How a German Bus Driver May Have Averted a War
An object lesson in hybrid attacks, escalation, deterrence, and miscalculation.
LAST WEEK, A BUS DRIVER AT Leipzig/Halle Airport in Germany briefly became a ninja warrior. He saw a drone buzzing around a Ukrainian An-124 cargo plane, and in a feat of inadvisable athleticism, kicked it out of the air. Whether or not he knew it at the time, that man’s quick thinking and fast feet may have changed the fate of the world.
Leipzig/Halle is one of Europe’s largest cargo hubs and an important node in the logistics network connecting European industry, transportation, and military operations. It has also become an operating base for Antonov, the Ukrainian firm that designs, builds, and operates heavy transport aircraft, since Russia’s full-scale invasion forced much of the company’s operations out of Ukraine. The aircraft at the center of the story is an Antonov An-124 Ruslan, one of the largest cargo airplanes anywhere in the world; it carries roughly 120 tons of cargo and can accommodate outsized equipment too big for most military transports. There are only fifty-seven of the type anywhere in the world, and NATO relies on the An-124 for its Strategic Airlift International Solution, or SALIS, a program that provides allies access to strategic transportation. Leipzig/Halle sits at the center of that arrangement.
When authorities examined the downed drone in Leipzig and found it was carrying explosives, German federal prosecutors took over the investigation, and officials began examining whether the incident represented something far more consequential than an aviation security violation.
Support independent journalism that provides original reporting, sharp analysis, and honest commentary without tribalism or spin. Join Bulwark+.
The bus driver who kicked the drone might easily have been killed, or he might have accidentally detonated the explosives near the aircraft. In either of those cases, the incident might have precipitated an international crisis.
German authorities have not publicly established that Russia was responsible for the incident, though reports suggest the American intelligence community is more certain it was. But whoever sent the drone selected a location containing Ukrainian aircraft involved in the strategic transportation network supporting European security. That should get our attention, particularly since several European governments have openly warned that Russia may test NATO resolve in the coming years—an assessment reportedly echoed by the American intelligence community. Leaders in the Baltic states and Poland have voiced increasing concerns about threats to energy systems, transportation networks, and other critical infrastructure. Latvian officials have warned specifically about the possibility of Russia indirectly testing NATO’s mutual defense commitment.
A conventional invasion would provide NATO with clarity: If Russian tanks cross the Polish border or troops enter Estonia, it would remove most of the questions about what had occurred and who was responsible. But hybrid attacks create the opposite effect. A warehouse burns, a railway switching station is sabotaged, or an undersea telecommunications cable is severed, or an explosive drone appears under the wing of a Ukrainian transport aircraft at a German airport—these types of events force political leaders to answer tough questions: What happened? Who did it? Can responsibility be proved? Was it criminal activity, terrorism, or state-directed sabotage? Or, perhaps most importantly, does it constitute an attack requiring a NATO response? The ambiguity is the objective.
JUST IMAGINE WHAT MIGHT HAVE HAPPENED if that bus driver had called in sick that day.
The drone detonates beside the An-124, igniting the aircraft and destroying it. Several German airport employees are killed and a dozen or more are seriously wounded. Leipzig/Halle suspends cargo operations while security forces search the airport for additional devices. (In actuality, the airport did shut down its runways for a few hours, and a “second flying object” struck another airplane, causing light damage.)
German authorities treat the incident as a counterterrorism investigation. Within forty-eight hours, German intelligence concludes with high confidence that the operation was planned or directed by Russian military intelligence. The German chancellor announces publicly that a Russian state organization deliberately attacked German territory, destroying an aircraft connected to NATO strategic transportation and killing German citizens. Germany would suddenly face a question far larger than the destruction of one airplane: Should Germany take the investigation and its political demands to Brussels for review by the other thirty-one members of NATO?
Article V of the North Atlantic Treaty is often discussed as though it were an automatic mechanism under which an attack on one NATO member instantly sends the alliance to war. It doesn’t work that way. The treaty considers an armed attack against one member an attack against all, but individual allies take whatever action they deem necessary, which may include the use of military force. NATO has acknowledged that significant cyber or hybrid attacks could reach the threshold of collective defense, but the difficult part is determining where that threshold lies.
Some allies might argue that a Russian intelligence operation killing German citizens and destroying an aircraft at a strategic logistics hub clearly qualifies. Others might urge restraint, fearful that invoking Article V over a covert drone operation could begin an escalatory process no one could control. Some would no doubt want to see conclusive intelligence linking Russia to the attack, but the allies in possession of that intelligence might not be willing to share all the details of how they know what they know. Germany might instead request Article IV consultations, a process that allows countries to share intelligence, evaluate future risks, and plan joint strategies to address the situation in anticipation of future escalation. Washington could seek additional intelligence before supporting a more forceful response. Each of these positions would have a reasonable argument behind it, and that is exactly what makes conducting such operations attractive to Moscow, Beijing, Tehran, and others.
