Part I — Situation overview

On Monday, 19 October, a court in Sofia issued a European arrest warrant for two 19-year-old German citizens. According to the prosecution, on the evening of 9 October they set fire to part of a Starlink antenna park standing in hilly terrain south of Sofia. Of the 18 antennas, three were completely destroyed, two partly burnt and a further three damaged. According to the charges, the suspects arrived from Serbia in a car with German plates, posed as tourists and spent only a few hours in the country. Plamen Tonchev, head of the Bulgarian State Agency for National Security (DANS), considers it deliberate sabotage and does not rule out further actions (Deutsche Welle, DW). Starlink is the satellite internet service of the American company SpaceX, which is connected to the network through ground stations. A week earlier, four people were detained in Germany over the sabotage at the end of September of a Starlink station in central Poland. According to the Polish internal security service, Russia had cooperated with organised criminal groups in Germany; Polish Prime Minister Donald Tusk called the incident hybrid warfare (DW). On Sunday, 18 October, the Lithuanian prime minister said that Russia may be behind an attempted arson against a Lithuanian company operating Starlink hardware (Euractiv, DW).

On the same Sunday, a hijacked Ukrainian drone exploded in Lithuania and hit a moving car. According to Lithuanian Prime Minister Mindaugas Sinkevičius, there is no doubt that it came from the direction of Poland. According to the Polish Ministry of Defence, its radars did not confirm the border crossing (Notes from Poland, Telex). According to Telex, the system did not automatically flag the drone as a threat precisely because it came from within the Schengen area. On Monday morning, NATO fighter jets again took off from Šiauliai air base because of an unidentified object. MIAK’s analysis yesterday examined the drone incident from the angle of NATO planning, and its analysis of 18 October from the angle of dependency on satellite providers. On 25 September it called for a register of hybrid incidents. These are not repeated here.

MIAK’s reading: three countries, four weeks, the same type of target. The pattern targets not military but civilian ground infrastructure, and it works with cheap, disposable perpetrators. The key to defence is therefore not air defence, but three less spectacular things. The state has to know what it is protecting. Cases far apart from one another have to be connected. And the path of recruitment has to be closed off.

Part II — Grounding in the literature

Three sources provide the interpretive framework. The European Union’s cybersecurity directive, NIS2 (Directive (EU) 2022/2555, which sets a common EU level for the protection of network and information systems), does not apply only to cyberattacks. It explicitly requires the protection of the physical environment of systems as well, for example against fire and unauthorised intrusion. Annex I of the directive lists the operators of ground-based infrastructure supporting satellite services as a separate sector. According to the European Union’s 2016 global strategy (Shared Vision, Common Action), terrorism, hybrid threats and organised crime know no borders. External action and internal security cooperation must therefore be linked more closely. In The Art of War, Sun Tzu (Chinese commander and strategist of the 6th–5th century BC) describes, among the five kinds of spies, the expendable spy. His principal deliberately gives him away, and even his exposure serves the principal’s aims. The detailed discussion of the literature — author by author — is in section 6.4 Literature in detail.

Part III — MIAK’s concrete proposal

MIAK proposes three measurable measures. The first makes visible what the state is protecting. The second serves to connect scattered cases. The third serves to prevent recruitment. They build on the earlier analyses’ proposals calling for counter-drone defence, an incident register and a dependency inventory, but do not repeat them.

3.1 A public summary of which Hungarian satellite and telecommunications facilities are under the protection applying to critical entities (by 31 December 2026)

Sector 11 (Space) of Annex I of the NIS2 Directive explicitly lists the operators of ground-based infrastructure supporting satellite services (see 6.4.1). The EU directive on the resilience of critical entities (the CER Directive, Directive (EU) 2022/2557) in turn sets out obligations concerning physical protection. Together, the two rules apply precisely to the type of facility that was attacked in Poland, Bulgaria and Lithuania. It is not publicly known how many such facilities operate in Hungary, or which of them have been placed in the circle of special protection. MIAK proposes that the Government publish an unclassified summary by 31 December, in a joint report of the authorities responsible for designating critical entities and for cybersecurity supervision. It should show, sector by sector, the number of designated critical and essential entities, separately for the space and the telecommunications sectors. It should also show how many operators’ risk assessments already include the scenario of deliberate physical damage. Finally, it should show how the two supervisory systems exchange information, as required by Article 13 of the NIS2 Directive. The list of sites may remain secret; the numbers and the gaps may not. The proposal of 25 September asked for physical sabotage to be included in risk assessments. This proposal makes it verifiable whether it has been included and whether it applies to the right entities. This is an application of D5 cybersecurity strategy, D17 space and sovereign digital infrastructure and HV1 cyber-defence capacity development.

