Introduction
Five Cents examines Germany’s Russia Warning to explain how a serious risk of violent conflict can coexist with no signs of a large-scale attack on NATO. We’ll unpack intelligence chief Martin Jäger’s remarks, distinguish covert pressure from military escalation, and consider what evidence could change the assessment. The starting point is what, exactly, each warning describes.
What is happening
A country can face hostile acts without intelligence showing that an invasion is being prepared. Sabotage, intimidation, and interference can cause harm now. They can also create situations in which governments misjudge each other’s intentions or respond in ways that escalate a confrontation. Neither possibility establishes that a major military attack is imminent.
That distinction is central to Jäger’s statement. At a public parliamentary hearing on October fifth, twenty twenty-six, the head of Germany’s foreign intelligence service, the BND, said Germany was in danger of becoming embroiled in a violent conflict with Russia. In the same hearing, he said the service saw no indications of a large-scale Russian attack on NATO territory.
Those statements answer different questions. The first concerns Germany’s exposure to confrontation and escalation. The second concerns whether intelligence indicates preparations for a particular kind of attack. Reading the first as a prediction of imminent invasion would erase an important qualification from the assessment itself.
Jäger described the present confrontation as a shadow war. He alleged that Russia was using covert activity to intimidate Germany and other European capitals, and to weaken support for Ukraine. He also said attacks on targets in Germany remained a real threat. One example he cited was an attempted attack at Leipzig, described in public reporting as an attempted drone attack on a Ukrainian cargo plane in August.
Its relevance to his argument is the connection between activity inside Germany and support for Ukraine. But an intelligence chief citing an incident is not the same as publicly disclosing all the evidence behind its attribution. That matters because two separate judgments are involved: what happened, and who directed it.
The context
Investigators might establish the method and intended target before the public receives convincing evidence of a link to a state service. Jäger’s remarks convey the BND’s assessment. They do not give listeners access to its complete intelligence case. What, then, could turn covert confrontation into a military clash?
A limited incident could provoke a response, followed by another response, especially if intentions were unclear. Jäger warned about possible low-level Russian military activity, particularly in the Baltic region. Such activity is different from a large conventional offensive, but it could still create a dangerous encounter.
That is an explanation of how escalation could happen, not a prediction that it will. The public remarks offered no timetable and did not say war was inevitable. They also did not establish that a particular incident would trigger a particular military response. The wider European assessment helps clarify this distinction.
NATO treats Russia’s war against Ukraine as a major threat to Euro-Atlantic security and has strengthened deterrence and defence. Yet on September thirtieth, Secretary General Mark Rutte said there was no imminent threat to NATO territory. He also said a military build-up would be detected and addressed.
That does not directly rebut Jäger’s concern. Rutte was addressing imminent military danger. Jäger was describing covert pressure and the broader possibility of escalation. Their statements need to be compared on scope and timing, rather than reduced to competing headlines. The European Union’s description of hybrid threats is useful here too. It includes combinations of cyberattacks, information manipulation, economic pressure, covert political activity, and military threats.
But that category is not proof of responsibility
But that category is not proof of responsibility. Each allegation still needs evidence specific to the incident. So what would make the warning clearer or change its significance? More detailed official disclosures could strengthen attribution: named suspects, identified methods, or demonstrated links between incidents. Investigations could also show whether alleged attacks were isolated or part of a coordinated campaign against infrastructure, military logistics, or support for Ukraine.
A changed military assessment would matter separately. Reports of significant force build-ups or unusual deployments would need to be evaluated alongside their location, purpose, and corroboration by allies. No single indicator automatically proves that an attack is coming.
The essential distinction remains: covert hostility can be serious without an invasion being imminent. Escalation is a risk, not an announced timetable. And classified intelligence limits what the public can independently verify, without automatically making the warning either baseless or proven. To explore this further, you can generate two new Five Cents: How Sabotage Is Attributed, about establishing responsibility, and Baltic Incidents and NATO Responses, about handling limited military encounters.
And with that, you're up to speed in a few minutes.