FlySafe was not operational during this event. This analysis reconstructs publicly available signals — to demonstrate how predictive airspace intelligence could have provided advance warning.
Copenhagen Drone Shutdown
September 22, 2025 — 109 Cancellations, Russia Suspected
On September 22, 2025, Copenhagen Airport — Scandinavia's busiest hub handling 30 million passengers annually — was forced to halt all operations after multiple drone sightings in the approach and departure corridors. 109 flights were cancelled. 65 flights were diverted to Malmö, Gothenburg, and Hamburg. What made the event alarming was the simultaneity: Oslo Airport Gardermoen reported drone activity at the same time, suggesting coordination. Danish Defence Intelligence Service (FE) assessed with medium-to-high confidence that the drones were part of a Russian hybrid warfare campaign targeting Nordic critical infrastructure. No drones were recovered despite military helicopter and police drone-hunting operations.
What Happened
On September 22, 2025, Copenhagen Kastrup Airport (EKCH) — Scandinavia's busiest aviation hub, handling over 30 million passengers annually — was forced into an unplanned operational shutdown after multiple drone sightings were confirmed within its protected approach and departure corridors. Danish air traffic control suspended all movements after drone contacts were observed at low altitude in areas that intersect directly with ILS approach paths for Runways 04L/R and 22L/R. The closure lasted approximately six hours, triggering the largest single-day disruption in Kastrup's modern history.
What elevated this event beyond a routine airspace incursion was its simultaneous occurrence: Oslo Gardermoen (ENGM), Norway's primary international gateway, reported comparable drone activity on the same day. The geographic and temporal coordination of drone sightings across two sovereign nations' busiest airports, coinciding with a broader pattern of suspicious UAS activity near Nordic military installations in preceding months, prompted an immediate intelligence assessment. Denmark's Defence Intelligence Service (FE) concluded that Russia was the likely source — characterising the campaign as a hybrid warfare operation targeting critical civilian infrastructure to sow disruption and erode public confidence in Nordic security.
SAS, Norwegian, easyJet, and Ryanair among primary carriers affected. Inbound aircraft redirected mid-route; outbound aircraft blocked at gate or returned to stand. Kastrup's six-hour closure window covered both morning and midday peak traffic banks.
Malmö Sturup (ESMS), Gothenburg Landvetter (ESGG), and Hamburg Fuhlsbüttel (EDDH) absorbed the overflow. Malmö, just 20 km across the Øresund Bridge, bore the highest load, straining its limited ground handling and passenger transit capacity.
Danish police and military helicopters were scrambled to conduct aerial drone-hunting operations over the airport perimeter and surrounding Amager Fælled area. Despite sustained search efforts, no physical drone was recovered — a forensic gap that complicated attribution but did not prevent FE from drawing intelligence conclusions based on signals intelligence, operational pattern analysis, and the broader geopolitical context of Russian hybrid activities targeting NATO member infrastructure in the Baltic region. Danish Prime Minister Mette Frederiksen convened an emergency national security meeting, and NATO was formally briefed on the coordinated Nordic drone threat picture.
Warning Signs
The Copenhagen shutdown did not emerge in a vacuum. A coherent threat signature had been building across the Nordic region for months before September 22. Intelligence agencies, aviation security professionals, and infrastructure protection authorities had access to a convergent set of indicators — each individually ambiguous, but collectively pointing toward elevated UAS-based disruption risk at high-value civilian nodes. The failure was not one of data availability but of cross-domain synthesis and actionable alerting to airport operators and airlines at the operational planning level.
In the months prior to September 22, Norwegian military bases at Bodø (home to allied fighter aircraft operations) and Rygge had reported repeated unidentified drone sightings. Swedish authorities raised the threat level for critical infrastructure across the country. These were not isolated incidents — they formed a documented escalation trajectory targeting the defence and aviation nodes of NATO's Nordic flank. The operational template being rehearsed was directly transferable to civilian airport approaches.
