The Web May Already Be Inside

Burak Oktenli
Burak Oktenli is an independent researcher based in Washington, DC, focusing on authority, assurance, and governance in autonomous and AI-enabled systems. He holds a bachelor’s degree in computer science and engineering.

Operation Spiderweb showed that an attacker can cross geography before combat begins. NATO’s counter-drone buildout should test rear-area command handoffs and decision latency, not only sensors and interceptors.

Ukraine’s 2025 Operation Spiderweb changed more than the range of drone warfare. Ukrainian operatives moved first-person-view drones close to Russian strategic air bases inside wooden structures carried by trucks, then launched them near their targets. Reuters later reported that US officials assessed the operation had destroyed around 10 Russian aircraft and damaged as many as 20.

The operational lesson is larger than the damage count. The strike did not have to cross thousands of kilometers of defended airspace on the day it began. Much of the distance had already been crossed before combat started.

That creates a different counter-drone problem. Most defensive architectures are built around an approaching threat: detect the track, classify it, decide, then engage. A pre-positioned system compresses that sequence because the launch point may already sit inside what planners treated as the rear area. The first warning can arrive only seconds before impact, with little or no observable approach path.

From kill web to latent kill web

A conventional kill web links sensors, decision makers and effects after contact. A pre-positioned drone network creates something closer to a latent kill web: nodes are emplaced before the moment of attack and become operational only when activated. The compression is geographic as well as digital.

The attacker is therefore doing more than shortening the sensor-to-shooter chain. It is removing the defender’s assumption that distance creates warning. A drone can appear near an airfield, headquarters, logistics hub, port, ammunition site or protected installation after the outer defensive layers have already been bypassed.

Better local sensors, electronic warfare, interceptors, and layered protection are necessary responses. They still leave a command problem when a threat appears inside defended depth and several organizations hold different pieces of the response.

The first fight is over ownership

Rear-area defense is often organizationally fragmented. Installation security may see the first contact. Air defense may control the interceptor. Electronic-warfare units may hold nonkinetic options. Aviation authorities may control local airspace restrictions. Intelligence elements may hold the best classification data. Civilian authorities can become relevant when a track leaves a military perimeter.

A pre-positioned attack punishes ambiguity across those seams. The questions arrive before the track is fully classified: Who owns it? Who may restrict local activity? Who can employ nonkinetic effects? Who may authorize force? What happens when the contact crosses an installation boundary? Who takes over if communications to higher headquarters degrade?

I examined a different side of this problem in a July Articles of War essay on swarm accountability. There, the question was whether increasingly autonomous architectures can make the human decision that the law depends on difficult to locate after an action. Rear-area defense creates an earlier operational problem: even when authority is defined on paper, a force can still lose time if responsibility for acting is fragmented across organizations.

Against a latent kill web, those seams belong inside the weapon-system design problem. A sensor-to-effector chain can be technically fast and still be operationally late if decision rights move more slowly than the drone.

The remedy is precontact design. Commands should decide in advance which organization owns which decision, how control transfers, what protective actions are standing, and what authorities remain available when connectivity fails. The goal is a rehearsed handoff architecture rather than an approval path that has to be invented after the first alert.

Measure decision latency, not only detection latency

Counter-UAS exercises already test detection range, classification performance, track continuity, and interceptor effectiveness. They should also measure the time required to move a track from the first observer to the organization that can lawfully and practically act on it.

A realistic internal-launch scenario should begin with an ambiguous contact appearing close to a protected site. The exercise should force a handoff among base security, air defense, intelligence, electronic warfare and any relevant civilian or aviation authority. It should then degrade communications, introduce a second contact, and move the first track across an organizational boundary while the incident is still unfolding.

The key metric is how much context survives each handoff. The receiving unit should inherit track history, timestamps, prior classifications, control measures already applied and the evidence behind them. A transfer that resets the incident to a voice report or screenshot wastes the time modern networking was supposed to save.

Exercises should also test what local commanders may still do when the network fractures. Decentralized action only helps when its limits were established and rehearsed before the crisis.

NATO’s Drone Edge should include the command layer

NATO has already created a useful window to institutionalize this. At the July 2026 Ankara Summit, Allies launched NATO’s Drone Edge, committing more than $40 billion to counter-drone capabilities over five years and setting a goal of training five times as many drone operators by the end of 2027. NATO is also developing a counter-drone marketplace to broaden access to solutions across the Alliance.

The technical side of that effort is already accelerating. On September 9, the NATO Communications and Information Agency launched a Counter-UAS Data Challenge seeking artificial-intelligence systems that can fuse radar, radiofrequency, camera, and acoustic data into a single operational picture. NATO exercises such as Baltic Trust 26 are also testing how counter-drone technologies from different nations and vendors operate together.

Compatibility should therefore include command handoffs as well as data exchange. A radar can share a track perfectly and an interceptor can receive a cue instantly, yet the force can still arrive late if no common procedure determines who owns the incident when it begins inside the defended area.

The pressure to solve that problem is increasing. Reuters reported on September 22 that Ukrainian mobile air-defense crews confronting faster jet-powered Shahed drones can have seconds rather than minutes to react. Technology is compressing the interval available for both interception and command.

NATO’s testing architecture offers a place to measure both. Internal-launch scenarios, degraded-network procedures, decision latency, and cross-organizational handoffs should become standard test events. A system should not count as fully interoperable merely because its sensors and effectors connect. The organizations responsible for using them should be able to transfer responsibility without losing time or context.

The rear is part of the opening move

Spider’s Web revealed a form of combat power that can look like logistics until the moment it activates. An attacker can distribute potential combat power in space, conceal it inside ordinary movement, and begin the engagement only after the system is already close to the target.

That changes the opening minutes of defense. The decisive question may be less about how quickly a drone is detected after crossing a line on a map than whether the defending force has already decided who may act when no such crossing occurs.

The next counter-drone advantage will depend on more than the longest-range sensor or the fastest interceptor. It will also depend on whether command relationships are already in place when the kill web wakes up inside the perimeter.

This article was originally published by RealClearDefense and made available via RealClearWire.