NATO and its Defense Against Russian Hybrid Warfare: The Critical Role of the Private Sector in Denial and Deterrence

In 2023, over 100 cyberattacks against European energy infrastructure were recorded, disrupting energy grids and communication networks. Meanwhile, undersea communication cables between Finland and Estonia were deliberately severed in 2024, highlighting the vulnerabilities of transnational infrastructure in the Baltic Sea. These events underscore a troubling reality: hybrid warfare tactics are escalating, and NATO’s reliance on privately owned critical infrastructure exposes significant weaknesses.

Hybrid warfare, defined by NATO as the interplay or fusion of conventional as well as unconventional instruments of power and tools of subversion, targets the vulnerabilities of modern interconnected societies[i]. These tactics aim to destabilize and exploit adversaries through cyberattacks, disinformation campaigns, and the disruption of critical infrastructure. Across NATO member states, energy grids, communication networks, transportation systems, and other critical infrastructure are owned and operated by the private sector. That means that NATO has to strengthen and increase private sector capabilities throughout its member states to ensure NATO's capabilities to deny and deter Russian hybrid warfare.

NATO has made progress in countering hybrid threats by addressing that hybrid attacks can trigger an Article 5 response, developing the 2022 Strategic Concept, creating hybrid threat response teams, and the use of advanced technologies through the defense innovation accelerator for the North Atlantic (DIANA). However, these measures remain insufficient.

This article defines and addresses the scope of Russian hybrid warfare, examines NATO’s reliance on the private sector, examines NATO efforts and their limitations, lays out the actions needed to deny and deter Russian hybrid warfare, and informs about the issue of consensus within NATO.

Defining and Understanding the Scope of Russian Hybrid Warfare

Hybrid warfare is a form of warfare that seeks to exploit the weaknesses of the enemy, create confusion, and weaken the capacity to counter the threat effectively. It is different from conventional warfare in that hybrid warfare often operates below the threshold of direct military conflict and is, therefore, more difficult to identify and counter.

Russia has refined these methods over several years. After the Georgia conflict in 2008, Russia used "borderization" to expand its influence gradually[ii]. By 2014, during the Crimea crisis, Russia turned to disinformation and unmarked troops to ensure plausible deniability[iii]. Today Russia has yet again expanded its hybrid warfare capabilities to include GPS jamming, undersea cable surveillance, cyberattacks, infrastructure sabotage, and election interference, showcasing the sophistication and scope of Russian hybrid warfare. Additionally, Russia is increasing its use of hybrid warfare. Between 2022 and 2023, Russian cyberattacks on NATO member states increased fivefold, particularly affecting critical infrastructure and private enterprises[iv]. 

NATO Reliance on the Private Sector

“During the Cold War, many key components of civilian infrastructure, including railways, ports, airfields, and energy grids, were in government hands and could be easily transferred to NATO control in a crisis or wartime situation.”[v]. Today that is no longer the case with the private sector owning 80-90 percent of the critical infrastructure which has made NATO reliant on the private sector to secure the transatlantic region[vi]. This is a serious vulnerability during both hybrid warfare and a potential conventional war that NATO is currently not prepared to handle. NATO states that 90 percent of large-scale military transport is accomplished by civilian assets and that the undersea cable network that 95 percent of the internet traffic between Europe and North America, including military communications, relies on is owned and operated by the private sector[vii]. NATO and its member states therefore cannot sufficiently protect and defend these critical capabilities without significant cooperation with the private sector.

NATO Efforts and Their Limitations.

In recent years NATO has taken significant actions to combat this threat by stating that a hybrid attack can lead to an Article 5 response while also taking actions to cooperate with the private sector more closely. However, these projects and actions still fall short of what is needed since they remain too focused on reactive responses and NATO's ability to gain capabilities from the private sector. The reactive stance NATO has is particularly problematic since it allows Russia to have the initiative, often targeting private enterprises first.

As a result, neither NATO nor the private sector take the initiative to proactively address these threats effectively. Combined with the rapid pace of technological advancements in the private sector,  creating a gap between it and NATO making a combined effort to deny and deter Russian hybrid warfare increasingly difficult.

Denying and Detering Russian Hybrid Warfare

To deny and deter Russian hybrid warfare, NATO and its member states should prioritize strengthening the resilience of the private sector by:

1.     Addressing vulnerabilities: NATO and its member states should encourage the private sector to find and address their vulnerabilities. This can be achieved through information campaigns, simulation exercises, and cybersecurity assessments.

2.     Enhancing Public-Private Partnerships: NATO should establish regular communication channels and joint task forces to facilitate the sharing of threat intelligence and best practices. This will ensure that private companies are prepared to address hybrid threats.

3.     Provide Financial Incentives: NATO should work with its member states to offer subsidies, tax incentives, and grants to private companies willing to invest in cybersecurity and infrastructure resilience.

4.     Develop Regulatory Frameworks: NATO should in cooperation with its member states develop regulatory frameworks to set minimum security standards for critical infrastructure and cybersecurity.

These actions address important gaps in the defense against hybrid attacks from Russia which makes NATO and its member states more secure while also ensuring that the private sector is less negatively impacted. 

Achieving Consensus Within NATO

The threat from hybrid warfare does not affect all NATO member states equally. While Eastern European member states such as Poland, Estonia, and Romania have been threatened and targeted by Russian hybrid warfare for several years, Western European member states have not been impacted or threatened in the same manner. This creates a challenge to reach a consensus.

To build consensus, NATO should increase awareness of this issue to all member states. This can be achieved through targeted briefings, joint exercises, and reports on the vulnerabilities of critical infrastructure. Additionally, emphasizing the consequences of inaction, such as economic loss, weakened military capabilities and weakened democratic institutions may help gather support for stronger measures against hybrid warfare. 

Conclusion

The private sector is crucial for NATO in its defense against hybrid warfare because of its ownership over critical infrastructure and assets. Therefore, NATO needs to take decisive action to cooperate more closely with the private sector and strengthen its resilience. Through stronger partnerships with the private sector, enhanced resilience, and consensus among the member states, NATO can better prevent and counter hybrid attacks. This will also ensure that the private sector becomes more aware, resilient, and better equipped to address hybrid threats from Russia, other actors such as China, and importantly non-state actors who are increasingly becoming more capable. This will benefit NATO both in peacetime and in a conventional war where it will have better control over the capabilities it relies upon from the private sector. NATO should therefore embrace the private sector and its technological advancements to ensure that it will be able to operate and defend against malicious actors in the age of advanced technology and hybrid warfare.

Photo: Damage on the Balticconnector natural gas pipeline between Ingå, Finland, and Paldiski, Estonia // Wikimedia commons