Drones over Europe
Maximator and the Shadow of Russian Espionage
The past two months have been deeply unsettling for civil aviation across Europe. A wave of drones and unidentified aerial objects has intruded into the airspace of major European airports and critical infrastructure sites, disrupting regular aviation activity and raising alarm over the security of civilian and military facilities. Most sightings have been reported in Northern Europe, with Germany and Denmark among the most heavily targeted countries.
Although the authors and motives behind these incursions remain unknown, one question stands out: why have these specific countries been so heavily affected? One possible answer lies in a secret intelligence alliance linking several European states—an alliance that may now be the target of sophisticated aerial espionage.
Maximator: The North-European Intelligence Alliance
The surge of incursions into European airspace may be linked to a little-known intelligence network composed of five North-European countries: Denmark, France, Germany, Sweden, and the Netherlands.
The alliance—known as Maximator—brings together the German Bundesnachrichtendienst (Federal Intelligence Service), the Danish Forsvarets Efterretningstjeneste (Defence Intelligence Service), the Swedish Försvarets radioanstalt (National Defence Radio Establishment), the Dutch Technisch Informatie Verwerkingscentrum(Technical Information Processing Centre, now part of the Joint Sigint Cyber Intelligence Unit), and the French Direction Générale de la Sécurité Extérieure (General Directorate for External Security).
The existence of Maximator was only revealed in 2020, when Professor Bart Jacobs published a groundbreaking paper detailing the alliance’s history. According to Jacobs, cooperation began in 1976, and its name derived from a Bavarian beer brand—an inside reference to Munich, where Germany’s foreign intelligence agency is based. Despite this mundane origin, the alliance specialized in signals intelligence (SIGINT): the interception and analysis of electromagnetic communications.
Maximator focused on cryptanalysis, technical interception, and satellite-based signals intelligence. Its main activities involved intercepting and decrypting diplomatic and military communications, which, at the time, were almost exclusively encrypted traffic.
Notably, countries such as Norway, Spain, Belgium, and Italy sought to join the alliance but were denied membership for lacking sufficient SIGINT capabilities. However, the Snowden leaks later revealed that these countries participate in SIGINT Seniors Europe (SSEUR)—an extended framework connected to the Five Eyes alliance (United States, United Kingdom, Canada, Australia, and New Zealand). SSEUR includes both Maximator members and their former applicants, indicating deep transatlantic cooperation on electronic intelligence.
Jacobs also documents several global operations linked to Maximator. For instance, the alliance allegedly helped Britain defeat Argentina during the Falklands War (1982) by exploiting Crypto AG encryption devices secretly rigged by the German BND and the CIA, giving the British military a decisive advantage. Another example involves the Aroflex encryption system, developed by Philips in the 1970s and approved for use within NATO and the Maximator network.
An Analysis of the Recent Drone Sightings over Maximator Countries
On September 10, approximately twenty drones entered Polish airspace. Four were shot down by NATO air defence forces, while the others reportedly crashed after running out of fuel. Although Russia denied any deliberate involvement—suggesting a technical malfunction or a jamming incident—subsequent analysis of the drone components indicated that the operation was likely intended to penetrate deeply into Polish territory.
After this deliberate incursion into NATO airspace, and against the backdrop of rising escalation risks in the war in Ukraine, multiple European cities reported sightings of unidentified aerial objects over civilian and military aviation facilities as well as other critical infrastructure.
A curious pattern emerged: most cases occurred in Northern Europe, particularly in Denmark, Belgium, and Germany. While national authorities have refrained from assigning blame and are conducting their investigations quietly, Western media outlets have suggested that Russia may be testing the military and political readiness of NATO and EU member states.
The Numbers
18 of the 32 total incidents occurred in Maximator countries.
Including SSEUR members (Belgium, Spain, Norway), 30 of 32 incidents took place in countries belonging to a SIGINT alliance.
8 of 11 military-site incursions were in Maximator states.
While most incident sites do not show clear links to SIGINT or air-surveillance facilities, five cases in Denmark, Germany, and the Netherlands coincide with radar stations and air-control nodes.
Denmark
Denmark recorded eight drone incursions in four days (22–25 September). It was, alongside Norway, the earliest target after the Poland incident. Five sightings occurred over Danish military infrastructure, and three appear linked to SIGINT or airspace surveillance:
The radar station in Skrydstrup. Coordinates: 55°15'42.8"N 9°13'26.6"E
Karup Air Station: Denmark's largest military workplace, where around 3,500 people work daily. The air base houses the headquarters of the Air Control Wing (ACW), a sub-unit of the Danish Air Force responsible for military surveillance of Danish airspace.
Skrydstrup Air Base: Home to two F-16 Fighting Falcon squadrons of the Danish Air Force’s Fighter Wing. Just three kilometres from the air base lies one of the three ACW radar heads monitoring national airspace.
Kastrup Airport (Copenhagen): Despite its primarily civilian role, it hosts ACW’s Squadron 515.
Germany
The radar station in Haindfling. Coordinates: 48°26'03.7"N 11°43'17.6"E.
Germany was the third most affected country after Denmark and Belgium, reporting five drone sightings between October 2 and November 2.
The first two incidents took place at Munich Airport, which lies near the historical headquarters of the BND in Pullach. More importantly, 10 km from Munich Airport sits the Haindlfing radar station, part of the Control and Reporting Center (CRC) responsible for monitoring German airspace. The station hosts the 248th Air Defense Training Group, an Air Force unit of the Air Operations Center 2.
