At 4:44 on a Sunday morning, Romanian radar picked up an intruder — a drone, crossing in from neighbouring Moldova. At 5:01, a Spanish fighter pilot, flying a NATO patrol in Romanian sky, pressed the trigger and shot it down. Seventeen minutes, detection to kill.

Now rewind three years. Since 2023, this same country had been finding Russian drone wreckage in its fields — and for nearly three years it never fired a single shot. Not once, until this summer. Even in September 2025, when a drone wandered its sky for fifty minutes with two fighters flying right alongside, nobody fired. Same radars. Same jets. What was missing was never the hardware. It was paper — and not one sheet of it, but a whole stack: the law that allows the shot, the rules that say who orders it, the procedure a pilot can actually follow at four in the morning. Romania spent three years assembling that stack. This is the story of what's written in it — and of the hole in the map that the stack still doesn't cover, because the drone's route that Sunday, through a neighbour that doesn't own a single fighter jet, was no accident.

Here is that Sunday in detail — the sixteenth of August. The drone entered about twenty-four kilometres north of the city of Galați, coming from Moldova's side. The Spanish F-18, on NATO air-policing duty, made radar contact, received authorisation, and downed it over an uninhabited area — the fourth drone Romania has shot down this year. In late July, its own F-16s downed three drones in three days, the first shootdowns in the country's history. Two days before the Spanish shot, an Italian fighter downed a drone over Latvia. NATO's assessment, in its own careful words: the drone appears to be Russian — the origin is formally still under investigation; Moldova identified it as a Shahed type, Russia denies it. And be careful with this sky in general: the same month, a Ukrainian decoy drone strayed into Bulgaria. Wreckage over this flank arrives from both sides of the war — remember that, because the pilot deciding at a quarter to five does not yet know whose drone it is.

And this is not one country's story. Zoom out to September 2025, Poland: at least nineteen drones crossed the border in a single night. Polish and allied jets shot several down — the first time in history NATO forces had fired on Russian military hardware over alliance territory. Poland invoked Article 4, the alliance's formal alarm bell. Within days, NATO launched a new operation, Eastern Sentry, to shuffle jets and sensors along the whole eastern flank. Before that night, Europe had spent two years collecting drone debris in its fields — without firing a shot.

The usual headline writes itself: Russia is testing NATO's resolve. That may well be true. But it explains the attacker, not the defence — and the more useful question is what, exactly, kept tying the defenders' hands. It wasn't radar coverage; the drones were seen. It wasn't jets; they were airborne, flying alongside. What tied their hands, each time, was rules — three of them, written down long before any drone took off.

Rule one: the law of peacetime skies was written for aircraft with humans inside. Here is what the rulebook tells a fighter pilot to do with an intruder in peacetime: approach it, identify it, rock the wings, make radio contact, escort it, force it to land. It's a conversation between people. A drone cannot hold that conversation. The only thing you can actually do to it is destroy it — and destroying something in peacetime is exactly what the old rules never clearly allowed. That was Romania's first two years of debris: no legal trigger existed at all.

So Romania wrote itself the permission — two laws, passed in February 2025, in force by May. And now comes the part that shows how deep the paper goes: the statute alone changed nothing visible. Four months later, that drone flew its fifty minutes — with the law already on the books, and the pilots that day even received authorisation to fire. They still didn't — after weighing the risk to people below. Because a statute is a permission, not a manual. The target must be identified visually; the debris must fall on no one; the missile must not cross into a neighbour's sky; and the windows where all of that is true at once last a few minutes. Building those windows — the tactics, the procedures, the drills — took another year. In May 2026, a drone carrying explosives hit an apartment roof in Galați and injured two people. Two months later came the first shootdown — fourteen months after the law. And Poland? It fired that September — the month of the fifty-minute flight — without any new drone law, because nineteen machines in one night reads as plain self-defence. It's the single, slow, ambiguous intruder — whose origin the pilot cannot even be sure of — that the old rules never answered.

Rule two: even inside NATO, the trigger is national. The alliance shares almost everything else — the radar picture, the patrols themselves: Romania's sky is guarded in rotation by allied squadrons — Spanish, Italian and others. But the decision to fire, and the legal liability for what falls out of the sky afterwards, belong to the country whose ground lies below. That Spanish pilot fired under Romanian authorisation, by Romanian law, over Romanian fields. Thirty-two members means thirty-two airspaces and thirty-two statutes, each moving through its own parliament at its own speed. The defence is collective; the trigger is not.

Rule three: the map has a hole. Moldova sits between the war and NATO's border — neutral by its own constitution, with no air-policing arrangement and no fighters at all: it inherited thirty-one MiG-29s from the Soviet Union and had sold them off, most to the United States, by the late nineties. Europe has gifted it a modern French radar and sixty million euros of short-range equipment — so Moldova can now see what crosses its sky. It still cannot reach most of it. A corridor, in other words. And the routes have learned it. Underneath sits the arithmetic: the drone costs twenty to fifty thousand dollars; the missile that killed it, about four hundred thousand; the bigger interceptors, millions. Russia builds roughly three thousand such drones a month. Even a perfect night of air defence is a losing trade at that exchange rate.

Design one: one sky, one trigger. Take Eastern Sentry to its logical end — standing, pre-agreed engagement rules for the whole flank, with authority delegated in advance. The currency is sovereignty over lethal force: a piece of the decision to shoot over your own towns moves abroad, and when wreckage one day falls on a school, the responsible address sits abroad too. Design two: patch the hole — arm the neutral. Europe already pays: the radar, the sixty million euros; the next step is missiles that reach, and data links into NATO's picture. The currency is the neutrality itself — it's written into Moldova's constitution, every gifted battery strains it and hands Moscow a ready-made escalation story, and no treaty sits behind the help. A gift is not a guarantee.

Design three: match the price. Europe's answer on paper is the drone wall — sensors, jammers and cheap interceptors along the flank, drawing on Ukraine's experience: interceptor drones at fourteen hundred dollars, hitting nine times out of ten, built by the thousand every month. Fourteen hundred against twenty thousand — finally, arithmetic that favours the defender. The currency is time and side effects: the wall doesn't exist yet while the drones fly now, jamming over towns breaks GPS for ambulances and airliners, and Germany's own defence minister warns a wall alone is not a defence. None of the three excludes the others. The real design question is the order — and whether the paperwork gets there before the next drone does.

So come back to those seventeen minutes on a Sunday morning. They were not bought with a newer missile or a better radar. They were bought with a stack of paper assembled over three years — the statute at the bottom, the engagement rules above it, the drills above those — that finally told a pilot in a peacetime sky: you may, and here is exactly how. That is the strange shape of modern air defence — it is a stack of documents before it is a stack of missiles.

So the next time a drone over Europe is in the headlines — and there will be a next time — the revealing questions aren't about the drone. Whose law owns the trigger in that particular sky, and has it actually been written yet? Where is the seam on the map — the neutral gap, the unpatrolled corridor — because every defence map has one, and the routes always find it. And what does one defensive shot cost, against what the intruder cost? Until those three answers change, the drones will keep choosing the same route.