3.2 A joint sabotage analysis group with written rules on competences and a cross-border contact point (rules within 90 days, by 18 January 2027)

The three cases are linked by one pattern, but the investigations are led by three authorities in three countries. If a similar attack were to hit a civilian facility in Hungary, the criminal investigation would be the task of the police, under the direction of the Ministry of the Interior. Uncovering a foreign state principal is the task of the civilian national security services. The Military National Security Service belongs under the Ministry of Defence and is only involved if the target is a military user or a defence asset. The protection of airspace is the task of the Hungarian Defence Forces. MIAK proposes that the Government set down this division of labour in written rules within 90 days and set up a joint analysis group. Its task would be to compare cases: target type, modus operandi, recruitment channel, travel route. The rules should separately regulate cross-border contact. There should be a designated contact point towards the European Union Agency for Law Enforcement Cooperation (Europol) and the Agency for Criminal Justice Cooperation (Eurojust). The prosecution service and the investigating authority decide within their own competence on setting up a joint investigation team; the Government’s task is to provide the expert and financial background needed for this. The lesson of the Lithuanian drone belongs here too: the alert system did not automatically flag a threat arriving from a “friendly” direction. A sabotage team, too, may arrive from within the Schengen area, with German plates. The thesis of the EU global strategy (see 6.4.2) says precisely this: hybrid threats and organised crime know no borders, so the institutions of internal and external security must be linked. This is an application of HV7 societal defence resilience, the KB1 criminal data platform and KP17 issue-based EU coalition-building.

3.3 Prevention against “small jobs” taken on for money: a warning for young people and an anonymous reporting channel (within 60 days, by 19 December 2026)

The Bulgarian suspects are 19 years old. In the Polish case, according to the authorities, organised criminal groups were the intermediaries (DW). The principal thus risks none of its own people; the cost of exposure is borne by the perpetrator. The logic of Sun Tzu’s expendable spy (see 6.4.3) works like this today: the perpetrator’s exposure causes the principal hardly any harm. The cheapest point of defence is therefore recruitment. MIAK proposes that the crime prevention organisation of the police launch warning information within 60 days. It should be addressed to young adults, schools and parents. The message is simple: if someone on a messaging app offers money for photographing a facility, placing a package or a “simple” arson, that is a serious crime, and a foreign secret service may be behind it. There should also be an anonymous reporting channel, and the police should publish quarterly how many such reports have been received. The information should not cause panic and should not stigmatise groups. The aim is that the recruiter should find no uninformed applicants. This is an application of KB3 crime prevention impact assessment, HV11 strategic communication and information defence and HV7 societal defence resilience.

The three proposals are linked by one principle: a hybrid attack is cheap where the defender does not know what it is protecting, does not connect the signals and does not warn the public in time. The logic of the NIS2 Directive (see 6.4.1) treats cybersecurity and physical security as a single risk. MIAK’s proposals carry the same approach over into the division of labour between authorities and into public prevention.

Part IV — Expected effects and risks

Dimension Expected effect Risk
Public security Comparing cases makes faster detection and earlier warning possible The joint group may become yet another bureaucratic layer if it has no decision-making power and no deadlines
Critical infrastructure It becomes clear which satellite and telecommunications facilities have been left out of special protection An overly detailed version of the summary could also be read as a target list
Economy Operators can plan the costs of physical protection in time For smaller operators, guarding and surveillance may be a disproportionate burden
Society Young people recognise “small jobs” offered for money The warning may cause fear or cast suspicion on certain groups
International cooperation The designated contact point speeds up joint investigation with the Polish, Bulgarian and Lithuanian authorities National differences in competences may slow down cross-border data exchange

The most important question to weigh is the relationship between transparency and the protection of secrets. If the Government makes nothing public, it cannot be verified whether the EU obligations are being met. If it makes too much public, it may help the attacker. MIAK therefore asks only for aggregated numbers and gaps to be made public, and leaves the details to closed sessions of the parliamentary committees. The proposal becomes risky if the summary names sites or protective solutions.

