By Ann Marie van den Hurk, Mind The Gap Advisory
In August, an unidentified object was spotted near Leipzig/Halle Airport in Germany. Flight operations stopped. Aircraft were diverted.
Investigators found a drone near the runway. It was carrying explosives and a detonator.
At that moment, this stopped being an airport security problem.
What happened at Leipzig/Halle
The incident opened as an aviation safety problem. Airport operations had to decide whether aircraft could land safely. Police took an immediate security role.
It didn’t stay there. Federal prosecutors became involved, opening a criminal investigation. Germany’s Joint Centre for Countering Hybrid Threats entered the picture. The National Security Council convened. In September, Germany’s Interior and Foreign Ministers formally attributed the attack to Russia, citing police investigation, pattern analysis, and intelligence findings. Russia has denied involvement.
Six authority domains, one incident
Aviation safety. Law enforcement. Criminal prosecution. Critical infrastructure protection. Intelligence. National security. Eventually, foreign policy. Each domain had a legitimate claim on the incident. None of them operated under the same rules as the one before it.
The people involved changed at every stage. So did the authority to decide.
Why “who owns the incident” is the wrong question
In a hybrid crisis, incident ownership doesn’t stay fixed. It moves as the incident changes shape, and the authority to decide moves with it.
Germany’s own drone defense guidance makes this explicit. Whether police or military authority applies depends on where the drone appears, what kind it is, and whether it can be tied to a foreign state. Same threat, different chain of command, depending on facts that may not be known yet.
Authority depends on context. And that context can still be forming while someone has to act.
Attribution and action do not run on the same clock
Germany did not publicly attribute the attack the night it happened. That conclusion came a month later. Flight operations still had to be managed that night. Protective action could not wait for certainty.
The same pattern holds in cyber incident response. An organization may not know exactly who is behind an attack, or the full scope, or the eventual legal implications, and may still need to isolate a system, change operations, notify leadership, or protect critical assets before any of that is known.
The decision model has to account for uncertainty
A plan that only knows how to act once attribution is confirmed will sit idle during the exact window when protective action matters most. Decision authority has to be designed to function without waiting for certainty.
The better question for leadership teams
Stop asking who owns the incident. Ask who owns the next consequential decision, and what causes that authority to change.
Who can stop operations? Who can restart them? Who can authorize protective action before attribution is known? Who decides when the issue moves beyond one function and becomes an executive-level crisis? And what happens when multiple functions all have a legitimate claim at the same time?
If your organization has to stop and negotiate those answers in a meeting every time the situation crosses a new threshold, that is a governance gap. Most organizations don’t find out where it sits until they’re already inside the incident.
If you want to find out before an incident forces the question
Governance Continuity Assessment
A 90-minute session that maps where decision authority, escalation, and cross-functional handoffs could break under pressure, with a written finding within 48 hours.
Ann Marie van den Hurk, MSc., APR is the founder of Mind The Gap Advisory and originator of the CrisisOS5™ Framework. She advises CISOs, General Counsel, Chief Risk Officers, and boards on decision authority and executive crisis readiness for the AI era. Based in Newport, Rhode Island — serving organizations in Providence, Boston, Portsmouth, Portland, and Hartford, and across New England, nationally, and globally. mindthegapcyber.com