As foreign ministers of the North Atlantic Treaty Organization (NATO) nations descended on Brussels this week, countering hybrid warfare was top of the agenda. Hybrid warfare is the use of conventional and unconventional means that fall short of an all-out war and yet create instability in the countries targeted.

NATO allies have decided to increase intelligence sharing, enhance cooperation with private companies, and make critical infrastructure more resilient to tackle hybrid warfare as cases of suspected sabotage increase on NATO territory. 

"Over the past years, Russia and China have tried to destabilize our nations with acts of sabotage, cyber attacks, disinformation, and energy blackmail to intimidate us," said NATO Secretary-General Mark Rutte. "NATO allies will continue to stand together to face these threats through a range of measures, including greater intelligence sharing and better protection of critical infrastructure." 

Two fiber-optic telecommunication cables in the Baltic Sea were severed last month, one linking Finland and Germany and the other from Sweden to Lithuania, while a Chinese ship was nearby. 

This is the most recent case in an increasingly long list of what NATO suspects are planned and coordinated acts of hybrid warfare instigated directly by or at Moscow's behest. 

A senior NATO official who spoke on the condition of anonymity said that as Russia displays an "increasing appetite for risk," the alliance was revising its 2015 strategy on combating hybrid warfare to pad it up with more measures. 

Resilient infrastructure, more cooperation between member states and with private companies 

According to a New York Times report earlier this year, Russia has attempted various hybrid attacks on NATO members including arson attacks on a warehouse in the United Kingdom, at a paint factory in Poland, and an Ikea store in Lithuania. 

While Russia has myriad weapons in its hybrid warfare toolkit, including cyber attacks and disinformation campaigns, NATO's undersea assets have emerged as among the most vulnerable to sabotage. Millions of kilometers of undersea cables and pipelines run underwater to enable communications and provide energy to people in NATO countries.

Among the ideas floating around NATO are better physical protection of underwater infrastructure, such as burying cables in the seabed and covering oil and gas pipelines with harder material such as concrete. Experts believe this could create an extra layer of protection from trawlers and anchors. Another suggestion is to lay fake cables, to confuse the enemy. 

The allies are also focusing on consistent surveillance of undersea infrastructure to allow them to not only identify the culprit but also rush ships nearby and hold them accountable. Experts believe such measures could deter future sabotage attempts. 

"NATO is talking about consistent surveillance of its critical undersea infrastructure, a video recording or some kind of data," that can help identify the perpetrator, "such as on the surface and even underwater drones installed with cameras," Rafael Loss, a policy fellow at the European Council on Foreign Relations (ECFR) and an expert in security and defense in the Euro-Atlantic area, told DW. 

Since private players often own the infrastructure under attack, NATO envisages more cooperation with those companies that can share information quickly. After the sabotage of the Nord Stream pipelines last year, NATO established a new Undersea Infrastructure Coordination Cell to coordinate efforts with the private sector. 

NATO isn't ready to name and shame 

Even though circumstantial evidence in various cases points to the usual suspects, NATO member states are divided over naming and shaming in the absence of rocksolid proof that establishes the chain of command, which experts say is hard to obtain in cases of hybrid warfare. 

Some experts suggest there are also political and economic considerations at play. 

"Do you really want to blame the Chinese state leadership for what could amount to an act of aggression when the relationship is extremely complex?" asked the ECFR's Loss, highlighting trade ties between Beijing and the EU. "Some also hope that China could play a role in diffusing the war in Ukraine, and in global climate policy."  

However, there are growing calls that if necessary, NATO can invoke Article 5, or at least dangle it as a threat to deter Moscow. 

Will NATO invoke Article 5 against hybrid warfare? 

Some believe NATO can invoke Article 5 of the NATO treaty ― which calls on all member states to come to the defense of any member under attack ― in case a hybrid attack crosses a certain threshold. 

"The extensive use of hybrid measures by Russia increases the risk that NATO will eventually consider invoking its Article 5 mutual defense clause," said Germany's intelligence chief Bruno Kohl at a think tank event in Berlin last week. 

Eitvydas Bajarunas, a former Deputy Ambassador at the Mission of Lithuania to NATO in Brussels and currently a visiting fellow at the Center for European Policy Analysis (CEPA), told DW that at the last NATO summit in July 2024, allied leaders reaffirmed that if hybrid operations against member states escalate to the level of an armed attack, it could potentially prompt the invocation of Article 5. 

However, experts say Russia is aware of the calculations and will likely keep the severity of attacks just below the point that seems like an all-out war. 

According to NATO's own definition "hybrid warfare entails an interplay or fusion of conventional as well as unconventional instruments of power and tools of subversion." However, these definitions are ambiguous, making attribution, and, hence, a response difficult. 

European governments have expelled more than 700 Russian spies posing as diplomats since Moscow invaded Ukraine in 2022. But the hybrid attacks haven't stopped and Russia continues to hide behind that ambiguity. 

Edited by: Carla Bleiker