President-elect Trump has made ambitious promises to end Russia’s war in Ukraine and face down China, but he’s also contending with a growing threat of “gray zone” attacks from foreign adversaries, from drone surveillance to acts of sabotage in the air, sea and on land.
These hybrid tactics are intentionally hard to trace, and NATO allies on the front lines of tensions with Russia say the alliance isn’t doing enough to keep up.
“Whether the level of deterrence in that domain is sufficient, probably the answer is not yet,” Estonian Ambassador to the U.S. Kristjan Prikk told The Hill in conversation at the Atlantic Council last month.
“But, unfortunately when it comes to resilience, it’s not an end state that can be declared. … It’s a constant process to maintain and increase the level of resilience.”
Despite its geographical distance from geopolitical flashpoints in Europe and Asia, the United States isn’t immune from hybrid attacks, as was highlighted by a Chinese spy balloon that flew over the U.S. in 2023.
Military analysts believe drones spotted late last year over military installations in England and Germany — locations that house American troops — could have been part of a state-sponsored surveillance mission, a U.S. official familiar with the incidents told The New York Times.
Fears that drones could cause problems closer to home were stoked ahead of the holidays, with reports of mystery drone swarms across numerous East Coast states. U.S. officials maintain that none of the unmanned objects are believed to be foreign surveillance drones.
Trump, set to enter his second term in just less than two weeks, will almost certainly have to contend with gray-zone tactics, even if he successfully brings the war in Ukraine to a swift end, as he’s often promised to do.
Russia, Iran, China and other NATO adversaries see the “gray zone” acts of sabotage as low-risk and high-reward operations, according to analysts.
NATO allies are likely to press the issue at its annual summit in July, when the alliance is set to update its strategy for countering hybrid warfare, due mainly to the persistent threat posed by Russia.
Among the most concerning acts of sabotage include the suspected Russian plot, identified in July, to put explosive devices aboard planes bound for the U.S. and Canada. Another recent, suspected act of sabotage damaged two underseas telecommunication cables in the Baltic Sea in December. Finnish police suspect a vessel carrying Russian oil damaged the cables but have not pointed to Moscow as directing the campaign.
In July, the U.S. sanctioned two Russian nationals in a Russian-based “hacktivist” group, Cyber Army of Russia Reborn (CARR), over its targeting of water treatment plants in Texas. While the U.S. did not accuse the Kremlin of directing the attack, the CARR group has been linked to Russia’s military.
The episodes are part of a long list of events that have occurred on NATO territory in recent years in which Russia is a main suspect. These include assassination attempts on British and German soil; explosions at an ammunition warehouse in Czechia; the weaponization of migrants crossing illegally into Poland, Latvia, Lithuania and Finland; and signal jamming to disrupt civil aviation in the Baltic region.
At the NATO summit in Washington in July, alliance members in their communiqué said that they had “decided on further measures to counter Russian hybrid threats or actions individually and collectively, and will continue to coordinate closely,” but did not lay out specific actions targeting Moscow.
NATO’s Eastern flank has sounded the loudest alarm over the gray-zone attacks. At the July summit, national security adviser Jake Sullivan told a group of Baltic officials that NATO countries are likely to accept some level of risk because Russia’s hybrid activities are too cost-effective for them to stop.
Russia has repeatedly denied having a hand in any hybrid attacks against NATO.
“All these statements, all those demarches on the part of European capitals are totally baseless and we decisively refute all of them,” Kremlin spokesperson Dmitry Peskov told reporters in May when asked about a series of Russian-directed sabotage acts.
NATO Secretary-General Mark Rutte, during a major speech outlining the alliance’s priorities in December, said Russia is carrying out a long-term confrontation with NATO aimed at destabilizing democratic societies and discouraging support for Ukraine.
“This is not a traditional war. It is not an Article 5, but we have to defend ourselves,” he added, referring to a key section of the alliance treaty that dictates collective self-defense — that if one member state is attacked, all other members must come to its defense.
Part of NATO’s response to the hybrid attacks is increasing information sharing among allies to identify where seemingly criminal acts may rise to the level of sabotage; arresting perpetrators and carrying out convictions; raising the level of awareness among the public and private sectors; and building resilience in the cyber domain to withstand attacks on critical infrastructure.
“I would say that the way we decided to not only share more intelligence but actually step up our game with naming and shaming … but also actually convicting people that have carried out some of these sabotage acts … I do think that this has already raised the deterrence level,” Prikk, the Estonian ambassador, told The Hill.
The European Union, for its part, in mid-December imposed sanctions against people accused of engaging in pro-Russian hybrid threats — the first time it has done so — and assigned four senior commissioners to counter such sabotage.
Also in December, lawmakers with the bipartisan Helsinki Commission released a report on Russia’s hybrid warfare activities since 2022, identifying 150 hybrid operations on NATO territory that fall into four main categories: critical infrastructure attacks, violence campaigns, weaponized migration and election interference and information campaigns.
The report concluded that Russian sabotage campaigns across North America and Europe had accelerated since Moscow invaded Ukraine, in an attempt to execute a shadow war on NATO “to destabilize, distress, and deter the transatlantic alliance” from its support of Ukraine.
But it cautioned that its findings underestimated the true scale of the threat, urging NATO leaders to stand united in taking Russia’s hybrid operations seriously or risk inviting escalation, “both in Ukraine and within NATO’s borders.”
