Countering hybrid threats: The necessity of public-private cooperation and integrated response strategies

As the interconnectedness of our societies and economic systems continues to develop, traditional approaches to security are continuously challenged. In recent times, the materialization of new types of threats—such as cyber threats and disinformation—has increasingly challenged the capacity of governments to exclusively ensure societal security, especially during the COVID-19 pandemic.[i] Although this notion of “Hybrid Threats” has indeed gained prominence among policymakers, discussing it only amongst organisations that bear direct responsibility for traditional security such as NATO or various entities within the EU neglects the vital role of the private sector in promoting a comprehensive approach to security in our interconnected world.

In essence, these hybrid campaigns blur the dividing lines between conventional and unconventional, military and non-military conflict by using a wide range of obscure methods or activities of influence. These campaigns are generally orchestrated in a coordinated and synchronised manner by state or non-state actors in order to achieve specific (geo)political and/or economic objectives. By exploiting dubious thresholds of detection and operating within different grey zones, they are designed to be difficult to attribute and often target critical vulnerabilities to create confusion and hinder effective public or private decision-making.

Unlike previous forms of conflict, however, numerous targets of hybrid campaigns are found within the private sector, disrupting the global supply chain, communication services, financial systems, and most notably operators of essential services. The challenge of adapting and responding to these threats impacts and expands the traditional attack surface of these organizations and makes collaboration among public and private stakeholders pertinent to deliver a comprehensive approach to security in a way that is beyond the scope of control of a single organisation and even most nation-states.[ii]

Subject-matter experts/specialists from the private sector can assist NATO and the Allied capitals to prepare for and respond to these challenges, building upon the experience with crisis management, organizational resilience, and corporate intelligence to create situational awareness. The approach should be grounded on the conviction that any organisation—be they public or private—has the potential to recognise, rapidly respond to, and recover from disruptive change caused by a hybrid campaign. As such, organisational response may be improved and crisis response strategy and capabilities may be enhanced, thus mitigating the possible ripple effects of a hybrid campaign.[iii] Whereas these campaigns are generally not isolated and contained incidents, crisis strategists, data analysts, and cyber and communication experts outside of the Alliance may be able to grasp the cross-silo effects.

Any future common approach must be able to assist organizations and governments alike with their organisational resilience in order to obtain a level of maturity that can effectively counter hybrid campaigns. In this context, one must advocate building bridges for information exchange and cross-competence domain processes and activities. Private-sector experts may assist the Alliance in the identification of interconnected threats and guide governments in designing comprehensive approaches to hybrid campaigns, based on the possible effects that these campaigns might have on our interconnected societies and economic systems.

Given the multifaceted nature of hybrid threats, the focus should be on key elements where notions of traditional and comprehensive security overlap. An effective response to hybrid campaigns must be underpinned by mutual trust, corporate accountability, and effective collaboration between possible public and private targets of a hybrid campaign.[iv] Until the malicious motives are identified, it proves difficult to operationalize correct crisis response and mitigation strategies or to protect the organisation against future malicious endeavors. To mitigate this increasingly complex situation, the Alliance must be committed to continuing to offer lessons learned, support, and guidance to respond to these campaigns, contributing to the overall security of our interconnected nation-states in the process.

A comprehensive approach towards resilience within the Alliance

As NATO is the most successful and long-standing political-military Alliance in recent history, the traditional approach to security that has characterised the Alliance is increasingly questioned. Within the contemporary threat landscape, the most time-sensitive unmanned aerial vehicles, submarines that can carry out exercises in the High North, or even traditional nuclear deterrence, fail to guarantee societal resilience in the face of novel non-conventional threats.

The recent and increasing materialization of these new types of threats—such as cyber or hybrid campaigns—as well as the impact of the recent epidemiological crisis, have increasingly challenged the capacity of governments to exclusively ensure societal resilience by conventional (military) means. As such, military planners must continue to innovate, to deter, and to defend the Alliance’s critical infrastructure and increase overall societal resilience in the process.[v]

The challenges of adapting and responding to these threats are numerous as they significantly impact and expand the traditional attack surface of our societies. As such, genuine collaboration among various stakeholders becomes increasingly important to deliver a comprehensive approach to security that is beyond the scope of control of a single organisation or Ally. It is within this context that public-private cooperation and the strengthening of the seven baseline requirements will prove to be pertinent in order to ensure that all Allies possess the right level of maturity to face the crises of tomorrow.

