Is Russia moving from hybrid warfare to open aggression against Europe?

Alleged Russian attacks on European countries are taking on an increasingly kinetic character, while voices are growing in Europe that the term "hybrid attacks" no longer fully describes the nature of Moscow's campaign.

In an analysis published by TVP World, it is argued that sabotage, cyberattacks, interference and other incidents attributed to Russia should be seen not as isolated cases, but as part of a coordinated campaign against European security.

According to this approach, the continued use of the term “hybrid” risks making these acts appear less serious and more politically manageable, keeping them below the threshold of a joint European or alliance response.

Lithuanian Foreign Minister Kęstutis Budrys has said that Russian attacks on European countries are "no longer hybrid" but are "very kinetic."

The same line was expressed by the Polish Foreign Minister, Radoslaw Sikorski, who stated that Russia's hybrid war against Europe has already taken on a kinetic dimension and that Moscow's actions are "on the border between hybrid war and open aggression."

The attacks are being treated as separate incidents.

According to the analysis, one of Europe's main problems is that suspected Russian incidents are handled mainly at the national level.

Investigations are conducted by the authorities of the affected countries, political responses are taken individually, while a mechanism that would treat these incidents as part of a broader campaign towards European security is lacking.

In this way, a coordinated campaign can be fragmented into a series of isolated incidents, making it more difficult to create a collective response.

The analysis argues that Europe should consider the possibility of treating Russian operations attributed with a high level of credibility as part of a joint campaign against European security and be followed by collective and proportionate measures.

These measures could include sanctions, asset freezes, expulsions of Russian operatives, measures against cyberattacks, and pressure on states that aid Moscow.

In the most severe cases, the analysis also mentions military measures, including air defense, interception of Russian drones and missiles, as well as direct NATO action. However, it is emphasized that these would remain emergency measures and do not imply their use in every incident.

"Russia is testing the limits of Europe's tolerance"

The analysis argues that sabotage and other incidents can also serve as a way to measure what costs Europe is willing to impose on Moscow.

Germany has attributed an explosive drone attack on Leipzig-Halle airport to Russia, while European authorities have investigated suspicions of sabotage against defense and infrastructure companies in Poland, Estonia and Slovakia.

Russia has also been linked to cyberattacks, interference in rail and energy systems, threats to underwater infrastructure, and violations of the airspace of NATO countries.

The Institute for the Study of War (ISW) has assessed that the Kremlin is conducting a series of kinetic and cognitive campaigns against Europe that support each other.

In some cases, European responses have been largely national. Poland, after the sabotage of a railway it attributed to Russia, closed the last Russian consulate in Gdansk. Germany, after the Leipzig incident, closed the Russian consulate in Bonn and the “Russian House” cultural center in Berlin.

Moscow responded by closing the German consulate in St. Petersburg and its Goethe-Institut centers.

According to the analysis, these measures have created costs for Russia, but have remained largely national responses and have not automatically transformed into coordinated EU sanctions packages, joint expulsions, or other collective measures.

Strategic goal – credibility of Article 5

Polish Prime Minister Donald Tusk has warned that Russia could target NATO territory through attacks presented as accidental, with the aim of making it difficult for the alliance to respond jointly.

According to Tusk, such a scenario could be used to present the incident as an unintentional event and avoid discussion about activating Article 5.

In this context, the analysis argues that one of Moscow's strategic objectives may be to weaken the credibility of collective defense and create divisions between European countries.

NATO has stated that a hybrid operation, under certain circumstances, could lead to the activation of Article 5. However, the decision depends on the political assessment of the Allies and the concrete circumstances of each incident.

Warnings for the coming months

Tusk has also warned that the final months of the year and winter could be among the most critical periods of the war in Ukraine.

He has warned of the possibility of increased Russian pressure on NATO's eastern flank through drone or missile attacks, which could appear to be unintentional incidents.

Meanwhile, European countries are increasing defense spending and investing in new military capabilities. However, some of these capabilities are expected to become fully operational only in the coming years.

At the same time, the United States has called for Europe to take more responsibility for its conventional defense, while recent reports have raised the possibility of reducing the American military presence in Europe.

NATO remains the main mechanism for military defense and deterrence in Europe, while the European Union has at its disposal a large number of economic instruments that can be used in the wake of a cyberattack or sabotage.

These include sanctions, asset freezes, export controls, and defense financing mechanisms.

However, competences are divided. NATO does not impose sanctions, while the EU does not command NATO forces. Also, countries such as the United Kingdom and Norway, which are of great importance for European security, are not part of the EU.

European Commission President Ursula von der Leyen has proposed several mechanisms to strengthen coordination, including a handbook against hybrid threats, an Emergency Security Protocol, and a European Security Council.

The idea is that these mechanisms will create a more coordinated system for assessing threats and responding to them, including non-EU partners such as the UK, Norway, Ukraine and Canada.

However, the effectiveness of such a mechanism would depend on the willingness of European governments to determine in advance how to respond and to take concrete measures, rather than coordination remaining only at a declarative level.

The analysis was written by Stuart Dowell and published by TVP World.