Other incidents were recorded over Berlin, Erfurt, and Bremen airports, though without direct links to known SIGINT facilities.
The Netherlands
On 11 November, media outlets reported multiple drone sightings in the southern province of Limburg, near several sensitive sites: NATO’s Allied Joint Force Command in Brunssum, the Chemelot industrial complex in Geleen, and Maastricht Aachen Airport.
However, just a few kilometres across the Dutch–German border lies one of NATO’s most important air bases in Europe: Geilenkirchen Air Base, home to the NATO Airborne Early Warning and Control Force (AWACS). Airspace surveillance is one of AWACS’s central missions as part of the Alliance’s airborne early-warning and control system. The air station hosts fourteen E-3A aircraft—modified Boeing 707s equipped with long-range radar and passive sensors capable of detecting aerial and surface contacts over vast distances.
During a recent visit to the base, NATO Secretary General Mark Rutte stressed its crucial role, describing AWACS as the Alliance’s “eyes in the sky,” responsible for monitoring Allied airspace, including NATO’s eastern flank.
Although the targets were NATO facilities rather than sites directly linked to Maximator’s SIGINT network, the Dutch case remains particularly important because it highlights the potential transnational dimension of drone incursions and provides credible indications of espionage activity near SIGINT-related stations.
The NATO E-3A aircraft.
Maximator and the War in Ukraine
Although Jacobs’s analysis covers a different geopolitical era, Maximator’s deep integration with Atlantic intelligence makes it plausible that the alliance is still operational, quietly supporting Ukraine under the broader umbrella of NATO assistance.
In terms of military and financial assistance, Maximator partners rank among Europe’s most significant contributors to Ukraine, both in humanitarian and military support. Denmark is the leading contributor relative to GDP, allocating 2.9% of its national output—over €10 billion—to Ukraine. Substantial commitments have also come from the Netherlands and Sweden, each contributing more than 1% of their GDP.
In absolute terms, Germany is Europe’s largest donor, with more than €22 billion allocated to Ukraine, nearly 80% of which is dedicated to military aid. Meanwhile, Denmark, the Netherlands, Sweden, and France occupy the third, fourth, fifth, and sixth positions, respectively, in Europe’s ranking of total support. Collectively, these five countries represent the core of Europe’s military and financial assistance to Kyiv.
With regard to intelligence sharing between the Maximator alliance and Ukraine, direct evidence remains unavailable—understandably, given the sensitivity of the matter. Nonetheless, several developments point toward active and ongoing bilateral intelligence cooperation:
In 2022, Die Zeit revealed a covert operation by the German BND that provided Ukraine with intelligence and satellite imagery detailing Russian troop movements.
In 2024, both Denmark and the Netherlands signed 10-year bilateral security agreements with Ukraine, explicitly enhancing intelligence cooperation.
That same year, the head of the Swedish Military Intelligence and Security Service visited his Ukrainian counterpart, underscoring the importance of sustained intelligence collaboration.
In March 2025, following statements from the newly installed Trump administration raising doubts over continued U.S. intelligence support to Ukraine, French Defence Minister Sébastien Lecornu publicly affirmed that France was actively sharing intelligence with Kyiv.
In July 2025, a joint statement by the Dutch MIVD, the Dutch AIVD, and the German BND warned that Russia’s use of chemical weapons in Ukraine was intensifying—an assessment that strongly implies close intelligence coordination among Maximator members on the Ukrainian front.
Taken together, these developments strongly suggest that deep and ongoing bilateral intelligence cooperation between Maximator partners and Ukraine is not only plausible but increasingly evident.
Drone Incidents and the Shadow of Russian Espionage in Europe
Although Russia denies any involvement, the concentration of drone incidents over the airspace of countries most engaged in supporting Ukraine raises legitimate suspicions.
European authorities have avoided directly accusing Moscow. Official statements describe the actors involved as “capable and professional,” and some drone incidents in the past have indeed been traced to civilian hobbyists. Yet the overall pattern is too consistent to ignore.
The evidence linking the flights to Maximator sites is partial but noteworthy. Denmark and Munich show plausible SIGINT-related targets. However, this correlation applies only to a subset of cases, suggesting the need to consider alternative explanations or additional motives, such as:
psychological operations to induce public fear;
testing NATO civilian air defences;
probing airport vulnerabilities for sabotage.
French analyst Jean-Claude Allard, from the think tank IRIS, offers a political interpretation: that the drone activity could relate to Denmark’s current presidency of the Council of the EU. As Copenhagen is expected to shape the Union’s defence posture, drone incursions could potentially hinder European support for Ukraine, especially in air defence.
As the disruption of civilian airport operations generated public anxiety and renewed concerns about national security, European governments may begin reassessing the scale of their financial and military support to Ukraine. The recent incidents have highlighted vulnerabilities in Europe’s own airspace protection, prompting debates over whether more resources should be diverted toward strengthening domestic defence and security systems. In response, European leaders are discussing the creation of a “drone wall,” a continent-wide air-defence network designed to detect, prevent, and neutralize hostile drone incursions.
Russia’s involvement remains a credible hypothesis, but available evidence is inconclusive. No drone has been publicly identified as Russian. Ambiguity may serve Moscow’s interests, enabling plausible deniability or outsourcing operations to non-state actors.
What appears almost certain, however, is that these mysterious aerial objects are repeatedly appearing over the airspace of Maximator and SSEUR partners, fueling speculation that the flights are probing the heart of Europe’s intelligence cooperation network.
Author: A.S.