In order to ensure resilience against these new threats, this contribution builds upon the ambition of increased public-private cooperation in NATO member states as advocated in the NATO2030 report and aims to explore how industry practices regarding organizational resilience can be employed in the context of Article 3.[vi] In order to maintain and develop their individual and collective capacity to resist an armed attack, such reflection will contribute to NATO’s continuous relevance in facing these novel threats and its fulfillment of core tasks.[vii]

The concept of resilience—crucial as it might be for the durability of the Alliance—is often misunderstood.[viii] Lacking a widely accepted definition, resilience is best described as the ability to adapt and react to a rapidly changing non-conventional security environment while preserving the societal functioning of the state—be it in the face of climate change, irregular migration, a lack of resources, or even the recent pandemic. These challenges transcend the traditional concept of national security as their impact is transnational and transsocietal. Within the military sphere, NATO traditionally understands resilience as “society’s ability to resist and recover easily and quickly from such shocks and combines both civil preparedness and military capacity” and integrated the concept within its Civil Emergency Planning.

Civil Emergency Planning under the Operations Division was established in order to provide oversight to the North Atlantic Council and plan rapid response deployment according to the crisis management role of the Alliance and the use of civilian resources and expertise to enhance civil preparedness to defend Allied nations during a non-Article V threat. This planning mechanism dates back to the 1950s, when the Northern Allies combated the North Sea Floods, and resulted in the establishment of the “Policy on Cooperation for Disaster Assistance in Peacetime.” In essence, all Allies committed to standing in solidarity in the face of natural disasters and providing mutual assistance during peace times. These positive developments aside, it still took decades for Allies to integrate the concept of resilience into an official guideline—the Warsaw Summit Communiqué—which emphasized civil preparedness as “a critical enabler for Alliance collective defence” while remaining a national responsibility.[ix]

More recently—as the COVID-19 pandemic precariously reminded us of the importance of societal resilience—the Euro-Atlantic Disaster Response Coordination Centre (EADRCC) became the Alliance’s in-house civil crisis response mechanism and first line of defence in case emergencies arise.[x] The overall coordination and planning of EADRCC is carried out and managed by the Assistant Secretary General for Operations, who oversees policy recommendations to the North Atlantic Council, including the allocation of national civil resources and infrastructure for the overall needs of NATO’s armed forces.[xi]

What follows from these historic developments is the emergence of a twofold concept of resilience within the Alliance: crisis assistance in case of natural disasters, on the one hand, and the resilience of our societies as a whole, including the government, public, and private sectors, on the other.[xii] In other words, civil-military cooperation and a comprehensive whole-of-society approach are regarded as a must to ensure deterrence against any unforeseen and future non-conventional threat.

NATO Deputy Secretary General Mircea Geoană has highlighted the importance of resilience—specifically the disruption of infrastructure—as malicious actors gradually increase their attacks on the established financial, legal, and political institutions and the critical infrastructure—such as the transportation, sealines, telecommunication channels and electoral systems—that support it.[xiii] Despite cutting-edge military technology, intelligence surveillance, and reconnaissance systems, societal resilience will undoubtedly serve a great purpose during a conventional armed conflict and should thus remain a core principle of the Alliance.

As a first line of defence, NATO must ensure that the Allied military operations on the ground are carried out effectively and that the readiness of its deployed military personnel is not affected by another crisis. For this purpose, Allied nations have been quite efficient in redesigning military training and exercises, as was put forward with the Defender-Europe 20 and, consecutively, the Defender-Europe 21 exercise. As briefly outlined above, the readiness and safety of military personnel in itself falls short as an effective resilience-building measure for non-conventional threats. In consequence, this traditional lens could be strategically revised, and a more forward-looking and horizontal approach established. Courses such as the Resilience through Civil Preparedness taught by the Civil-Military Cooperation Centre of Excellence serves as an apt example of how the Alliance may initiate these discussions among the policymakers and various stakeholders in the private and public sectors.[xiv] Such reflections will eventually transcend the traditional frameworks and strengthen options to respond to a non-Article 5 attack.

In the process of implementing this whole-of-society approach, each security threat has to be studied and analysed horizontally. The next non-conventional threat might be multidisciplinary in nature—be it a climate disaster in combination with a stock market crash or tensions along the Southern Flank as a result of a cyber-attack by Northern adversaries.

Although the seven baseline requirements defined by NATO are predominantly domestically-orientated—including physical investments, extensive planning, and arrangements, from supplying food to building new roads—they offer a perspective for further transnational cooperation to ensure common standards in critical (military) infrastructure and its capability to function during (military) crises.[xv] Despite legislative action to this effect within the EU, NATO can offer a platform in which 30 Allies—all with different understandings and capabilities towards building resilience—may share their good governance practices and lessons learned, which in return will provide opportunities for integrating a civilian as well as a military aspect to resilience.

