.jpg)
Russia’s intensifying hybrid warfare poses an acute challenge to European societies. Because they take place in a legal gray zone below the threshold of armed conflict, these actions are difficult for Western governments to respond to within the limits of their own legal frameworks and existing institutions. Russia exploits the openness of democratic societies and often tries to weaponize Western liberal values against the targeted countries. Its objectives are usually to sow fear and discord in these societies, which can lead to less popular support for Ukraine or a general weakening of the government’s position.
Over the past decade and more, Russia has been able to cultivate its hybrid interference strategies almost with impunity due to lack of political willingness in European capitals to attribute and counter its hostile actions. This article tracks some of the main challenges that hybrid warfare currently presents in Europe, including a variety of methods deployed: non-physical attacks (including disinformation campaigns, cyber attacks, and prank calls to officials) and a myriad of physical incidents (including sabotage of private or public property and critical infrastructure, instrumentalized migration, property purchases in strategic locations, GPS jamming, and assassination plots). It argues that Nordic-Baltic regional coordination is crucial in responding to Russian gray zone aggression. European countries can only effectively counter the intensifying threat if they work together. Because of their long-standing exposure to Russian intimidation and interference, as well as already existing regional cooperation frameworks, Nordic and Baltic countries are well suited to develop a response blueprint that can be scaled up to the European level in the future. Currently, European policy responses lag behind the increasing pace of incidents. As a first step, information exchange to establish proper situational awareness needs to be improved and consultation processes streamlined between countries on the EU and NATO level, as well as between the organizations.
Multidimensionality in Russia’s Hybrid Playbook
The main challenge in responding to Russia’s hybrid warfare is its multidimensionality. A single incident can include elements pertaining to national security, international law and/or domestic rule of law, and moral dilemmas. In addition, there is always an information dimension connected to an attack: the perpetrator of a physical attack uses the incident as a tool of information warfare. The goal is to amplify the effect of an operation in a physically limited area; for example, putting pressure on a neighboring country by sending large numbers of migrants to its border only works if the target society is aware of their arrival and it galvanizes public opinion and triggers a political reaction. The questions the aggressor is interested in are: How does the targeted society react? What is the media reporting about the incident like? Does the attack succeed in spreading fear? How well are officials prepared?
The most obvious threats to targeted countries’ national security are incidents of aggression that are below the threshold of armed conflict but that include a military component. A frequent element in the Russian repertoire is the use of military exercises or airspace violations by military aircraft for intimidation purposes. Examples of such intimidating military maneuvers include NOTAMs in the Arctic close to Norwegian waters, simulated air attacks on Norway, and perhaps most notoriously, the simulated nuclear attack on Sweden during the Zapad 2013 exercise. A prime example of an airspace violation used to express discontent and a veiled threat was when two Russian Su-27 jets, transporting Iskander missiles to Kaliningrad, buzzed Finnish airspace the day before Finland signed a bilateral letter of intent on defense cooperation with the United States in 2016. Furthermore, NATO Baltic Air Policing counted over 300 interceptions of Russian aircraft in 2023 in the Baltic states’ airspace. The challenge is often how to calibrate a response that is firm enough but will not trigger unwanted escalation steps.
Apart from direct and immediate threats to physical security, upholding the rules-based world order that guarantees countries’ existence and right to sovereignty is an essential security interest in its own right, especially for small countries. However, the often criminal nature of Russia’s strategies, or at least their taking place in a legal gray zone, presents a challenge because it means that a symmetric response is not available to Western countries that value the rule of law. Often, a conflict emerges between a target country’s immediate national security and its security interest in protecting the rules-based international order, as will be illustrated with the example of instrumentalized migration.
Such a conflict between responding to an immediate threat to security and upholding the rules-based international order and human rights creates a moral dilemma for the targeted country. Especially if a particular response leads to human suffering, it can cross the limit of societal acceptance. Different parts of the country’s population often do not react uniformly, which can create division within a society.
Domestic Responses: Closing Legal Loopholes
While foresight strategies and overall crisis preparedness can help societies cope with the impact of Russian gray zone aggression and reduce its effectiveness, no society is completely immune. Russia excels at target audience analysis and often tailors its attacks to exploit the specific vulnerabilities of the country in question, often adapting details to the new context to apply a strategy that has previously been successful against another target. Malign actors also learn from each other. For example, a disinformation campaign spread widely in Sweden in 2021 and 2022, claiming that Swedish authorities were taking Muslim children from their families. The campaign bore significant resemblance to a Russian disinformation campaign against Finland in 2012, which had claimed that the Finnish government was unfairly taking Russian children from their families. While the campaign against Sweden did not seem to originate from Russian sources, there nevertheless was a connection: some videos used as evidence against Sweden had circulated in Russian media in 2012. The 2021–2022 disinformation campaign spread like wildfire in Arabic-language media and was one of the largest-scale disinformation attacks against Sweden to date, according to the Swedish Psychological Defence Agency. The campaign, together with disinformation about Quran burnings in Sweden in 2023 that was amplified by Russian-supported actors, contributed to Sweden’s troubles in its NATO accession process. The disinformation campaign even spiraled into physical violence: The Swedish embassy in Baghdad was stormed and set on fire in July 2023 and three Swedish soccer fans were shot (two fatally) after a game in Brussels by an Islamist extremist in October 2023.
