Paris and Rome have denied receiving a reported CIA alert about sea-launched Russian drones. Their denials settle who was briefed. They leave open a harder question: whether Europe’s collective drone defence was designed to cover the Mediterranean at all, and the Union’s published plans do not answer it.

A small Russian drone, catapulted from a merchant vessel in international waters, needs between one and two hours to reach the coast of Spain, France or Italy. That is the scenario El Mundo set out on 23 September, citing a CIA assessment reportedly shared with European governments after Director John Ratcliffe’s visit to Moscow on 25 August. By the next day, Rome had publicly dismissed it and Paris had denied receiving it.

The reported drone threat to southern Europe deserves a harder reading than those denials allow. Whether the CIA briefed Paris is a question of intelligence plumbing. Whether European defences would detect a slow, low aircraft crossing from open water toward Valencia, Marseille or Naples is a question of architecture. The public record offers no reassuring answer, because the Union’s flagship counter-drone planning was drawn with the east in mind and none of its published milestones name a Mediterranean coastline.

A word on scope. This is an argument about the Union’s published planning. National air forces, navies and intelligence services keep their own operational picture, much of it classified, and nothing here claims to see inside it. The question is what the public record shows, and what it does not.

The Reported CIA Warning and the Denials in Paris and Rome

The Spanish account rests on an anonymous source close to Lithuania’s defence ministry. It names the Gerbera, a drone roughly two metres long, weighing about 18 kilograms, with a stated range of 600 kilometres. Its warhead is small. The purpose would be disruption: a closed airport, a fire at a fuel terminal, proof that Moscow can reach Europe’s rear without crossing a land border. The CIA has made no public comment.

Guido Crosetto, Italy’s defence minister, answered first. He wrote that the alarm served no one, lacked any confirmation, and that nobody needed more fuel on the fire. Emmanuel Macron followed on French television, and Reuters carried his words: the agency had not informed French services. In the same interview, however, the French president was asked whether an attack like the one on Leipzig/Halle airport in early August could happen in France. His answer was yes.

That second answer matters more than the first. A denial of receipt concerns a document. Macron’s own judgement concerns the drone threat to southern Europe itself, and it points the other way.

What the European Commission and the Capitals Have Said

The Commission took a different tone. Asked about the Spanish report at the midday briefing on 24 September, spokesperson Thomas Regnier said, according to EFE, that it came as no surprise at all, given repeated violations of Union airspace and hybrid attacks on many member states. He stressed that the Commission was aware of the reports, not of any specific alert. He pointed to the flagship drone defence, air shield and space shield initiatives, and added a point that matters for this argument: the matter falls to national authorities, although the Union has a long record of supporting member states in need.

Andrius Kubilius, the defence commissioner, had made a related point to a small group of European media, in remarks El Mundo carried alongside its story. Citing concern he had heard from Spanish members of the European Parliament, he said Russia could easily launch drones from ships or from the coast to disrupt airports and damage tourism, while placing the risk of a wider attack on a NATO country two or three years out. In Rome, the opposition Democratic Party’s Lia Quartapelle demanded that the government clarify what it was doing to protect the country. Madrid, whose airports Kubilius singled out, had made no public statement at the time of writing.

Two official statements predate the Spanish story and offer partial support for its premise. On 17 September, Donald Tusk told the Polish parliament that intelligence pointed to Russian plans for hybrid drone and missile strikes against countries supporting Ukraine, possibly disguised as accidents. A day later, Lithuania’s foreign minister, Kęstutis Budrys, said Vilnius held the same intelligence. Both warnings centred on the eastern flank, Poland in particular; neither named southern targets or a maritime method.

The Case for Official Silence

The denials have a serious defence. Russia’s hybrid campaign aims at nerves as much as at infrastructure. A single-sourced newspaper story, amplified by ministers, would hand Moscow the alarm it wants at almost no cost. Crosetto’s instinct to refuse the frame reflects sound crisis discipline. Governments also have good reason to protect liaison channels with Washington; acknowledging a CIA briefing, even implicitly, would burn a source relationship to win a news cycle.

A second argument is heard less often. Spain, France and Italy all hold national elections in 2027, and in each country political forces stand ready to capitalise on fatigue with the war in Ukraine. A government that looks frightened feeds them. Silence can be a form of resilience.

Both points are fair. Neither touches the question the report exposed.

Europe’s Drone Defence Plans and Their Eastern Axis

The Union’s collective answer to hostile drones, and so to any drone threat to southern Europe, sits in the Commission’s Defence Readiness Roadmap 2030. Two flagships lead it. The European Drone Defence Initiative was due to launch in the first quarter of 2026, reach initial capacity by the end of this year and become fully functional by the end of 2027. The Eastern Flank Watch trails it by a year. A European Parliament research briefing777962_EN.pdf) describes the latter as reinforcement of the Union’s eastern borders against threats from Russia and Belarus, integrating air defence, electronic warfare, surveillance and maritime security.

The geography was contested from the start. At the informal summit in Copenhagen in October 2025, Giorgia Meloni told reporters that the alliance’s borders were very extensive and that the southern flank must not be forgotten. Spain and Greece pressed the same point. Ursula von der Leyen later told the European Parliament that the Union needed a shield covering all of its territory, the south included, while naming the east as the priority.

