Cooperating to counter hybrid threats

Just as hybrid threats exploit the synergy of diverse actors and activities, so should our hybrid defences. Since 2016, NATO and the European Union have identified countering hybrid threats as a priority for cooperation. The new European Centre of Excellence for Countering Hybrid Threats (Hybrid COE(Linkki toiselle web-sivustolle.)) in the Finnish capital Helsinki plays a unique role in facilitating this cooperation.

Hybrid threats are diverse and ever-changing, and the tools used range from fake social media profiles to sophisticated cyber attacks, all the way to overt use of military force and everything in between. Hybrid influencing tools can be employed individually or in combination, depending on the nature of the target and the desired outcome. As a necessary consequence, countering hybrid threats must be an equally dynamic and adaptive activity, striving to keep abreast of variations of hybrid influencing and to predict where the emphasis will be next and which new tools may be employed.

For example, in the aftermath of the last US presidential elections, the focus of countering hybrid threats was on strategic communication, disinformation and hampering the election process. Before that, much of the focus was dedicated to the “little green men” who played such a visible and central role in Russia's illegal annexation of Crimea. Another refocusing took place after the nerve agent attacks in Salisbury, putting the issue of threats involving chemical, biological, radiological and nuclear agents at the top of the agenda. We have not yet seen all faces of hybrid influencing and the only certainty is that new ones will be coming along.

Hybrid threats need to be pre-empted by both “passive” elements, such as increased resilience against shock or surprise, and more active ones including robust measures to prepare and protect the functions and structures that are most likely to be targeted by hybrid attacks. For these purposes, the importance of sufficient civil preparedness arrangements, a free press, an educated public and an effective legal framework cannot be overstated.

It is vital to achieve a working definition of what hybrid threats are, taking into account the many different actors that need to cooperate with each other. At the national level, Finland’s comprehensive security model consists of a myriad of different authorities and agencies that together give the necessary scope and spread to measures for countering hybrid threats. At inter- and supranational levels, actors include entities like the NATO civilian and military staffs and the EU institutions, in particular the European Commission services and the European External Action Service(Linkki toiselle web-sivustolle.) (EEAS). For these to pull in the same direction, a common understanding is needed of the hybrid threats for which regular engagement within and between the relevant EU and NATO structures is essential to advance this goal.

At the same time, conceptual work must not get in the way of actually preparing for and countering these threats. A common understanding of hybrid threats does not mean a watertight definition, which probably would be outdated the next day or could affect the nature of activities to counter hybrid threats. Not only are hybrid threats diverse, they are tailor-made to exploit specific vulnerabilities of specific targets. This means that each country has to have its own understanding of the kind of hybrid threats that can be directed against it. This is achieved by thoroughly familiarising oneself with one's own vulnerabilities, not through a universal definition of a non-universal concept.

National vulnerabilities can have effects that reach beyond borders. Examples of this could be global positioning systems, transport systems or interconnected electric grids, where an attack against a vulnerable node in one country would inevitably have consequences on other countries where such vulnerabilities did not exist. A hybrid attack exploiting a national vulnerability may therefore require not only sovereign action but also common planning and a common response. Although the element of response is absent, this logic is captured in the European Programme for Critical Infrastructure Protection(Linkki toiselle web-sivustolle.), which is designed to identify and protect critical infrastructure that, “in case of fault, incident or attack, could seriously impact both the country where it is hosted and at least one other European Member State.”

EU and NATO measures to counter hybrid threats

In 2016, the European Commission and the EEAS developed a joint framework on countering hybrid threats(Linkki toiselle web-sivustolle.), containing 22 actions for member states and the institutions that set out ways to recognise hybrid threats, improve awareness thereof, and take steps to build resilience. Although the actions are by no means exhaustive, the framework established a clear ambition to make countering hybrid threats an EU priority. The most tangible effects were the establishment of a Hybrid Fusion Cell as part of the EU Intelligence and Situation Centre, and a European Centre of Excellence for Countering Hybrid Threats in Helsinki.

