Hybrid warfare after the Brussels Summit

By John G.L.J. Jacobs, Director Atlantic Forum

This article was originally published by the Atlantische Commissie (Netherlands Atlantic Commission).

This article looks at the development of hybrid warfare following the recent NATO Summit in Brussels. It first investigates NATO’s common understanding of hybrid warfare and its focus on cyber threats and (dis)information war. The article then looks at five concrete initiatives undertaken by NATO and reiterated in the Summit’s declaration. The key development in hybrid warfare is the declaration’s suggestion that hybrid warfare constitutes grounds to invoke Article 4 or Article 5, and the paper outlines the threat of misattribution. 

Hybrid warfare has dominated the academic and policy debate since the illegal annexation of Crimea by the Russian Federation. It has been labelled with different monikers (irregular warfare, unrestricted warfare, non-linear warfare etc.) and a large part of the debate concerned (and still concerns) the question whether hybrid warfare is inherently something new.

While the adversaries of the transatlantic liberal order continue to develop innovative ways of fighting war, it seems we continue to debate, rather than to take action. At least, that seemed the case until about a month ago when NATO published its Brussels Declaration1 at the new NATO Headquarters.

The declaration suggests a couple of initiatives that go beyond the analyzing and defining of what we are up against and instead proposes more concrete actions to bolster defenses. It also outlines possible responses to hybrid threats.

What is hybrid warfare?

Or perhaps a better question would be: what does NATO think hybrid warfare is? I have already touched upon a few aspects of hybrid warfare: the non-kinetic component of hybrid warfare and the relationship to cyber warfare. But do the 29 member states of NATO agree among themselves on a common understanding?

The commonly accepted definition is given by retired USMC Lieutenant colonel Frank G. Hoffman:

"Hybrid threats are any adversary that simultaneously employs a tailored mix of conventional weapons, irregular tactics, terrorism, and criminal behavior in the same time and battlespace to obtain their political objectives".2

The downside of this definition is that it includes nearly everything, and subsequently nothing, and certainly does not help in defining criteria for actions constituting grounds to invoke Article 4 or 5. Franklin D. Kramer and Lauren M. Speranza from the Atlantic Council specified four hybrid threats facing the Euro-Atlantic community: Low-Level Use of Force, Cyberattacks, Economic and Political Coercion and Subversion, and Information Warfare.3 Cyber and (dis)information threats appear to be NATO’s primary concern.

Assuming that, as the Brussels Summit Declaration has been signed by all 29 members, the document published on July 11, 2018 reflects the shared understanding of all members of the North Atlantic Council, we can distil the following from the declaration.

Hybrid challenges include disinformation and malicious cyberattacks, according to article 2 of the declaration. The latter is an interesting choice of words as hybrid warfare is neither war nor peace, but we can all agree such actions are not benevolent but are malicious in nature.

If we continue reading the declaration it again mentions disinformation and cyberattacks in article 6 as hybrid actions, but also separates cyberattacks from hybrid warfare in article 13 where it groups terrorism, hybrid warfare and cyberattacks together as requiring similar support from NATO to facilitate decision-making and operations.

In article 20 the declaration reaffirms NATO’s mandate for collective defense against the full spectrum of cyber threats, including those part of a hybrid campaign. This is followed by article 21, which introduces the application of articles 4 and 5. In this article NATO also introduces its first concrete action with the establishment of so-called Counter-Hybrid Support Teams which I will touch upon later.

In the last articles of the declaration NATO focusses on cooperation between allies and partners such as the NATO-Ukraine Platform on Countering Hybrid Warfare and concludes with mentioning again the malicious cyber and hybrid activities, though this time linked to energy security.

To my surprise the declaration does not mention the Center of Excellence (CoE) inaugurated in October 2017 in Helsinki or the Skripal attack of March 2018. UK members of parliament have, in press reports, linked the latter to Russia,4 an assessment shared by NATO allies, who have collectively expelled Russian diplomats.

One of the reasons for the omission of the Skripal incident might involve the issue of attribution. While the discussion on hybrid warfare has been pushed forward by NATO, a second discussion is ongoing on the standard of evidence in relation to both the Skripal5 and MH17 cases.6 In both a claim is made for “beyond a reasonable doubt,” a term originating from the jurisprudence of common-law countries, where it is the highest burden of proof, apart from complete certainty, in a legal case.

Article 5 has been invoked once to date, after the terrorist attacks against the United States on September 11, 2001. NATO allies retaliated against Al Qaeda and the Afghanistan Taliban regime after Al-Qaeda claimed responsibility for the attack. The unquestionable aggressor and the danger to the Euro-Atlantic Community justified the ongoing NATO presence in Afghanistan, fifteen years and counting, in helping to rebuild the security architecture in the country.

