The Return of Direct Defense in Europe: The Challenge to the Infrastructures of the Liberal Democratic Societies

By Robbin Laird

Russia and China as 21stcentury authoritarian powers are challenging the liberal democracies in both classic military terms as well as in less classic ways.

The Russians with their approach to hybrid warfare and the Chinese with their evolving operational approaches in the “gray zone” are crafting innovative approaches to enhance their objectives short of significant engagements with peer competitors.

They are working to push the “red line” further down the spectrum of conflict and shaping a wider range of operational space within which their forces and capabilities can achieve desire objectives.

Another key area in which they are operating is with the direct engagement of their peer competitors is through expanded control or influence within the infrastructures of the economies and societies of those competitors.

The Finnish Perspective

The Finns have focused squarely on ways to enhance their capability to resist incursions from the Russians and to work towards expanded ways to enhance democratic military capabilities. They prioritize security of supply and have maintained military inscription system to prepare to mobilize in a crisis as well.

The Finns recognize that this is not enough given the nature of their 21stcentury competitor. They have established a new Centre to deal with the challenge of not just new ways of conducting influence operations but against European infrastructure as well.  And they have done so in a manner which underscores that a purely national solution is not enough and requires a broader European Union response as well.

The Government of Finland has stood up a new Centre designed in part to shape better understanding which can in turn help the member states develop the tool sets for better crisis management.

This is how the Finnish government put it with regard to the new center in its press release dated October 1, 2017.

The European Centre of Excellence for Countering Hybrid Threats has reached initial operational capability on 1 September 2017. The Act on the European Centre of Excellence for Countering Hybrid Threats entered into force on 1 July 2017, following which Matti Saarelainen, Doctor of Social Science, was appointed Director of the Centre. The Centre has now acquired premises in Helsinki, established a secretariat consisting of seven experts and made the operational plans for this year.

“Hybrid threats have become a permanent part of the Finnish and European security environment, and the establishment of the Centre responds well to this current challenge.

Since early July, rapid progress has been made to allow the Centre to begin its operations. The Steering Board will be briefed on the progress at its meeting next week,” says Jori Arvonen, Chair of the Steering Board of the Centre.

The Centre will launch its activities at a high-level seminar to be held in Helsinki on 6 September. The seminar will bring together representatives of the 12 participating countries, the EU and NATO. Approximately 100 participants will take part in the seminar. The Centre’s communication channel ( will also be opened at the seminar. Minister for Foreign Affairs Timo Soini and Minister of the Interior Paula Risikko will speak at the seminar as representatives of the host country. The official inauguration of the Centre will be held on 2 October.

The Centre is faced with many expectations or images. For example, the Centre is not an ´operational centre for anti-hybrid warfare´ or a ´cyber bomb disposal unit´. Instead, its aim is to contribute to a better understanding of hybrid influencing by state and non-state actors and how to counter hybrid threats. The Centre has three key roles, according to the Director of the Centre.

“First of all, the Centre is a centre of excellence which promotes the countering of hybrid threats at strategic level through research and training, for example. Secondly, the Centre aims to create multinational networks of experts in comprehensive security. These networks can, for instance, relate to situation awareness activities. Thirdly, the Centre serves as a platform for cooperation between the EU and NATO in evaluating societies’ vulnerabilities and enhancing resilience,” says Director Matti Saarelainen.

The EU and NATO take an active part in the Centre’s Steering Board meetings and other activities. As a signal of the EU and NATO’s commitment to cooperation, Julian King, EU Commissioner for the Security Union, and Arndt Freytag von Loringhoven, NATO Assistant Secretary General for Intelligence and Security, will participate in the high-level seminar on 6 September.

Currently, the 12 participating countries to the Centre are Estonia, Finland, France, Germany, Latvia, Lithuania, Norway, Poland, Spain, Sweden, the United Kingdom and the United States. EU and NATO countries have the possibility of joining as participant countries.