A year on, the priority appears to have become the plan. The Eastern Flank Watch has a name, a timetable and a defined group of participating states. No southern counterpart appears in the roadmap. The Commission is right that two of the projects Regnier named are Union-wide by design: the Air Shield is meant to span the full air and missile defence spectrum, and the Drone Defence Initiative is open to every member state. Yet the roadmap attaches only a political endorsement milestone to the Air Shield, and the first technical meeting of the drone-wall effort that became the Initiative brought together the seven eastern frontline governments with Denmark, Ukraine and NATO. Participating states are still drafting national implementation plans, so a southern dimension may yet emerge. On the evidence published so far, though, southern capitals won the rhetorical argument for 360-degree coverage, while the programme’s most defined commitments still run along one axis. This week’s first official responses sit awkwardly beside that history. Rome and Paris addressed the Spanish report’s sourcing, not the coastal exposure it described, and Madrid has not yet addressed either.

The Drone Threat to Southern Europe Arrives by Sea

The eastern problem and the Mediterranean one differ in a way that matters for design. Nothing in the reported scenario crosses a frontier. The launch platform is a merchant ship, and the Mediterranean carries thousands of them on any given day.

Europe has seen a version of this before. In September 2025, drones shut Copenhagen airport and circled Danish military sites while the tanker Boracay, blacklisted by the Union as part of Russia’s shadow fleet, lay off the Danish coast. French naval commandos boarded the vessel days later. The proceedings that followed, according to AFP, concerned the crew’s refusal to cooperate and to prove the ship’s nationality, not the drones. Macron himself declined to connect the two. In February, the Swedish Armed Forces confirmed that a drone jammed near the French aircraft carrier Charles de Gaulle, docked in Malmö on the Öresund, had taken off from a Russian signals intelligence ship. And on 15 September, Italian fighters on NATO duty shot down a drone that had entered Lithuanian airspace from Belarus. President Gitanas Nausėda said it was a Gerbera-type drone, most likely bound for Ukraine and diverted by electronic warfare rather than aimed at Lithuania. Even so, the type named in the Spanish report is not hypothetical to Italian pilots.

The Boracay case suggests an uncomfortable question rather than settling it. The grounds France used to stop that vessel hinged on its flag and its crew’s conduct, and the Union’s flagship surveillance effort is organised around the eastern land border. National air forces and navies in Spain, France and Italy run their own coastal surveillance, and nothing in the public record shows how it would perform against a small, slow drone launched from a merchant hull. Would a merchant vessel with clean papers, sailing 250 kilometres off the Spanish coast, attract attention before launch? No published document answers that.

That unanswered question is the drone threat to southern Europe in practical form. It stands whether or not the CIA ever wrote the report the Spanish daily described.

What Madrid, Paris and Rome Should Ask of Brussels

Madrid, Paris and Rome can address the drone threat to southern Europe without verifying any intelligence product.

First, they should demand a southern tranche of the Drone Defence Initiative with milestones matching the eastern ones: named coastal sites, starting with the ports, liquefied natural gas terminals and airports that lie closest to open water, and initial capacity dates that do not lag the east by years. The Commission’s action plan on drone and counter-drone security already lists the funding routes, including the European Defence Industry Programme and SAFE loans. What the published documents do not yet show is a map with the Mediterranean on it.

Second, they should treat the launch hull as the perimeter. The Union keeps a growing list of sanctioned shadow-fleet tankers; national navies track traffic; port authorities inspect cargo. Those streams rarely meet. A shared maritime watch list linking sanctions designations, flag-change histories and port-state records would let a vessel that raised concern in the Baltic be followed once it enters the Mediterranean. The Union already runs EUNAVFOR MED Irini in the central Mediterranean, and its boarding experience could inform the rules.

Third, the capitals need a better public line than denial, not least because the Commission has now said plainly that first response is theirs. Ministers can decline to discuss intelligence while still stating what posture they have adopted. Announcing that coastal air surveillance has been reviewed, or that port operators have been briefed, reassures citizens without exposing a source. A flat “not confirmed” tells voters little and leaves the question of coastal preparedness unanswered in public. Every week of official silence leaves the drone threat to southern Europe framed by newspapers rather than by governments.

Spain’s position shows what is at stake. The Sánchez government has resisted NATO’s higher spending target, and analysts such as Keir Giles point to gaps in Spanish air and missile defence. Kubilius singled out Spanish airports this week, and they have already felt the nuisance version of the problem: on the evening of 27 October 2025, the airport operator Aena halted flights at Alicante-Elche for about two hours after a drone was detected near the runway, the Associated Press reported; no operator was identified at the time. Taken together, those facts suggest Madrid would gain as much as any capital from a southern tranche, and one financed partly through EU instruments would not require reopening the spending quarrel with Washington.

The El Mundo story may prove wrong in its details, and the CIA may never acknowledge it. None of that settles the question it raised. The Union’s flagship drone programme was designed around the direction from which Russia has already struck, and the south’s call for wider coverage has yet to appear, in the plans published so far, as a southern tranche with milestones of its own. Southern governments are the ones best placed to say whether their coasts are covered. The drone threat to southern Europe gives them reason to say so in public, before a ship and a container answer the question for them.