Hybrid threats also rose to the top of NATO’s agenda following the appearance of "little green men" in Crimea in 2014, which created an acute awareness of how military force could be used in the Euro-Atlantic area below the legal threshold of war. NATO was quick to adopt a strategy to counter hybrid threats(Linkki toiselle web-sivustolle.)(Linkki toiselle web-sivustolle.) based on a horizontal "all-of-NATO" approach. Similarly to the European Union, NATO has created a capability to monitor and analyse hybrid threats, based in the intelligence community and cooperating with other NATO authorities. Furthermore, NATO has established counter hybrid support teams that can be sent in support of the authorities of a stricken nation.

A joint declaration(Linkki toiselle web-sivustolle.)  was signed by NATO Secretary General Jens Stoltenberg and European Commission and Council Presidents Jean-Claude Juncker and Donald Tusk in Warsaw in July 2016, which set out a "common set of proposals" with 74 concrete actions, many of which focus on hybrid threats, building resilience in cyber security, and strategic communications. A second joint declaration(Linkki toiselle web-sivustolle.)(Linkki toiselle web-sivustolle.)agreed in Brussels in July 2018 provided an additional focus on military mobility, counter-terrorism and resilience to risks posed by chemical, biological, radiological and nuclear agents.

In addition to giving NATO-EU cooperation a long-awaited platform of common interest, countering hybrid threats has led to some other important new developments in the European Union. The European Commission and the EEAS have set up an inter-service group for countering hybrid threats that meets regularly at different levels. This group – designed to ensure common awareness of events and processes throughout European institutions relevant to countering hybrid threats – is a promising first step towards a comprehensive model for security-related challenges. Ideally, it could lead to a more solid platform for civil and economic preparedness, cyber security and other inherently multi-sectoral issues.

Furthermore, the European Council Friends of the Presidency Group for Countering Hybrid Threats (FoP) has been awarded an extended and significantly broadened mandate, stretching through the next four presidencies until June 2020. Whereas the initial FoP mandate from 2017 was very limited, the new one calls for an overview of ongoing EU efforts on countering hybrid threats, so as to spot shortfalls, avoid duplication, and support political decision making across Council bodies. By the end of the new mandate, the FoP could even become a permanent body responsible for maintaining cross-sectoral awareness and – similarly to NATO's Civil Emergency Planning Committee(Linkki toiselle web-sivustolle.) – supporting member states' civil preparedness and thereby their resilience against hybrid threats.

One key field where cooperation between the European Union and NATO should be intensified is training and exercises. Multi-faceted, complex exercises that test the ability to respond to hybrid threats below the threshold of war would be a particularly ideal area for the two organisations to explore their strengths and weaknesses, and perhaps discover complementarities. In September, an informal meeting of the North Atlantic Council(Linkki toiselle web-sivustolle.) (NAC) with the EU Political and Security Committee(Linkki toiselle web-sivustolle.) (Linkki toiselle web-sivustolle.)(PSC) included a hybrid scenario-based discussion facilitated by the Hybrid COE. This initiative should become a recurring element of future NAC-PSC deliberations, and other joint meetings as appropriate.

Joint exercises could also be designed to link up functional counterparts in EU and NATO institutional structures around a mutually relevant hybrid threat scenario, supported by the COE. Furthermore, the(Linkki toiselle web-sivustolle.) NATO School(Linkki toiselle web-sivustolle.)(Linkki toiselle web-sivustolle.) in Oberammergau and the European Security and Defence College(Linkki toiselle web-sivustolle.)(Linkki toiselle web-sivustolle.)  could open up their training courses for selected EU and NATO staff respectively.

