How Hybrid Tactics Targeted NATO Allies in 2024: Drones, Exploding Parcels, Sabotage

When mysterious drones began appearing over oil rigs and wind farms off Norway’s coast about three years ago, officials were not certain where they came from.

But “we knew what they were doing,” Stale Ulriksen, a researcher at the Royal Norwegian Naval Academy, said in a recent interview. “Some of it was espionage, where they are charting a lot of things. Some of it, I think, was positioning in case of a war or a deep crisis.”

The drones were suspected of being launched from Russian-controlled ships in the North Sea, Mr. Ulriksen said, including some ships that were near underwater energy pipelines. Norway could not do much to stop them, he added, given that they were flying over international waters.

In recent weeks, reports of drone swarms over the United States’ East Coast have brought fears of hybrid warfare to widespread attention. Only 100 out of 5,000 drone sightings there required further examination, U.S. officials said, and so far none are believed to have been foreign surveillance drones. But it is a different story for the drones spotted in late November and early December over military bases in England and Germany where American forces are stationed.

Military analysts have concluded those drones may have been on a state-sponsored surveillance mission, according to one U.S. official familiar with the incidents, who spoke on the condition of anonymity to discuss an open investigation. British and German defense officials declined to discuss details of the sightings.

Experts said the drones’ presence was indicative of a so-called hybrid or “gray zone” attack against the West, where a range of tactics — military, cyber, economic and even psychological — are used to covertly attack or destabilize an enemy.

As Russia, Iran and other hostile states become increasingly brazen in their hybrid attacks on Western countries — such as the hacking of sensitive computer systems and alleged assassination plots — defense officials face a thorny challenge. How to deter such acts without touching off a broader and potentially deadly conflict? And how to assign blame against the attacker when the strikes are designed to evade culpability?

‘It’s not random; it’s part of military operations.’

Hybrid attacks are not new, but they have escalated in recent years.

One of the most visible and potentially deadly incidents came in July, when a series of packages exploded in Europe. Postmarked from Lithuania, the parcels contained electric massage machines with a highly flammable magnesium-based substance inside. Two exploded in DHL cargo facilities in Britain and Germany, and the third in a Polish courier firm.

Western officials and Polish investigators said they believed the packages were a test run by Russia’s military intelligence agency to plant explosives on cargo planes bound for the United States and Canada.

“We are telling our allies that it’s not random; it’s part of military operations,” Kestutis Budrys, Lithuania’s foreign minister, said of the explosions. “We need to neutralize and stop it at the source, and the source is Russia’s military intelligence.” Russia denies being behind acts of sabotage.

Other examples of hybrid tactics include cyberattacks on Albania in the past several years, which an investigation by Microsoft concluded were sponsored by Iran, and Russia’s unsuccessful attempt to sway presidential elections using disinformation in Moldova in October and November, according to Moldovan and European officials. European countries are also investigating whether a number of ships intentionally cut underwater cables in recent months in an attempted attack.

While China, Iran and North Korea have shown a growing appetite for hybrid attacks, officials said that Russia in particular has deployed them as covert sabotage against NATO allies since the Kremlin’s full-scale invasion of Ukraine in 2022.

“Russia has stepped it up across the board, and as a result, it is reaching levels that are of growing concern,” James Appathurai, a NATO deputy assistant secretary general who oversees hybrid warfare strategy, said in an interview. “They are willing to accept more risk to us, to the safety of our citizens’ lives.”

Britain, Germany, the United States and Baltic and Nordic countries close to Russia’s border are among the Western countries most targeted by hybrid threats, in part because of their prominent support for Ukraine, officials said. Last year, according to Western officials, American and NATO intelligence agencies uncovered a Russian plot to kill the chief executive of a German weapons giant, Rheinmetall, which has built millions of dollars’ worth of arms and ammunition for Ukraine.

The drones spotted in Britain in November — three days after President Biden said Ukraine could launch U.S.-made deep strike missiles into Russia — were larger and more durable to challenging weather than a hobbyist would be expected to own, and were mostly spotted after nightfall. That is partly why military analysts concluded that a hostile state was responsible, the U.S. official said.

Then, in early December, around the time the drone sightings in Britain began to taper off, drones appeared above Ramstein Air Base in Germany, one of the largest American military posts in Europe. Some were also reportedly spotted near facilities owned by Rheinmetall.

Investigators are considering whether the flights in both countries were “out of a Kremlin playbook,” the U.S. official said.

Russia has repeatedly denied launching hybrid attacks against NATO, in many cases ridiculing the accusations, even though NATO officials say Moscow has set up a special directorate focused on carrying them out.

Russian officials also say they are the ones being targeted. “What is going on in Ukraine is that some people call it hybrid war,” Russia’s foreign minister, Sergey V. Lavrov, said in an interview with Tucker Carlson in early December. “I would call it hybrid war as well.”

How to fight a shadow war.

NATO has begun to create a new strategy to confront hybrid attacks to replace a 2015 policy that it says is now out of date. The new approach, Mr. Appathurai said, will provide a base line picture of recent hybrid attacks to help the alliance measure whether risk levels are escalating.

“That will be important for allies to determine just how serious an incident is, and what their response might be,” he said.

The European Union is also stepping up its efforts, imposing sanctions in mid-December for the first time against people specifically accused of engaging in pro-Russian hybrid threats. It also recently tasked four senior commissioners with countering hybrid threats.

Officials and experts agree a wide range of measures are needed to deter and protect against hybrid attacks, including more “naming and shaming” of adversaries and imposing legal penalties; improving intelligence and technical systems to monitor threats; and military exercises and other displays of force to demonstrate that even covert aggressions will not go unpunished.

But that will require unity among NATO members, especially when attacks cross international borders. And because hybrid warfare is by its nature designed to evade clear attribution of responsibility, officials have hesitated to launch powerful responses without having indisputable evidence of an adversary’s identity.

That has emboldened Russia and China to push the limits, according to officials, diplomats and experts.

“As long as NATO and European member states disagree on how to respond more assertively to the Kremlin’s hybrid warfare, Europe will remain vulnerable,” Charlie Edwards, a former British intelligence and security strategist, wrote in November. “Failing to act will mean the Kremlin retains the strategic advantage.”