CRG-INT-NOTE-0925/10: Nordic Drone Incursions
23/09/25 18:58
CRG-INT-NOTE-0925/10: Nordic Drone Incursions — CPH/OSL, 22 Sep 2025
Subject: Coordinated drone activity over Copenhagen and Oslo airports
Date: 23 Sept 2025
Prepared by: Condor Research Group (CRG) - Nordic Node
Audit Sources: Reuters; AP; VG/Dagbladet (NO); Aftenposten (NO); EBU/Eurovision News Spotlight; The War Zone; Guardian live; Flightradar24; The National (UAE), BT (DK), Ekstra Bladet (DK). Inline citations at end.
Extract:
Multiple large UAVs operated for hours inside/near restricted airspace over Copenhagen Airport (CPH) and Oslo Airport (OSL), forcing sustained airspace closures, mass diversions, and nationwide political response. Danish police assessed a “capable operator”; prime minister labeled it the most serious attack on Danish critical infrastructure to date. Link to Russia not proven; Kremlin denies. Arrests in Oslo (two Singaporean tourists) appear unrelated to the airport incident.
Zulu Timeline (22–23 Sep 2025)
- 18:26Z (22 Sep) — CPH halts take-offs/landings after 2–3 large drones reported.
- ~22:25–22:30Z (23 Sep 00:25–00:30 local) — CPH reopens; disruption persists.
- ~22:00–22:30Z — OSL closes airspace after drone sighting(s); initial operations consolidated to one runway before full closure.
- 01:22–03:00Z — OSL reopens (sources differ: 01:22Z per Avinor; 01:00Z–01:30Z window in press; reopened “03:00 local” seen in NO press).
- 05:00Z (23 Sep) — CPH police/Naviair 07:00 local briefing: “capable actor”; drones’ behavior deliberate.
Factual Summary:
Drone Types:
- Described as “large” drones; video verified by EBU shows airborne object with flashing green light over CPH consistent with a drone (not a conventional aircraft nav light pattern). Exact model/config unknown.
Number of Drones:
- CPH: police/public statements vary between 2–3 (sometimes 3–4); NATO SG referenced “three big drones.”
- OSL: at least one drone; multiple observations triggered full closure.
Estimated Operation/Launch Range (analytic):
- Flight behavior (multi-hour presence, lights toggled, approached from multiple directions) implies BVLOS control and rotation of airframes. Danish police consider ship-based launch from Øresund/Baltic plausible.
Assessment: control/launch radius 5–30 km from CPH (shore or vessel), consistent with heavy multirotor/fixed-wing hybrids operated in relays. (Hypothesis, not confirmed.)
People Involved / Arrests:
- Oslo: two Singaporean nationals arrested in central Oslo for illegal drone flights over Akershus Fortress around 19:00Z; police indicate no link to OSL incident (Akershus ≈40 km from OSL).
- CPH: no arrests announced as of press time.
Response from Authorities:
- Airspace closures: CPH ~4 hours; OSL ~3 hours.
- Police & PET (DK) on-site, with Danish Armed Forces assisting investigation; police call it a “capable operator” event.
- Diversions/cancellations (Flightradar24): CPH 51 diverted / 109 cancelled; OSL 11 diverted / 19 cancelled.
- Authorities did not shoot down any drones (risk to people/structures; drones later vanished).
Government Measures / Political Actions:
- DK PM Frederiksen: event = “most serious attack” on critical infrastructure; cannot rule out Russia.
- Confidential briefing convened for all Danish party leaders with police/PET leadership.
- EU/NATO statements: pattern consistent with recent Russian airspace violations (Poland/Romania/Estonia); deterrence posture reaffirmed.
- Context: Denmark already pursuing legislation to authorize shoot-down at critical infrastructure (pre-incident policy track).
Drones Neutralized / Taken Down:
- Zero confirmed shoot-downs or recoveries tied to the airport incidents. (Norwegian media reported a seized drone near OSL; airport/officials later disputed linkage.)
Foreign States Possibly Involved:
- Russia: not proven; DK PM and EU officials do not rule out; Zelensky publicly blamed Russia; Kremlin (Peskov) denies.
- Current status: attribution unresolved.
Other Relevant Signals:
- Maritime angle: Danish media/police considering launch from one or more vessels; three vessels reportedly under scrutiny (TV 2 reports relayed via EBU/Airlive).
- Spillover reports: Same evening, Malmö/Skåne residents reported drones; Swedish police opened inquiries; no confirmations.
