By now there's a pattern. A Ukrainian long-range drone is launched at a Russian oil terminal on the Baltic coast. Russian electronic warfare activates. The drone ends up in Finland, or Latvia, or Lithuania — not Russia.
I've been tracking these incidents since March 2026. The Kouvola crash on 29 March. The Nautrēni shoot-down on 8 June. The Rēzekne strikes before that. The Estonia intercept in May. Each time, the technical explanation is the same: Russian EW jamming diverted the drone. What that means in practice, and what AirVeto's wind layer shows about the corridors involved, is worth explaining plainly.
How GPS jamming sends a drone to the wrong country
Modern long-range drones navigate primarily via GNSS — the global satellite navigation systems (GPS being the American one; GLONASS the Russian). A strike drone flying from Ukraine to Ust-Luga follows a preprogrammed route defined by GPS coordinates. If that signal is disrupted, the drone has a problem.
There are two distinct ways to disrupt it.
Jamming floods the radio environment with noise, overwhelming the drone's GNSS receiver. The drone loses satellite lock. If it has inertial navigation — dead reckoning from last known position — it falls back to that. But dead reckoning accumulates error over time and distance. Over the Gulf of Finland, accumulated error means dozens of kilometres of displacement.
Spoofing is more targeted. The attacker transmits fake GPS signals on the correct frequencies, feeding the drone false position data. The drone's autopilot believes it is somewhere it isn't. It "corrects" toward the false coordinates — flying toward Finland or Latvia rather than Russia — while the onboard system reports everything on track.
Russian forces have been deploying both capabilities. Finnish PM Petteri Orpo said publicly, after Kouvola, that "Russia has extremely strong electronic jamming capabilities, which could explain why these drones are drifting into Finnish airspace." Ukraine's Foreign Ministry attributed the Kouvola crossing directly to Russian EW interference, stating that "under no circumstances were any Ukrainian drones directed toward Finland."
Kouvola: two Chaika drones miss Ust-Luga, land in southeastern Finland
The 29 March 2026 incident is the clearest documented case of this mechanism. Ukraine launched a large strike overnight — over 345 drones — aimed at the Ust-Luga oil terminal on the southern shore of the Gulf of Finland in Russia's Leningrad region. Ust-Luga handles around 700,000 barrels of oil per day; sustained attacks in March 2026 reportedly took more than 40% of Russia's total oil export capacity temporarily offline, according to Bloomberg.
Two drones didn't reach Ust-Luga. They crossed the Gulf of Finland and came down in southeastern Finland: one north of Kouvola, on the Savistontie road near Oravala, and one near Luumäki in South Karelia. Finnish F/A-18 Hornets tracked them in. The Kouvola drone was carrying an unexploded warhead when it came down. Finnish authorities destroyed it in a controlled detonation at 20:15 local time that evening.
The Finnish Air Force initially identified the drones as AN-196 Liutyi — a large long-range attack drone. Finland's NBI later corrected this: they were Chaika decoys. The Chaika is a Ukrainian low-cost saturation drone with a 2.5 m wingspan, around $500 per unit, designed to overwhelm Russian air-defence radar and expose radar positions rather than strike targets directly.
That identification matters. A Chaika isn't navigating to a hardened target with precision sensors. It's an inexpensive decoy following a programmed route. When Russian EW broke that route over the Gulf of Finland, the drone had nowhere useful to go — and the wind carried it the rest of the way toward Kymenlaakso.
Nautrēni: the same mechanism, a different outcome
On 8 June 2026, NATO Baltic Air Policing jets — French Rafale B aircraft flying from Šiauliai Air Base in Lithuania — shot down a drone over Nautrēni Parish in eastern Latvia. Latvian and NATO authorities attributed the incursion to the same pattern: a Ukrainian drone launched against Russian infrastructure, diverted by Russian EW across the Latvian border.
This is Latvia's first aerial intercept. The backstory matters.
On 7 May, three drones had entered Latvian airspace and come down without being engaged. The Rēzekne / Viļāni strikes damaged an oil storage facility and triggered a political crisis that forced the resignation of Latvia's Defence Minister and then Prime Minister. After that, Latvia's new Defence Minister stated that drones entering Latvian airspace must be shot down. Nautrēni is the first time that policy was carried out.
The EW mechanism was identical to Kouvola. The outcome differed because NATO fighters were in position and the political threshold for engagement had changed.
Where the wind layer fits in
Here's where I need to be honest about what AirVeto's wind layer actually shows — because the honest version is more useful than the inflated one.
A powered military drone is not a balloon. It flies a programmed route at altitude under its own propulsion. Wind is not what's driving it. So for Kouvola and Nautrēni, the 900 hPa wind field shows regional weather context during the drone's final approach, not a trajectory reconstruction of the kind we run for contraband balloons drifting from Belarus.
But guidance failure changes that.
At the moment a drone's GNSS lock breaks, or a spoofed signal sends the autopilot in the wrong direction, the drone transitions from "guided system" to "object in an air mass." If the engine keeps running on a corrupted heading, the drone still feels the crosswind. If the engine cuts out — a terminal failure, or a warhead detonation that didn't reach its target — the drone becomes fully wind-dependent. At 1,000 m, the wind field is the difference between coming down in Kymenlaakso and coming down in the Gulf of Finland.
The drift path from Ust-Luga to Kouvola is more than 300 km. Guidance failure alone doesn't explain that displacement. The wind field over the gulf on the night of 29 March is part of the picture.
This is why AirVeto embeds the wind layer on every incident page, including the powered-drone events. Not to claim the wind carried the drone there. To show which corridors were active at altitude during the event window — because for EW-disrupted drones transitioning out of controlled flight, that corridor context is the closest useful approximation of a drift path we can provide.
For balloon events — contraband balloons from Belarus, meteorological balloons drifting into Lithuanian airspace — the wind reconstruction is direct. The balloon goes where the wind takes it. For EW-diverted drones, it's context. Both are documented in the archive at /incidents.
The pattern, as it stands
The March 2026 cluster established the mechanism: Varėna (Lithuania), Krāslava (Latvia), Auvere (Estonia), and Kouvola (Finland) all happened within a six-day window, all attributed to Russian EW interference during Ukrainian strike waves on Leningrad-region oil infrastructure. Wikipedia now has a named article for the cluster — "2026 Ukrainian drone incursions into the Baltic states." When something gets its own Wikipedia article, it has crossed the threshold from news story to documented event category.
Nautrēni in June shows the mechanism is ongoing.
What I find striking isn't that drones end up in NATO airspace. It's that Russia can predictably redirect Ukrainian drones into NATO territory — and that this mechanism is now publicly named by four Baltic governments, two NATO fighter rotations, and the Ukrainian Foreign Ministry in official statements. The capability isn't concealed. The incidents aren't ambiguous. The attribution is consistent, from all sides.
The question that matters for anyone using AirVeto's data — journalists, border-security analysts, defence planners — is this: given a known EW-diversion mechanism and a known set of Russian infrastructure targets on the Baltic coast, which corridors should be treated as active threat zones whenever a Ukrainian strike wave launches? The answer changes by altitude, by season, and by synoptic weather pattern. The live map shows current conditions. The incident archive documents where these corridors have already been.
That's the data. The conclusions are yours to draw.