EU defence ministers assembled in Brussels on September 28 to try to formulate a response to increasing Russian aggression in Europe. The talks focused on Russia’s strategy of hybrid warfare – that is, hostile acts that fall below the threshold of actual war.
These tend to include sabotage, disinformation, airspace violations, political interference and cyberwarfare. One part of Europe that has become familiar with these kinds of actions in recent years are the Baltic states – Estonia, Latvia and Lithuania. Quite apart from being nervous because of their physical proximity to Russia, these countries have had to deal with regular acts of hybrid warfare for some years now.
These tactics fall into what is often called the “grey zone” – they generally fall shy of the criteria needed to invoke Nato’s Article 5 clause of mutual self defence, which considers an attack on one member state as an attack on all. The increased use of hybrid actions has intensified in recent years, and the question of how to react to these grey zone threats has become a matter for debate inside Nato. The agreement is that a “game-changing” cyberattack could theoretically merit such a move.
One of the difficulties is that these grey zone tactics come with a degree of plausible deniability. We saw this in 2014, when Russian troops entered parts of Ukraine, including Crimea, with no insignia (sometimes referred to as the “little green men”).
Russia has also claimed that its aircraft and drones violating other countries’ airspaces have done so accidentally. And it’s often hard to determine who the malign player behind a serious cyberattack is and whether there are any links to a hostile government.
The use of cyberattacks is a serious threat. Malicious cyberattacks can disable governance systems and telecommunications, and interfere with air traffic control and energy supplies. They can also be maliciously combined with real world conditions to amplified affect, for example, targeting heating systems in the winter.
On occasions where attacks have been traced to Russia in the past, the Kremlin has blamed “online activists” and “non-state actors”. It is difficult to definitively confirm or disprove this in real time.
Russia has been conducting cyberattacks against the Baltic nations for decades. But since the Russian invasion of Ukraine in 2022, these have formed part of a wider campaign of hybrid aggression – not only against the Baltic states but against a broader range of European states which have supported Ukraine.
Geography suggests that the Baltic states would be the most vulnerable to a conventional military invasion in the event Russia wanted to challenge Nato’s resolve. But there is no particular evidence that Russia either intends to do so, nor is capable of doing so, given it remains bogged down in a heavily attritional conflict in Ukraine.
But Russia’s hybrid actions have become bolder, including drone incursions, arson, and violent sabotage. There are signs that this is being increasingly recognised, such as in the speech to the United Nations general assembly by the UK prime minister, Andy Burnham on September 22.
My ongoing research project in collaboration with partners in the region has been exploring scenarios where hostile states can fuel hybrid crises and how democratic states can respond to them. One of the incidents we have examined in detail was what is known as the “Bronze night” in Estonia in 2007.
This early example of hybrid conflict featured both cyberattacks and various other hostile acts, including the incitement of rioting, disinformation campaigns and economic pressure.
The episode began after city authorities in Tallinn moved a Soviet-era statue, the Bronze Soldier, commemorating the soldiers of the Red Army. The statue was relocated from the centre of the city to a cemetery on the outskirts. While a symbol of pride to Estonia’s Russian-speaking minority, it symbolised Soviet occupation and oppression to many Estonians.
The statue’s removal prompted outrage from many Russian speakers and a campaign of misinformation from Russia. News bulletins claimed the statue – and Russian war graves – had been destroyed. Two nights of rioting ensued. In Russia the Estonian embassy was besieged and the ambassador attacked.
At the same time, Estonia was hit by a concerted campaign of cyberattacks, knocking out banks, media outlets and government departments through a series of distributed denial-of-service (DDoS) attacks. These events prompted Estonia’s government to set up a cyber defence unit. Estonia also now hosts Nato’s cooperative cyber defence centre of excellence.
Baltic defence
Nearly two decades on, what is remarkable is how consistent these hybrid attacks have remained. But as technology continues to develop and expand, so do the grey zone opportunities – whether they are cyberattacks or social media powered disinformation campaigns.
Our ongoing research is developing war-gaming scenarios to support decision-makers in responding to these hybrid threats and the crisis events they can trigger. Through our work, we highlight the multiple ways that Moscow has, and continues to exploit the grey zone, drawing upon Baltic experience, while also highlighting similar hostile Russian tactics elsewhere in our scenarios.
The project explores how policymakers, local and national governments, and organisations can better prepare for such campaigns. The aim is to develop an open-access tool which will be supported by detailed guidance and case studies which will help in training policy development and operational planning.
The Baltic way of dealing with these crises is broadly speaking defined through recognition of the problem, unflinching attribution to Moscow, outspoken support for Ukraine, and a refusal to be intimidated by the Kremlin.
This was perhaps best summed up by the Latvian president, Edgars Rinkēvičs, in May. Responding to what he called “absolutely clear lies,” from Moscow that his country was allowing Ukraine to launch drone attacks against Russia, with the implicit threat that Russia could attack Latvia in response, Rinkēvičs told the state broadcaster that: “We are in a new reality. Such attempts in these anxious times – both internationally and domestically – will and must be treated with a cool head.”