The US European Command has stepped up its force protection level for several bases in the region to its second-highest level.
This assessment was issued to clients of Dragonfly’s Security Intelligence & Analysis Service (SIAS) on 02 July 2024.
- US military officials have said this is to reflect that ‘some form of terrorist action or targeting against personnel or facilities is likely’
- In the absence of further detail, we assess the most plausible explanation is a threat from Iran- or Russia-linked hostile actors
The threat of hostile actions against US military entities appears to have risen in recent days. This seems to be due to escalating global hostilities, towards and involving the US, not least because of the wars in Gaza and Ukraine. The United States European Command (USEUCOM) on Sunday, 30 June, raised its force protection condition to Charlie, its second-highest level, for bases in Germany, Romania, Bulgaria and Italy. This level indicates that it has received some form of intelligence suggesting that ‘terrorist action or targeting’ at these bases is ‘likely’.
We doubt this change points to a higher risk to identifiably-US-linked entities and individuals outside of the military community. The threat seems specifically linked to US Air Force entities, and no US embassies in the region have issued any security alerts or adjusted their advice for civilians there. And wider disruption – such as from additional security measures at the affected bases – seems improbable; the bases are not located near large airports or business and transport hubs.
Imminent attack unlikely
The US does not seem to be anticipating any terrorist or sabotage incidents at its bases imminently. According to its own explanation of its threat levels at military bases, Charlie (the second highest) is used when ‘an incident occurs or intelligence is received indicating some form of terrorist action or targeting against personnel or facilities is likely’. The highest level (Delta) is used when this scenario is imminent. It nonetheless seems plausible that the US has received intelligence about a threat to certain bases in the region. The change applies to:
- Aviano Air Base; northeast Italy
- Unspecified locations in Romania (in our analysis, likely to include Mihail Kogalniceanu Air Base in the southwest)
- Unspecified locations in Bulgaria
- Rheinland-Pfalz garrison unit; Rhineland-Palatinate, western Germany, including installations in Romania and Bulgaria
- Ramstein Air Base; southern Germany
- Spangdahlem Air Base; southwest Germany
- Stuttgart USEUCOM HQ installations and Army Garrison; Stuttgart, Germany
That is based on reports by Stars and Stripes, a US military outlet that provides news to the armed forces community worldwide. While international media outlets have since reported that the threat change applies to all US military bases across Europe, these seem to reference the Stars and Stripes article. Our understanding of that article is that threat levels have only been raised at certain bases, garrisons and installations.
Source of threat unclear
USEUCOM has provided little to no information on where exactly this threat stems from. In a statement on 1 July, shortly after the alert, it said it is ‘constantly assessing a variety of factors that play into the safety of the US military community abroad’. Taking into account recent geopolitical developments, we assess the following to be the threats that plausibly underpin this warning:
Iran-affiliated hostile actors. Iran and the actors it supports seem to have stepped up hostile rhetoric in recent days, particularly around the consequences should Israel attack Lebanon, which we assess is likely in the coming months (see P-LBN/ISR-28-06-24 for more on this). The level of support that the US gives Israel both politically and militarily is very likely to have made its bases a priority target for such actors since the war in Gaza began.
Russia-affiliated hostile actors. We have long assessed that defence infrastructure in Europe is likely to be a prized target for Russia-affiliated sabotage as a way to discourage European aid for Ukraine. This is especially true given recent approvals by several NATO member states to use their donated long-range weapons to strike within Russia.
We suspect that the threat is nation-state-linked. This is first because of the wide geographical scope of the alerts, suggesting the threat actor has capabilities or presence across most of the region. Second, the severity of the threat level – the last time it was raised to Charlie was more than ten years ago – suggests the threat is beyond the baseline of the last decade, during which there have been periods of acute terrorism threats. Independent hostile actors, including Europe-based terrorist groups such as IS, have been active throughout this time and would probably have tried to mount an attack at or near US bases if they could.
Third, that the target seems to specifically be the US military rather than general US assets or entities suggests the threat actor has a specific grievance against the US military. In our analysis of non-state-backed terrorist groups in recent years, an attack against other US entities, such as an embassy or consulate, would be an effective way to target US interests. These would also probably be a lot easier to target (or even reach) than a US military base, which already had extensive ID and vehicle checks in place at the Bravo level (one level lower than the current Charlie).
Plausible link to NATO and recent drills
It is plausible that the threat change in Germany, Romania, Bulgaria and Italy is linked to recent NATO drills. The Ramstein Airbase (Germany) held Legacy 2024 exercises in Romania and Bulgaria for two weeks in June. Those drills demonstrated the use of a newly-introduced surface-based air and missile defence (SBAMD) system, aimed at countering unmanned aerial systems. Apart from Slovenia, all countries to which the USEUCOM threat change applies supplied those SBAMD systems.
The threat does seem to be Air Force-focused. It is mainly air (as opposed to naval or infantry) bases to which the threat level change seems to apply. In addition, Spangdahlem air base in Germany has now prohibited its 52nd Fighter Wing airmen from wearing their uniforms off base, according to the independent military news outlet that first reported the threat changes. That unit ‘specifically […] maintains and employs F-16 […] aircraft […] in support of NATO and national defence directives’, according to the base’s website. The first F16s donated by the West are due to arrive in Ukraine this month.
Risk to non-military US entities seems unchanged
It seems unlikely that the threat this alert concerns extends to civilians or other non-military US entities in Europe. In a sign that the US views the threat as limited to its army personnel, we have not seen any US embassies in any of the countries above issue any additional advice to US civilians or warnings of any unusual threats. We are confident it would do so if that were the case, based on precedent.
The likelihood of wider disruption stemming from this alert is low, in our assessment. The airbases affected by the threat level change are not near any major or international airports, transport hubs, or business centres. And a lack of advisory changes from US embassies elsewhere in the affected countries suggests the security picture for general civilians is unchanged.
Image: The flag of the United States flies on the roof of the US embassy as in background can be seen the cupola of the Reichstag building that houses Germany’s Bundestag (lower house of parliament) in Berlin on 27 May 2024. Photo by Odd Andersen/AFP via Getty Images.
