Bottom lines up front
LONDON—It’s not just suspicious cable cuts, arson attacks, parcel bombs, and the weaponization of migration. All of these forms of aggression have already hit Europe, causing considerable harm and expense, but they’re far from the only attacks below the threshold of war to have hit Europe in recent years. In fact, hostile actors seem to think up new forms of subthreshold aggression almost monthly.
NATO should take on a more active role in coordinating the response to such attacks and in helping allies build response options. Specifically, the Alliance should use the upcoming NATO Summit in Ankara to establish response options for its member states.
People, including some NATO officials, often refer to hostile activities below the threshold of Article 5 as “hybrid warfare.” That term, however, isn’t quite accurate. “Hybrid” denotes a combination of things that are very different: For example, a hybrid car uses both gasoline and electricity. As Frank Hoffman, who coined the term “hybrid war,” explained in 2007, “Instead of separate challengers with fundamentally different approaches (conventional, irregular or terrorist), we can expect to face competitors who will employ all forms of war and tactics, perhaps simultaneously.” Hybrid war is, in other words, the combination of conventional war with irregular forms of aggression. Thus, “subthreshold” or “gray zone” are more accurate descriptions of the types of recent attacks on some NATO member states.
Gray-zone threats are not new. They have been a concern in Europe for at least the past decade. But more recently, the number of subthreshold activities and their different iterations has proliferated. Whereas a decade ago, the forms of aggression taking place were mainly disinformation campaigns and cyberattacks, over the past five years or so, European countries have been subjected to attacks on telecommunications masts, intrusions into water treatment plants, weaponized migration, suspicious incidents involving undersea cables and pipelines, and arson attacks. Drones have disrupted airports. What makes these incidents different from ordinary criminal cases of arson or drone disruption is that European countries have been able to credibly trace them to hostile states.
Unfortunately, the past is no guide to the future. In the months and years ahead, Russia and other states involved in gray-zone aggression might continue to target, say, telecoms infrastructure, but they might also decide to switch to completely different targets. Gray-zone aggression can utilize almost any tool and appear anywhere; adaptability is a defining feature of it.
That makes defense against gray-zone aggression difficult. (Indeed, my book on the matter is called The Defender’s Dilemma.) How do you defend your country against forms of aggression that are below the Article 5 threshold—and may never have taken place before?
Despite the difficulties, many NATO members—especially in the Nordics and Baltics, but also countries such as the United Kingdom—have been highly proactive in the past few years. Indeed, because NATO is only responsible for an “armed attack” according to Article 5, the alliance has no obvious role in defending against subthreshold threats. The responsibility rests with individual states. So far, the countries that have tackled subthreshold threats have focused on enhancing societal resilience, a strategy that makes sense since it’s not escalatory. In many cases, NATO has coordinated allies’ cooperation and sharing of best practices—not in response to attacks but as a general matter of preparedness.
Yes, at their summit in Vilnius in 2023, NATO leaders agreed that the Alliance could respond to “hybrid attacks,” though they didn’t specify the kinds of attacks, and to date, NATO has not avenged any such attacks. In case of an extremely serious subthreshold attack—a coordinated assault on hospitals within the Alliance, for example—NATO might respond with a coordinated counterattack on the hostile state behind the assault.
But NATO remains a military alliance. Its task is not defense against subthreshold threats, and assuming that the Alliance can take on the task because no other organization is available is unrealistic. NATO can, however, become a much stronger convener, a hub that allows allies to share best practices and coordinate responses even if the Alliance does not respond to subthreshold attacks itself.