WTF Is Going On in NATO!

CIA Director to Moscow. NATO aircraft deployed around Russia’s heavily militarized Kaliningrad enclave.

Aug 26, 2026

BOTTOM LINE: NATO is not mobilizing for an announced war with Russia, and there is presently no public evidence that Moscow has decided to attack the Alliance. Something nevertheless has changed in the European security environment. During the past several weeks NATO aircraft have operated around Russia’s heavily militarized Kaliningrad enclave in combinations designed not merely to watch an adversary but to practice finding, understanding, disrupting and defeating one.

Russian warships are moving through the Baltic and North Atlantic while Moscow publicly threatens European commercial shipping. Western intelligence is warning that Vladimir Putin may eventually test NATO with something more consequential than the sabotage, cyber operations, drone incursions and proxy attacks already occurring below the threshold of conventional war. At almost precisely the same moment, Germany has begun rewriting the laws governing its intelligence services so they can move beyond collecting information about hostile operations and, under defined conditions, interfere with them.

None of these facts establishes that war is imminent. Taken together, however, they tell us that NATO and several of its most important governments are behaving as though the possibility of a deliberate Russian test can no longer be treated as theoretical.

That is what is going on in NATO.

On August 18, an unusual concentration of Allied military aircraft appeared over Poland and the Baltic region, including close to Russia’s Kaliningrad enclave. The operation was not secret. Commercial flight-tracking services could watch much of it unfold in real time. What attracted military observers was not the presence of any single aircraft but the combination of capabilities operating together.

Article content — USAF - Senior Airman Edgar Grimaldo

According to reporting by Stars and Stripes, confirmed through NATO officials, U.S. and Norwegian fighters participated alongside Polish forces and a NATO E-3A Airborne Warning and Control System aircraft. Tankers supported the package. Most interesting was the presence of a U.S. Air Force EA-37B Compass Call, one of America’s newest electronic-warfare aircraft, operating from Powidz, Poland. NATO officials declined to provide the total number of aircraft for operational-security reasons, while outside observers estimated that the larger activity may have involved roughly 25 to 50 aircraft. The Alliance described the activity as multi-day training and deterrence rather than the opening stage of some combat operation.

That distinction matters. So does the aircraft.

The NATO E-3A is not simply an airplane with a large radar mounted above it. It is an airborne command-and-control platform capable of detecting and tracking aircraft at great distances while helping commanders construct a common picture of the battlespace and direct friendly aircraft. NATO says its E-3A fleet has flown hundreds of missions along the eastern flank since Russia’s invasion of Ukraine and can monitor aircraft, missiles, naval vessels and large unmanned systems.

The EA-37B performs a different mission. Its purpose is to contest the electromagnetic environment upon which modern military forces depend for communications, radar, navigation and command and control. Its appearance alongside fighters, tankers and airborne surveillance near Kaliningrad therefore deserves attention without requiring exaggeration. Taken as a package, these are capabilities used to see, coordinate, sustain and, in wartime, interfere with an adversary’s ability to operate.

Training those capabilities together near NATO’s northeastern frontier is deterrence in its most practical form. The message is not that NATO intends to attack Kaliningrad. The message is that if deterrence fails, NATO intends to understand the battlespace and operate inside it.

There is no evidence that the exercise was improvised in response to recent Russian naval movements. NATO routinely trains across the Baltic, and Alliance officials characterized this activity as part of continuing defensive preparation. That is the first place where sensational reporting can outrun the facts. But the context surrounding the exercise cannot simply be discarded.

Immediately before the NATO activity, the Russian frigate Admiral Kasatonov was observed moving past Germany’s island of Fehmarn as it departed the Baltic. The ship is one of Russia’s modern Admiral Gorshkov-class frigates and can carry the 3M22 Zircon hypersonic cruise missile.

Another Russian warship normally associated with northern waters had passed through the region weeks earlier. Russia has also maintained increased naval and submarine activity around Britain and across the North Atlantic. None of that proves a direct causal relationship with NATO’s August exercise. It does tell us why both sides are paying unusually close attention to the same geography.

The Suwalki Gap

Kaliningrad is not an ordinary piece of Russian territory. It is a Russian exclave positioned between Poland and Lithuania, with the Baltic Sea on one side and NATO territory around much of the rest. It sits adjacent to the Suwałki corridor connecting Poland with Lithuania and, beyond it, Latvia and Estonia. Russian forces there possess air defense, missile, naval and electronic-warfare capabilities capable of complicating NATO reinforcement of the Baltic states. NATO planners have therefore worried about Kaliningrad for years, while Moscow sees NATO military activity around the enclave as evidence of precisely the encirclement it says threatens Russia.

