NATO will send additional maritime patrol aircraft, drones, radar systems and specialist teams to the Black Sea after at least seven commercial vessels were struck by drones this month near Romania and Bulgaria. The alliance announced the reinforcement Tuesday after its North Atlantic Council discussed the attacks, which have killed or left missing dozens of sailors and pushed a maritime-security problem closer to NATO territory.

The package is designed first to improve surveillance and attribution rather than establish a protected shipping corridor. NATO has not publicly blamed a country for the attacks and has not announced a mission to escort merchant ships. The measured response reflects the alliance’s immediate need to see more of the air and sea picture without widening the conflict around Ukraine through unverified attribution or an open-ended combat role.

NATO adds sensors before escorts

Allies have sent or will send maritime patrol aircraft, intelligence personnel, drones, radar systems and teams able to analyze explosive remnants, according to NATO officials quoted by Reuters. The North Atlantic Council, NATO’s principal political decision-making body, considered Black Sea security at alliance headquarters in Brussels before the package was disclosed.

The central operational goal is “situational awareness” through more sensors and data sharing, a Supreme Headquarters Allied Powers Europe spokesperson told Stars and Stripes. A U.S. Navy P-8A Poseidon maritime patrol aircraft had arrived in the Bulgarian port city of Varna by Sunday, although NATO did not say whether that flight was formally part of the new reinforcement. Patrol aircraft can monitor large sea areas, classify contacts and support reconnaissance, while forensic teams may help identify weapons after an attack.

Commercial shipping faces a widening threat

The deployment follows a rapid succession of attacks on merchant traffic in and near the exclusive economic zones of two NATO members. An AP review counted at least seven cargo vessels attacked in October. The targets included chemical and oil tankers as well as ships moving other cargo through routes connected to Ukraine’s trade. Some ships burned or sank, and search operations continued for missing crew members.

Officials in Ukraine and analysts have pointed toward Russia, arguing that attacks on the route serve Moscow’s effort to constrict Ukrainian exports. Russia has not accepted responsibility, and NATO has stopped short of attribution. Bulgarian Prime Minister Rumen Radev said the logic pointed toward Russia but acknowledged that authorities could not prove it. That evidentiary gap makes the promised explosive analysis and intelligence sharing important: a military response based on fragments, flight paths and sensor data needs a firmer chain of evidence than political suspicion.

Romania’s data show a steep escalation

The shipping attacks are part of a larger pattern of drones crossing or approaching allied territory. Romania’s defense ministry recorded 97 attacks near its border, 77 aircraft scrambles and 35 unauthorized drone entries during 2026 through October 17. It reported six drones shot down this year, compared with none in each of the previous three years. The categories can overlap, so they should not be added into a single incident count, but the year-over-year increase is unmistakable.

Bulgaria, Romania and Turkey had already been coordinating responses before Tuesday’s NATO decision. Bulgaria’s defense ministry said their ministers discussed stronger surveillance, greater intelligence exchange and joint action to protect navigation on October 13. Bulgaria subsequently sought additional NATO aircraft and counter-drone systems. The new allied package answers part of that request, while leaving the division of forces and command arrangements undisclosed.

The Article 5 boundary remains unclear

NATO’s mutual-defense obligation is strongest when an armed attack occurs against a member’s territory, forces, ships or aircraft as defined by the North Atlantic Treaty. Several Black Sea incidents occurred in exclusive economic zones, where coastal states have resource rights but not the same sovereignty they exercise in territorial waters. That distinction has produced uncertainty over whether any single strike would trigger an Article 5 response.

The ambiguity does not prevent NATO from strengthening defensive surveillance or helping national investigations. It does, however, explain why the alliance is emphasizing awareness and attribution rather than announcing automatic interception or retaliation. The European Union has separately called attacks on civilian shipping near Romania and Bulgaria violations of international and maritime law. In its latest Council conclusions, EU leaders also urged faster work on drone and counter-drone security.

What the reinforcement can accomplish

More patrol aircraft and radar can close surveillance gaps, help distinguish military drones from civilian traffic and give allied commanders more warning when aircraft approach national airspace or ships. Shared intelligence can also connect separate incidents that national authorities might otherwise investigate in isolation. Forensic examination may reveal common components or explosive signatures, though such evidence does not automatically establish who ordered an attack.

The package does not by itself make commercial shipping safe. NATO has not promised convoy protection, continuous fighter cover or the interception of drones over every vessel. Those steps would require more forces, detailed rules of engagement and decisions about when allied units may use weapons near neutral ships or outside territorial waters.

Tuesday’s move is therefore a defensive expansion with a deliberately limited public mandate. It gives NATO more eyes, data and investigative capacity over a contested sea while preserving room for political decisions if attribution becomes clearer or attacks move into allied territory. The next test will be whether the added surveillance deters further strikes—and whether member governments are prepared to move from monitoring to protection if it does not.