The question is not how to preempt and avoid every attack but how to render them as ineffective as possible, which requires authorities to be prepared to respond flexibly to unexpected disruptions. As the Baltic and Nordic countries have been frequent targets of Russian gray zone aggression since long before Russia’s full-scale invasion of Ukraine in February 2022, they have developed different response methods with varying degrees of success. It is important for European countries to review their domestic legislation regularly and consider adjustments whenever possible. Examples from the Nordic-Baltic region show that legal measures can be successful, albeit often with delay due to the lengthy nature of legislative processes in democratic countries.
A rare opportunity for a symmetric response presented itself in May 2024, when a document suggesting changes in Russia’s maritime borders with Finland and Lithuania appeared (and disappeared some hours later) on the Russian Ministry of Defence’s website. The Kremlin denied any intention of redrawing the border, but the incident nevertheless caused alarm in Finland and Lithuania, as well as in Estonia, where Russia later removed maritime border buoys. The Finnish authorities reacted by initiating a reassessment of the maritime border, due every thirty years to account for natural topographical changes and last conducted in 1995—a symmetric response well within international law.
Another case where Finland was able to shield itself through a legal response related to property purchases by Russian nationals in strategic locations in Finland. After Finnish legislation changed in the early 2000s to be more permissive of third-country nationals buying property in Finland, Russian nationals started systematically buying properties in locations close to Finnish military bases and installations, data masts, and important supply lines. Often, the purchases were made with the expressed intention of opening tourism businesses, but the plans rarely materialized. The most infamous example was the acquisition of island and coastal properties in the Finnish archipelago by Russian-owned company Airiston Helmi. Airiston Helmi installed a helicopter landing platform on an island and purchased decommissioned ships from the Finnish navy, which the company failed to rename and repaint. Finland is extremely dependent on the sea trade lines, as almost 90 percent of its imports and exports are transported via the Baltic Sea. The Finnish authorities—concerned that the company had essentially established a monitoring and blockading capacity along Finland’s main sea lines—intervened in 2018, prosecuting Airiston Helmi on charges of financial crimes. Despite the long-standing concerns over the pattern of Russian property purchases and a parliament debate on the topic in 2014, it took until 2020 to reintroduce more restrictive legislation on property purchasing rights for third-country nationals, who now in certain cases have to seek permission from the Finnish Ministry of Defence. In recent years, the ministry has declined permits to Russian buyers in several cases. The already-purchased properties remain an issue, however, as ex-post confiscation is a difficult matter in Finland.
Other countries in the region are grappling with the same issue. In spring 2024, during the NATO exercise “Nordic Response,” Norwegian media reported that Swedish and Norwegian defense forces had hired cabins overlooking the Bardufoss military airbase in northern Norway that were owned by Russian oligarchs close to the Kremlin. Furthermore, Russia has been particularly cynical in its use of the Russian Orthodox Church (ROC). The ROC has been utilized not only as a propaganda tool in the war against Ukraine, with Patriarch Kirill blessing the war, but also for espionage purposes. For example, the Moscow patriarchate has established a church in Västerås, Sweden, conveniently close to an airport and a Westinghouse nuclear fuel production site, and another one next to the Marma military shooting range in an area with critical infrastructure like bridges and power plants (though the rental contract for the Marma church is now terminated). The ROC lost state-funded support in Sweden in 2024 after the Swedish Security Service issued a warning about the church in Västerås on the grounds of its connections to Russian intelligence and security services and the funding it received from Russian state-owned energy company Rosatom. The ROC also operates a church close to Norway’s most important naval base in Haakonsvern. A recent attempt to build a church next to the Vardø military radar complex in northern Norway was averted. Churches enjoy special protection in Sweden and Norway, which makes it particularly hard to address the issue once the ROC has established presence.
