MApN publishes aggregates and technical findings. SRI publishes a sabotage case and an associated information layer.
THE STAKE
What connects these episodes?
The sources do not place every event inside one operation. They show something more concrete. Romania receives signals, fragments, investigations, breaches, and false narratives. Each one calls for different evidence and a different response.
The link on this page is the response work. It does not prove that one episode caused another.
Each card names the institution or speaker making the attribution. The exact wording matters.
This selection does not prove one command structure, one shared intensity, or a direct link between every episode.
01 / FIVE REGISTERS
The same territory. Five kinds of trace.
The five bands track different kinds of evidence. An episode can have a physical object, an institutional attribution, and a public explanation. They are different things.
01AIRSPACE
Airspace
Drones, fragments, tracked targets, and air-policing missions.
02ELECTROMAGNETIC
GPS signals
GPS jamming and the risk it can create for ships.
03COVERT ACTION
Covert action
Recruitment, encrypted instructions, and an investigation.
04CYBER
Digital infrastructure
Compromised routers, passwords, tokens, and critical infrastructure.
05INFORMATION
Public narrative
A photograph, a false caption, and a story that changes.
Each band starts with a different kind of evidence.
Six episodes, five public sources.
02 / CHRONOLOGICAL THREAD
Windows can align. Events stay separate.
Choose a year. The filter hides older cards. Relationship labels show what the source connects and where it leaves a gap.
29 September 2023ELECTROMAGNETIC
REPORTED RELATION
Reported GPS interference
European Pravda reported the Chief of Defence's statement about repeated Russian jamming in Romanian territorial waters.
OBSERVED
The article describes repeated interference and a collision risk for ships.
ATTRIBUTED
The statement, as reported, attributes the jamming to Russia.
PUBLIC RESPONSE
The public record contains an operational risk statement. The source gives no fragment count.
30 July 2024COVERT ACTION
LEGAL PATH
The Bragadiru case: a disrupted operation
SRI says it identified and detained a Colombian national. DIICOT referred him for trial under an accusation involving actions against the constitutional order.
OBSERVED
SRI describes recruitment through an online intermediary, prepaid travel, and encrypted communication.
ATTRIBUTED
SRI describes the operation as Russian-instrumented. The public legal status is a trial referral, not a final conviction.
PUBLIC RESPONSE
The 17 January 2025 release states what SRI says it found and gives the case's public legal status.
17 January 2025INFORMATION
PAIRED CASE
The same image, another caption
SRI says photographs and videos prepared for a false narrative were later used to present a separate accidental fire as proof of the sabotage.
OBSERVED
The account describes two distinct events: the alleged sabotage attempt and the accidental Bragadiru fire.
ATTRIBUTED
SRI attributes the false-narrative layer to a Russian information operation.
PUBLIC RESPONSE
The release separates the physical event from the later caption.
8 April 2026CYBER
SEPARATE EPISODE
Operation Masquerade
An SRI statement, republished by Agerpres, describes compromised routers and the collection of passwords, tokens, and sensitive data.
OBSERVED
SRI and Cyberint describe access to routers and data collection from Romanian entities, including critical infrastructure.
ATTRIBUTED
The statement attributes the operation to APT28, also called Fancy Bear, and the GRU.
PUBLIC RESPONSE
The institutions publish the operation name, the attribution, and the effects they describe.
29 May 2026AIRSPACE
EXPLICIT SOURCE LINK
Galați: a Geran-2 drone
MApN describes a Russian-made drone with a KOMETA GNSS system and an estimated 30 kg explosive charge.
OBSERVED
At 01:46, the target had been identified in Ukrainian airspace, about 19 km from Romania's border.
ATTRIBUTED
MApN says the evidence was structurally and functionally identical to elements from incidents previously attributed to Russia.
PUBLIC RESPONSE
The 31 May release publishes a technical reconstruction two days after the incident.
30 June 2026AIRSPACE
EXPLICIT SOURCE LINK
Rachelu and Luncavița: fragments at the border
MApN says it found drone fragments and an explosive charge after a Russian attack on Ukrainian port infrastructure.
OBSERVED
Fragments were found at Rachelu, with other elements at Luncavița in Tulcea county.
ATTRIBUTED
MApN gives the Russian attack on Ukrainian port infrastructure as the preliminary origin.
