Threats to stability and security are increasingly taking place in the “grey zone”, where state and non-state actors employ hybrid tactics, such as disinformation or cyber attack. How is NATO responding to these challenges?

Today’s security environment is increasingly complex. The times when peace, crisis and conflict were three distinct phases, when conflicts were fought largely with military means, and when adversaries were well known, are over. Cyberattacks are hitting nations below the threshold of a military attack. Social media campaigns create alternative realities that seek to destabilise political communities without a single soldier crossing a single border. And the “hybrid” combination of military and non-military instruments creates ambiguities that make NATO’s situational awareness and, consequently, consensual and speedy decision-making far more difficult.

For these reasons, countering hybrid threats is a top priority for NATO. Since adopting an Alliance strategy on countering hybrid warfare in 2015, Allies have consistently broadened NATO’s toolbox to respond to these threats.

The appearance of “little green men” (irregular armed forces) in Crimea, Ukraine, ahead of its illegal annexation by Russia in March 2014, illustrates one type of hybrid threat. Other hybrid threats can be invisible. © Meduza
)

The appearance of “little green men” (irregular armed forces) in Crimea, Ukraine, ahead of its illegal annexation by Russia in March 2014, illustrates one type of hybrid threat. Other hybrid threats can be invisible. © Meduza

Enhancing situational awareness

The Joint Intelligence and Security Division, which NATO stood up in 2017, includes a unit dealing specifically with monitoring and analysing hybrid threats, marked a major step forward in providing Allies with a better capability to “connect the dots”. Realising that hybrid threats were both internal and external in nature, nations were increasingly willing to share intelligence about domestic developments.

Intelligence assessments are now also used more routinely to support discussions among Allies on hybrid threats to provide a shared picture of trends and help develop a common understanding of a given situation. In an ever more complex security environment, intelligence has to be regarded as a genuine “capability” alongside tanks, drones, or missiles.

Adapting NATO exercises

The best way to test whether NATO’s structure and capabilities are fit for purpose in hybrid scenarios is to exercise them regularly. By injecting more hybrid elements into NATO’s exercises, political and military decision-makers are confronted with the challenge of managing possible tensions between hybrid attacks on individual Allies, the desire to respond collectively, and to do so in environments where information is ambiguous and incomplete.

These exercises, some of them conducted in parallel to and in coordination with the European Union, also highlight the difficulties of an essentially “kinetic” (or military) alliance in responding to non-kinetic attacks. As a consequence, NATO has agreed on an even more ambitious exercise regime, including shorter exercises that will also include top-level civilian decision-makers. NATO’s training and education programme has also been enhanced to include more frequent scenario-based discussions on hybrid situations.

Enhancing Allied resilience

To fulfil its military tasks, NATO is ever more dependent on national civilian infrastructures, which can be vulnerable in particular to hybrid attacks. Ensuring the resilience of this infrastructure has therefore become a prerequisite for NATO’s military effectiveness. At the 2016 Warsaw Summit, Allies committed to enhancing their resilience “against the full spectrum of threats, including hybrid threats, from any direction.”

Acknowledging that enhancing resilience is largely a national responsibility, NATO focuses on advising Allies. It has identified seven “baseline requirements” in strategic sectors to serve as yardsticks for national self-assessments. These baseline requirements are continuously updated over time in light of new challenges, such as the 5G communications standard and, most recently, the response to the coronavirus pandemic.

Over the past decade, Russia has deployed a range of hybrid threats against the energy assets, policies or supplies of NATO Allies, as well as other countries.
(Read more about ‘Energy security in the era of hybrid warfare © Insights ABN AMRO
)

Over the past decade, Russia has deployed a range of hybrid threats against the energy assets, policies or supplies of NATO Allies, as well as other countries. (Read more about ‘Energy security in the era of hybrid warfare © Insights ABN AMRO

Improving cyber defence

Malicious cyber activities are among the most frequently employed elements in hybrid campaigns. This is hardly surprising. Digital weapons will remain an attractive option for years to come: they can be operated by states as well as proxies and private organisations, without geographic constraints. Attribution may take time and responses need to be calibrated to manage escalation.

In line with NATO’s defensive mandate, Allies are determined to employ the full range of capabilities to deter, defend against, and to counter the full spectrum of cyber threats, including those conducted as part of a hybrid campaign. NATO has declared cyber as a new operational domain, and produced a guide for strategic response options to significant malicious cyber activities, which catalogues the broad range of tools – political, military, diplomatic and economic – at the Alliance’s disposal to respond to cyber activities.

Allies also continue to strengthen and enhance the cyber defences of national networks and infrastructure as a matter of priority through the Cyber Defence Pledge. With much of cyberspace in private hands, it is crucial to deepen public-private partnerships, including through the NATO Industry Cyber Partnership. The goal is to establish ‘communities of trust’ in which different stakeholders can share information on cyber threats, discuss effective responses, and keep pace with technological change.

Deploying counter-hybrid support teams

Modelled on already existing advisory teams for resilience or critical infrastructure protection, a Counter Hybrid Support Team (CHST) could be deployed on short notice to an Ally requesting NATO support, either in a crisis or to assist in building national counter-hybrid capacities. Such teams consist of civilian experts drawn from a pool of NATO experts as well as specialists nominated by Allies.

In November 2019, the first CHST deployed to Montenegro, then a new NATO Ally seeking to mitigate vulnerabilities. Upon request, Military Advisory Teams can also be embedded within a CHST, thus offering comprehensive civil-military advice. These steps demonstrate that NATO is building response options below the threshold of Article 5 (on collective defence) of the Washington Treaty.