The An-124 might be the physical target, but NATO cohesion could be the real objective. Suppose German attribution is convincing, several Germans are dead, and the aircraft is destroyed, but NATO decides not to treat Leipzig as an Article V attack. The alliance would not suddenly disappear. NATO headquarters would remain in Brussels, American forces would still be stationed across Europe, and alliance exercises would continue. But something fundamental would have changed.
Governments in Estonia, Latvia, Lithuania, Poland, and Finland would immediately ask what kind of Russian attack would trigger collective defense. If a state-directed attack killing NATO citizens at a strategically important facility did not qualify, where was the line? Ten deaths? Twenty? A sabotaged ammunition depot? An electrical grid disabled during a Baltic winter?
Deterrence depends not merely on capability but on an adversary’s perception of political will. Once Moscow concluded that a gap existed between NATO’s treaty commitments and what the various members’ governments were prepared to enforce, the Kremlin would have every reason to probe that gap again. Each subsequent attack could be slightly more damaging, calibrated to remain just below whatever threshold NATO had demonstrated it was reluctant to cross.
There is another possible response, however, and it might represent a serious Russian miscalculation. Europe might not become more cautious. It could become much more aggressive in supporting Ukraine. Poland and the Baltic countries could conclude that the best way to defend themselves was to help Ukraine destroy more Russian military capability before it ever reached NATO territory. Governments could increase deliveries of long-range missiles, drones, air defenses, and ammunition, while accelerating their own defense production and expanding intelligence cooperation with Kyiv. They might even consider supplying their own armed forces to contribute to the Ukrainians’ fight.
Russia might then increase sabotage and cyber operations against the European logistics architecture supporting Ukraine—the ports, railroads, warehouses, airports, and maintenance facilities by which weapons travel from around the world to Ukraine.
The danger is that escalation would not necessarily remain confined to Europe. With the United States and Europe distracted, Tehran might see an opportunity to intensify its own pressure against American forces and interests. Iranian-backed groups increase operations elsewhere, and the Houthis step up attacks in the Red Sea. A Houthi attack strikes a French frigate and kills sailors while Germany is still wrestling with the aftermath of Leipzig. France has casualties at sea while Germany has casualties at home. Poland and the Baltic states are demanding a stronger response against Russia, and Washington is trying simultaneously to contain escalation in Europe and sustain a costly military operation in the Middle East. The situation becomes even more complicated because Saudi Arabia, Turkey, and Pakistan have just entered a new mutual-defense arrangement. Turkey is already a NATO member, while Saudi Arabia faces continuing threats from the Houthis and Iran, and nuclear-armed Pakistan is now in theory responsible for the defense of both countries. If attacks spread to Saudi territory, Ankara could find itself navigating overlapping commitments at precisely the moment NATO is debating how to respond to Moscow.
At the same time, China could announce new air and naval exercises that completely surround Taiwan, raising the prospect of a blockade without actually announcing one. With Washington distracted, America’s Pacific allies struggle to coordinate, and no one challenges the Chinese until it’s too late.
WE TEND TO IMAGINE MAJOR WARS beginning when a leader consciously decides to launch one. History is often messier. Wars expand because one state attempts a supposedly limited action, another responds proportionately, a third sees an opportunity, proxy forces pursue their own interests, and alliance commitments gradually pull additional countries into the confrontation. Each individual decision appears rational while the cumulative result becomes catastrophic.
Ever since Herman Kahn illustrated multi-tiered paths to nuclear war in 1965, military professionals have often described escalation as a ladder, but it actually can look more like a web. Pull one strand at Leipzig and something moves in Tallinn. Increase support to Ukraine and calculations shift in Moscow. Tehran sees Washington distracted and presses its advantage. An attack in the Red Sea changes decisions in Paris. Those decisions affect Brussels, and Brussels affects what Moscow believes it can risk next.
None of this is a prediction about what will follow the Leipzig incident. But military planners conduct war games using precisely these kinds of scenarios because waiting until every hypothetical becomes reality is a poor way to prepare for a crisis.
The significance of Leipzig is therefore not simply that an airport bus driver became an unlikely ninja warrior for a few seconds on a German runway. It is that those few seconds reveal the strange environment in which NATO deterrence now operates and in which global security is threatened or preserved. European leaders warning about a potential Russian attack may be describing something subtler than Russian armies crossing borders. The attack they fear could come as a series of limited actions deliberately designed to prevent anyone from ever identifying a single clear moment when peace became war.
Last week, perhaps through luck, technical failure, or one extraordinarily brave airport employee, NATO did not have to answer that question. We should not assume the next bizarre operation by a malign actor fomenting a crisis will give us the same luxury.
Holy shit.
History teaches that whatever folly is possible human beings will sooner or later make inevitable. It’s a blessing (for me) that at 71 I stand a good chance of passing on first.