During a 2018 visit to the Centre, we interviewed  Päivi Tampere, Head of Communications for the Centre, and with Juha Mustonen, Director of International Relations and discussed the approach of the new Centre to the authoritarian states.

The Centre is based on a 21st century model whereby a small staff operates a focal point to organize working groups, activities and networks among the member governments and flows through that activity to publications and white papers for the working groups.

As Tampere put it: “The approach has been to establish in Helsinki to have a rather small secretariat whose role is to coordinate and ask the right questions, and organize the work.

“We have 13 member states currently. EU member states or NATO allies can be members of our Centre.”

“We have established three core networks to address three key areas of interest.

“The first is hybrid-influencing led by UK;

“The second community of interest headed by a Finn which is addressing “vulnerabilities and resiliencies.”

“And we are looking at a broad set of issues, such as the ability of adversaries to buy property next to Western military bases, issues such as legal resilience, maritime security, energy questions and a wide variety of activities which allow adversaries to more effectively compete in hybrid influencing.”

“The third COI called Strategy and Defense is led by Germany.

“In each network, we have experts who are working the challenges practically and we are tapping these networks to share best practices what has worked and what hasn’t worked in countering hybrid threats.

“The Centre also organizes targeted trainings and exercises to practitioners.

“All the activities aim at building participating states’ capacity to counter hybrid threats.

“The aim of the Centre’s research pool is to share insight to hybrid threats and make our public outreach publications to improve awareness of the hybrid challenge.”

With Juha Mustonen, who came from the Finnish Ministry of Foreign Affairs to his current position, we discussed the challenges and the way ahead for the Centre.

“Influencing has always been a continuum first with peaceful means and then if needed with military means.

“Blurring the line between peace time influencing and war time influencing on a target country is at core of the hybrid threats challenge.

“A state can even cross the threshold of warfare but if it does not cross the threshold of attribution, there will be no military response at least if action is not attributed to that particular state.

“Indeed, the detection and attribution issue is a key one in shaping a response to hybrid threat.”

And with the kind of non-liberal states we are talking about, and with their expanded presence in our societies, they gain significant understanding and influence within our societies so they are working within our systems almost like interest groups, but with a focus on information war as well.

Mustonen: Adversaries can amplify vulnerabilities by buying land, doing investments, making these kinds of economic interdependencies.

“They can be in dialogue with our citizens or groups of our citizens, for example, to fostering anti-immigrant sentiments and exploiting them to have greater access to certain groups inside the European societies.

“For example, the narratives of some European far right groupings have become quite close to some adversaries’ narratives.”

Question: But your focus is not only on the use of domestic influence but mixing this with kinetic power as well to shape Western positions and opinion as well, isn’t it?

Mustonen: Adversaries are using many instruments of power. One may identify a demonstration affect from the limited use of military power and then by demonstrating our vulnerabilities a trial of a psychological affect within Western societies to shape policies more favorable to their interests.

“If you are using many instruments of power, below the threshold of warfare, their synergetic effect can cause your bigger gain in your target societies, and this is the dark side of comprehensive approach.”

“The challenge is to understand the thresholds of influence and the approaches.

“What is legitimate and what is not?

“And how do we counter punch against the use of hybrid influencing by Non-Western adversaries?

“How can we prevent our adversaries from exploiting democratic fractures and vulnerabilities, to enhance their own power positions?

“How do we do so without losing our credibility as governments in front of our own people?”

Clearly, a key opportunity for the center is to shape a narrative and core questions which Western societies need to address, especially with all the conflict within our societies over fake news and the like.

Mustonen: Shaping a credible narrative and framing the right questions is a core challenge but one which the Centre will hope to achieve in the period ahead.

“We are putting these issues in front of our participants and aim at improving our understanding of hybrid threats and the ways we can comprehensively response to the threats.”

The Authoritarian Regime Approach

These two approaches – military enabled (hybrid war and “gray zone” con-ops) – and direct infrastructure engagement – lay a solid foundation for the authoritarian powers to engage effectively in information war, another key element of challenging the European democracies.

