NATO weighs response to Russian hybrid attacks amid escalation fears

BRUSSELS — Despite Russia's intensifying attacks on European critical infrastructure and weapons factories, NATO countries remain wary of making immediate tough moves that could provoke the Kremlin.

European capitals are eyeing options including opening a debate about whether a so-called hybrid attack could trigger NATO’s Article 5 mutual defense clause, more unified communication in response to incidents and a greater push on protecting critical infrastructure, according to three NATO diplomats and one person familiar with the matter, who were granted anonymity to speak freely due to the sensitivity of the matter.

But so far, Europe is avoiding taking any drastic steps — in part over fears it could escalate into an all-out war with Russia.

“We have all the response options ... some of them will be public, some are not,” NATO Secretary-General Mark Rutte told POLITICO on Monday. “I'm saying to [Russian President Vladimir] Putin and everyone who wants to listen, if you continue doing this, we will not only have our response options .... we will also continue the support in Ukraine.”

The calls for action underscore growing anxiety around the increasing frequency of sabotage, cyberattacks and other actions that fall below the threshold of conventional war across Europe. Over the weekend, a Russian drone hit a train near the Polish-Ukrainian border shortly after top Western security officials passed through, while Bulgarian authorities launched investigations into two explosions at weapons storage sites in the country.

“The pressure is mounting in view of the events on the Polish border,” said a fourth, senior NATO diplomat. But for now, the strategy is “keep calm and carry on and … continue our support for Ukraine.”

The most serious incidents pinned on Russia — including an attempted attack on Leipzig airport last month — have so far been thwarted. But European officials are increasingly grappling with the prospect they may soon face a successful attack with casualties, and the backlash that brings.

“The secret services have done a good job” so far, said one senior European defense official. But “we have been lucky — there have been no big incidents … if we do not act, then things might get much worse.”

“We are too shy — definitely,” said German lawmaker Marie Agnes Strack-Zimmermann, who chairs the European Parliament’s defense committee. “Vladimir Putin never stops, he’s always coming closer … we have to show we’re willing to fight back.”

Opening a debate

Inside NATO, allies have not yet formally drawn up plans for responding to the uptick in incidents, two of the alliance diplomats mentioned above said. Controversial options like offensive cyber operations against Russia are typically handled by national intelligence services.

Informally, some allies are discussing the possibility of starting a debate on whether an accumulation of sub-conventional attacks could cross NATO’s Article 5 threshold, the three diplomats said. Clarifying where that line is would send a clear warning to Russia and show NATO’s unified opposition to such attacks, two of the diplomats said, but acknowledged so far there is no consensus on the issue.

The senior European defense official said opening the discussion was “worthwhile,” but cautioned it would need to be matched with clear “political will” for a military response — to avoid hollowing out the meaning of the collective defense clause.

U.S. President Donald Trump’s repeated wavering on NATO and collective defense in particular also makes that debate more sensitive. “We have considered calling for Article 5,” said an Eastern European diplomat. “But we don't want to escalate and it could backfire, as it could show Putin that Trump is not ready to help.”

Countries are discussing how to formally, quickly and collectively attribute the attacks to the Kremlin, the three diplomats said. Allies could also be asked to spell out more clearly their spending on civilian preparedness and protection of infrastructure like hospitals, as part of their obligations to funnel 1.5 percent of GDP into civil defense by 2035, the diplomats said. So far, what spending counts toward that target has remained largely undefined.

Gerlinde Niehus, a former longtime NATO official and independent security expert, said the alliance should come up with “pre-agreed packages” in response to specific future attacks, coordinated with governments and intelligence agencies.

Today, “Putin … clearly plays on long decision processes [and] institutional inertia between NATO and the EU,” she said. If a serious Russian-linked sabotage incident was not matched with a clear NATO response, “that would undermine fundamentally the credibility of the alliance,” she said.

That's a concern Rutte brushed off on Monday. “I don't think [NATO] will be perceived as weak” in that scenario, he told POLITICO, while declining to comment on whether the alliance was drawing up new options.

EU not united

The EU is also discussing further measures — but so far there is little evidence that it too is planning an immediate response.

Defense and security is expected to be a key plank of European Commission President Ursula von der Leyen’s annual policy address this week, which is likely to spotlight hybrid threats and the bloc's long-anticipated security strategy, according to two EU officials. The strategy is expected to be presented in the coming weeks.

EU foreign policy chief Kaja Kallas is also preparing new sanctions against 1,600 entities, but these were proposed before the latest incidents over the weekend.

Meanwhile, the European Parliament is this week set to adopt a nonbinding resolution led by the Lithuanian MEP Rasa Juknevičienė, with unusually strong language that singles out Russia as “the gravest hybrid threat facing the Union and its Member States.” It is also likely to pass another report calling for strengthening EU agencies’ capacity to act against hybrid activities.