Seven Lessons from Leipzig

One week after the night of the incident, it is becoming clearer what happened at Leipzig/Halle Airport, and the first political reactions are becoming apparent. This special edition analyzes the incident and draws seven conclusions for drone defense in Germany. Jan Hesselbarth of BRAVO SIX ADVISORY discusses the situation and what needs to be done.

What Happened in Leipzig

First, the facts. On the night of August 5, 2026, an airport employee discovered a drone equipped with an explosive device in the security area of Leipzig/Halle Airport. Specialists removed the detonator, which, according to current findings, was defective; the Federal Prosecutor’s Office described it as professional-grade explosives. It took over the investigation on August 6 and classified the case as a serious attack on transportation and logistics infrastructure. Investigators are examining the attempted triggering of an explosive device and a dangerous interference with air traffic. That same night, a second drone allegedly collided with a cargo plane that had to take off due to the airspace closure and later landed in Hanover with minor damage. Federal Interior Minister Dobrindt spoke of a hybrid attack scenario and a new level of threat. The National Security Council met on August 7.

The perpetrators, motive, and those who ordered the attack remain unknown. Several politicians pointed to Russia; investigative authorities have so far neither publicly confirmed nor ruled out attributing the attack to Russia. As of today, there is no evidence as to who is behind the attack. For the consequences that follow, the answer is of secondary importance, as they apply to any conceivable perpetrator.

1. Leipzig is not an isolated case

The statistics from the past twelve months speak for themselves. German Air Traffic Control recorded approximately 145 drone-related disruptions at German airports in the first half of 2026 alone. For the year 2025, the German Aerospace Center (DLR) counted 226 drone incidents at German airports and estimated the minimum damage at around 60 million euros, with ripple effects reaching up to 160 million euros. In July 2026, a man was arrested in Munich for allegedly flying a drone over a defense contractor.

The European context further underscores the situation. On the night of September 10, 2025, Russian drones entered Polish airspace; NATO aircraft shot down several of them, and Poland requested consultations under Article 4 of the NATO Treaty. In late September 2025, Copenhagen Airport was closed for about four hours due to several large drones; this was followed by closures in Aalborg and Oslo, as well as drone formations over naval bases in Kiel. In early October 2025, Munich Airport suspended operations twice within 24 hours, stranding thousands of passengers. In November 2025, Brussels Airport and several Belgian military bases were targeted. And as early as July 2024, an air cargo package containing an incendiary device caught fire in Leipzig; in Lithuania, suspected perpetrators with ties to Russian military intelligence are currently on trial for this incident.

My assessment: The incidents prior to this were disruptions, reconnaissance, and provocations. The Leipzig incident marked the first time on German soil that a drone carrying explosives was deployed within an airport’s security zone. Anyone who interprets this sequence as a series of unfortunate coincidences is ignoring its underlying trend: frequency, target selection, and methods have been escalating in the same direction for the past year.

2. Implementing What Has Been Decided

Over the past ten months, Germany has established the necessary structures. Since December 17, 2025, the Joint Federal and State Drone Defense Center has been operating 24 hours a day to maintain a national situational picture. In December 2025, the Federal Police commissioned a drone defense unit initially comprising 130 personnel, backed by 100 million euros in funding. The amendment to the Federal Police Act, which explicitly regulates the use of technical means against dangerous drones, was adopted by the Bundestag on July 10, 2026, in its second reading; the legislative process is still ongoing. At the same time, according to media reports, more than 40 agencies are involved in drone defense in Germany.

My conclusion is this: Calling for a new commission or an additional defense unit would be the easiest response to the Leipzig incident. The center, the units, and the law already exist. Any additional structure would lengthen reporting chains and spread responsibility across more shoulders until no one is left to bear it. The task for the coming months is implementation: finalize the Federal Police Act, expand the defense unit, integrate the Drone Defense Center’s situational awareness with the operators of critical infrastructure, and practice, practice, practice. A country with 145 drone incidents in half a year needs response chains that operate in seconds and on-site personnel with decision-making authority.

3. The private security sector has a role to play in drone defense

The day after the discovery, the Federal Association of the Security Industry (BDSW) and the Federal Association of Aviation Security Companies (BDLS) called for uniform nationwide minimum standards for drone detection and defense at critical infrastructure sites, clear operator responsibility, and legal certainty regarding the interception of dangerous drones. BDSW Vice President Cornelius Toussaint puts the numbers into perspective: over 30,000 KRITIS operators with an estimated 150,000 properties; without the systematic involvement of the security industry, there will be no comprehensive protection.

The numbers speak for themselves. A government defense unit with 130 personnel is tasked with protecting an estimated 150,000 critical infrastructure sites. Even at full strength, government drone defense will remain mobile and sporadic, and will be ineffective on a nationwide scale: it can protect key areas, manage situations, and intervene. Private security services are already providing site protection across the country, with personnel stationed at airports, power plants, data centers, and substations. Integrating drone detection and defense capabilities into this existing infrastructure is the fastest way to achieve comprehensive coverage. This requires three prerequisites: mandatory qualification standards, certified technology, and regulatory oversight.

