The EBU mapped Russia-linked incidents in Europe. Attribution still varies by case

What the newsrooms chose to count

The EBU's project announcement describes airspace incursions, sabotage, recruitment of expendable agents, instrumentalised migration and military activity. Spotlight's methodology focuses on physical acts or plots. It excludes cyberattacks, influence operations and espionage by trained spies. A reader cannot use this map to estimate all forms of Russian hybrid activity in Europe, because whole classes of conduct sit outside its stated boundary.

The EBU lists the participating public-service broadcasters, including newsrooms in Poland, the Baltic states, Finland and Germany. Its published roster names no partner newsroom based in Romania, Ukraine or Moldova. That fact says nothing by itself about whether those countries have incidents in the map. It does mean a regional newsroom's participation should not be assumed when interpreting how cases were collected. The index draws on public reports rather than an inventory supplied by every affected state.

Attribution is recorded, not settled by inclusion

Spotlight says it records the source and level of attribution to Russia. Its selection rule can include a case linked to Russia by an official statement or by news reporting. Those are useful leads, but their evidentiary weight depends on what the underlying source actually established. An official suspicion, an indictment and a court finding are different levels of proof. A pin on the same map does not make them equivalent.

Spotlight gives Moldova as an example: Defence Minister Anatolie Nosatîi said in late September that the government had recorded 84 drone incursions in 2026 and accused Russia of endangering citizens. Moldova's 84 drone incursions are a minister's 2026-to-date figure, not a count of EBU map entries. The map covers only 1 April to 15 October, and some points group multiple events. To assess Russian direction in any one flight, a reader would still need its dated track, the official incident record and the evidence behind the minister's attribution.

“Moldova's 84 drone incursions are a minister's 2026-to-date figure, not a count of EBU map entries.”

The count cannot be read as an escalation rate

The EBU announcement says 'hundreds' without a precise public event total. Some mapped pins can group several episodes, while incidents never reported publicly cannot appear. The published feature supplies no basis for an exact attack total, a national ranking or a month-by-month acceleration. A larger collection of reports can reflect broader newsroom coverage as well as a change in underlying activity.

An Associated Press investigation counted 145 cases from 2022 through 2025 under its own rule requiring Western-official links to Russia, proxies or Belarus. AP said its database was incomplete. Its period, threshold and categories differ from the EBU's six-month physical-incidents index, so putting the two totals side by side would not show a jump in attacks. Researchers at ETH Zurich's Center for Security Studies explain that geography, timeframe, categories and evidentiary thresholds change which cases enter a dataset.

NATO's October Bucharest meeting on Russian hybrid activities brought in Ukrainian and Moldovan experience alongside allies. Its agenda included cyber and infrastructure threats, a wider field than the EBU map. That difference gives the index a useful role: investigators can use its physical cases as leads while keeping other threat categories and case files separate. It does not turn the map into a complete measure of what the region faces.

The EBU has assembled public reports of physical incidents and shown who linked them to Russia. A case ledger with unique IDs, dates, original investigations and updated attribution status would let readers separate established Russian direction from reported links and count comparable events. Moldova's ministerial 2026-to-date tally illustrates the present gap: it cannot become a six-month map total without matching each recorded flight to a dated case. Later official findings could strengthen or reverse individual attributions. Only then could readers measure a trend among documented, consistently defined cases or count entries with verified Russian direction. Unreported incidents would remain outside the map.