This challenge was the focus of a study published in 2018 written by Thomas Mahnken, Ross Babbage, and Toshi Yoshihara which was entitled “Countering Comprehensive Coercion: Competitive Strategies Against Authoritarian Political Warfare.” [1]

“Authoritarian regimes in Beijing and Moscow have clearly committed themselves to far-ranging efforts at political warfare that hope to achieve the ability to comprehensively coerce the United States and its allies.

“Only by clearly and frankly acknowledging the problem and organizing the respective governments to respond do we stand a chance of defending fee societies from these sophisticated efforts at manipulating public opinion and the decision-making pace of elected officials and government policy makers.”

One of the authors of the report, Ross Babbage, discussed with us further how he looks at the challenge.

“For the liberal democracies, there is a pretty clear break between what we would consider war and peace.

“For the Chinese and the Russians, there is not quite the same distinction.

“They perceive a broad  range of gray areas within which political warfare is the norm and it is a question of how effective it is; not how legitimate it is.

“They are employing various tools, such as political and economic coercion, cyber intrusion, espionage of various types, active intelligence operations and so forth.”

Shaping a purely military response to the new challenges posed by direct defense in Europe is a necessary but not sufficient response to the threats posed by the 21stcentury authoritarian states.

Babbage went on to identify in the interview how we might repond.

What can we do to actually stop this and fix it?”

At present we are not telling the story of foreign political warfare broadly enough within our political and economic sectors.

We’ve got to improve our information operations. We need to throw sunlight on what these guys are doing and do so in a comprehensive and sustained manner.

Beyond that effort, I would identify a number of potential components  of what one might call an effective counter strategy.

First is a denial strategy.

Here the objective is to deny, not just the operations and make them ineffective, but also to deny the political benefits that authoritarian states seek to win by conducting their operations.

Second is a cost imposition strategy.

We need to find ways to correlate their behavior with an imposed cost.  We need to make clear that if they are going to behave like this, it will cost them in specific ways.

Third is focused on defeating their strategy, or making their strategy counterproductive.

We can turn their strategy on its  head and make it counter-productive even within their own societies.

Their own societies are fair game given the behavior of the of our combined assets Russians and Chinese.

Fourth is to make it damaging, and even dangerous, for authoritarian regimes  to sustain their political warfare strategy.

Authoritarian regimes have their own vulnerabilities and we need to focus on the seams in their systems to make their political warfare strategies very costly and risky.

 And we need to do this comprehensively as democratic allies. 

There’s no reason why we can’t coordinate and cooperate and make the most of our combined resources, as we did in the Cold War.

But do we have the right tools and coordination mechanisms for an all-of-alliance strategy to work well?

In my view, the Western allies have a great deal of work to do.

A Danish Perspective

During a conference held in Copenhagen on October 11, 2018, the Danish Minister of Defence provided an overview on how the government views defence and security, particularly challenges in direct defence of Denmark and Europe – cyberwar posed by Russia and the need to enhance infrastructure defence are of key concern.

The lines between domestic security and national defense are clearly blurred in an era where Russians have expanded their tools sets to target Western infrastructure. Such hidden attacks also blur the lines between peace and war.

Within an alliance context, the Danes and other Nordic nations, are having to focus on direct defense as their core national mission. This will mean a shift from a focus on out of area operations back to the core challenge of defending the homeland.

Russian actions, starting in Georgia in 2008 and then in the Crimea in 2014, have created a significant environment of uncertainty for European nations, one in which a refocus on direct defense is required.

Denmark is earmarking new funds for defense and buying new capabilities as well, such as the F-35. By reworking their national command systems, as well as working with Nordic allies and other NATO partners, they will find more effective solutions to augment defensive force capabilities in a crisis.

It was very clear from our visits to Finland, Norway and Denmark over the past few years, that the return to direct defense has changed as the tools have changed, notably with an ability to leverage cyber tools to attack Western digital society to achieve political objectives with means other than use of lethal force.