The geography encourages both sides to watch the other closely. It also creates abundant opportunities for miscalculation.

The danger becomes more serious when military movement is considered alongside Moscow’s changing rhetoric at sea.

On August 12, Vladimir Putin stood aboard the Russian Pacific Fleet cruiser Varyag and threatened retaliation if European governments continue seizing vessels associated with Russia’s sanctions-evading commercial network. France and Britain have detained tankers suspected of operating within what is commonly called Russia’s shadow fleet, while the European Union has sanctioned hundreds of vessels believed to be helping Moscow circumvent restrictions on its petroleum trade.

Putin called the Western actions “piracy and robbery” and said Russia would respond in kind if seizures continued. More important than the rhetoric was his warning that Moscow’s response need not occur in the same waters. Russia, he said, could act wherever it considered necessary. Pacific Fleet commander Adm. Viktor Liina then told Putin that his forces possessed sufficient capability to inspect and detain commercial vessels serving states Russia considers unfriendly.

Russia’s former president and now deputy chairman of its Security Council, stripped even more ambiguity from Moscow’s message. He argued that Russia has the right to attack merchant vessels belonging to hostile countries—including vessels in neutral waters—when Russia believes they are carrying cargo supporting an enemy.

Medvedev says many things calculated to shock Western audiences, and his statements should not automatically be treated as Russian operational orders. Putin’s words carry more weight. Yet Medvedev operates inside Russia’s national-security establishment, and his statement expands the public boundaries of what Moscow wants European governments to contemplate. At sea, as elsewhere, deterrence is partly a contest over expectations.

The problem for NATO is that this increasingly muscular Russian rhetoric is arriving while Western intelligence assessments themselves are becoming less comfortable.

In early August, The Wall Street Journal reported that new U.S. intelligence assessments judge that Putin could attempt a limited assault against a NATO member during the next several years as a means of testing Alliance resolve. The scenarios reportedly range from cyber operations to a limited land incursion. The assessment represents an important change from earlier judgments that Moscow would probably avoid deliberately provoking NATO while Russia remained consumed by the war in Ukraine.

That is a warning, not a countdown clock. Claims circulating that intelligence has established a Russian attack “this fall” go beyond what the strongest publicly accessible reporting currently supports. Classified intelligence is fragmentary by its nature, and assessments of possible adversary behavior are frequently presented as ranges of probability rather than predictions. A responsible analyst must preserve the distinction between Russia could and Russia will.

The Spy Chief Goes to Moscow

Then, on August 25, Washington did something that deserves to be read alongside the new intelligence warning, without pretending we yet know exactly what it meant. CIA Director John Ratcliffe made an unannounced trip to Moscow for meetings with Russian officials. It was his first publicly known visit to Russia as CIA director and the first known visit by a serving CIA director to Moscow since William Burns went there in November 2021, three months before Russia’s full-scale invasion of Ukraine. Burns had carried a direct warning from President Biden about the consequences of an attack.

The purpose of Ratcliffe’s mission has not been publicly disclosed.

The trip was difficult to hide even if its agenda was not. A U.S. Air Force C-17 Globemaster III that had originated at Joint Base Andrews flew through Riga, Latvia, and landed at Moscow’s Vnukovo International Airport. Russian state media acknowledged the unusual American military transport flight before U.S. reporting identified Ratcliffe as the senior passenger. Public flight-tracking accounts differ on exactly how long the aircraft remained in Moscow: some reporting described roughly four hours, while other tracking reviewed by major U.S. newspapers indicated approximately eight to eight and a half hours on the ground.

The defensible description is therefore a brief, same-day mission, not a precisely established four-hour visit.

One operational detail is more revealing than the flight path. According to multiple U.S. reports, Washington asked Ukraine to refrain from long-range drone and missile strikes on Moscow and other northern Russian cities during the period surrounding the visit. Kyiv was reportedly told that a senior American official would be traveling inside Russia. Whatever Ratcliffe intended to discuss, the United States took steps to reduce the possibility that a Ukrainian strike could kill or endanger the CIA director, embarrass Moscow during the talks, or turn a clandestine diplomatic channel into an escalation crisis.