Way forward

Whereas today’s world heavily relies on new technology, conflicts are increasingly moving towards cyber and outer space. Be that as it may, the impact of such conflicts—be it on pipelines, powerlines, or other critical infrastructure—will increasingly be measured in human harm, physical or financial. That is why it is essential that multilateral cooperation, be it within NATO, the EU, or the UN, must engage and keep up with the dynamics of the private sector to ensure the strengthening of the baseline requirements are in accordance with industry best practices. Cooperation with partners should be encouraged by involving more and more actors from militaries, the civil sector, and private corporations.

Resilience is indeed a national responsibility; yet can the Alliance leave such a crucial security issue to chance, or simply to national governments’ policies and capabilities? Can NATO take the responsibility of not being able to deter a cyber or hybrid threat, since the border nation was not resilient enough to deter that threat of our adversaries? Can or should the Alliance project resilience beyond its territorial borders? Can the Alliance maintain peace for one billion people while remaining relevant and fulfill its three core tasks: collective defence, crisis management, and cooperative security? Or is it time to add another core task as the Alliance drafts a new Strategic Concept?

Notes

[i] Baiba Braze, “NATO Strengthens Resilience in Response to COVID-19 Pandemic,” Turkish Policy Quarterly, 4 September 2020, http://turkishpolicy.com/article/1014/nato-strengthens-resilience-in-res....

[ii] Igor Linkov, Lada Roslycky, and Benjamin D. Trump, “Resilience and Hybrid Threats: Security and Integrity for the Digital World,” NATO Science for Peace and Security Series, 19 December 2019.

[iii] “Building transatlantic resilience: Why critical infrastructure is a matter of national security,” NATO, 10 December 2020, https://www.nato.int/cps/en/natohq/opinions_180067.htm.

[iv] Resilience Capacity Building – Implications for NATO Conference Report, 1–2 June 2017, https://www.dokumenty-iir.cz/Publikace/Resilience_NATO.pdf.

[v] “Resilience and Article 3,” NATO, 16 November 2020, https://www.nato.int/cps/en/natohq/topics_132722.htm.

[vi] “NATO toward 2030: a resilient Alliance and its main priorities,” IAI, 27 November 2020, https://www.iai.it/en/pubblicazioni/nato-toward-2030-resilient-alliance-and-its-main-priorities.

[vii] “NATO’s Response to the COVID-19 Pandemic,” NATO, 14 April 2020, https://www.nato.int/nato_static_fl2014/assets/pdf/2020/4/pdf/200401-factsheet-COVID-19_en.pdf.

[viii] Jim Townsend and Anca Agachi, “Build resilience for an era of shocks,” Atlantic Council, 14 October 2020, https://www.atlanticcouncil.org/content-series/nato20-2020/build-resilie....

[ix] “Warsaw Summit Communiqué: Issued by the Heads of State and Government participating in the meeting of the North Atlantic Council in Warsaw,” NATO, 8–9 July 2016, https://www.nato.int/cps/en/natohq/official_texts_133169.htm.

[x] Giovanna De Maio, “NATO’s response to COVID-19: Lessons for resilience and readiness,” Brookings, October 2020, https://www.brookings.edu/wp-content/uploads/2020/10/FP_20201028_nato_covid_demaio-1.pdf.

[xi] Gunhild Hoogensen Gjørv, “Coronavirus, invisible threats and preparing for resilience,” 20 May 2020, https://www.nato.int/docu/review/articles/2020/05/20/coronavirus-invisible-threats-and-preparing-for-resilience/index.html.

[xii] Tim Prior, “NATO: Pushing Boundaries for Resilience,” CSS Analyses in Security Policy ETH, September 2017,  https://ethz.ch/content/dam/ethz/special-interest/gess/cis/center-for-securities-studies/pdfs/CSSAnalyse213-EN.pdf.

[xiii] “NATO must invest to build pandemic resilience, avoid dependence on China,” NATOPA, 22 November 2020, https://www.nato-pa.int/news/nato-must-invest-build-pandemic-resilience-avoid-dependence-china.

[xiv] “Resilience through Civil Preparedness,” Civil-Military Cooperation Centre of Excellence The Hague, https://www.cimic-coe.org/resources/fact-sheets/resilience-through-civil-preparedness.pdf.

[xv] Lorenz Meyer-Minnemann, “Resilience and Alliance Security: The Warsaw Commitment to Enhance Resilience,” https://archive.transatlanticrelations.org/wp-content/uploads/2016/12/resilience-forward-book-meyer-minnemann-final.pdf.

Image: https://www.cimic-coe.org/media/photoalbums/course_impressions/

This publication was co-sponsored by the North Atlantic Treaty Organization.