This is why the West needs to shape new approaches and evolve thinking about crisis management in the digital age. It means that NATO countries need to work as hard at infrastructure defense in the digital age as they have been working on terrorism since September 11th.

New paradigms, new tools, new training and new thinking is required to shape various ways ahead for a more robust infrastructure in a digital age.

Article III of the NATO treaty underscores the importance of each state focusing resources on the defense of its nation. In the world we are facing now, this will mean much more attention to security of supply chains, robust security of infrastructure, and taking a hard look at any vulnerabilities.

Robustness in infrastructure can provide a key defense element in dealing with 21st century adversaries, and setting standards may prove more important than the buildup of classic lethal capabilities.

A return to direct defense, with the challenge of shaping more robust national and coalition infrastructure, also means that the classic distinction between counter-value and counter-force targeting is changing. Eroding infrastructure with non-lethal means is as much counter-force as it is counter-value.

We need to find new vocabulary to describe the various routes to enhanced direct defense for core NATO nations.

A new strategic geography is emerging, in which North America, the Arctic and Northern Europe are contiguous operational territory that is being targeted by Russia, and NATO members need to focus on ways to enhance their capabilities to operate seamlessly in a timely manner across this entire chessboard.

In an effort to shape more interactive capability across a common but changing strategic geography, the Nordic nations have enhanced their cooperation with Poland and the Baltic states. They must be flexible enough to evolve as the reach and lethality of Russia’s air and maritime strike capabilities increases.

Clearly, tasks have changed, expanded and mutated.

An example of a very different dynamic associated with direct defense this time around, is how to shape a flexible basing structure.

What does basing in this environment mean? Can allies leverage national basing with the very flexible force packages needed to resolve a crisis?

One of the sponsors of the Danish Conference was Risk Intelligence, provide a very cogent perspective on how to look at the challenge.

Their CEO, Hans Tino Hansen, a well-known Danish security and defense analyst explains the new context and challenges facing the Nordic countries:

“We need to look at the Arctic Northern European area, Baltic area, as one. We need to connect the dots from Greenland to Poland or Lithuania and everything in between. We need to look at the area as an integrated geography, which we didn’t do during the Cold War.

“In the Cold War, we were also used to the Soviet Union and the Warsaw Pact being able to actually attack on all fronts at the same time, which the Russians wouldn’t today because they are not the power that they used to be.

“And clearly we need to look beyond the defense of the Baltic region to get the bigger connectivity picture.”

He went on to assert the need to rethink and rebuild infrastructure and forces to deal with the strategic geography that now defines the Russian challenge and the capabilities they have […] to threaten our interests and our forces.”

Evaluating threats across a spectrum of conflict is the new reality. “We face a range of threats in the so-called gray area which define key aspects of the spectrum of conflict which need to be dealt with or deterred.”

A system of crisis identification with robust procedures for crisis management will go a long way towards effective strengthening of infrastructure in the face of the wider spectrum of Russian tools.

“A crisis can be different levels. It can be local, it can be regional, it can be global and it might even be in the cyber domain and independent of geography. We need to make sure that the politicians are not only able to deal with the global ones but can also react to something lesser,” Hansen says.

“The question becomes how to define a crisis.

“Is it when x-amount of infrastructure or public utilities have been disrupted or compromised?

“And for how long does the situation have to extend before it qualifies as a crisis?

“This certainly calls for systems and sensors/analysis to identify when an incident, or a series of incidents, amount to a crisis. Ultimately, that means politicians need to be trained in the procedures necessary in a crisis similar to what we did in the WINTEX exercises during the old days during the Cold War, where they learned to operate and identify and make decisions in such a challenging environment”.

In short, the Russian challenge has returned – but in a 21st century context. that incorporates incredibly invasive infrastructure threats.

Direct defense strategies must include these threats as part of any comprehensive national security concept.