- Cumulative stressor: Incident followed major airport IT outage days earlier (Collins Aerospace), compounding Nordic/European aviation fragility.
Assessment (CRG):
- Operator Profile: Disciplined capable actor using multi-airframe rotation and procedural discipline (lights, altitude, vectoring) to hold airport at risk without kinetic effects. This is classic hybrid signaling: showcase access, impose costs, avoid signatures.
- Launch Mode: Maritime-based C2/launch is the primary hypothesis for CPH (Øresund/Baltic), enabling rapid exfil and jurisdictional fog. Land-based launch can’t be excluded.
- Attribution: Pattern aligns with recent Russian airspace probes and drone intrusions region-wide; however, no evidentiary chain (airframe, telemetry, EW, debris) is public. Working judgement: State-enabled operation > sophisticated non-state. Maintain “suspected state actor” as analytic label, not fact claim.
- Effect: Operational paralysis at two Nordic hubs; 20k+ pax affected; escalates political risk and public tolerance for C-UAS rules of engagement (ROE) near dense urban nodes.
Directive:
- Treat airport-adjacent “large drone” sightings in the Nordics as strategic IO + capability probe, not hobbyist noise.
- Do not overweight unrelated arrests (Oslo city center) in attribution chains. Keep airport incidents analytically siloed until forensics bridge them.
- Preserve analysis–opinion firewall; cite only verifiable operational data points.
- Treat forthcoming forensic signals (RF intercepts, radar tracks, maritime AIS gaps, EO/IR captures) as decisive for attribution. Until then: discipline > drama.
Margin note:
"When airspace is closed by objects that never touch the ground, the objective isn’t damage — it’s obedience."
Media Sources:
Reuters CPH reopen/start times, police “capable operator”
AP briefing/PET presence & “most serious attack” framing
EBU fact-check (video verified; ship-based hypothesis; OSL closure/reopen Zulu)
VG/Dagbladet OSL minute-by-minute (00:30–03:00 local)
Aftenposten arrests (Singaporean)
Sol.no police log time (“litt over kl. 21”)
TWZ (NATO SG “three big drones”; EU/NATO context)
Guardian live (party leaders briefed; Russia not ruled out; Kremlin denial relayed)
The National (12:25 a.m. local reopening ref)
Flightradar24 diversion/cancellation counts
Airlive/TV2 vessels under investigation (indicative)
The Local DK (pre-existing shoot-down law track)
Subject: Coordinated drone activity over Copenhagen and Oslo airports
Date: 23 Sept 2025
Prepared by: Condor Research Group (CRG) - Nordic Node
Audit Sources: Reuters; AP; VG/Dagbladet (NO); Aftenposten (NO); EBU/Eurovision News Spotlight; The War Zone; Guardian live; Flightradar24; The National (UAE), BT (DK), Ekstra Bladet (DK). Inline citations at end.
Extract:
Multiple large UAVs operated for hours inside/near restricted airspace over Copenhagen Airport (CPH) and Oslo Airport (OSL), forcing sustained airspace closures, mass diversions, and nationwide political response. Danish police assessed a “capable operator”; prime minister labeled it the most serious attack on Danish critical infrastructure to date. Link to Russia not proven; Kremlin denies. Arrests in Oslo (two Singaporean tourists) appear unrelated to the airport incident.
Zulu Timeline (22–23 Sep 2025)
- 18:26Z (22 Sep) — CPH halts take-offs/landings after 2–3 large drones reported.
- ~22:25–22:30Z (23 Sep 00:25–00:30 local) — CPH reopens; disruption persists.
- ~22:00–22:30Z — OSL closes airspace after drone sighting(s); initial operations consolidated to one runway before full closure.
- 01:22–03:00Z — OSL reopens (sources differ: 01:22Z per Avinor; 01:00Z–01:30Z window in press; reopened “03:00 local” seen in NO press).
- 05:00Z (23 Sep) — CPH police/Naviair 07:00 local briefing: “capable actor”; drones’ behavior deliberate.
Factual Summary:
Drone Types:
- Described as “large” drones; video verified by EBU shows airborne object with flashing green light over CPH consistent with a drone (not a conventional aircraft nav light pattern). Exact model/config unknown.
Number of Drones:
- CPH: police/public statements vary between 2–3 (sometimes 3–4); NATO SG referenced “three big drones.”
- OSL: at least one drone; multiple observations triggered full closure.
Estimated Operation/Launch Range (analytic):
- Flight behavior (multi-hour presence, lights toggled, approached from multiple directions) implies BVLOS control and rotation of airframes. Danish police consider ship-based launch from Øresund/Baltic plausible.