The second dilemma concerns preventive information. A campaign that is too loud may cause panic and may also draw recruiters’ attention to a new target group. A campaign that is too quiet, however, is ineffective. The solution is targeted information spreading through school and family channels, and public tracking of the number of reports. This shows whether the warning is reaching its goal.

Part V — Measurability and summary

5.1 What is worth following? (suggested KPIs)

MIAK suggests the following key performance indicators (KPIs). These are suggested indicators, not government commitments.

  • A public summary of critical and essential entities by sector, separately for the space and the telecommunications sectors. Target: by 31 December 2026. It is worth following whether it states how many operators’ risk assessments include deliberate physical damage.
  • Written rules on competences and a functioning joint analysis group. Target: by 18 January 2027. It is worth following whether there is a designated Europol and Eurojust contact point, and whether an aggregated, unclassified annual report on the cases is prepared.
  • Preventive information launched and an anonymous reporting channel. Target: by 19 December 2026. It is worth following the number of reports published quarterly, and how many reports led to an investigation.
  • A briefing to the competent committees of the National Assembly in closed session. It is worth following whether it takes place in the first quarter of 2027.

5.2 Summary

MIAK’s request is addressed to the Government. It should publish how many facilities in the Hungarian satellite and telecommunications sector are under special protection, and where the gaps are. It should set down in writing which authority does what after a sabotage, and set up a joint analysis group with a cross-border contact point. And it should launch preventive information, so that young people recruited for money do not become the disposable tools of a foreign state.

Of MIAK’s foundational values, data-drivenness and accountability are affected here. Data-drivenness, because the pattern of hybrid attacks only becomes visible if cases far apart from one another are recorded and compared according to the same criteria. Accountability, because the fulfilment of EU protection obligations can only be verified if the Government reports on them at least in aggregated numbers.

Part VI — Reasoning and further sources

6.1 Press framing by spectrum

In the international public-service press, Deutsche Welle presented the Bulgarian case as a pattern, drawing a parallel with the Polish case. It highlighted the young age of the suspects, the entry from Serbia and the warning of the head of the Bulgarian internal security service. The BBC concentrated on the consequences for Ukraine: according to an adviser to Ukrainian President Volodymyr Zelensky, the Starlink and Starshield restrictions (Starshield is the military version of Starlink) are still in place, and Kyiv is already looking for alternative communication systems. Al Jazeera’s video summary highlighted the same strand, the disruptions to early warning.

In the regional press, Notes from Poland put the Lithuanian–Polish contradiction at the centre. It set side by side the Lithuanian government’s “there is no doubt” wording and the denial of the Polish Ministry of Defence. Euractiv’s Brussels newsletter (Rapporteur) put the Lithuanian prime minister’s accusation naming Russia in its headline (the article was not publicly downloadable). In the domestic press, Telex covered the Lithuanian drone incident, with an assessment by security policy expert Krisztián Jójárt. The paper also pointed out that the alert system did not automatically treat the drone arriving from the Schengen area as a threat. According to MIAK’s press monitors, the domestic papers did not list the Starlink sabotage cases among their featured topics on that day.

What the framings have in common is that each paper looked at the individual case from the perspective of its own country. The cross-border pattern — that the same type of target is being attacked in three countries within weeks — was made the axis of its article only by Deutsche Welle.

6.2 Facts and data

The timeline (according to the sources):

Date Event Source
End of September 2026 Sabotage against a Starlink station in central Poland; according to Warsaw, Russia was behind it DW
9 October 2026, evening Part of the Starlink antenna park south of Sofia is set on fire DW
12–16 October 2026 (“last week” according to DW) Four people are detained in Germany in the Polish case DW
18 October 2026 (Sunday) The Lithuanian prime minister names Russia as the likely principal behind an attempted arson against a company operating Starlink hardware; a hijacked Ukrainian drone explodes in Lithuania DW, Euractiv, Notes from Poland, Telex
19 October 2026 (Monday) A Sofia court issues a European arrest warrant for two 19-year-old German citizens; NATO fighter jets take off from Šiauliai because of an unidentified object DW, Notes from Poland