Russia's documented hybrid warfare doctrine — confirmed through the Ryanair FR4978 interception over Belarus in 2021, Baltic GPS jamming campaigns in 2024, and ongoing electronic warfare operations near Finnish and Estonian airspace — established a pattern of using aviation infrastructure as a lever for political pressure and operational disruption against NATO members. Denmark's visible support for Ukraine and its NATO membership made it an analytically predictable target for escalatory signalling through civilian infrastructure interference.
At the time of the incident, Copenhagen Airport had not yet deployed an integrated counter-UAS detection and interdiction system. The DKK 200M investment announced post-event confirms that the pre-incident capability gap was real and significant. The airport's flat coastal geography (Amager island) and proximity to the Øresund Strait provided minimal natural obstruction for long-range drone operations. Kastrup's dual-parallel runway layout meant that a single drone in the approach corridor was sufficient to halt all movements simultaneously.
The simultaneous activation at Oslo Gardermoen introduced a coordination dimension that distinguished this event from opportunistic criminal UAS operations. A state-level actor capable of staging concurrent drone operations at two international airports across two countries represented a qualitative escalation in the threat model. Had analysts been monitoring cross-border drone incident correlation in real time, the Oslo signal may have reflected elevated the EKCH risk assessment before or concurrent with the first Kastrup sighting.
Sweden's formal elevation of its critical infrastructure threat level in the months before the incident represented a government-level acknowledgement of the UAS risk environment. Malmö Sturup — which ultimately absorbed a significant share of the Copenhagen diverted traffic — sits within the same Scandinavian operational geography. The Swedish threat assessment was a publicly available leading indicator that the regional threat had crossed into actionable alert territory.
Timeline
Repeated unidentified drone sightings reported at Norwegian military installations including Bodø Air Base and Rygge. The incidents remain publicly attributed to unknown actors but are internally assessed by Norwegian and allied intelligence as consistent with Russian hybrid reconnaissance operations. Sweden formally raises its threat level for critical national infrastructure, citing UAS-related risks. No aviation-specific NOTAM guidance is issued across the Nordic FIR network at this stage.
First drone sighting reports emerge near Copenhagen Kastrup Airport (EKCH). Air traffic control receives initial notifications from ground observers and airport security patrols. Contacts are confirmed in the vicinity of active approach corridors. Danish police are alerted. Initial operational assessment determines the drone activity constitutes a credible threat to aircraft safety within the EKCH CTR.
Copenhagen ATC issues a ground stop. All departures are halted and inbound aircraft are instructed to hold or divert. The closure is immediately communicated to Eurocontrol's Network Manager Operations Centre (NMOC). Flow control restrictions cascade across the European ATM network. SAS, Norwegian, easyJet, and Ryanair — the four largest operators at EKCH — activate disruption protocols. 109 flights are ultimately cancelled across the closure window.
Simultaneous drone activity is reported at Oslo Gardermoen, Norway's busiest airport. The dual-nation, dual-airport activation in a single operational window constitutes a significant escalation marker. Norwegian authorities initiate their own response. The geographic span — from Oslo in the north to Copenhagen in the south, covering both the Scandinavian Peninsula and the Danish straits — eliminates the possibility of a single-actor opportunistic incident and points strongly toward coordinated state or state-directed activity.
Danish police helicopters and military aviation assets are deployed over and around EKCH in active drone-hunting operations. The Amager Fælled nature reserve adjacent to the airport, and the coastal approaches from the Øresund Strait, are swept. Ground teams are deployed on the airfield perimeter. Despite the scale of the response, no drone is physically recovered — a result consistent with the use of long-endurance commercial-grade or purpose-built military UAS capable of rapid repositioning or self-destruction.
Sixty-five aircraft are redirected to alternate airports. Malmö Sturup (ESMS), 20 km to the northeast across the Øresund Bridge, absorbs the largest share but quickly reaches practical capacity limits for ground handling, gates, and transit bus coordination. Gothenburg Landvetter (ESGG) and Hamburg Fuhlsbüttel (EDDH) receive additional overflow. Passengers face road transfers of 30 minutes to over 3 hours to reach Copenhagen, with no established emergency coach-link infrastructure in place at scale.