Values vs. Security: A Difficult Balancing Act
The instrumentalization of migration has proven one of the hardest challenges to tackle. Russia first tested this strategy in 2015–2016 at the Finnish and Norwegian borders, when it sent refugees from the Middle East and North Africa to cross the border on bicycles. At the time, Finland resolved the situation with Russia through a bilateral agreement, as no collective solution on the EU level was offered. Finland’s then president Sauli Niinistö recounted that the message from EU partners was that Finland should try to solve the problem directly with Russia. This message signaled to Russia that its strategy had worked, as Finland and Norway were left to deal with the problem with inadequate national means. In recent years, Belarus—acting as a Russian proxy in the wake of its gradual takeover by Russia—has been directing migrants through its territory to its borders with Latvia, Lithuania, and Poland. And as soon as the tide turned for Russia in its war with Ukraine in fall 2023, the Russian border guard began bringing groups of migrants to the Finnish border and pushing them to the Finnish side. As a response, Finland has kept the border crossing points to Russia closed since November 2023. Countries targeted by instrumentalized migration have responded in various ways, but illegal pushbacks have become almost a norm both in the Mediterranean and along the Belarusian border. Finland has recently attempted to legalize pushbacks with national legislation, but this is in violation of both EU law and international law on human rights.
Weaponized migration as a gray zone aggression is a particularly good example of the multidimensional nature of hybrid warfare. It has at least four dimensions that conflict with each other, which makes it impossible to find a legally and morally clean solution:
- National security. The risk of letting people in through the Russian route is that as the Russian border guard is organizationally part of the FSB, asylum seekers may be compelled to commit acts of sabotage once in the target country (acting as “little green men”). The Russian objective is to overwhelm the authorities of the target country as well as to cause costs related to the processing, housing, and possible returns of the asylum seekers.
- International law and the rules-based world order. There is no way to stop all asylum seekers from crossing the border without violating their right to asylum—a human right under international law. The Russian objective here is to force the target countries to choose between their immediate border security and the values and rules that are the basis of liberal Western democracy. Illegal pushback procedures cause not only an image problem for the target countries, which Russia can in turn exploit to point out Western hypocrisy, but also legal problems and costs if the EU decides to sue its member states.
- The information dimension. In the case of the Finnish border, Russia easily reached its targets in the information sphere, as the public debate about the pushback law was highly divisive. However, divisions are not limited to domestic public debates but can also manifest between Western countries if they prioritize the dimensions differently and therefore fail to reach consensus on how to respond collectively.
- The moral dimension. When pushbacks result in deaths at the borders, public opinion in the targeted societies can reach a breaking point. Citizens may raise doubts about the proportionality of prioritizing border security at the cost of human suffering, even if it is widely acknowledged that the asylum seekers in these cases may pose a security risk and Russia and its proxies are the main culprits. Here, Russia’s objective is to stress the inhumanity of the pushback procedures.
Nordic and Baltic states have found different approaches to deal with these challenges. In Finland, the balance between values and security has been in favor of security, sometimes at the expense of values. Sweden offers a contrasting example: when it was presented with the dilemma of a central value in the Swedish society—freedom of speech—being instrumentalized against Swedish security interests in Quran burnings that created complications for Sweden’s NATO accession process and led to a deterioration of the country’s domestic security situation, values nevertheless prevailed over security. The balance should be somewhere in between. Sometimes democracy must be protected against hostile instrumentalization, but this should not be done at the expense of the core values that build the basis of free societies.
The Attribution Dilemma
Two further challenges in responding to gray zone aggression are attribution, and if that can be done with confidence, appropriate measures. Attribution is not only a question of collecting sufficient evidence, but also of political willingness. Until Russia launched its full-scale war of aggression against Ukraine in 2022, there was little political willingness in Europe to address Russia as a security threat. Instead, Russia’s constant intimidation was tolerated for the sake of good relations—despite its clearly aggressive aims against Ukraine already in 2014. A typical example is the Airiston Helmi legal case, which Finnish authorities prosecuted purely on grounds of financial crime, with no mention of a security threat. Targeted countries have tolerated some high-level gray zone aggression despite clear attribution to Russia, such as the downing of Malaysia Airlines Flight MH17 in 2014, for which the Netherlands and Australia later sued Russia; the attempted poisoning case in Salisbury, UK, in 2018; and the Tiergarten murder in Berlin in 2019, none of which led to a fundamental revision of relations with Russia. Although the downing of the MH17 flight was not itself a targeted attack, the ensuing Kremlin disinformation campaign about the incident certainly was. The attempted and successful assassinations merely led to the expelling of suspected intelligence officers from Russian embassies, and the Flight MH17 legal case has been overshadowed by Russia’s escalation into full-scale war in Ukraine.
