Drones, cyberattacks, and sabotage: Hybrid warfare from Russia? | To the Point

Key Concepts

• Hybrid War: A multifaceted conflict strategy operating in "gray zones" between traditional war and peace, friend and foe, internal and external security, and civil and military domains. It leverages ambiguity and plausible deniability.
• Gray Zones: Ambiguous areas where actions fall short of conventional warfare but are still hostile, making attribution and response difficult.
• Plausible Deniability: The ability for an actor to deny responsibility for an action due to a lack of definitive proof, often achieved through proxies or indirect methods.
• Critical Infrastructure: Essential systems and assets whose disruption would have a debilitating impact on national security, economic security, public health or safety, or any combination thereof (e.g., energy, transport, water, IT networks).
• Weaponized Migration: The deliberate use of migration flows as a tool to exert pressure, destabilize, or infiltrate target countries.
• Disinformation/Misinformation: The intentional spread of false or misleading information to manipulate public opinion, sow distrust, or influence political processes.
• Single-Use Agents: Individuals or groups recruited for specific, often short-term, disruptive or intelligence-gathering tasks, making them difficult to trace back to a state actor.
• Zeitenwende (Titan vending): Germany's strategic shift in defense policy, announced in response to the war in Ukraine.
• Comprehensive Hybrid Defense/Resilience Building: A multi-domain approach to counter hybrid threats, encompassing military defense, societal resilience, critical infrastructure protection, and counter-disinformation efforts.

---

The Resurgence of Hybrid Warfare in Europe: Challenges and Responses

The discussion centers on the return of "hot war" in Ukraine and the simultaneous escalation of "hybrid war" targeting NATO countries, particularly Germany. This hybrid warfare operates in various "gray zones" between war and peace, friend and foe, and internal and external security, making attribution and response complex.

Escalation and Manifestations of Hybrid Threats

• Increased Frequency and Visibility: While hybrid operations are not new, there has been a significant "ramp up of frequency" in recent weeks and months. Drone sightings, in particular, are highly visible to citizens, increasing public concern.
• Specific Incidents:
  • Drone Attacks: Munich airport was brought to a standstill on two separate days due to alleged Russian criminal-controlled drones. European airports in Oslo and Copenhagen also experienced closures after major infrastructure attacks. NATO missiles costing tens of thousands of euros have been used to shoot down cheaper Russian drones over Polish territory.
  • Cyber Intrusions: Over a thousand cyber intrusions are recorded weekly in Germany alone, targeting critical infrastructure, government agencies, and businesses. The Berlin airport experienced profound consequences from a cyber attack.
  • Sabotage: Attacks on critical undersea infrastructure (maritime cables, pipelines) were prevalent last year, leading to NATO's "Baltic Sentry" mission. More recently, attacks have shifted to transportation infrastructure, including military corridors and train lines vital for aid to Ukraine, as well as defense infrastructure (military bases, production facilities, executives).
  • Espionage: Classic espionage remains a component, exemplified by an AFD politician's employee sentenced for spying for China.
• Attribution and Plausible Deniability: Experts point to autocracies like Russia, China, and Iran as instigators. While many activities fit the context of the Russia-Ukraine war and Western support, tracing single events is difficult due to "plausible deniability," with drones being a "perfect means of hiding." Russian President Vladimir Putin has mocked Western "hysteria" regarding these accusations.

Strategic Goals of Hybrid Warfare

Yanick Khadman outlines three principal objectives behind these incidents:

1. Testing Readiness and Assertiveness: To gauge how quickly and assertively NATO and EU members respond, and whether responses lead to policy changes.
2. Sowing Division: To create internal debates and divisions among EU/NATO members regarding appropriate responses (e.g., assertive vs. defensive postures).
3. Psychological Effect: To generate a feeling of uncertainty and insecurity among the population, undermining credibility in defensive institutions and alliances. This also serves to "distract from the actual front line which is in Ukraine," shifting headlines away from the conflict itself.

Broader Dimensions of Hybrid Warfare

• "Iceberg" Analogy: Colonel Johan Schmid emphasizes that hybrid warfare is like an iceberg, with only a small "tip" visible. Less visible but equally threatening elements include "weaponized migration routes" and the infiltration of "fifth columns" (adversaries entering Europe).
• Disinformation and Misinformation: Identified as the "top risk" in the World Economic Forum Global Risks Report 2025, even surpassing wars and climate change. Disinformation campaigns aim to create distrust in society and influence elections. While some measures against misinformation have worked in recent elections, it remains a significant, ongoing problem.
• Infiltration by Spies: Experts assume many European countries are already infiltrated by spies and "single-use agents" from other states, further increasing insecurity and distrust.

Challenges in European Response

• Operating in Gray Zones: Hybrid actors deliberately exploit interfaces between war/peace, state/non-state actors, and reality/fiction to paralyze situational awareness and decision-making processes.
• Disproportionate Response Costs: Defending against hybrid threats can be resource-intensive; for example, stopping a cheap drone can require "massive resources" and expensive missiles.
• Difficulty in Comprehensive Resilience: It's challenging to build resilience in every domain, especially for extensive infrastructure like train lines or critical cables that are kilometers long and cannot be easily fenced.
• Adaptive Adversaries: When resilience is increased in one domain (e.g., maritime), adversaries shift to another (e.g., air incursions).
• Germany's Vulnerabilities and Slow Response:
  • Societal Vulnerability: German society is "largely unprotected against non-military hybrid attack vectors" like weaponized migration and ideological radicalization.
  • Legislative Lag: Germany is perceived as slow in reacting with legislation. For instance, a recent law to increase physical safety of critical infrastructure did not initially include provisions for drone defense, only being addressed after increased headlines. Similarly, a law for cyber resilience excludes some state infrastructure.
  • Democratic Processes: "Quick is not something that democracies usually are," making rapid legislative and policy changes difficult.

Proposed Solutions and Recommendations

• Raising the Cost to Russia: Yanick Khadman suggests NATO should signal "clear red lines" that, if violated, would lead to "severe consequences." Poland's defense minister's firm stance against further incursions, which seemingly led to a cessation of incidents, is cited as a good example.
• Comprehensive Hybrid Defense and Resilience:
  • Multi-dimensional Situational Picture: Creating a holistic view across military, information, economic, and societal domains.
  • Closing Hybrid El Doradoes: Reducing space for hybrid actors within societies, e.g., by addressing weaponized migration.
  • Improving Anticipation: Enhancing capabilities to anticipate unorthodox hybrid attack vectors and understand national vulnerabilities.
  • Critical Infrastructure Protection: Focusing on drone defense for all critical infrastructures (e.g., power plants), as drones are easily accessible to state and non-state actors.
  • Societal Resilience: Informing and communicating with the public not to spread fear, but to raise awareness, demonstrate control, and educate on protective measures. This includes sending experts to schools and businesses.
  • Technological Solutions: Developing cheaper drone defense systems like laser systems.
  • Enhanced Cooperation: Improving data exchange between intelligence services in NATO and the EU. Germany's armed forces already operate a cyber and information domain space command.
• Change of Mindset: Wilhelmina Stanglin emphasizes the need for a fundamental "change of mindset" to be ready for this new type of warfare.

Conclusion

Europe is currently not fully ready for hybrid warfare. While some progress is being made, particularly in military defense (Germany's Zeitenwende), significant vulnerabilities remain in societal resilience, critical infrastructure protection, and legislative responsiveness. The ongoing challenge requires a comprehensive, multi-domain approach, clear red lines, improved anticipation, and a fundamental shift in mindset to effectively counter the evolving and adaptive nature of hybrid threats.