Danish Prime Minister Mette Frederiksen convenes an emergency national security council meeting. Defence Minister and intelligence chiefs brief on the threat assessment. FE — Denmark's Defence Intelligence Service — formally assesses Russia as the likely source of the drone campaign, framing it within the broader pattern of Russian hybrid warfare targeting NATO member critical infrastructure. NATO's command structure is formally briefed on the coordinated Nordic drone threat picture, elevating the incident from a domestic aviation disruption to an Alliance-level security event.
Copenhagen Airport resumes operations after authorities determine the immediate threat window has passed. Normal ATM flow is gradually restored. Eurocontrol NMOC begins clearing the backlog of held and rerouted traffic. Airlines initiate the multi-day process of recovering crew positioning, aircraft rotations, and passenger rebooking across their EKCH-based networks — a recovery typically requiring 36–72 hours for a disruption of this scale.
Copenhagen Airport announces a DKK 200 million (approx. €27M) investment programme in counter-drone systems — one of the largest single-airport counter-UAS commitments in European civil aviation to date. The investment covers radar-based UAS detection, radio frequency monitoring, and physical interdiction capability. Danish authorities table legislative amendments to enable more aggressive drone countermeasures in controlled airspace. NATO member states accelerate review of critical aviation infrastructure protection standards in the context of hybrid threat doctrine.
Aviation Impact
The September 22 closure delivered one of the most concentrated single-day disruption events in Northern European aviation since the 2010 Eyjafjallajökull eruption forced widespread Scandinavian airspace closures. Unlike a weather event, the drone shutdown produced zero advance warning through conventional aviation forecast systems — ATIS, SIGMET, or pre-departure weather tooling provided no indication. The operational and commercial damage was immediate, cascading, and disproportionate to the physical footprint of the threat.
SAS, Norwegian, easyJet, and Ryanair collectively operated the majority of cancelled rotations. Each cancellation triggered EC261/2004 passenger rights obligations including rebooking, care duties, and potential compensation claims — exposing airlines to aggregate liability in the range of several million euros for a single operational day.
Malmö (ESMS), Gothenburg (ESGG), and Hamburg (EDDH) absorbed the overflow. Diversion costs per aircraft — fuel burn to alternate, ground handling fees, passenger transport to destination, crew accommodation — typically run €8,000–€25,000 per flight event depending on aircraft type and passenger load.
A six-hour ground stop at a hub of EKCH's throughput (approximately 550 daily movements in peak season) eliminates roughly one-quarter of the airport's daily capacity in a single event. Recovery delays compound through the following 24–48 hours as aircraft and crew repositioning lags the schedule rebuild.
Copenhagen Airport's post-event security investment — approximately €27 million — represents the direct infrastructure cost of operating without adequate UAS detection capability in a threat-elevated environment. The investment validates, retrospectively, the materiality of the pre-event risk that was left unaddressed.
Beyond the direct operational numbers, the simultaneous activation at Oslo Gardermoen introduced a second-order network effect. Scandinavia's hub-and-spoke topology means that EKCH and ENGM function as primary redistribution nodes for thin-route Nordic regional connectivity. Simultaneous disruption at both nodes created a triangulation problem for network carriers: aircraft and crews originally positioned for onward connections through Copenhagen or Oslo faced a compound positioning failure with no clean recovery path through the alternate airports, which lacked the gate capacity, slot infrastructure, and ground handling agreements to absorb coordinated overflow from two major hubs simultaneously.
The political dimension added a layer of reputational and systemic risk that has no precedent in conventional weather or mechanical disruption scenarios. When a sovereign state's intelligence service publicly attributes an airport closure to a foreign power's hybrid warfare campaign, and that assessment is formally communicated to NATO, airlines and their insurers face questions about force majeure applicability, passenger rights obligations, and the adequacy of security risk frameworks that were never designed to account for state-directed UAS operations against civilian airports.