Assessment: control/launch radius 5–30 km from CPH (shore or vessel), consistent with heavy multirotor/fixed-wing hybrids operated in relays. (Hypothesis, not confirmed.)
People Involved / Arrests:
- Oslo: two Singaporean nationals arrested in central Oslo for illegal drone flights over Akershus Fortress around 19:00Z; police indicate no link to OSL incident (Akershus ≈40 km from OSL).
- CPH: no arrests announced as of press time.
Response from Authorities:
- Airspace closures: CPH ~4 hours; OSL ~3 hours.
- Police & PET (DK) on-site, with Danish Armed Forces assisting investigation; police call it a “capable operator” event.
- Diversions/cancellations (Flightradar24): CPH 51 diverted / 109 cancelled; OSL 11 diverted / 19 cancelled.
- Authorities did not shoot down any drones (risk to people/structures; drones later vanished).
Government Measures / Political Actions:
- DK PM Frederiksen: event = “most serious attack” on critical infrastructure; cannot rule out Russia.
- Confidential briefing convened for all Danish party leaders with police/PET leadership.
- EU/NATO statements: pattern consistent with recent Russian airspace violations (Poland/Romania/Estonia); deterrence posture reaffirmed.
- Context: Denmark already pursuing legislation to authorize shoot-down at critical infrastructure (pre-incident policy track).
Drones Neutralized / Taken Down:
- Zero confirmed shoot-downs or recoveries tied to the airport incidents. (Norwegian media reported a seized drone near OSL; airport/officials later disputed linkage.)
Foreign States Possibly Involved:
- Russia: not proven; DK PM and EU officials do not rule out; Zelensky publicly blamed Russia; Kremlin (Peskov) denies.
- Current status: attribution unresolved.
Other Relevant Signals:
- Maritime angle: Danish media/police considering launch from one or more vessels; three vessels reportedly under scrutiny (TV 2 reports relayed via EBU/Airlive).
- Spillover reports: Same evening, Malmö/Skåne residents reported drones; Swedish police opened inquiries; no confirmations.
- Cumulative stressor: Incident followed major airport IT outage days earlier (Collins Aerospace), compounding Nordic/European aviation fragility.
Assessment (CRG):
- Operator Profile: Disciplined capable actor using multi-airframe rotation and procedural discipline (lights, altitude, vectoring) to hold airport at risk without kinetic effects. This is classic hybrid signaling: showcase access, impose costs, avoid signatures.
- Launch Mode: Maritime-based C2/launch is the primary hypothesis for CPH (Øresund/Baltic), enabling rapid exfil and jurisdictional fog. Land-based launch can’t be excluded.
- Attribution: Pattern aligns with recent Russian airspace probes and drone intrusions region-wide; however, no evidentiary chain (airframe, telemetry, EW, debris) is public. Working judgement: State-enabled operation > sophisticated non-state. Maintain “suspected state actor” as analytic label, not fact claim.
- Effect: Operational paralysis at two Nordic hubs; 20k+ pax affected; escalates political risk and public tolerance for C-UAS rules of engagement (ROE) near dense urban nodes.
Directive:
- Treat airport-adjacent “large drone” sightings in the Nordics as strategic IO + capability probe, not hobbyist noise.
- Do not overweight unrelated arrests (Oslo city center) in attribution chains. Keep airport incidents analytically siloed until forensics bridge them.
- Preserve analysis–opinion firewall; cite only verifiable operational data points.
- Treat forthcoming forensic signals (RF intercepts, radar tracks, maritime AIS gaps, EO/IR captures) as decisive for attribution. Until then: discipline > drama.
Margin note:
"When airspace is closed by objects that never touch the ground, the objective isn’t damage — it’s obedience."
Media Sources:
Reuters CPH reopen/start times, police “capable operator”
AP briefing/PET presence & “most serious attack” framing
EBU fact-check (video verified; ship-based hypothesis; OSL closure/reopen Zulu)
VG/Dagbladet OSL minute-by-minute (00:30–03:00 local)
Aftenposten arrests (Singaporean)
Sol.no police log time (“litt over kl. 21”)
TWZ (NATO SG “three big drones”; EU/NATO context)
Guardian live (party leaders briefed; Russia not ruled out; Kremlin denial relayed)
The National (12:25 a.m. local reopening ref)
Flightradar24 diversion/cancellation counts
Airlive/TV2 vessels under investigation (indicative)
The Local DK (pre-existing shoot-down law track)