The figures of the Bulgarian sabotage:

Data Value Source
Number of antennas in the antenna park 18 DW (Bulgarian prosecution)
Completely destroyed 3 DW
Partly burnt 2 DW
Damaged 3 DW
Age of the suspects 19 years (two German citizens) DW
Detained in the Polish case 4 people (three men and one woman, in Germany) DW

Discrepancies between the sources:

Question Claim 1 Claim 2
Where did the drone in Lithuania come from? From the direction of Poland, “there is no doubt” (Lithuanian prime minister and defence minister; Telex, Notes from Poland) Polish radars did not confirm the border crossing (Polish Ministry of Defence); according to anonymous sources of a Polish television channel it was launched from Lithuanian territory, which the ministry firmly denied (Notes from Poland)
Who hijacked the drone? According to Ukraine, Russian electronic jamming (Ukrainian foreign ministry) the authorities have published no evidence (Telex)

The EU legal framework: sector 11 (Space) of Annex I of the NIS2 Directive lists the operators of ground-based infrastructure, owned by member states or private parties, that supports satellite services. Under Article 21 of the directive, risk-management measures must also extend to the physical environment of systems. Article 13 requires regular information exchange between the authorities responsible for cybersecurity and for critical entities, as well as cooperation with law enforcement authorities. Under the CER Directive, member states had to identify their critical entities by 17 July 2026. MIAK found no public data on how many entities Hungary has designated per sector.

6.3 Policy dimensions

  • Defence (programme points) — societal resilience against hybrid threats (programme point ID: HV7); defence capacity for critical infrastructure (programme point ID: HV1); preventive information and information defence (programme point ID: HV11);
  • Public security and law enforcement (programme points) — uniform recording and comparison of cases (programme point ID: KB1); measuring the effect of prevention (programme point ID: KB3);
  • Digitalisation and AI regulation (programme points) — implementation of the NIS2 Directive and physical security (programme point ID: D5); satellite ground infrastructure as sovereign digital infrastructure (programme point ID: D17);
  • Foreign policy (programme points) — EU channels of cross-border investigative cooperation (programme point ID: KP17).

6.4 Literature in detail

6.4.1 European Parliament and Council: NIS2 Directive

The preamble of Directive (EU) 2022/2555 starts from the premise that threats to network and information systems can have different origins. Risk management must therefore be based on an all-hazards approach that also protects the physical environment of systems. Recital (79) of the directive lists as examples, among others, theft, fire, flood, and cases of

“…unauthorised physical access to an essential or important entity’s information and information processing facilities…”

Article 21 makes this mandatory: risk-management measures must also extend to the physical environment of systems. Sector 11 (Space) of Annex I names the operators of ground-based infrastructure supporting satellite services, with the exception of providers of public electronic communications networks. Article 13, in turn, requires the authorities responsible for cybersecurity and for critical entities to exchange information regularly and to cooperate with law enforcement authorities.

The Bulgarian and Polish cases are exactly the situation described by the directive: physical intrusion and fire endanger the availability of the network service. The legal framework therefore exists. Proposal 3.1 asks for the outcome of Hungarian implementation to be publicly verifiable. Proposal 3.2 fills the cooperation obligation of Article 13 with organisational content.

📖 Source: European Parliament and Council: Directive (EU) 2022/2555 (NIS2) on measures for a high common level of cybersecurity across the Union (2022), recital (79), Articles 13 and 21, Annex I

6.4.2 European Union: Shared Vision, Common Action

The Union’s 2016 global strategy does not separate security challenges into internal and external matters. According to a later chapter of the strategy, in terms of security “terrorism, hybrid threats and organised crime know no borders”. From this the strategy draws the conclusion that the institutions of external action and of the internal area of freedom, security and justice must be linked more closely. Joint Council meetings and joint working groups are needed. Elsewhere, the strategy names security of supply and the protection of critical infrastructure as conditions of rapid recovery after attacks.

The Starlink sabotage cases are textbook examples of this thesis. A state principal attacks through organised criminal intermediaries, with citizens of a third country, entering from a fourth country. No single national authority sees the whole picture. The joint analysis group and the cross-border contact point of proposal 3.2 translate this strategic principle into Hungarian organisational practice.