Deterring hybrid threats

Improving NATO’s ability to deter hybrid actors is also receiving greater attention. While resilience would be a major element of a “deterrence by denial” approach, Allies are aware that “deterrence by punishment” has to be explored as well. Deterrence by punishment seeks to change hostile behaviour by influencing a potential adversary’s cost-benefit calculation.

At the 2016 Warsaw Summit, Allies stated that hybrid attacks could trigger Article 5 of the Washington Treaty. Below such a threshold, other responses, ranging from sanctions to the expulsion of diplomats, need to be considered too. Like collective attribution – arguably one of the strongest means of punishing a hybrid actor – such steps remain a delicate issue, as they touch on national sovereignty. However, Allies need to send a message that hybrid activities come at a price that attackers may not be willing to pay.

Drawing civilian and military instruments closer together

Deterring hybrid threats may sound easy in theory but is very hard in practice. One way NATO is enhancing its hybrid deterrence toolbox is by developing a set of comprehensive preventive and response options that bring together military and non-military instruments. By examining a large spectrum of potential hybrid actions, and by relating the most appropriate combinations of civil and military response tools to each of them, packages of measures will be created that should allow for faster decision-making and more tailored responses.

The challenges this entails are considerable, however. Making such a comprehensive approach work will require not only political agreement of Allies to trigger the necessary action(s), but also the seamless coordination between NATO’s political and military entities in implementing them, as well as possible coordination with other actors and stakeholders.

Examining emerging disruptive technologies

New technologies, such as “Artificial Intelligence” and “big data” analysis, can be beneficial for NATO, for example to quickly detect and counter fake news campaigns on the internet. However, they can also offer a potential aggressor effective means for disruption or diversion as part of a hybrid campaign.

Accordingly, NATO has adjusted the structure of its International Staff by standing up new units dedicated to innovation and to data policy. After having elevated the importance of cyber defence and intelligence a few years earlier, these additional changes underscore NATO’s determination to avoid an aggressor gaining advantage through the use of new technologies. This work has also opened up many opportunities for much needed cooperation with the private sector.

Advances in Artificial Intelligence present both threats and opportunities for the Alliance. © IoT Business News
)

Advances in Artificial Intelligence present both threats and opportunities for the Alliance. © IoT Business News

Detecting and responding to disinformation

Spreading disinformation is among the most frequently used tools in the hybrid toolboxes of many state and non-state actors. Since the party that launches a disinformation campaign will always have the advantage of the initiative, NATO must aim to detect disinformation campaigns early and to dispel them quickly and resolutely.

A NATO website called “Setting the Record Straight” serves as a “one-stop shop” for myth-busting factsheets, speeches, interviews, rebuttal statements, videos, and imagery, and is published in several languages, including Russian. NATO also engages media continuously and persistently asks to correct false stories. Such measures cannot stop hostile propaganda, yet they demonstrate that such propaganda will be exposed. And, just as importantly, they demonstrate that NATO’s own narrative ultimately is far more accurate and plausible than that of its opponents. Countering disinformation will not be fully effective if not supported by continued, pro-active communications to the most vulnerable audiences to make sure that NATO’s narrative/story is as prominent as adversarial narratives.

New ways to engage the whole of government

Responding to hybrid threats demands a whole-of-government approach. This has prompted NATO to look beyond the established formats of summits of heads of state and government, and meetings of foreign and defence ministers.

In May 2019, an informal meeting of the North Atlantic Council brought together, for the first time, national security advisers and senior national leads for hybrid threats. The meeting underscored the value of convening expertise on both civil and military threats, and exchanging national experience on handling hostile hybrid campaigns. It also showed NATO’s willingness to approach hybrid threats in novel and innovative ways.

Deepening NATO-EU relations

As targets of hybrid activities, both NATO and the European Union have grasped the importance of working together on the shared security challenges that hybrid campaigns present.

Largely through informal cooperation at a staff-to-staff level, the two organisations have developed so-called “playbooks” and “operational protocols” to share information on disinformation activities, increase mutual situational awareness and help align their responses to hybrid threats. Mutual briefings on the hybrid landscape, as well as on the specific threat picture, have led to a closer relationship between the organisations. This is supported by the European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE), an initiative launched by Finland in 2016 specifically to foster practical NATO-EU cooperation.

Extending cooperation with partners

NATO does not and cannot counter hybrid threats alone, which is why cooperation with a broad range of partners is essential. NATO and Allies have much to learn from partners, such as Finland and Sweden, with highly sophisticated systems of comprehensive security and total defence designed, tested and updated over decades to respond to the full range of threats.

NATO and Allies also have much to learn from partners such as Georgia and Ukraine, which have been on the front line of intensive and sustained hybrid campaigns. More recently, NATO is engaging with partners in the Asia Pacific, which have extensive experience and best practice to share on national approaches to countering hybrid activity. Building close ties with like-minded nations across the globe is in itself a deterrent to would-be hybrid aggressors.


Countering hybrid threats is a long-term strategic challenge for NATO and its Allies. It requires moving away from the deliberate, sequential planning and decision-making processes that were typical for NATO crisis response operations in the post-Cold War era, and towards a more dynamic approach where continuously updated situational awareness drives political discussion, option development, decision-making, and political control. To do this most effectively, NATO is looking at each hybrid actor as a unique entity with a unique strategic motivation. A more focused approach improves NATO’s ability to contain hybrid campaigns by influencing the cost-benefit analysis of potential hybrid aggressors and to better contest the “grey zone” in what has become the modern theatre of operations.