It would be a dangerous and unhealthy development if Article 5 were to be invoked based on a hybrid attack where the identity of the attacker is not certain, but rather suspected beyond a reasonable doubt.

Hybrid warfare and articles 4 and 5

The term “hybrid” is mentioned a total of 17 times in 8 of the 79 articles of the Brussels Summit Declaration. The declaration names five concrete actions: Counter-Hybrid Support Teams, Intelligence Sharing, Training & Exercise, the NATO-Ukraine Platform on Countering Hybrid Warfare and the Center of Excellence for Countering Hybrid Threats. The most curious and perhaps exciting statement made in the declaration regarding hybrid warfare can be found in article 21 of the declaration:

“While the primary responsibility for responding to hybrid threats rests with the targeted nation, NATO is ready, upon [The North Atlantic] Council decision, to assist an Ally at any stage of a hybrid campaign…”

suggesting that Article 4 applies to hybrid warfare as it does to a kinetic threat. The article allows the 29 members of NATO to consult one another when territorial integrity, political independence or the security of any of them is threatened. Previous invocations of Article 4 include, for example, the requests for help with terrorist attacks in Turkey in July 2015 or the meeting requested by Poland following the increased tensions in neighboring Ukraine in 2014.

The Brussels Declaration nudges NATO to also invoke Article 4 on hybrid threats and ask for consultations or meetings of the North Atlantic Council.

The declaration continues:

“In cases of hybrid warfare, the Council could decide to invoke Article 5 of the Washington Treaty, as in the case of armed attack.”

This statement broadens the scope of actions that may constitute an Article 5 attack. This decision follows the recognition of cyberspace as the 5th military domain in July 2016, with cyber threats being a major component of hybrid threats, as well as the ongoing discussions on cyber threats in June 2017 following the massive computer hack against Ukrainian government and corporate targets.

More recently Supreme Allied Commander Europe General Curtis Scaparrotti reiterated the recognition of cyberspace as a military domain during his testimony before the US Senate Armed Services Committee in March 2018.7 The discussion on cyberattacks has been ongoing since NATO member Estonia was hit by such attacks in April 2007 and led to a NATO communique in June that year.

Ten years later it seems NATO is now ready to recognize a wider spectrum of hybrid threats as non-kinetic actions that constitute an armed attack. Like cyberattacks, hybrid warfare often deals with the same challenge of attribution (who did it?) — actors employing hybrid warfare do so within the so-called grey zone, an area that is neither war nor peace but rather somewhere in between. Their goal is to hide the perpetrator behind the smokescreen of the grey zone.

Optimizing Intelligence

The first concrete action mentioned by NATO is the optimization of intelligence, an initiative set in motion at the NATO summit in Warsaw in 2016. In February 2017 the Joint Intelligence and Security Division (JISD) was created, consisting of two pillars: intelligence (with the merged strands of military and civilian intelligence) and security (the NATO Office of Security).

In July 2017 a new branch was created within JISD with a mandate to combine open-source and classified information from military and civilian sources to analyze hybrid actions in the fullest sense.8

Despite good progress in the development of NATO intelligence capabilities and NATO-EU cooperation in this field, intelligence sharing at the strategic level continues to have shortcomings.9 Meanwhile in light of the attribution issue, optimizing intelligence remains a core element in countering hybrid warfare.

Counter-Hybrid Support Team

The setting up of the counter-hybrid support teams was highlighted by NATO Secretary General Jens Stoltenberg in his press conference during the Brussels summit: “But many of the challenges we face blur the line between peace, crisis and conflict. So today, we set up new counter-hybrid support teams.”10 The Counter-Hybrid Support Teams (CHSTs) can be called upon by NATO allies to provide specific, tailored expertise in the preparation of a response to a hybrid threat.

NATO has not specified in official communication what kinds of expertise are pooled in these teams, but one can imagine they would include, but not be limited to, information/media watch analysts and cyber experts to aid in combatting the two main hybrid threats identified by NATO.

NATO-Ukraine Platform on Countering Hybrid Warfare

Two days prior to the NATO Summit the North Atlantic Council visited Ukraine, commemorating the 20th anniversary of the Charter on a Distinctive Partnership between NATO and Ukraine. During this meeting, as well as during the Brussels Summit, the work of the NATO-Ukraine Platform on countering hybrid warfare was discussed.