That does not establish that Ratcliffe flew to Moscow to warn Putin about a prospective attack on NATO. The CIA has declined to discuss the mission, the White House has not publicly described its purpose, and Kremlin spokesman Dmitry Peskov said there were no plans for Ratcliffe to meet Putin. Public reporting has not identified Ratcliffe’s Russian interlocutors. Ratcliffe has, however, maintained contact with Sergei Naryshkin, the head of Russia’s Foreign Intelligence Service, since early in the Trump administration, and the two services agreed in March 2025 to preserve regular intelligence-channel contact. At a moment when Ukraine negotiations are stalled, American intelligence is reportedly reconsidering the possibility of a Russian test of NATO, and Washington is simultaneously pressuring Russia over its relationship with Iran, several subjects could plausibly have been on the table.

The 2021 Burns precedent is therefore useful but must not be abused. A CIA director traveling personally to Moscow is not routine diplomacy. Intelligence chiefs are often used when presidents need a channel that can carry unusually sensitive messages, clarify red lines, test intentions or reduce the risk that military activity will be misread. Ratcliffe’s journey tells us that Washington believed some matter was important enough to justify sending the Director of Central Intelligence into Moscow in person. It does not yet tell us what message he carried.

For this NATO story, the timing matters more than speculation about the secret conversation. NATO is rehearsing increasingly sophisticated operations around Kaliningrad. European governments are hardening intelligence authorities.

American analysts are reportedly entertaining scenarios in which Moscow might probe the Alliance. Russian leaders are publicly widening the language of retaliation against Western shipping.

Then the President’s CIA director appears in Moscow on an unannounced, tightly controlled visit while Washington asks Ukraine to hold its fire around the Russian capital. That is not evidence that war is imminent. It is evidence that the United States is managing the risk seriously enough to keep a direct intelligence channel open to Moscow while the military and political signals around NATO grow harder.

President Trump has not, as of this writing, publicly explained Ratcliffe’s mission. That silence is analytically relevant. The administration has allowed the existence of the trip to become known while withholding the message, the interlocutors and the outcome. Until one of those elements is disclosed, the proper conclusion is limited: Washington is simultaneously strengthening deterrence, exploring diplomacy and preserving a channel capable of carrying warnings that are too sensitive to entrust to public rhetoric.

The more consequential question is why American intelligence professionals would now consider a limited NATO test plausible at all.

One answer is that Russia has already spent years conducting something resembling a reconnaissance of NATO political will.

The Alliance itself said in May 2024 that Russia was conducting an intensifying campaign of hostile activity on NATO territory and “through proxies,” including sabotage, violence, cyber operations, electronic interference and disinformation. Those activities have since been accompanied by repeated drone incidents and airspace violations along NATO’s eastern frontier. On August 12 of this year, the North Atlantic Council met specifically to discuss airspace violations affecting Poland and Romania and other drone incidents, stating that Russia demonstrated an increasing tolerance for risk.

That phrase—increasing tolerance for risk—is worth remembering.

A state does not have to decide one morning to invade NATO in order to become more dangerous. Risk can be increased incrementally. A drone enters an Ally’s airspace. A railway is sabotaged. A logistics warehouse burns. An undersea cable is Severed. A computer network is penetrated. A local criminal is recruited to conduct surveillance or arson. Each incident provides intelligence about how quickly governments recognize the event, how readily Allies share information, what evidence they demand before attributing responsibility, and what consequences follow. The operation may achieve a physical objective. The response teaches Moscow something.

This was the problem hiding underneath our examination of Germany’s intelligence reforms.

On August 12—the same day NATO was publicly condemning Russian airspace violations and Putin was threatening Western shipping—the German cabinet approved what Berlin describes as the most extensive restructuring of the legal foundations governing its foreign and domestic intelligence services in the history of the Federal Republic.

Germany has historically constrained its intelligence services more tightly than Britain, France or the United States. The reasons are obvious and legitimate. German democracy was constructed in the shadow of the Gestapo and later confronted the East German Ministry for State Security, the Stasi. Berlin therefore developed powerful institutional barriers intended to prevent intelligence collection from becoming unaccountable state coercion.

Those restrictions now confront an adversary that has discovered how to operate inside the distinctions democratic systems carefully preserve.

