When Cyber Stops Being Cyber
Who owns the decision in a hybrid crisis? The August 2026 drone attack at Leipzig/Halle Airport shows why critical-infrastructure response becomes a governance problem when physical security, operations, law enforcement, intelligence and national security converge.
Late on August 4, an unknown airborne object was reported near Leipzig/Halle Airport. Flight operations were halted. Aircraft were diverted. Investigators then found a drone near the southern runway carrying professional explosives and a detonator.
Within days, the incident had moved beyond airport operations and local policing. Federal prosecutors took over the investigation. Germany's newly established Joint Centre for Countering Hybrid Threats became involved. The National Security Council convened. By September 1, the German government publicly attributed the attack to Russia and announced a national response.
The most useful question for leadership teams is not which function "owned" the incident. It is what happens to decision authority when the nature of the threat is still being determined and several organizations hold legitimate authority over different parts of the same event.
The hardest crises do not stay inside one function
The Leipzig/Halle incident began with an immediate aviation-safety decision: stop flight operations and protect the airport. It quickly became a criminal investigation, an explosives case, a critical-infrastructure security event, a counter-hybrid-threat matter and, eventually, a national-security and foreign-policy decision.
Germany's own guidance illustrates the authority complexity. Responsibility for responding to a drone can vary depending on where it appears, whether it is private or commercial, whether it can be attributed to a foreign state, and whether police or military assistance is required.
That is the governance challenge in a hybrid crisis. The organization cannot wait for the incident to fit neatly into one category before acting. But as the category changes, the people authorized to make consequential decisions may change too.
Leadership teams should therefore ask a more precise question than "Who owns the incident?"
Who owns which decision while we are still determining what kind of incident this is?
Hybrid threats create decisions before they create certainty
At approximately 11:40 p.m. on August 4, authorities reported an unknown airborne object near Leipzig/Halle Airport. Flight operations were stopped and several aircraft were diverted. A suspicious object was located near the southern runway and examined using an explosives robot.
The following day, investigators said a drone carrying an explosive device had been found in the secure cargo area. Federal prosecutors later said there were sufficient indications that an explosion had been intended and that a cargo aircraft had been forced to abort its approach.
None of those immediate operational decisions required officials to know who had launched the drone or why.
That distinction matters. Attribution can be essential to prosecution, national-security response and diplomacy. But aviation safety operates on a different clock. An airport cannot wait for intelligence agencies to establish attribution before deciding whether aircraft should continue landing.
A hybrid crisis may require protective action long before the organization can classify the threat with confidence. Decision authority should therefore distinguish between actions that require attribution and actions that can be triggered by consequence, credible threat or loss of operational safety.
Which protective decisions can your organization make based on consequence alone, and which require confirmation of cause or attribution?
Who owns the decision depends on what the threat becomes
Hybrid incidents complicate authority because the relevant decision-maker can change as the threat is understood.
German government guidance on drone defence makes this explicit. State authorities are generally responsible for dealing with private or commercial drones within their jurisdiction when those drones cannot clearly be attributed to a foreign state. The Federal Police has authority when drones are on or above federal railway facilities or airports. The armed forces can support police through administrative assistance and have separate responsibilities involving state or military drones, military self-protection and national defence.
That is not merely a jurisdictional detail. It demonstrates a larger governance principle.
The same physical object can create different authority pathways depending on location, attribution, intent and consequence.
The equivalent exists inside private organizations. A suspicious event may begin with Security, move to Operations, trigger Legal, involve executive leadership and require engagement with law enforcement or government agencies. The event is the same. The authority structure surrounding it is changing.
Authority models should be designed around decisions and thresholds, not only departmental ownership. When the facts change which authority applies, the handoff should be explicit: who retains authority, who gains authority, who must be consulted and who becomes accountable for the next decision.
What condition causes a security decision in your organization to become an operational, legal, executive or public-safety decision?
Critical-infrastructure response crosses organizational boundaries
Leipzig/Halle Airport is part of Germany's critical infrastructure. That immediately expands the response beyond the organization operating the facility.
Saxony's authorities said state and federal security agencies were working together from the night of the incident. The Joint Centre for Countering Hybrid Threats and Federal Police drone-defence capabilities were involved. On August 6, the Federal Prosecutor General took over the investigation because of the case's particular significance.
On August 7, Germany's National Security Council convened under the Chancellor to consider the incident. By September 1, after police investigations, intelligence assessments and examination of the attack pattern, the federal government said it had concluded that Russia was responsible.
Each step added a different authority domain: facility operations, aviation safety, policing, criminal prosecution, intelligence, national security and foreign policy.
Critical-infrastructure operators should expect the same basic pattern during a sufficiently serious incident. Their internal response may eventually intersect with regulators, law enforcement, emergency management, sector authorities, insurers, government security organizations and other external stakeholders.
A critical-infrastructure crisis is rarely governed entirely inside the organization experiencing it. Decision models should identify where internal authority ends, where external authority begins, what information triggers those handoffs and which internal executive remains accountable for organizational decisions after government authorities become involved.
When law enforcement, regulators or government security authorities enter your incident, which decisions remain yours and which no longer do?
Attribution and action run on different clocks
Germany did not publicly attribute the Leipzig/Halle attack to Russia on the night the drone was discovered. The federal government announced its conclusion on September 1, nearly four weeks later, after combining police investigations, intelligence findings and analysis of the attack pattern.