📖 Source: European Union: Shared Vision, Common Action: A Stronger Europe — A Global Strategy for the European Union’s Foreign and Security Policy (2016)

6.4.3 Sun Tzu: The Art of War

In the closing chapter on spies, Sun Tzu distinguishes five kinds of spies: the local, the inward, the converted, the expendable and the surviving. The expendable spy is the one whom his principal sends out with false information, and whose exposure also serves the principal’s purpose. According to Sun Tzu, relations with spies are the commander’s most secret affair, and the use of spies is indispensable. (The rights status of the work’s Hungarian translation is still to be clarified, so only paraphrase is used here.)

The perpetrators of today’s sabotage are modern versions of the expendable spy, with one essential difference. They do not carry false information; they protect the principal’s anonymity. If they are caught, the investigation reaches the intermediary, at best the organised criminal group, but rarely the state principal. It follows that catching the perpetrators does not in itself reduce the risk, because the principal recruits new ones. Proposal 3.3 therefore focuses on the moment of recruitment. If potential applicants recognise the offer, it becomes ever more expensive for the principal to find disposable perpetrators.

📖 Source: Sun Tzu: A háború művészete (The Art of War), Chapter XIII (on the use of spies)

6.5 International comparison

The closest examples are the affected countries themselves. In Bulgaria, the court is requesting the surrender of the suspects from Germany by means of the European arrest warrant, that is, the simplified surrender procedure between EU member states. In Poland, the investigation has already led to Germany, where the German police detained the suspects (DW). The two cases show that the investigation is cross-border from the outset. A country that has no designated contact point and no division of labour set down in advance joins in more slowly.

The example of Lithuania warns of a blind spot in the alert system. According to Telex, the system did not automatically flag the drone because it arrived from an allied country, from within the Schengen area. The Polish and Lithuanian authorities subsequently published publicly contradictory data (Notes from Poland). According to Notes from Poland, in March and May several Ukrainian drones also strayed into the airspace of Lithuania, Latvia, Estonia and Finland, probably because of Russian jamming. The lesson for Hungary is that a threat arriving from a “friendly” direction must not be ruled out in advance, either in intelligence or in investigation. The Bulgarian suspects, too, arrived from Serbia, with the plates of an allied country.

Defence

  • HV1 — Cyber-defence capacity development
  • HV7 — Societal defence resilience
  • HV11 — Strategic communication and information defence

Public security and law enforcement

  • KB1 — Criminal data platform
  • KB3 — Crime prevention vs. punishment impact assessment

Digitalisation and AI regulation

  • D5 — Cybersecurity strategy
  • D17 — Space and sovereign digital infrastructure

Foreign policy

  • KP17 — Issue-based coalition-building in the EU

Proposed new programme point: Rules on competences against hybrid sabotage and prevention against recruitment: a division of labour set down in writing between the police, the civilian and military national security services and the Hungarian Defence Forces, with a joint analysis group, a cross-border contact point and preventive information for young people with measured impact — for the Public security and law enforcement area.

6.7 List of sources

International press sources (MIAK foreign press monitor, 20 October 2026 — topic 1):

Domestic press source (MIAK press monitor, 20 October 2026 — topic 3):

Knowledge base references (literature, legal sources):

  • 📖 European Parliament and Council: Directive (EU) 2022/2555 (NIS2) (2022)
  • 📖 European Union: Shared Vision, Common Action — A Global Strategy for the European Union’s Foreign and Security Policy (2016)
  • 📖 Sun Tzu: A háború művészete (The Art of War)

MIAK internal materials:

  • MIAK policy area: Defence (programme points; programme point ID: HV1, HV7, HV11)
  • MIAK policy area: Public security and law enforcement (programme points; programme point ID: KB1, KB3)
  • MIAK policy area: Digitalisation and AI regulation (programme points; programme point ID: D5, D17)
  • MIAK policy area: Foreign policy (programme points; programme point ID: KP17)
  • MIAK foreign press monitor, 20 October 2026 — topic 1, score: 87/100

Supplementary public data sources:

  • Directive (EU) 2022/2557 on the resilience of critical entities (CER Directive)

Generation metadata