Germany’s proposed reform would give the Bundesnachrichtendienst, the Federal Intelligence Service, and the Bundesamt für Verfassungsschutz, the Federal Office for the Protection of the Constitution, substantially expanded authorities to obtain digital information and counter hostile operations. Interior Minister Alexander Dobrindt told reporters that the reform would, for the first time, provide genuinely operational authorities rather than leaving the services principally as collectors and analysts. Under carefully defined conditions, the services could interfere with hostile computer infrastructure, copy or delete data, disable tools being used in foreign cyber campaigns and even manipulate physical elements of an adversary’s operation. The proposals would also provide clearer legal foundations for artificial-intelligence-supported analysis and modern telecommunications surveillance while placing those powers under strengthened independent supervision. The German parliament must still approve the legislation.

The most important sentence in the Reuters account did not concern hacking. Chancellor’s Office Minister Nina Warken said “Germany faces a “real, very acute” danger from foreign hybrid operations and can no longer depend so heavily upon allied intelligence services to protect itself.”

That is not the language of administrative housekeeping. Germany is telling us that intelligence collection without the ability to act rapidly against what has been discovered is becoming inadequate for the environment in which Europe now operates.

The connection between the German reforms and the NATO aircraft around Kaliningrad is therefore not that one caused the other. It is that they represent different levels of the same deterrence problem.

The aircraft are the visible layer. Germany’s intelligence reforms are the invisible layer.

A formation of fighters, Airborne Warning and Control System aircraft, tankers and electronic-warfare platforms demonstrates that NATO can detect and fight in a contested military environment if a crisis crosses into conventional conflict. Intelligence reform addresses the much larger territory before that moment, where Russia has repeatedly sought strategic effects without providing NATO the clean trigger of tanks crossing a recognized frontier.

This is where the argument about fifth-generation warfare becomes useful if we avoid making it mystical.

The Russian challenge is not primarily that Moscow has invented some revolutionary new concept of war. Intelligence services have used agents, criminals, cutouts, sabotage and allied services for generations. The Soviet Union did so throughout the Cold War. Bulgarian State Security provided Moscow with a useful degree of operational distance in certain sensitive activities, most famously during the period surrounding the 1978 assassination of Bulgarian dissident Georgi Markov in London.

Technology has made the old method cheaper. Moscow no longer necessarily needs a Warsaw Pact intelligence service to provide deniability. An encrypted messaging application, cryptocurrency transfer, social-media recruiter and disposable local criminal can create several layers between the Russian state and the person who ultimately sets the fire.

That creates a peculiar deterrence problem.

NATO possesses overwhelming conventional military power. If Russian armored formations launched an unmistakable attack on Poland or Lithuania, the political decision would be grave but conceptually straightforward. Article 5 exists for precisely that circumstance. A warehouse fire is harder. So is a severed cable, an unidentified drone, a compromised logistics network, a railway explosion or a commercially recruited European citizen taking photographs outside a NATO installation.

Russia benefits whenever the tactical act is easier to recognize than the strategic campaign behind it.

Germany’s answer is to reduce the distance between detection and disruption. The August NATO activity answers the problem from the opposite direction: demonstrate before a conventional attack ever occurs that the Alliance possesses the military integration necessary to make an overt attack prohibitively expensive.

Both are deterrence. Neither is sufficient alone.

This is also where Washington enters the story, and where political preference should be separated from strategic analysis.

Donald Trump has spent years criticizing European NATO members, questioning burden sharing and periodically creating uncertainty about the automatic character of American support. Russian planners undoubtedly read American political statements, because the credibility of Article 5 rests not simply upon military capability but upon Moscow’s belief that those capabilities will actually be employed.

At NATO’s July 2026 Ankara Summit, all Allied leaders—including President Trump—again formally affirmed the Alliance’s “ironclad commitment” to collective defense and the principle that an attack against one is an attack against all. Reuters subsequently reported that Trump told NATO leaders in their closed meeting that the United States wanted to remain in the Alliance. European Allies and Canada are also assuming substantially larger defense responsibilities rather than simply waiting for Washington to solve the problem.

Moscow therefore confronts contradictory signals. That is dangerous.

Russian strategists can see political disputes inside NATO and legitimate questions about American priorities, munitions inventories and global commitments. They can also see thirty-two governments increasing defense spending, restructuring force plans, expanding air and missile defense, exercising large formations near Russia, strengthening the Baltic and Arctic approaches, and reengineering national intelligence services to defeat Russian covert activity.

The uncertainty cuts both ways. Putin may conclude that NATO is divided enough to test. He may also conclude that the test has become too dangerous. The purpose of deterrence is to make the second judgment dominate the first.

That brings us back to those aircraft near Kaliningrad.

