# Five channels, one response line A drone, GPS interference, an investigation, compromised infrastructure, and a false caption reach the same response line. _Current as of 15 August 2026. Six episodes, five sources. Not a live feed._ ## What connects these episodes? The sources do not place every event inside one operation. They show something more concrete. Romania receives signals, fragments, investigations, breaches, and false narratives. Each one calls for different evidence and a different response. **DOCUMENTED.** MApN publishes aggregates and technical findings. SRI publishes a sabotage case and an associated information layer. **ATTRIBUTED.** Each card names the institution or speaker making the attribution. The exact wording matters. **LEFT OPEN.** This selection does not prove one command structure, one shared intensity, or a direct link between every episode. ## The same territory. Five kinds of trace. The five bands track different kinds of evidence. An episode can have a physical object, an institutional attribution, and a public explanation. They are different things. ### AIRSPACE / Airspace Drones, fragments, tracked targets, and air-policing missions. ### ELECTROMAGNETIC / GPS signals GPS jamming and the risk it can create for ships. ### COVERT ACTION / Covert action Recruitment, encrypted instructions, and an investigation. ### CYBER / Digital infrastructure Compromised routers, passwords, tokens, and critical infrastructure. ### INFORMATION / Public narrative A photograph, a false caption, and a story that changes. ## Windows can align. Events stay separate. Choose a year. The filter hides older cards. Relationship labels show what the source connects and where it leaves a gap. ### 29 September 2023 / ELECTROMAGNETIC **Reported GPS interference.** European Pravda reported the Chief of Defence's statement about repeated Russian jamming in Romanian territorial waters. - **OBSERVED.** The article describes repeated interference and a collision risk for ships. - **ATTRIBUTED.** The statement, as reported, attributes the jamming to Russia. - **PUBLIC RESPONSE.** The public record contains an operational risk statement. The source gives no fragment count. - **HOW TO READ THE LINKS.** REPORTED RELATION - **Source.** [SR-05: The reported GPS-jamming statement](https://www.pravda.com.ua/eng/news/2023/09/29/7422015/) ### 30 July 2024 / COVERT ACTION **The Bragadiru case: a disrupted operation.** SRI says it identified and detained a Colombian national. DIICOT referred him for trial under an accusation involving actions against the constitutional order. - **OBSERVED.** SRI describes recruitment through an online intermediary, prepaid travel, and encrypted communication. - **ATTRIBUTED.** SRI describes the operation as Russian-instrumented. The public legal status is a trial referral, not a final conviction. - **PUBLIC RESPONSE.** The 17 January 2025 release states what SRI says it found and gives the case's public legal status. - **HOW TO READ THE LINKS.** LEGAL PATH - **Source.** [SR-03: The disrupted sabotage operation](https://www.sri.ro/articole/SRI-a-dejucat-o-operatiune-de-sabotaj-instrumentata-de-Federatia-Rusa-pe-teritoriul-Romaniei.html) ### 17 January 2025 / INFORMATION **The same image, another caption.** SRI says photographs and videos prepared for a false narrative were later used to present a separate accidental fire as proof of the sabotage. - **OBSERVED.** The account describes two distinct events: the alleged sabotage attempt and the accidental Bragadiru fire. - **ATTRIBUTED.** SRI attributes the false-narrative layer to a Russian information operation. - **PUBLIC RESPONSE.** The release separates the physical event from the later caption. - **HOW TO READ THE LINKS.** PAIRED CASE - **Source.** [SR-03: The disrupted sabotage operation](https://www.sri.ro/articole/SRI-a-dejucat-o-operatiune-de-sabotaj-instrumentata-de-Federatia-Rusa-pe-teritoriul-Romaniei.html) ### 8 April 2026 / CYBER **Operation Masquerade.** An SRI statement, republished by Agerpres, describes compromised routers and the collection of passwords, tokens, and sensitive data. - **OBSERVED.** SRI and Cyberint describe access to routers and data collection from Romanian entities, including critical infrastructure. - **ATTRIBUTED.** The statement attributes the operation to APT28, also called Fancy Bear, and the GRU. - **PUBLIC RESPONSE.** The institutions publish the operation name, the attribution, and the effects they describe. - **HOW TO READ THE LINKS.** SEPARATE EPISODE - **Source.** [SR-04: The SRI statement on Operation Masquerade](https://agerpres.ro/comunicate/2026/04/08/comunicat-de-presa---serviciul-roman-de-informatii--1545445) ### 29 May 2026 / AIRSPACE **Galați: a Geran-2 drone.** MApN describes a Russian-made drone with a KOMETA GNSS system and an estimated 30 kg explosive charge. - **OBSERVED.** At 01:46, the target had been identified in Ukrainian airspace, about 19 km from Romania's border. - **ATTRIBUTED.** MApN says the evidence was structurally and functionally identical to elements from incidents previously attributed to Russia. - **PUBLIC RESPONSE.** The 31 May release publishes a technical reconstruction two days after the incident. - **HOW TO READ THE LINKS.** EXPLICIT SOURCE LINK - **Source.