The Hybrid COE – one year on

One of the most concrete outcomes of the efforts to counter hybrid threats is the Hybrid COE in Helsinki, which reached its initial operational capability in September 2017. Now that the Centre has completed its first full year of existence, there is an opportunity to have a look at what it has achieved and what direction it should take next.

Since April 2017, the number of participating countries has doubled from the initial nine to 18, with several more showing increased interest to join. The Centre has developed a concept for its three Communities of Interest (COI). Three COIs with their networking, analysis, training and exercise activities have succeeded in promoting both situational awareness, resilience and response capabilities in participating countries. The COI on Hybrid Influencing is Ied by the United Kingdom, the sub-COI on Non-state Actors by Sweden, and the COI on Vulnerabilities and Resilience by Finland. This past summer, they convened networks to share best practices on issues such as legal resilience, maritime and harbour safety, energy networks, drones and election interference. A fourth COI on Strategy and Defence, led by Germany and manned in August, will address strategic understanding of hybrid warfare.

As we have seen, countering hybrid threats has quickly become a central vehicle for strengthened cooperation between NATO and the European Union, based first and foremost on mutual interest. Because the Centre is neither an EU nor a NATO body but a freestanding legal entity, the Hybrid COE has been able to play a unique role in facilitating and strengthening this cooperation.

The Centre continues to support EU and NATO staffs working on hybrid threats. Both staffs have participated in its activities, including workshops, seminars and exercises aimed at enhancing the understanding of hybrid threats. And representatives of both organisations are present at the Centre’s Steering Board meetings.

In March, the Centre hosted a retreat which aimed to specify possible concrete actions in all key areas of interaction and formulate recommendations for further enhancing EU-NATO cooperation. Discussions focused on improving early warning and situational awareness, strategic communication and messaging, crisis response, resilience, cyber defence and energy security. Such retreats may become an annual event.

In April, the Hybrid COE convened a regional seminar to exchange best practices in countering hybrid threats among Nordic and Baltic nations, in cooperation with NATO’s Special Operations Forces Headquarters. One conclusion was the need to develop whole-of-government and whole-of-society responses to counter hybrid threats. Regional cooperation serves this endeavour and the Centre and NATO will work together on similar seminars in other regions.

In May, within the scope of assessing the implications of hybrid threats on capability development, the Centre facilitated a scenario-based workshop on "Harbour Protection under Hybrid Threat Conditions", organised by the European Union and attended by both EU and NATO staff. This workshop was the outcome of a hybrid threats tabletop exercise conducted in 2016.

All participating countries contribute significantly to the efforts of the Centre. Four countries have taken lead roles in the Centre's Communities of Interest, and six of them also support the Centre by seconding staff to the Secretariat in Helsinki. One concrete example of national contribution is the Comprehensive Security Training Event, organised by the Centre in cooperation with Finnish Defense Forces. This one-week event is targeted at NATO member states and selected partner countries to support them in developing comprehensive approaches or fusion doctrines to counter hybrid threats. The Finnish comprehensive security model is at the core, but it will be discussed in the context of other national and institutional experiences in comprehensive security.

Although much has been achieved, there is still so much to do. We should be able to move on from describing the threats to countering them. In the field of training and exercising, there is a demand for tabletop exercises and scenario-based discussions that can be played jointly or as individual national exercises. Participating states should trust and support each other in identifying national vulnerabilities and build resilience jointly. The Romanian and Finnish EU Presidencies in 2019 will provide further opportunities to promote cooperation on countering hybrid threats. The common understanding of hybrid threats is by necessity a living thing that requires constant attention, research and dissemination. And, as long as there are member states of NATO or the European Union that have not yet joined the Centre, there is room to grow.

Axel Hagelstam is Counsellor for Civil Preparedness at the Mission of Finland to NATO and Finnish representative to NATO’s Civil Emergency Planning Committee.


Kirsti Narinen is Director for International Relations at the European Centre of Excellence for Countering Hybrid Threats in Helsinki.


The article was originally published in the NATO Review.