Belgium’s Public Confrontation with Hybrid Threats: Lessons from Drone Incursions

On Tuesday 4 November 2025, Belgian Minister of Defence Theo Francken suddenly had to leave the studio of a popular talk show to take an urgent call: another drone incursion had just been reported.

*****

Belgium’s Public Confrontation with Hybrid Threats: Lessons from Drone Incursions

On Tuesday 4 November 2025, Belgian Minister of Defence Theo Francken suddenly had to leave the studio of a popular talk show to take an urgent call: another drone incursion had just been reported. This new alert came about a month after the first unmanned aerial vehicles (UAVs) had made the news, when drones were spotted over the military training area of Elsenborn. At the time, it appeared to be an isolated incident over a military site of limited strategic significance. The first days of November, however, brought a different story. A series of drone incidents occurred, most notably over Kleine Brogel Military airbase, home to American nuclear weapons, F-16s, and soon also the F-35s. The call Francken received during the talk show differed again from the earlier incidents. This time it was not just about military installations: several airports, including Brussels Airport in Zaventem, were shut down following drone sightings.

Belgium is not accustomed to such widespread and sudden public disruptions, and this was reflected in the communications and debate that followed. The incidents fuelled a growing narrative suggesting that Belgium is facing an intensification of hybrid threats for which it is ill-prepared. Yet such a narrative, of a vulnerable, indecisive Belgium confronted with an increasingly challenging world, may inadvertently support the very objectives of the perpetrators: weakening the target state. It is therefore important to acknowledge the challenges posed by hybrid attacks, but to communicate resolve about possible responses at the same time. Failure to do so risks contributing to the adversary’s strategic intent.

The recent drone incursions should be understood in this broader context as manifestations of hybrid threats. Although the term “hybrid threat” has often been used as a catch-all expression for diverse forms of present day great power rivalry, certain core elements recur across definitions. Hybrid threats involve the use of diverse non-military or non-kinetic means intended to destabilize and weaken a target state. Cyberattacks, disinformation, and economic coercion are among the most cited examples of such techniques. What distinguishes hybrid activities is that they are designed to operate deliberately below the threshold of open armed conflict. They blur the line between peace and war and aim to avoid a clear response. Their cumulative impact, however, can be significant; small actions can generate long-term effects when aggregated. Hybrid actors seek gradual, incremental changes to the status quo, exploiting societal divisions, structural weaknesses, and existing grievances to undermine the target state.

The UAV incursions observed in Belgium fit within this logic. While drones are used in kinetic operations in Ukraine, their deployment across other parts of Europe has been predominantly non-kinetic, operating in the grey zone between peace and conflict. They are intentionally used in ways that keep them below attribution and retaliation thresholds. Attribution is particularly challenging. State actors have demonstrated an ability to recruit individuals with a criminal background to carry out hybrid activities. No definitive evidence currently links the UAV incursions to any entity, as with recent incidents in other European states. At the same time, these UAVs appear to deliberately avoid large-scale physical harm, instead creating significant disruption in other ways. Both elements show that the incursions are intended to stay below traditional thresholds for retaliation. Instead, their purpose is to create uncertainty and decrease trust in the state.

Recognizing these UAV incursions as hybrid threats provides a basis for reflecting on Belgium’s response. Seen through this hybrid lens, several lessons can be identified for  future national and European policy approaches.

First, strategic communication is key. Since hybrid attacks are designed to sow uncertainty and provoke overreaction, political and military communication must be measured, transparent and unified. When confronted with unfamiliar activities, the public looks to the government for clarity; contradictory statements or blame-shifting can be counterproductive. In this context, comments about past indecisiveness do not reassure the public. Instead, they create friction and contribute to a fragmented narrative that serves the attacker’s objectives.

Communication about hybrid attacks must also be realistic about the complexity of the challenge. The debate quickly centred on Belgium’s lack of capabilities and the “counter-drone” package of 50 million euros approved on 8 November. This attention is understandable, yet misleading if it cultivates the illusion that there exists a single, quick technological fix. No European country possesses absolute security against such incursions; even with advanced layered systems, vulnerabilities remain. The rapid technological evolution of UAVs and counter-UAV systems also creates the necessity of continuous attention to the innovation cycle.

Equally important is the resilience of society itself. Hybrid actors seek to weaken trust: in institutions, in government, in factual information. The wide circulation of narratives alleging that the government orchestrated the incidents illustrates this vulnerability. Such stories are not merely by-products; they are precisely the cognitive terrain hybrid adversaries attempt to exploit. Acknowledging the difficulty of attribution helps prevent such narratives from gaining traction and preserves public confidence. Additionally, hybrid attacks should be framed within a broader strategic response to our adversaries, which can include messaging to our adversaries that we do not need complete certainty to take measures.

A second lesson concerns institutional coordination. Hybrid threats exploit blurred lines between war and peace, fragmented responsibilities, and gaps between jurisdictions. UAV incursions expose precisely these seams in Belgium’s layered governance model. Responding effectively requires clarity about the responsibilities of police, Defence, intelligence services, civil aviation authorities and private operators. Technical capability alone is insufficient when governance structures are not aligned. The hybrid nature of these threats demands that institutional coordination be strengthened and clearly delineated.

A third lesson relates to strategic prioritization. Hybrid attacks aim not at maximal physical destruction but at maximal distraction. Overreaction is part of the trap: if Belgium were to divert an excessive share of its limited defence and security resources toward chasing every drone signal, it could undermine long-term priorities such as support to Ukraine, NATO commitments or structural defence modernization. Calmness within society therefore has a direct strategic function: it prevents the security apparatus from being consumed by short-term incident management and preserves focus on the real strategic challenges.

Finally, hybrid attacks are not a single member state issue. When, on 10 September 2025, Poland invoked Article 4 of NATO, it demonstrated that such incidents should not be viewed as isolated national problems but as collective challenges requiring joint responses. Belgium did not call for a meeting with all NATO ambassadors, but it did reach out to its neighbouring countries for assistance. Germany was the first to respond, sending a specialist unit for detection and interception, followed by France and the UK, which also offered support in addressing the challenge. Belgium’s request for help from its neighbours was not an act of supplication but rather a positive example of European cooperation. It illustrates why it was important for Belgium to move beyond its former “free-rider” status: being a loyal ally makes it possible to receive help in times of unexpected crisis. No country can confront all aspects of hybrid warfare alone; sharing capabilities and expertise is essential. Moreover, hybrid threats do not respect national borders, and effective communication and coordination are key to strengthening Europe’s collective response.

In short, although the wave of UAV incidents has certainly shaken Belgian society, it has also revealed several important lessons that can help Belgium and Europe prepare for the hybrid challenges that lie ahead. The drones may vanish as suddenly as they appeared, but the imperative they have exposed remains: Europe’s security will depend not on technology alone, but on unity, societal resilience and strategic calm.

(Photo credit:  Jakub Zerdzicki, Unsplash)