Their greatest value may be that nothing happened. No missile was fired. No Russian aircraft was shot down. No NATO border was crossed by an armored column. Allied aircraft practiced their missions, Russia observed them, NATO observed Russia observing them, and everyone went home.

That is what successful deterrence frequently looks like.

The danger comes when exercises cease to communicate capability and begin to generate uncertainty about intention. NATO must therefore combine military readiness with disciplined strategic signaling. Exercises close to Russian territory should be sufficiently credible to demonstrate that NATO can execute its defense plans while remaining sufficiently transparent that Moscow cannot plausibly mistake preparation for an imminent attack.

Russia carries the same responsibility, although its recent behavior gives NATO considerable reason for caution. When Russian naval leaders speak publicly about detaining Western vessels and a senior Security Council official talks about attacking merchant ships in neutral waters, Moscow increases precisely the ambiguity that can produce escalation at sea.

The Alliance needs more than stronger forces to navigate this environment. It needs a common intelligence picture capable of recognizing a campaign before a collection of unrelated incidents becomes strategically coherent.

That is the lesson Germany is beginning to institutionalize.

NATO should now force-appreciate the entire Russian system—not merely Russian divisions and missile inventories, but military intelligence, security services, cyber organizations, maritime assets, covert financial networks, criminal intermediaries and the disposable local agents increasingly used to place distance between Moscow and an operation.

Then the Alliance should red-team itself from the Russian side.

If Moscow wanted to test Article 5 without triggering a conventional NATO response, where would it apply pressure? If it wanted to paralyze European reinforcement without openly attacking a military formation, which railway junctions, ports, communications systems and logistics centers would matter? If it wanted to discover the limits of NATO political cohesion, what action would create maximum disagreement about attribution and proportionality? If a recruited criminal or ideological proxy could achieve the same operational effect as a uniformed Russian serviceman, why would Moscow assume the greater political risk?

Those questions should shape NATO planning as seriously as the number of Russian tanks facing the Alliance.

Germany has reached one important conclusion already: a service that can discover an attack but cannot interfere with it may simply become an exceptionally well-informed witness.

NATO faces the same problem at Alliance scale.

It must be able to connect indications across national boundaries, distinguish Russian operations from ordinary crime and accident, protect the intelligence sources necessary for attribution, move relevant information rapidly to law enforcement and military commanders, and create consequences that alter Moscow’s calculation before repeated probing becomes accepted strategic behavior.

The response need not imitate the provocation. It must make the provocation unprofitable.

That principle applies equally at sea. Western governments enforcing lawful sanctions need clearly established legal foundations, common evidentiary standards and agreed rules for maritime interception. If Russia begins escorting sanctioned commercial traffic with warships or attempting to detain Western vessels in retaliation, NATO governments will require predetermined options rather than improvising during the first confrontation between armed ships.

Improvisation is where miscalculation breeds.

The German reforms, NATO’s Baltic air activity, Russia’s movements around Kaliningrad, Putin’s shipping warning and the new American intelligence assessment should therefore not be stitched together into a sensational prediction of impending war.

The more troubling conclusion is subtler.

Europe is entering an environment in which the distinction between peace and conflict is becoming progressively less useful for understanding what Russia is doing.

There is still peace between Russia and NATO in the conventional sense. No Russian army is advancing into Poland. NATO has not attacked Russian territory. Diplomatic relations continue. Commercial aircraft cross Europe. Families go to work and children go to school.

At the same time, intelligence services are hunting foreign sabotage networks. NATO fighters are intercepting unmanned aircraft. Governments are protecting ports, telecommunications networks and underwater infrastructure. Russian officials are threatening merchant shipping. Western intelligence agencies are reconsidering whether Putin might deliberately test the collective-defense guarantee. Germany is rewriting laws created after the Second World War because its government believes the existing authorities no longer match the threat.

That is the answer to WTF is going on in NATO?

The Alliance is trying to deter two wars simultaneously.

One is the war everyone recognizes: Russian aircraft, missiles, submarines, warships and conventional formations confronting NATO military power.

The other is already being fought in the spaces where governments hesitate to call it war: intelligence networks, computer systems, logistics corridors, political institutions, commercial infrastructure and ordinary Europeans recruited to perform extraordinary acts for someone they may never meet.

The aircraft over the Baltic are intended to prevent the first war. Germany’s intelligence reform is intended to fight the second.

The strategic danger is that NATO succeeds at deterring a Russian army while allowing Moscow to conclude that everything short of sending one remains affordable.