Civil-Military Coordination Center Study

Executive Summary

Between October and December 2025, repurposed Belarusian balloons crossed Lithuanian airspace, closing Vilnius airport for more than 60 cumulative hours and stranding over 51,000 passengers. The September 2025 Šakalienė amendments authorise instant-reaction airspace defence, but the coordination between civilian agencies (air traffic, electricity grid, hospitals, transit, e-government) and the military shoot-down decision is the real gap. On 29-30 December 2025, Russian state hackers (Sandworm) destroyed the digital systems running two Polish power stations; a similar strike during a Lithuanian kinetic crisis would force civil and military responders to act without a shared picture. Lithuania already has the Ministry of National Defence, the Ministry of the Interior, the Seimas Defence Committee, and the State Defence Council. The gap is between these bodies, not within them. Reference models exist: the Finnish Security Committee coordinating seventeen ministries under the Prime Minister, the Estonian Riigikantselei role under the 2015 National Defence Act, and the Polish Government Centre for Security. The recommended next step is a feasibility study by the Office of the Prime Minister examining which model fits Lithuanian institutions. The structure is for Lithuania to determine.

The Problem

The late-2025 balloon crisis shut Vilnius airport for more than 60 hours across eight separate incidents, stranding over 51,000 passengers; civilian air traffic, military air policing, customs, and the Ministry of the Interior each handled their slice without a common decision board. On 29-30 December 2025, Sandworm wiped the operational technology at two Polish combined heat and power plants by stealing the certificates that authenticate utility networks. In April 2026, a leaked Russian Ministry of Defence target list named Vilnius among twenty-one objectives. A combined cyber-plus-kinetic strike requires the electricity operator, the hospital network, the air defence cell, and the cabinet to share a single picture within minutes, not hours.

Coordination today runs through ad-hoc working groups, ministerial phone trees, and the State Defence Council convened by the President. There is no permanent watch floor where civilian and military duty officers sit together, no shared common operating picture covering airspace, electricity, telecoms, hospitals, and transit, and no rehearsed playbook for the moment a hybrid incident crosses the line into Article 4 or Article 5 territory.

Without action: Each new incident is improvised. The next balloon swarm, GPS jamming campaign, or utility cyber attack costs days of disruption that a rehearsed coordination layer could compress to hours.