Strategic Communications and Resilience – Speech by Director Matti Saarelainen

“This morning I’m going to take my 10 minutes to talk about three things:1) How states and institutions can response to Hybrid threats effectively (and Strategic Communication’s role in that)
2) Where EU and NATO can improve their response to Hybrid Threats
3) What the Hybrid CoE is doing to enable Member States and the institutions to build capability in this area

  1. How: Given the theme of this conference I wanted to focus on the centrality of communication to effective Hybrid response. A few thoughts.

Separation anxiety- Strategic Communication suffers from a degree of separation anxiety- it is often treated as a separate field, with separate experts and communities. But at Hybrid CoE we see it as an intrinsic part of the response.

Effective resilience requires an open conversation with our population about unfolding Hybrid events (and our response to them) which maintains trust in our values, democratic processes and governance structures. Resilience also requires persuasive communications as we prepare our populations- campaigns which encourage them to change their behaviour and improve their own personal resilience are critical- whether we are asking them to put aside peanut butter or improve password security.

Separately, Effective deterrence of Hybrid threats requires States to demonstrate: resolve, coherence, capability, agility, willingness to attribute and desire to act in concert. To shape the adversary’s perception, we need to make sure our actions are effectively communicated- to achieve ultimate impact. Our strategic communicators are best placed to do this.

All this speaks to the importance of strong- connective tissue between strategic communicators, policy makers and the intelligence community. They should not be an afterthought in the national or institutional crisis response structures. They should be at the policy making table, thinking not just about how to communicate the government or institution’s response but what that response should be. They also need to be in close contact with the intelligence community. Strategic communicators often have a detailed understanding of the open source debate surrounding a Hybrid event ( and access to the tools required to analyse it). Given the challenge of information sharing within and between governments open source material can and should be the bedrock of our resilience and deterrence strategy. A strong relationship between these two communities will ensure it is effectively leveraged.

  1. Where: Mr. Chairman, you asked me to focus on where I think the EU and NATO response was strong and where there was room for improvements.  Hybrid CoE has a unique perspective, being neither EU, nor NATO and given one of our core goals is acting as a neutral facilitator between the two. A couple of thoughts on each.

On strengths, I want to pause a moment on vulnerabilities and values. Often the values which are central to these institutions: respect for human rights, strong democratic institutions, the market economy, freedom of speech and media and rule of law are singled out as intrinsic vulnerabilities. And there is no doubt many of these have been exploited by our adversaries for their own ends. But they are also the values with which we won the Cold War. They are in fact our strength. They form the foundation of our resilience as institutions (and the resilience of the member states within them). It is both glib and true to say we need to be better about communicating them.

On a more practical level, EU and NATO have developed a strong set of commitments and actions on countering Hybrid Threats.  There is a good level of awareness of Hybrid and political will, at the most senior levels, to address it.  The key now is to implement these effectively and and communicate that implementation with impact. While initiatives are key, it is their implementation which will shift the dial.

And with that I turn to a discussion on where the collective response could be improved… At our inauguration Commissioner King encouraged the Centre to be challenging… So, in that spirit a few areas for the EU and NATO to consider.

Hybrid threats are full spectrum in nature. The use of multiple means in coordination and with malign intent to achieve a political ends requires a coordinated response. At Hybrid CoE, when we talk about deterrence our underlying principle is that we will most effectively deny the benefit or impose cost on our adversary if all aspects of government and society are coordinated in their response. The same is true at the institutional level. Between them, EU and NATO have the capabilities to detect and respond to a hybrid attack. They also have the tools to effectively impose cost and deny benefit to the adversary. There is still a need at a strategic level to have discussions between the two organisations about using these capabilities and tools in a coordinated and coherent way, as part of a campaign to protect the values that are central to the institutions. So strategic level discussions about a coordinated response is key.

This however requires a whole of institution response to Hybrid within each organisation. The bureaucratic vulnerability, as we call it at the Centre is the single biggest spoiler in any actor’s response to Hybrid threats. Siloes, blocks and poor information flow hampers response. On the EU side this means coherence between the Commission, EEAS, Council and Parliament and on the NATO side this is fusion across the civilian military divide. Both organisations are restructuring their approach to Hybrid internally, so we are keen to see the results. The logical extension of this is the creation of informal communities across the organisations (more on that later).

