Russia’s hybrid warfare spills into NATO, raising new fears

Russia’s increasing use of hybrid and gray-zone attacks against European countries is posing a major challenge for the U.S. and NATO: how to respond without sparking a major conflict with Russian President Vladimir Putin. 

Baltic countries, Poland and the Czech Republic in particular, are raising alarm that acts of sabotage — and sometimes fatal attacks against individuals — allegedly sponsored by Russia are a growing threat to Europe and the defensive alliance. 

“Russia is throwing at us all the time new challenges, new risks, and hybrid has turned to be one of the serious ones for the alliance,” Estonia’s ambassador to NATO, Jüri Luik, said in an interview with The Hill in Washington last week. 

“In all seriousness, we have to respond because if we don’t respond, this will grow. And Russia will feel that there are no limits to what they can do in our countries, and obviously, there is also a discussion among allies about what would be the best responses.”

Just in the past few weeks, Estonia has raised alarm that Russia was behind the GPS jamming and disrupting of a commercial flight, and that Russia is sowing confusion along the border by removing maritime border lines. 

Poland has blamed the recent death of a Polish border guard as part of the larger, hybrid threat from Belarus and directed by Moscow. Lithuania has said Russia was “likely” behind a March attack on a Russian political dissident in Vilnius.

A hacking group based in Russia is accused of carrying out a dangerous cyberattack against major hospitals in London this month, and instances of arson across NATO countries — targeting supply warehouses for Ukraine but also civilian sites like an Ikea in Lithuania — have raised suspicions of Russian sabotage. 

Secretary of State Antony Blinken acknowledged late last month that the Kremlin was “intensifying its hybrid attacks” against NATO members and raised the possibility of potential retaliation.

“We know what they’re up to, and we will respond both individually and collectively as necessary,” he said following a meeting with foreign ministers of NATO countries. 

It is important for countries to respond, including collectively as NATO, to show Russia that lines cannot be crossed, National Security Advisor Jake Sullivan told a group of Baltic officials during a meeting in June.

But NATO countries are likely going to have to accept some risk because Russia’s hybrid activities are too cost-effective for them to stop. There’s no clear answer to establish deterrence, officials at the meeting discussed.

John Kirby, the White House national security spokesperson, said that the U.S. is closely watching Russian malign activity, but said its efforts to counter Putin were focused on sanctions targeting Russia’s war economy and increasing military and economic support for Ukraine.

“We are watching these, quote, unquote, ‘hybrid attacks,’ to use your phrase, closely,” Kirby said, responding to a question from The Hill about whether the topic would be addressed at the leaders summit of Group of Seven nations this week, or at the NATO summit to be held in Washington in July. 

“We are certainly mindful that these are the kinds of things that Russia has done in the past and has certainly continued to prove their capability of doing now. It is a page from their playbook.”

The leaders of the Bucharest Nine — the countries on NATO’s eastern flank — expressed urgency in a statement earlier this week: “We are deeply concerned about Russia’s recent malign hybrid activities on Allied territory, which constitute a threat to Allied security,” they said. 

“These incidents are part of an intensifying campaign of activities which Russia continues to carry out across the Euro-Atlantic area, including sabotage, acts of violence, cyber and electronic interference, provocations related to Allied borders, disinformation campaigns and other hybrid operations.” 

Luik, Estonia’s ambassador to NATO, said responses so far are focused on defensive actions, but that information-sharing between countries experiencing these types of attacks should be prioritized. 

“Our position is that we should be unified, we should also be public, meaning we should inform the public what Russia is doing and explain how they operate,” he said.

“And of course it’s very important to exchange information between allies, because often the modus operandi of those various groups are pretty similar. Exchange of information is important.”

NATO Secretary General Jens Stoltenberg, following a meeting of NATO Defense Ministers on Friday, said the alliance is prioritizing intelligence sharing and that potential action likely includes imposing further restrictions on Russian intelligence personnel, restricting their movements or possibly expelling them.

“What NATO has done is to partly make Allies aware that these are not kind of individual random things, they’re part of a campaign from Russia or a campaign of hostile actions,” he said.

Elisabeth Braw, author of “The Defender’s Dilemma: Identifying and Deterring Gray-Zone Aggression,” said these provocations are hard to detect and predict. And there are no clear guidelines for a response.

“The reason there’s no punishment is because it’s not a military attack, so we don’t have a rule book for how to respond,” she said. There’s also a major challenge of assigning blame. It took seven years for Czech authorities to point to Russia as behind an arson attack in 2014. 

“We can’t respond in kind, and issuing condemnations doesn’t exactly frighten the perpetrator,” said Braw, who is also a senior fellow with the Atlantic Council in its Transatlantic Security Initiative.

Braw also questioned whether it’s NATO’s responsibility to respond to gray-zone attacks, and said it’s more important for governments to build resilience within the public and private sector. 

“The thinking hasn’t really advanced much since the last NATO summit,” she said.

“The government will need to involve — when they think of a proper defense and retaliation strategy … the private sector,” she added, citing a number of initiatives from Sweden, the Czech Republic, Finland and Australia as having built up collaboration with wider society in identifying and pushing back against such threats. 

“The Swedish Psychological Defense Agency is a really good model for when it comes to detecting disinformation that comes from abroad … the Czech Republic has gray-zone exercises to which companies are invited, I think it’s a brilliant scheme. That’s something I hope other countries will pick up, and essentially, copy [and] paste what the Czechs have done.”

Braw also suggested that with information-sharing between NATO allies, member states who were not victims of attacks could quietly impose visa restrictions on individuals identified as perpetrators.

“Many governments are totally unused to this whole-of-society approach, and it is really difficult frankly. I work on a lot of these thorny issues, and it is really hard to figure out.”

Can Kasapoğlu, a nonresident senior fellow at the Hudson Institute, warned Russia may increase hybrid attacks against defense manufacturing facilities in Europe surrounding the NATO summit. 

He highlighted as major warning signals a fire in May at a chemical plant in Germany, whose parent company is connected to manufacturing air defenses for Kyiv, and the foiling of an arson attempt, labeled as terrorism, in the Czech Republic.

“Thinking like a Russian and studying the Russian military mindset, [Europe’s] defense industry would be under huge risks from the Russian subversive and sabotage activities following the [NATO] summit. We have to be very careful about that,” he said. 

Kasapoğlu called for a reshaping of how countries view Russia’s malign activity, pointing to actions that extend well beyond NATO’s European borders, to include Russia’s military and political influence campaigns in Africa, and propaganda efforts meant to turn global south countries against the West. 

“The first action we have to take is to understand that we do not even have a right diagnosis … If the diagnosis is wrong, I can guarantee that the treatment will be wrong,” he said. 

“I would call it unrestricted Russian warfare. The Russian way of warfare does not have to be, and is not restricted by, the Western intellectual boundaries that we are fooling ourselves with. The Russian way of warfare is unrestrained warfare. Warfare by all means.”

The NATO summit, taking place in Washington July 9 through 11, will be a test of how seriously the alliance — and the U.S. in particular — is taking the threat. 

“The U.S. position is of crucial importance in NATO, and especially because the U.S. is the host country, which gives it even more added importance,” Luik told The Hill. 

“The positions are not yet cast in stone.”