Takeaway
The Copenhagen drone shutdown represents the definitional case for a category of airspace risk that no existing aviation weather or NOTAM system is designed to surface: state-directed hybrid threat activity targeting civil aviation infrastructure. The threat did not arrive as a tropical cyclone trackable on a synoptic chart, a volcanic plume visible on VAAC satellite imagery, or a GPS jamming signature detectable by GNSS monitoring networks. It arrived as a pattern — distributed across months, geographies, and domains — that was only legible as a coherent threat signal to an analytical framework capable of synthesising geopolitical intelligence, historical incident databases, and cross-border UAS event correlation in real time.
The lesson is structural, not operational. Airlines and airports operating under conventional disruption risk models — which weight meteorological, ATC, and mechanical failure modes — had no mechanism to assign probability mass to a six-hour EKCH closure driven by state-sponsored drone activity. The risk was not invisible; it was siloed in intelligence channels that do not interface with airline network operations centres or airport capacity planners. The result was that 109 cancellations and 65 diversions were absorbed reactively rather than anticipated proactively.
This is precisely the analytical gap that airspace risk prediction platforms exist to close. The Copenhagen event was preceded by a cascade of publicly documentable signals — military base drone incursions, Sweden's raised infrastructure threat level, the Baltic GPS jamming campaign of 2024, and the established Russian hybrid warfare doctrine against NATO members — each of which independently moved the probability needle for a high-impact UAS disruption event at a major Nordic hub. Synthesised against EKCH's known counter-UAS capability gap, the risk picture was materially elevated before September 22.
A retrospective analysis suggests FlySafe's indices may have indicated elevated disruption probability for Copenhagen Kastrup (EKCH) and Oslo Gardermoen (ENGM) in the weeks prior to September 22, 2025. With drone-related hybrid threat activity against Bodø and Rygge catalogued as a regional escalation trend, and Sweden's critical infrastructure threat elevation registered as a corroborating regional signal, the EKCH risk score for state-directed UAS airspace incursion may have reached HIGH threshold — triggering an alert to subscribed operators recommending contingency planning for an unscheduled closure event of 4–8 hours duration, with Malmö, Gothenburg, and Hamburg identified as the operationally viable alternate cluster. Airlines operating morning banks at EKCH on September 22 could have had the analytic foundation to pre-position crews, pre-brief diversion procedures, and reduce connecting passenger exposure at the most vulnerable schedule points — converting a reactive crisis into a managed disruption.
The DKK 200M counter-drone investment that Copenhagen committed post-event closes one dimension of the vulnerability: physical detection and interdiction. It does not close the intelligence gap that left airline network planners blind to a foreseeable risk class. That gap requires a dedicated airspace risk intelligence function — one that treats geopolitical threat actor behaviour, hybrid warfare doctrine, and cross-domain incident pattern analysis as first-class inputs to operational planning, not as background noise in a news feed. The Nordic drone campaign of 2025 will not be the last instance of this risk category. The airports and airlines that treat it as an outlier will be disrupted again. Those that build it into their risk architecture will be positioned to absorb the next event with materially less operational and commercial damage.
Sources
- — DR (Danish Broadcasting Corporation) — Copenhagen Airport Drone Shutdown Coverage, September 22, 2025
- — NRK (Norwegian Broadcasting Corporation) — Simultaneous Drone Activity Reported at Oslo Gardermoen and Copenhagen, September 22, 2025
- — Reuters — Denmark Suspects Russia Behind Copenhagen Airport Drone Disruption, September 2025
- — Berlingske — Danish Defence Intelligence Service (FE) Assessment of Drone Threats to Nordic Infrastructure, 2025
- — The Local Denmark — Copenhagen Airport Closure Timeline: Drone Sightings, Police Response, and Resumption of Operations, September 22, 2025
This is a retrospective analysis of publicly documented events. FlySafe's prediction system was not operational during this event. All information is sourced from public records, aviation authority publications, airline statements, and open data.