The Platform was set up last year with a two-fold rational: using lessons learned to increase the ability of both Ukraine and NATO to better recognize hybrid threats, and to exchange expertise on how to counter these threats, thereby strengthening state institution capacity and resilience.

The platform was inaugurated with an expert seminar organized in Warsaw on October 26, 2017, featuring expert panels and examples drawn from the ongoing Russian-Ukrainian conflict, giving practical insights into the aspects of hybrid warfare. A second seminar is planned later this year.

Training & Exercise

Later this year NATO will organize one of its largest multinational exercises in Norway. Trident Juncture 2018 will feature over 40,000 personnel and is scheduled to take place between October 25 and November 7.

The wargame has included hybrid threats since its 2015 iteration and features a range of hybrid combat scenarios, such as a negative “strategic communication” narrative, which NATO faces in the enhanced Forward Presence in the Baltic States and Poland. Furthermore, NATO ally Norway plans to deploy its new cyber-defense capabilities during the exercise. Active involvement of hybrid threats in large and small exercises for NATO will likely become the standard in the coming years.

Hybrid Center of Excellence

The Hybrid Center of Excellence was formally inaugurated in October 2017. Situated in NATO partner country Finland, the Center is a joint initiative of the European Union and NATO. While not mentioned in the declaration beyond NATO-EU cooperation, Hybrid CoE is an important tool in NATO’s toolbox for developing ways to counter hybrid warfare. The Center’s goal is to further the common understanding of hybrid threats and to promote comprehensive and whole-of-government approaches.

Recent work of the Center includes Strategic Analysis Papers and working papers on Cyber threats and Disinformation, while earlier work also includes aspects of Lawfare. A portmanteau of the words law and warfare, lawfare was coined by now retired Major General Charles J. Dunlap in 2001.

Then an Air Force Colonel, Dunlap defined lawfare as strategically “using, or misusing, law as a substitute for traditional military means to achieve an operational objective.”11 Lawfare has been an important element of hybrid threats. However, despite recommendations from NGOs and the Center of Excellence, NATO has not adapted lawfare in its understanding of hybrid threats.

Conclusion

While good efforts have been made in moving forward with the hybrid warfare discussion and moving away from the academic debate into practical solutions to combat hybrid threats, most initiatives still seem too little too late, or at least too limited in their execution. Nevertheless, NATO should be applauded for its achievements in this field in the last year and for giving hybrid warfare the attention it both deserves and requires.

While mainly reiterating existing initiatives, each of the five concrete actions mentioned in the Brussels Declaration are good steps beyond the academic and policy debate. Apart from the use of hybrid threat scenarios in wargaming, the current projects are still rather fledgling and exploratory, and I fear they are not receiving the proper support in capabilities and finances to develop at the speed required in the rapidly changing security environment. Nevertheless, that is no reason to dismiss them, but rather to embrace them and have NATO members champion and sponsor one or more of these initiatives.

The main key development is the setting of a precedent that allows hybrid threats to constitute a threat or attack as defined in articles 4 and 5 of the Washington Treaty. However, at the same time this development should be followed with healthy suspicion lest it create dangerous situations due to misattribution.

1 Brussels Summit Declaration, July 11, 2018.
2 Frank G. Hoffman, “On Not-So-New Warfare: Political Warfare Vs Hybrid Threats,” War on the Rocks, July 28, 2014.
3 Franklin D. Kramer and Lauren M. Speranza, “Meeting the Russian Hybrid Challenge,” Atlantic Council/Brent Scowcroft Center on International Security, May 30, 2017.
4 Annual Report 2016-2017, Intelligence and Security Committee of Parliament, December 20, 2017.
5 Oliver Wright, “Sergei Skripal: Theresa May set to hit back at Russia over spy attack,” The Times, March 12, 2018.
6 Sir D. Omand, “From Nudge to Novichok: The response to the Skripal nerve agent attack holds lessons for countering hybrid threats,” The European Center of Excellence for Countering Hybrid Threats, April 18, 2018.
7 Statement of General Curtis M. Scaparrotti, United States Senate Committee on Armed Services, March 8, 2018.
8 Arndt Freytag von Loringhoven, “Adapting NATO intelligence in support of “One NATO”,” NATO Review Magazine, September 8, 2017.
9 Artur Gruszczak, NATO’s Intelligence Adaptation Challenge, GLOBSEC, March 26, 2017.
10 Jens Stoltenberg, Press Conference, NATO, July 11, 2018.
11 Charles R. Dunlap, “Lawfare Today: A Perspective,” Yale Journal of International Affairs, Winter 2008, 146.