PUBLIC RESPONSE
The release adds MApN's counts. They include more than 100 attacks near the border, 29 incursions, and about 50 drone or fragment cases.
HOW TO READ THE LINKS
Explicit link: the source makes the connection. Paired case: the source separates two events and explains them together. Reported relation: the connection comes from a secondary source. Separate episode: the page leaves the link open.
explicitopen
03 / THE RESPONSE LINE
The hard part comes at the handoff.
These are questions for reading the page. They are not a threat score. They track what happens after the first signal and before a response becomes public.
01DETECTION
Where does the signal appear?
The first signal may be a radar return, a fragment, interference, or a technical alert.
02ASSESSMENT
What is documented?
A photograph, a technical finding, and an institutional account do not carry the same weight.
03ATTRIBUTION
Who says what, and on what basis?
Name the speaker, the evidence, and the exact wording of the source.
04EXPLANATION
What becomes public?
A release can connect facts, separate events, and correct a caption.
05DECISION
What response becomes possible?
The hard part comes when different data must become a public action.
EDITORIAL READINGThe numbers describe the cards on this page. They do not measure severity.
04 / PAIRED CASE
Bragadiru: two events, one caption
The SRI case follows a photograph from the alleged sabotage file to the false caption that appeared later. The interaction keeps the events separate and lights up only the caption layer.
Highlight the information link described by SRI.
A / SRI CASE
The attempt described by SRI
SRI says a Colombian national was recruited online, received encrypted instructions, and was detained on 30 July 2024. DIICOT referred him for trial.
PUBLIC STATUSInstitutional account and trial referral
B / SEPARATE EVENT
The accidental fire
SRI says the Bragadiru fire was a separate accidental event. Its images were later used as alleged proof of the attempt.
PUBLIC STATUSExplicit separation in the SRI source
THE CAPTION LAYERTHE CAPTION GIVES THE IMAGE A NEW ROLE
The later caption moved event B into the role of proof for event A. The source describes it as an information-operation layer.
The two plates remain two events. The caption is the third object. SRI, 17 January 2025
05 / PUBLIC TIME
One case can have two clocks
In the Galați case, MApN separates target identification from the publication of the technical finding. The two dates answer different questions.
INCIDENT MOMENT29 May 2026 / 01:46
The target was identified in Ukrainian airspace.
PUBLICATION MOMENT31 May 2026
MApN publishes the technical reconstruction.
The incident date and the release date answer different questions. MApN, Press Release No. 112
06 / EVIDENCE HANDOFF
From trace to response
Read each case in the same order. Record the event. Name the attribution. Then check what the institution put in public.
- 01Observe
What happened physically or technically?
- 02Attribute
Who makes the link, and what does the source say?
- 03Check the response
What became public, and what remains open?
07 / WHAT YOU TAKE WITH YOU
Keep the four questions.
Keep the six cards separate. Follow the handoff from a trace to a response.
- 01
What is the observable event?
- 02
What is the source for the attribution?
- 03
What public response exists?
- 04
Which relationship remains unknown?
This is a reading method. It is not a conclusion about every incident in the region.
08 / SOURCE ROOM
Start with the sources.
The page uses five public sources and six cards. When a source does not connect two cards, the page leaves the gap open.
The Rachelu and Luncavița release
30 June 2026. Aggregates and drone fragments.
Open sourceThe Galați technical finding
31 May 2026. Geran-2, KOMETA, and the identification timeline.
Open sourceThe disrupted sabotage operation
17 January 2025. Bragadiru, the attempt, and the information layer.
Open sourceThe SRI statement on Operation Masquerade
8 April 2026. APT28, compromised routers, and Romanian targets.
Open sourceThe reported GPS-jamming statement
29 September 2023. Statement attributed to the Chief of Defence.
Open sourceLIMIT
- The CRS R49134 report in the supplied brief is excluded. The link could not be independently verified during source review.
- GPS jamming appears as a reported statement, not as a MApN finding in this corpus.
- The Bragadiru trial referral is not a final conviction.
- There is no shared score for the five channels.
METHOD
I used Romanian institutional sources for the MApN and SRI episodes, a republication of an SRI statement for the cyber operation, and one secondary source for GPS. The page marks editorial synthesis separately and is current on 15 August 2026.
Accessed 15 August 2026.
If the legal status, attribution, or technical record changes, this page needs a new edition.