Russia's drone-strike decree turns physical attacks into an ownership question

President Vladimir Putin has signed a decree allowing the Russian state to take control of companies targeted by drone attacks, covering energy, transport, logistics and installations deemed essential to national security. The mechanism can be triggered by presidential order alone.

The measure is worth attention beyond Russia because of what it does to incident classification. In most jurisdictions, an attack on a company's physical infrastructure triggers an incident response process oriented toward restoration and, where relevant, regulatory notification. Here it can trigger a change of ownership.

That inverts the incentive an operator faces when deciding whether to report. Where disclosure of a successful attack can result in loss of the asset, the rational course for management is to minimise, delay or absorb the event quietly. Underreporting follows directly, and with it the loss of the sector-wide visibility that makes coordinated defence possible.

There is a second-order effect on the security market. Insurers price physical and cyber-physical risk using loss data drawn from reported incidents. A regime that suppresses reporting degrades the data on which that pricing depends, which tends to widen premiums for everyone operating in the affected sectors.

Analysts have described the measure as a form of hybrid nationalisation, since the trigger is a security event rather than a stated economic policy. For multinationals with Russian assets in the named sectors, it introduces an expropriation pathway that conventional political-risk cover was not written to anticipate.

Based on reporting by Euronews.