Europe is assembling a shared picture of the drone threat at its eastern flank. The EU runs the European Drone Defence Initiative and the Eastern Flank Watch. NATO runs Operation Eastern Sentry. Poland is building a national counter-drone wall with its own command layer. Estonia has installed fixed detection systems on three sections of its border with Russia. Finland is funding detection and counter-drone procurement through its Border Guard. The current analysis converges on the same recommendation: collect the data from every detection station on the flank into a common operating picture, and build an information exchange for drone incidents near critical infrastructure farther west (Franke, ECFR, August 2026).
The recommendation is correct as far as it goes. Brief №1 showed why it does not go far enough. At Kunduz the hospital's coordinates were in the intelligence database. The picture existed. The strike proceeded because the information was not at the point of decision when the decision was made. A shared picture is necessary. It prevents nothing by itself.
This brief is about the two things the flank picture needs that the current plans do not specify: records a stranger can act on, and a decision committed before the event it governs.
Who Writes the Record
Every entry in the proposed picture is produced by an institution that is measured by it.
The German aviation agency's sighting figures come from pilot reports. Pilot reports cannot be checked after the fact, and one sighting from an aircraft turned out most likely to have been a plastic bag. In Latvia, the defence minister and the prime minister both lost their positions over a response to incursions that was judged insufficient. The agencies that report incursions are the same agencies whose adequacy the reports establish.
This is a natural limit, not an accusation. A record written by the institution it measures can be entirely honest and still be worth only that institution's word, because no reader outside it can verify anything. The grade of the evidence is capped at the source.
The picture also contains an entry produced by the adversary. Attribution of intent at the flank rests partly on Russia's account of itself: incursions described as accidents of the war next door, an account that is sometimes plausible and sometimes not. A shared picture that includes the actor's self-description includes a record nobody on the reading side wrote.
And the picture must cross borders. Nine states line the flank. A Romanian commander will act on a track produced by Polish sensors under Polish procedure, or a Lithuanian one on Estonian data. The reader was not present at capture and does not run the chain that produced the record. This is the situation Brief №8 described: a record leaving its producer and reaching wider circles of readers, useful to each new circle only at the grade it carries.
The Drone on the Tarmac
On 5 August 2026 a small drone carrying explosive material was found at Leipzig airport. Two things set the incident apart from every previous airport disruption: the explosives, and the fact that the authorities recovered the airframe.
Recovery changed the grade of the record. Before Leipzig, the public record of the overflight campaign was built from sightings and closed runways. After Leipzig there is an object. The airframe can be examined by any party without trusting the chain that reported it. Its components can be traced. Its flight can be matched against the airport's camera footage. The record stopped being a report and became evidence.
The same instinct shows up in the current analysis of countermeasures, which prefers taking over a hostile drone's controls and landing it, precisely because that preserves the drone for examination. The preference is right and the reason generalizes. The value of the flank picture tracks the grade of its records, and the grade is set at capture. A track written to a tamper-evident record the moment a sensor produces it can be verified later by a stranger. A track assembled afterward from an institution's summary cannot be raised above the institution's word, no matter how many dashboards display it.
The Improvised Gate
In May 2026 a drone crossed into Romanian airspace and crashed into an apartment building in Galați, injuring two people. The Romanian military had tracked it and deployed two F-16s. The jets did not fire. The stated reasons were operational constraints and legal limits. The sensors worked. The picture worked. The decision failed, because it met a question nobody had answered in advance: under what committed rule does a state at peace fire on a military drone in its own sky. As a Romanian military representative put it, "Ukraine is at war, but Romania is at peace."
Every flank state shares that condition, and each is currently deriving the rule alone. Germany has amended national law to let its armed forces intercept drones in extreme cases. France has authorized private companies to defend civilian infrastructure. Romania met the question in the air, with the drone inbound.
Brief №7 named this failure shape in information systems. A loop that observes first and improvises the decision afterward puts its weakest step at the moment of highest pressure. The correction is a change of order: commit the intent before the event, and hold the commit at a gate that exists independently of any single chain in the loop. Translated to the flank: interception conditions written before an incursion and agreed among the states that will share the picture. Response stays local, because local speed is the point, and swarming doctrine from Brief №4 says local authority coordinating through shared awareness beats central command in a transparent space. What is pre-committed is not the response. It is the conditions under which a local commander is already authorized to respond.
The September 2025 incursion over Poland shows the decision already crosses national chains: Dutch F-35s flew alongside Polish F-16s, and together they downed three drones over Polish territory. The rules for the decision should cross the same borders the decision does, and they should cross them in writing, in advance.
Requirements
As in Brief №4, these are engineering requirements, not principles.
Written at capture. Sensor output is committed to the record when the sensor produces it, before any institution decides what it means. A record assembled at reporting time is a summary, and a summary carries the situation of whoever wrote it.
Append-only and tamper-evident. Entries are chained so a later reader can detect any edit. The producing installation signs its segment. A reader in another country verifies the signature without asking the producer.
Provenance on every entry. Which sensor, at which position, operated by which unit, under which procedure. A track without provenance cannot be graded, and an ungraded track cannot carry a firing decision in a state at peace.
Contradiction as signal. The shared picture sees more than any national feed, which means disagreements between feeds become visible there and nowhere else. A picture that reconciles its feeds quietly deletes the one thing it can provide that no member can. Where the feeds disagree is where a false record shows itself.
The gate committed first. Interception conditions are written before the event and held at a defined place, readable by every state that shares the picture. The record shows the rule existed before the track did.
None of this requires new sensors. It is record architecture and legal drafting, and the two are the same work: a pre-authorized interception rule is an entry in the record, and the gate is only checkable if the record is.
What This Means
The flank picture will be built. The programmes are funded and the installations are going in. The open choice is quieter than the procurement decisions and will outlast them: whether the picture is a collection of national summaries or a record graded for strangers. The first produces briefings. The second supports a firing decision by a state at peace, on a track its own sensors did not produce, under a rule written before the drone crossed the border.
The structure is not hypothetical. It already runs in information infrastructure, where the actors are software agents and the record is a hash-chained log (Brief №7). The flank needs the same shape at continental scale: records written before the act and readable by strangers, with a gate that was there before the event it decides.