Developing story
We are following this story for new developments and will update this article when significant news emerges.
Monitored since 15 November 2026 | no updates yet
Key takeaways
- Estonia will close all Russian border crossings from 1 December after a foiled arson attempt on drone maker Threod Systems.
- Estonia's security service says the GRU coordinated the attack. Eight Latvian residents were detained and no court has ruled.
- Analysis: the suspects were Latvian residents moving freely in Schengen, so the closure works more as signalling than a fix.
Estonia will close all of its border crossings with Russia from 1 December, Reuters reported, citing Foreign Minister Margus Tsahkna, who spoke on Sunday. The decision comes a day after intruders tried to set fire to a drone maker's premises north of Tallinn. Tsahkna said it followed what he called "clear evidence" that Russia's military intelligence service, the GRU, ordered the attack.
At 3.06 a.m. on Saturday, intruders tried to break into the premises of Threod Systems in Viimsi. The company makes long-range reconnaissance and attack drones. Margo Palloson, director general of the Internal Security Service (KAPO), said the aim was to break the windows and pour in flammable liquids. The attackers wanted to set the building on fire and cause an explosion. Prosecutor General Astrid Asi said Threod's own security team stopped the attack. No one was hurt, damage was limited, and production and deliveries were not affected. KAPO and the Police and Border Guard Board detained eight Latvian residents overnight. Prosecutors sought custody for five.
Attribution and the closure order
Latvia's State Security Service (VDD) gave KAPO "risk information" about possible sabotage plans on Friday and Saturday, and the two services launched joint activities, the VDD said on Sunday. On Saturday it searched nine sites in Latvia linked to the suspects. It seized explosive devices, pyrotechnic articles, ammunition and a large number of mobile phones and data storage devices.
KAPO says its counterintelligence work confirmed that Russia was behind the attack and that the GRU coordinated it. Palloson told Sunday's press conference that one GRU method is to recruit EU residents who can move freely in the Schengen Area, the EU's passport-free travel zone. He said the GRU looks for perpetrators in criminal circles and among people in difficult socioeconomic circumstances. This is an official allegation. The investigation continues and no court has ruled. Moscow did not comment immediately. Reuters reported that Moscow has regularly denied accusations by European authorities of involvement in sabotage operations.
Three crossings are open: Narva, Luhamaa and Koidula. They admit pedestrians and freight from 7 a.m. to 7 p.m. Interior Minister Igor Taro said he will propose closing all road crossing points to pedestrians and vehicles from the beginning of December. Estonian residents and truck drivers in Russia will have about two weeks to get home. The government will discuss in the coming days whether the closure is temporary or indefinite, Taro said.
Observers are reading: why the suspects' route through Schengen limits what a border closure can achieve, and how Tallinn's response compares with Berlin's.
Become an Observer, it's free. Get full access to all Crisis.Zone analysis, briefings and breaking coverage.
What happens next
Michal has convened the Security Cabinet for Friday to discuss the incident, the sabotage threat and next steps. The final government order had not been reported by Sunday. Taro said the government would discuss the closure proposal next week. Exemptions, and the effect on Estonian citizens and freight, were also unanswered.
Tsahkna said he had informed his Finnish, Latvian and Lithuanian counterparts of the decision. No reaction from them had been reported. Moscow had not responded either.
Michal called the attack "part of Russia's broader hybrid war against Europe" and said Estonia "will not be intimidated". The government said defence firms had received threat warnings and security recommendations before and after the Milrem fire, and that Threod followed them. "We do not warn about these threats without reason. Preparedness matters, and this time it clearly paid off," its statement read.
Become an Observer (it's free) to unlock direct links to all sources used in this article.
We believe you deserve to verify everything we write. That's why we meticulously document every source.