During those weeks, Germany still had to investigate, secure the airport, assess the broader threat and determine what additional protective measures were warranted.
The distinction is important for cyber incident response and physical security alike. Organizations often want certainty before making consequential decisions. In hybrid incidents, that certainty may arrive after operational decisions are already unavoidable.
This creates two decision tracks.
The first asks: what must we do now to protect people, operations and critical assets?
The second asks: what can we responsibly conclude about cause, intent and attribution, and what additional actions become appropriate once that conclusion is reached?
Treating those as the same decision can create delay where speed is needed or certainty where caution is required.
Organizations should define different evidence thresholds for different actions. Protective containment may require credible risk. Public attribution may require a far higher standard. The authority model should make those distinctions explicit before an incident forces leaders to negotiate them under pressure.
Does your crisis plan define what level of evidence is sufficient for operational action, executive escalation, public communication and external attribution?
Resilience means knowing how authority crosses the boundary
Germany's response to the Leipzig/Halle attack is occurring within a broader effort to strengthen critical-infrastructure protection against hybrid threats.
The federal government describes a threat environment that includes drone attacks, cyberattacks, sabotage, espionage and disinformation. Germany has created a Joint Centre for Countering Hybrid Threats, strengthened critical-infrastructure resilience requirements and is continuing work on legal and operational frameworks for drone detection and defence.
The implication for organizations is larger than drone defence.
Modern crises increasingly cross the boundaries leaders use to organize normal work. Cybersecurity, physical security, operations, legal, communications, government affairs and executive leadership may each own part of the problem without owning all of it.
Resilience therefore depends on more than having every function represented in the room. It depends on knowing how authority moves across those functions as the consequence changes.
Cross-functional crisis readiness should define authority transitions with the same discipline used to define technical escalation. When an incident crosses from cyber to physical, operational, legal or national-security consequences, leaders should know what changes in the decision model before the handoff is required.
If an incident stopped belonging to one function tomorrow, would everyone involved know how decision authority changes?
Hybrid crisis management requires an authority model that crosses functions
The Leipzig/Halle incident points to five capabilities organizations should pressure-test.
1. Separate consequence from attribution
Teams should know which protective actions can be taken because the consequence demands it, even when cause, intent or attribution remains unresolved.
2. Define authority transitions
Establish what changes when an incident crosses from cybersecurity into operations, physical security, legal exposure, public safety or another authority domain.
3. Map external authority
Know when regulators, law enforcement, emergency management or government security bodies acquire authority, and which decisions remain with the organization.
4. Set evidence thresholds by decision
The evidence required to isolate a system, stop an operation, notify leadership or publicly attribute an attack should not automatically be the same.
5. Exercise the handoffs
Tabletops should introduce ambiguity, cross-domain consequences and external authorities so leaders can test whether decision ownership remains clear as the crisis evolves.
Who owns the incident may be the wrong question
The Leipzig/Halle attack began with a practical safety problem: an unknown airborne object near an airport and a device carrying explosives. Flight operations had to be managed before authorities could know who was responsible or what larger threat the incident represented.
Over time, the event moved through several decision environments: aviation safety, criminal investigation, critical-infrastructure protection, hybrid-threat analysis, national security and foreign policy.
That is the challenge hybrid crises create for organizations. The incident may not belong to one function long enough for traditional ownership models to remain useful.
The better question is not "Who owns the incident?" It is "Who owns the next consequential decision, and what causes that authority to change?"
Your crisis plan may define functional roles. Does it define how authority moves when the crisis crosses those functions?
The Governance Continuity Assessment examines how decision authority, escalation, succession and cross-functional handoffs are designed to work when a cyber or operational crisis stops fitting neatly inside one team.
- Identify consequential decisions that cross Cybersecurity, Operations, Legal, Communications and executive leadership
- Clarify which thresholds change who has authority to act
- Surface dependencies on external authorities, regulators and law enforcement
- Examine what decisions can be made under uncertainty and which require higher evidentiary thresholds
- Identify authority handoffs that should be pressure-tested before a real incident forces them
Sources
- Police Directorate Leipzig, "Sichtung eines unbekannten Objektes am Flughafen," August 5, 2026. View source
- Saxon State Ministry of the Interior, "Innenminister Armin Schuster zu den Ereignissen am Flughafen Leipzig/Halle," August 5, 2026. View source
- Federal Prosecutor General, "Übernahme der Ermittlungen nach Drohnenfund am Flughafen Leipzig/Halle," August 6, 2026. View source
- German Federal Government, "Was tut die Bundesregierung gegen hybride Angriffe und Drohnenvorfälle?" August/September 2026. View source
- German Federal Government, "Entschlossenes Vorgehen gegen hybriden Angriff," September 4, 2026. View source
- German Federal Government, "Regierungspressekonferenz vom 2. September 2026," September 2, 2026. View source
- German Federal Government, "Stärkerer Schutz kritischer Infrastrukturen," September 2, 2026. View source
- Reuters, "Germany plans anti-sabotage shield after airport drone attack," September 6, 2026. View source
Source note: This case study is based on public statements from German federal and Saxon authorities, the Federal Prosecutor General, and Reuters reporting through September 8, 2026. The analysis focuses on what the publicly documented incident reveals about decision authority in hybrid crises. It does not assess the internal performance of Leipzig/Halle Airport, German authorities or any individual decision-maker.