When mysterious drones began appearing over oil rigs and wind farms off the coast of Norway about three years ago, officials weren’t sure where they came from.
But “we knew what they were doing,” Stale Ulriksen, a researcher at the Royal Norwegian Naval Academy, said in a recent interview. “Some of them are charting a lot of things as espionage. I think part of it was positioning for war or a serious crisis.”
The drones are suspected to have been launched from Russian-controlled vessels in the North Sea, including some near underwater energy pipelines, Ulriksen said. He added that given they were flying over international waters, Norway could not do much to stop them.
In recent weeks, reports of drone swarms off the East Coast of the United States have raised widespread fears of hybrid warfare. U.S. officials said only 100 of the 5,000 drones seen there required further investigation, and so far none are believed to be foreign surveillance drones. However, it is a different story when drones were spotted over military bases in the UK and Germany where US troops are stationed in late November and early December.
Military analysts concluded that the drone may have been carrying out a state-sponsored surveillance mission, according to a U.S. official familiar with the case who spoke on condition of anonymity to discuss a public investigation. British and German defense officials declined to discuss details of the sighting.
Experts say the presence of drones signals so-called hybrid or “grey zone” attacks against the West, using a variety of tactics – military, cyber, economic and even psychological – to covertly attack or destabilize enemies.
As Russia, Iran and other adversaries become increasingly brazen in their hybrid attacks against Western nations — such as hacking sensitive computer systems and claiming assassination plots — Pentagon officials face a tricky challenge. How can such behavior be curbed without sparking a wider and potentially deadly conflict? And how can liability be assigned to the attacker if the attack is designed to avoid negligence?
‘It’s not random. It’s part of a military operation.’
Hybrid attacks are not new, but they have expanded in scale in recent years.
One of the most notable and potentially fatal incidents was the explosion of a series of packages in Europe in July. The parcel, with a Lithuanian postmark, contained an electric massager with a highly flammable magnesium-based substance inside. Two exploded at DHL cargo facilities in the UK and Germany, while a third exploded at a Polish courier company.
Western officials and Polish investigators said they believed the package was a test conducted by Russian military intelligence to plant explosives on cargo planes bound for the United States and Canada.
“We are telling our allies that it is not random. This is part of a military operation.” Lithuanian Foreign Minister Kestutis Budrys spoke about the explosion. “We must neutralize and stop it at the source, and that source is Russia’s military intelligence.” Russia denies being behind the sabotage.
Other examples of hybrid tactics include cyberattacks against Albania over the past few years, which Microsoft’s investigation concluded were sponsored by Iran. Russia tried unsuccessfully to sway the presidential election in Moldova in October and November using disinformation, according to Moldovan and European officials. European countries are also investigating whether a number of ships deliberately cut underwater cables in attempted attacks in recent months.
While China, Iran and North Korea have a growing appetite for hybrid attacks, officials say Russia has deployed them as a covert sabotage against NATO allies, especially after the Kremlin’s full-scale invasion of Ukraine in 2022.
“Russia has stepped it up across the board and as a result it is reaching increasingly worrying levels,” James Appathurai, NATO deputy secretary-general who oversees the hybrid warfare strategy, said in an interview. “They are willing to take more risks on us for the safety of the lives of our citizens.”
The Baltic and Nordic countries close to the borders of Britain, Germany, the United States and Russia are among the Western countries most targeted by hybrid threats, in part because of their outstanding support for Ukraine, officials said. Last year, Western officials said U.S. and NATO intelligence agencies uncovered a Russian plot to kill the chief executive of Rheinmetall, a German arms giant that produced millions of dollars worth of arms and ammunition for Ukraine.
The drone discovered in Britain in November, three days after President Biden said Ukraine could fire American-made deep strike missiles at Russia, was larger, more weather-resistant and mostly out of the sun than a hobbyist would expect to own. It was discovered after losing. That’s partly why military analysts concluded a hostile nation was responsible, the U.S. official said.
Then, in early December, just as drone sightings in the UK were beginning to decline, a drone appeared over Ramstein Air Base in Germany, one of the largest US military bases in Europe. Some were reportedly seen near facilities owned by Rheinmetall.
Investigators are considering whether the flights from both countries were a “deviation from the Kremlin playbook,” a U.S. official said.
Russia has repeatedly denied launching hybrid attacks against NATO and, on many occasions, has ridiculed the accusations. NATO officials said Moscow had set up a special unit focused on carrying out such attacks.
Russian officials also said they were being targeted. “What is happening in Ukraine is what some people call a hybrid war,” Russian Foreign Minister Sergei V. Lavrov said in an interview with Tucker Carlson in early December. “I would also call this hybrid warfare.”
How to fight the shadow war.
NATO has begun crafting a new strategy to combat hybrid attacks to replace a 2015 policy it now says is outdated. Appathurai said the new approach will provide a baseline picture of recent hybrid attacks, helping allies gauge whether the level of risk is increasing.
“It will be important for our allies to determine how serious the incident is and what their response is,” he said.
The European Union is also stepping up its efforts, imposing sanctions for the first time in mid-December on people accused of involvement in pro-Russian hybrid threats. We also recently tasked four senior members with responding to hybrid threats.
Officials and experts agree that a wide range of measures are needed to deter and protect against hybrid attacks, including more “naming and quantification” of adversaries and imposing legal penalties. Improved intelligence and technological systems to monitor threats, and military exercises and other displays of force to demonstrate that even covert aggression cannot go unpunished.
But this requires unity among NATO members, especially when attacks cross borders. And because hybrid warfare is inherently designed to avoid clear attributions of responsibility, officials have been hesitant to launch a strong response without hard evidence of the enemy’s identity.
This has emboldened Russia and China to push the envelope, according to officials, diplomats and experts.
“Unless NATO and European member states agree on how to respond more actively to the Kremlin’s hybrid warfare, Europe will remain vulnerable,” Charlie Edwards, a former British intelligence and security strategist, wrote last November. “Failure to act means the Kremlin maintains its strategic advantage.”