The problem with attribution is that if a government calls out another state actor as the perpetrator of a hostile action but cannot respond in kind, it may spread fear and appear weak to its own population and thus help the hostile power to achieve its goals in the information sphere. Strategic communication is an important part of societal resilience, as it shapes citizens’ perceptions of their security environment. The best way to communicate about hybrid threats is to present a solution. This requires investment into preparedness and resilience of different societal and state functions, including regular analysis and identification of possible weak points in the targeted country’s own legal framework, critical infrastructure, intragovernmental coordination, and international partnerships. Effective deterrence in the sphere of hybrid warfare would mean that gray zone aggression misses its goals because of a sufficient level of resilience in the targeted country. If an attack fails to cause physical disruptions of any critical functions of a society and the public stays calm, the costs of such hostile actions eventually outweigh their benefits. Currently, most European countries have not sufficiently addressed exploitable loopholes in legislation, critical infrastructure has often not been protected from potentially hostile foreign direct investment, ministries and agencies within governments work in silos, and European countries lack effective coordination mechanisms to see the pattern in Russian and other malign actors’ actions.
The question of imposing costs on the aggressor is even more difficult for many European governments because of the asymmetry problem in available responses. Finland has recently found a creative way to impose significant costs on the Kremlin: it began to confiscate Russian assets in Finland in October 2024. Finnish authorities had in 2023 unsuccessfully attempted to confiscate the Russian Science and Culture Center in Helsinki, which has long been known to have connections to the Russian secret services, but had to release it because the sanctions used as legal basis for the confiscation applied only to Russian individuals, not the state. However, in 2024, Finland found a creative legal solution. A compensation claim by the Ukrainian energy company Naftogaz for loss of revenue in the Russian-annexed Crimea region since 2014 has enabled Finnish authorities to confiscate forty properties in Finland with an estimated total worth of about 4 billion euros. If the properties can be sold at a later date, Naftogaz will receive the profits as a contribution toward its 5 billion euro compensation claim.
A Way Forward: A Nordic-Baltic Blueprint for More and Better EU-NATO Cooperation
Overall, a national response is bound to be less effective than a collectively coordinated multilateral one. However, there are several challenges on the collective level. The first is lack of information-sharing practices and mechanisms, which leads to insufficient situational awareness in a regional or European context. Intelligence services have established information-sharing practices, but exchanges on the political level are still clearly insufficient. For example, the Russian pranksters Vovan and Lexus have been able to dupe a large number of Western officials by pretending to be African Union officials, Russian or Belarusian opposition figures, or Western activists such as Greta Thunberg. Danish, Norwegian, Swedish, Polish, Irish, British, and Italian foreign or prime ministers, as well as French President Emmanuel Macron (who has also been impersonated by the duo), Turkish President Recep Tayyip Erdoğan, the United Kingdom’s Prince Harry, and U.S. Senator Bernie Sanders, have fallen victim to the Russian pranksters. In addition to the embarrassment of having fallen victim to the pranksters, these officials have often talked to them about sensitive and confidential issues such as strategy for the war in Ukraine and exposed significant information security gaps.
Often, the first reaction by government officials to an incident can determine the success or failure of the overall response. The maritime border case regarding Russia’s borders with Finland and Lithuania in May 2024 illustrated the coordination problem: while Lithuanian ministers immediately demanded tough action in fiery social media posts, their Finnish counterparts made a concerted effort to downplay the incident. The lack of coordination between Finland and Lithuania was painfully obvious and contributed to confusion in the information sphere.
The three Baltic states—Estonia, Latvia, and Lithuania—have become increasingly well coordinated among themselves and with Poland, including in matters concerning their borders with Russia and Belarus: they restricted visas for Russian citizens in a concerted effort in late summer 2022, ahead of Finland, and have made efforts to jointly build fortifications along the border in the Baltic Defense Line. The five Nordic countries—Denmark, Finland, Iceland, Norway, and Sweden—are also a close-knit group with long-standing cooperation in many policy fields, which generally helps them respond to hybrid threats thanks to well-established information-sharing practices, but the overall coherence of the Nordic-Baltic region requires further improvement.
Institutionally, a framework for collective action already exists. Ideally, the EU could provide a useful tool for countering hybrid threats, as its regulation power could address some of the legal loopholes. For example, it recently introduced a new sanctions regime for hybrid threats and commissioned a report on improving Europe-wide resilience and preparedness from Niinistö (in recognition of Finland’s advanced preparedness practices) that was released in October 2024. As a political union, the EU can in some cases be more suitable for escalation management purposes than NATO can as a military alliance. Finland, in particular, has relied on the EU in the most high-profile hybrid incidents: When the Balticconnector gas pipeline between Finland and Estonia was damaged in October 2023, Finland activated the EU’s hybrid toolbox, a new and promising instrument providing a blueprint for collective measures against hybrid threats. When Russia began to bring asylum seekers to the Finnish border, Finland requested support from the EU’s border agency Frontex. On the other hand, NATO is better equipped to deal with technically complex threats, such as to critical maritime infrastructure, where military capabilities are required in addition to civilian monitoring. EU-NATO cooperation is therefore more necessary than ever and should be prioritized for the greater good of the transatlantic community. The Baltic and Nordic countries, now with important security-related portfolios in the new European Commission, can bring their experience to help the EU create more effective responses.