** [SR-02: The Galați technical finding](https://english.mapn.ro/cpresa/6786_Press-release) ### 30 June 2026 / AIRSPACE **Rachelu and Luncavița: fragments at the border.** MApN says it found drone fragments and an explosive charge after a Russian attack on Ukrainian port infrastructure. - **OBSERVED.** Fragments were found at Rachelu, with other elements at Luncavița in Tulcea county. - **ATTRIBUTED.** MApN gives the Russian attack on Ukrainian port infrastructure as the preliminary origin. - **PUBLIC RESPONSE.** The release adds MApN's counts. They include more than 100 attacks near the border, 29 incursions, and about 50 drone or fragment cases. - **HOW TO READ THE LINKS.** EXPLICIT SOURCE LINK - **Source.** [SR-01: The Rachelu and Luncavița release](https://english.mapn.ro/cpresa/6804_press-release) ## The hard part comes at the handoff. These are questions for reading the page. They are not a threat score. They track what happens after the first signal and before a response becomes public. ### DETECTION **Where does the signal appear?** The first signal may be a radar return, a fragment, interference, or a technical alert. ### ASSESSMENT **What is documented?** A photograph, a technical finding, and an institutional account do not carry the same weight. ### ATTRIBUTION **Who says what, and on what basis?** Name the speaker, the evidence, and the exact wording of the source. ### EXPLANATION **What becomes public?** A release can connect facts, separate events, and correct a caption. ### DECISION **What response becomes possible?** The hard part comes when different data must become a public action. ## Bragadiru: two events, one caption The SRI case follows a photograph from the alleged sabotage file to the false caption that appeared later. The interaction keeps the events separate and lights up only the caption layer. ### A / SRI CASE / The attempt described by SRI SRI says a Colombian national was recruited online, received encrypted instructions, and was detained on 30 July 2024. DIICOT referred him for trial. **PUBLIC STATUS.** Institutional account and trial referral ### B / SEPARATE EVENT / The accidental fire SRI says the Bragadiru fire was a separate accidental event. Its images were later used as alleged proof of the attempt. **PUBLIC STATUS.** Explicit separation in the SRI source **THE CAPTION LAYER.** The later caption moved event B into the role of proof for event A. The source describes it as an information-operation layer. ## One case can have two clocks In the Galați case, MApN separates target identification from the publication of the technical finding. The two dates answer different questions. - **INCIDENT MOMENT.** 29 May 2026 / 01:46. The target was identified in Ukrainian airspace. - **PUBLICATION MOMENT.** 31 May 2026. MApN publishes the technical reconstruction. ## From trace to response Read each case in the same order. Record the event. Name the attribution. Then check what the institution put in public. 1. **Observe.** What happened physically or technically? 2. **Attribute.** Who makes the link, and what does the source say? 3. **Check the response.** What became public, and what remains open? ## Keep the four questions. Keep the six cards separate. Follow the handoff from a trace to a response. 1. What is the observable event? 2. What is the source for the attribution? 3. What public response exists? 4. Which relationship remains unknown? _This is a reading method. It is not a conclusion about every incident in the region._ ## Start with the sources. The page uses five public sources and six cards. When a source does not connect two cards, the page leaves the gap open. ### SR-01 / The Rachelu and Luncavița release INSTITUTION / MApN. 30 June 2026. Aggregates and drone fragments. [Open source](https://english.mapn.ro/cpresa/6804_press-release) ### SR-02 / The Galați technical finding INSTITUTION / MApN. 31 May 2026. Geran-2, KOMETA, and the identification timeline. [Open source](https://english.mapn.ro/cpresa/6786_Press-release) ### SR-03 / The disrupted sabotage operation INSTITUTION / SRI. 17 January 2025. Bragadiru, the attempt, and the information layer. [Open source](https://www.sri.ro/articole/SRI-a-dejucat-o-operatiune-de-sabotaj-instrumentata-de-Federatia-Rusa-pe-teritoriul-Romaniei.html) ### SR-04 / The SRI statement on Operation Masquerade REPUBLISHED / Agerpres. 8 April 2026. APT28, compromised routers, and Romanian targets. [Open source](https://agerpres.ro/comunicate/2026/04/08/comunicat-de-presa---serviciul-roman-de-informatii--1545445) ### SR-05 / The reported GPS-jamming statement REPORTED / European Pravda. 29 September 2023. Statement attributed to the Chief of Defence. [Open source](https://www.pravda.com.ua/eng/news/2023/09/29/7422015/) ### LIMIT - The CRS R49134 report in the supplied brief is excluded. The link could not be independently verified during source review. - GPS jamming appears as a reported statement, not as a MApN finding in this corpus. - The Bragadiru trial referral is not a final conviction. - There is no shared score for the five channels. ### METHOD I used Romanian institutional sources for the MApN and SRI episodes, a republication of an SRI statement for the cyber operation, and one secondary source for GPS. The page marks editorial synthesis separately and is current on 15 August 2026. Accessed 15 August 2026. --- A public object by [Marius Comper](https://mariuscomper.uk/en/).