s warning reflects a shift from fearing a future attack to responding to an active, below-threshold campaign: Western governments describe a growing Russian pattern of sabotage, cyber operations, influence activity, and airspace-related pressure across Europe. It does not amount to public evidence that Russia is preparing an imminent full-scale invasion of NATO’s eastern flank; the nearer concern is a deniable, limited test of NATO cohesion.

• Evidence behind the “hybrid war” description: A U.S. Congressional Research Service review says U.S. and European officials attribute sustained and increasingly serious activities to Russia after 2022—including sabotage, assassinations, political interference, cyberattacks, and airspace violations. Rinkēvičs has said intelligence shared by Latvia, Lithuania, and other NATO members indicates Russian attempts at sabotage.

• Why arson, disinformation, and drones matter: These methods can impose costs, disrupt logistics and critical infrastructure, create fear, and test political resolve while preserving Moscow’s room to deny responsibility. They also expose practical gaps in surveillance, low-altitude air defence, and counter-drone systems; NATO militaries are treating drone activity as a means of probing those defences.

• Conventional-war caveat: The public reporting supports concern about hybrid escalation, not a demonstrated decision or present capability for a major Russian invasion of the Baltic states. Rinkēvičs himself has distinguished the two: Russia may lack the capability for such an invasion now while still conducting hostile hybrid activity. That distinction is important: alarm should drive resilience and deterrence, not claims that war is imminent.

• Kaliningrad transit proposal: Lithuania’s current facilitated-transit arrangements stem from EU measures adopted in 2003; the framework contemplated a limited transit duration, and the established ceiling has been 24 hours. Seimas member and former defence minister Arvydas Anušauskas has proposed changing Lithuanian border law to cut the permitted period to six hours, arguing that it can be done without unilaterally rewriting EU law.

• What the transit figures imply: The reported rise in violations—from 360 in 2024 to 1,493 in 2025—alongside nearly 13,000 Russian-registered cars using simplified transit documents is being used to argue that a 24-hour window is harder to supervise and creates more opportunity for unauthorized activity. These figures support a stricter monitoring case, but they do not by themselves prove espionage or sabotage by transit users.

• Why intelligence assessments sharpen the concern: Recent U.S. intelligence reporting says Putin could test NATO in the next several years through scenarios ranging from a cyberattack to a small ground incursion. Reporting places the possible period as early as fall 2026 through 2029, with eastern Europe—the Baltic region and Poland—seen as the most plausible arena because a limited provocation could test Article 5 while avoiding an overt large-scale war.

• Limits of the claim: Those assessments are contingency judgments based on classified intelligence, not predictions that an attack will happen. Publicly available evidence is insufficient to substantiate a specific claim that Russia will use “Ukrainian drones” against European critical infrastructure; the more defensible conclusion is that cheap, adaptable drones are a demonstrated vulnerability and therefore a planning priority.

The policy logic for Latvia, Lithuania, Estonia, and Poland is therefore collective risk reduction: jointly monitor borders and Kaliningrad transit, integrate air-defence and counter-drone coverage, protect infrastructure and logistics, share intelligence rapidly, and seek EU-level rules that prevent weak links between national restrictions. The aim is to deny Russia an easy, deniable test—not to treat a conventional invasion as already underway.