4. Authorization Must Become the Standard

Today, active drone defense is reserved for the police and the German Armed Forces. Brandenburg’s Interior Minister Jan Redmann is calling for operators of critical infrastructure to be authorized to counter approaching drones; the response window is 60 to 90 seconds. Brandenburg passed a draft bill to this effect at the end of January 2026. The energy association BDEW supports delegated authority in cases where government capacities fall short, but demands cost neutrality and clear liability rules. The Association of Municipal Enterprises, however, objects: security is a primary responsibility of the state, and drone defense is a matter for the police and intelligence services. Constitutional law experts also question the legislative authority of the states.

The delegation of authority is a tried-and-true concept in German security law. For years, private aviation security assistants have been screening passengers and luggage at German airports—among other tasks—as delegates of authority, under official supervision based on the Aviation Security Act. This model delegates sovereign powers in a precise, limited, and controlled manner. This is exactly the framework drone defense needs: A facility security officer who detects an approaching drone has 60 to 90 seconds. No police station in the country can arrive on the scene within that time. The VKU’s objection deserves a serious response, and the delegation of authority provides it: The state retains the authority to define powers, standards, and oversight; private entities carry out their duties under this oversight. The federal government should regulate this uniformly through the Federal Police Act, aviation security law, and the KRITIS framework. A federal law establishes uniform certification and liability; 16 state regulations would fragment both and subject operators with locations in multiple states to conflicting requirements.

5. Adopt a Far More Resilient Approach to Security

In 2025 in The Hague, NATO resolved to invest 1.5 percent of GDP in infrastructure and resilience, in addition to 3.5 percent for traditional defense. At the same time, damage figures from the DLR show how a single drone can cause millions in damage through network effects: a closed cargo airport disrupts supply chains across Europe.

So far, Germany has planned security based on normal operations, with the goal of preventing disruptions. Resilience begins one step earlier, during the design phase of systems: redundancies, backup sites, recovery plans, and practiced improvisation. A system is resilient if, after a successful attack, it continues to operate at a reduced rate and a second site takes over while the first one recovers. The metric for this is recovery time, and it belongs as a key performance indicator in every resilience plan. This applies to airports just as much as it does to substations, ports, data centers, and government agencies. Society is also part of resilience: calm communication in the event of an incident, well-rehearsed procedures among operators and emergency services, and informed citizens. Panic is a tool used by hybrid attackers; preparedness neutralizes it.

6. KRITIS Is a Current Priority

The legal framework is in place. The Bundestag passed the KRITIS umbrella law at the end of January 2026, and the Bundesrat approved it on March 6, 2026. Since July 17, 2026, operators have been registering with the Federal Office for Civil Protection and Disaster Assistance. The deadlines: registration within three months of being identified as a critical infrastructure facility, initial risk analysis after nine months, resilience plans after ten months, and reporting of significant disruptions within 24 hours.

The law’s timeline extends well into 2027. The attack took place in August 2026. An operator who submits their risk analysis only at the very end of the deadline is failing to keep pace with the threat. There are four things that can be done immediately, without waiting for a single legislative change: among other things, include the drone scenario in the risk analysis, procure detection systems (operators are already permitted to do so today), establish reporting channels to the police and the drone defense center, and prepare one’s own organization for future certification. I believe the call by BDSW and BDLS to enshrine minimum standards for drone detection within the KRITIS framework is correct; it would turn voluntary precautionary measures into a reliable baseline.

7. Widespread Drone Defense: The Mothership Principle

Finally, a concept that I expressly put forward for discussion. It is a proposal from a practical perspective, and I identify it as such.

Stationary defenses protect specific points. A hybrid attacker freely chooses its target and strikes where no one is expecting it. The answer lies in the breadth of public space, and Germany already possesses the infrastructure for this: municipal waste collection vehicles travel on nearly every street in the country on weekdays. Police patrol cars and fire department vehicles are distributed throughout the country, manned, and ready for deployment. Public properties offer rooftops, power, and secure areas. Equipped as mother ships, with sensors for detection and several interceptor drones (such as the Netz-Interceptor) as payloads, these fleets would form a distributed defense network that shortens response times from minutes to seconds and becomes denser with each equipped fleet. The concept reuses existing structures: vehicles, personnel, properties, and radio networks already exist; drone defense is added as a payload.

Four questions remain open, and they can be resolved. First, the legal basis: Who authorizes the response, and under whose authority? This brings us full circle to the issue of delegation of authority and the amendment to the Federal Police Act. Second, command and control: A distributed network requires integration with the situational awareness provided by the Joint Drone Defense Center. Third, training and certification of operators; fourth, the safety of interception operations over populated areas. Whoever answers these four questions will transform everyday municipal fleets into Europe’s densest sensor network.

JAN HESSELBARTH, as co-founder and managing partner of BRAVO SIX ADVISORY GmbH, is responsible for the defense division and brings over 20 years of operational and strategic leadership experience from the German Armed Forces, federal agencies, and the private sector. As a paratrooper officer and Joint Terminal Attack Controller (JTAC), he was responsible for territorial tasks and host nation support at the Hamburg Regional Command following a deployment in Kunduz, Afghanistan. His consulting portfolio includes NATO missions, programs involving up to 1,000 participants, training contributions for more than 5,000 Bundeswehr personnel, and co-authorship of a nationwide study on maritime security for the Federal Ministry of the Interior—a core topic in the KRITIS context.

BRAVO SIX ADVISORY online