Agility is also key in cross institutional response and where there is always room for improvement at the national and institutional level. Particularly when it comes to crisis responses and political decision making. The PACE exercises have been key in exercising the organisations alongside each other. There is no substitute for exercising to test agility. Coherent and parallel exercising will remain important and the Hybrid CoE was pleased to support a joint NAC/PSC scenario-based discussion last autumn which tested this agility and provided an opportunity for a strategic discussion about a coordinated response. They will also support the exercises proposed as part of the Finnish EU Presidency.

Member States provide a key role in encouraging and supporting effective institutional response to Hybrid Threats. They also critical to overcoming some of the key barriers to closer institutional cooperation on Hybrid Threats. I continue to encourage all Hybrid CoE Member States to support their institutions in overcoming these barriers and being more ambitious in their implementation of these actions.

  1. What the Hybrid CoE does to support the institutions and Member States to improve response.

In the last nearly two years we have focused our work in four key areas which we believe to be key to improving the Euro-Atlantic region’s response to Hybrid threats.

Networks:  We have built practitioner networks across our 20 member states, EU and NATO and the private sector. These networks train, exercise and share best practice with one another, as well as coordinating action and testing policy response options. We have practitioner networks on: energy, drones, maritime security, technology and hybrid warfare, strategic communication, open source data, countering hostile states and legislative resilience. A networked response requires a networked solution.

Training: One of the Centre’s core goals is to improve the capability of its member states to counter Hybrid threats.  Training is an important way in which we do this. We have two flagship training events. One on using open source material to counter Hybrid threats. As I noted earlier, open source material is a critical enabler in building situational awareness and responding to Hybrid Threats. We train analysts and policy makers from across our Member States EU and NATO to analyse open source data and use it as part of their policy response to countering disinformation. We have run this course twice already and will run it on a further three occasions this year. This builds and supports our digital community of analysts across our 20 member states EU and NATO. We also train journalists to counter disinformation (with thanks to NATO support).

The second flagship training is on countering electoral interference. Elections, as I need not tell this community, are particularly susceptible to Hybrid attack. The two day event aims to bring together strategic communicators, intelligence and other government practitioners involved in securing elections- it and exercises them together. Facebook and Microsoft are our private sector partners.  This roadshow will take place in six capitals this year.

Exercising and scenario based discussions are mainstreamed in most of our activities because they are so critical to ensuring agility and testing the ability to coordinate. We have held two strategic multinational exercises on Hybrid Threats with participation of our member states, EU and NATO. We have also held numerous subject specific exercises on everything from de-synchronisation of energy supply networks, to countering electoral interference (and in support of the Romanian Presidency last week hosted an exercise on mass casualties – to support EU and NATO crisis response). In addition to running our own exercises we run them for institutions- the NAC/PSC scenario-based discussion is a case in point. We also support others with scenario development.

Trend Mapping and Intellectual Matchmaking: There are plenty of actors out there willing to admire the problem but at Hybrid CoE we are actively engaged in trying to counter it. Trend mapping has been key to this. We have a unique methodology for doing this which brings nominated academic experts from across our Member States (we call them our expert pools) together with practitioners working on that topic to map emerging trends in the Hybrid landscape. In Madrid last week we held a trend mapping exercise in this academic/practitioner format behind closed doors on Russia. We find this intellectual matchmaking the most effective way of ensuring cutting edge academic thinking makes it into the policy making bloodstream.

High Level Retreat: Finally, we host an annual EU/NATO high level retreat in Helsinki for senior leaders from both organisations. This outcome focused event gives staff from both organisations the chance to talk (beyond the confines of staff to staff cooperation) about emerging challenges and how the two institutions can develop a collective response.

It has been a pleasure to address you this morning. At the Centre we aim to lead the conversation on Countering Hybrid Threats. I look forward to hearing what follows.”

The featured photo features the dais at a conference in Romania by the director of the Centre. Romania currently is in the chair of the European Union.