Russian President Vladimir Putin, frustrated by his bogged-down war in Ukraine, is trying to intimidate the European nations that — given President Donald Trump’s severe cuts in aid to Kyiv — are now Ukrainians’ main military, economic and diplomatic supporters.
A few of the many examples: an explosive-laden drone found at the airport in Leipzig, Germany; vital undersea cables cut or damaged in the Baltic Sea; parcels exploding at logistics facilities in Germany, Poland and the UK; a failed arson attack at a Czech bus depot; a Polish railway damaged by explosives; and a steady increase in the intensity of cyberattacks against North Atlantic Treaty Organization members.
While Moscow of course denies involvement, Western intelligence and law-enforcement agencies have convincingly attributed these attacks to the Kremlin, and in some cases obtained indictments and convictions.
Such incidents are known as hybrid or gray-zone warfare. The idea is to undertake sabotage and initiate disruptions across a wide spectrum of civilian targets that fall short of actual warfare, and in a way that makes it difficult to attribute them to Moscow.
What may seem to be isolated attacks can have far broader consequences. This intensifying pattern by Russia could trigger NATO’s Article 4 — under which any member believing its security or sovereign territory is under serious threat can initiate an alliance-wide consultation on collective action. That, in turn, can lead to an Article 5 determination — activating the fundamental premise of the alliance, that an attack on one nation is an attack on all.
Given that the Russian Federation and NATO both have nuclear weapons, the potential for miscalculation and vertical escalation is chilling. And while Putin has turned up the heat, he has been playing with fire for decades.
When I became NATO’s supreme allied commander in 2009, we were already studying intelligence reports about hybrid warfare. When Russia invaded Georgia a year earlier, its military and intelligence services had used cyberattacks, disinformation campaigns and aid to separatist forces very strategically. (This was a precursor to Russia’s use of unmarked troops, or “little green men,” when it seized Crimea in 2014.)
Russia had also previously conducted cyberattacks against the Baltic states, leading to the establishment in 2008 of the NATO Cooperative Cyber Defence Centre of Excellence in Estonia.
At NATO headquarters, two things were clear to me: Putin would continue these types of operations, yet the alliance had no effective tactics, techniques or procedures to counter them. While NATO has made progress on these fronts over the last decade and a half, it still needs a firmer, more comprehensive set of responses that its forces can execute — without triggering a full-scale war.
First, NATO needs an all-hands-on-deck intelligence effort to uncover the Russian organizations involved in hybrid attacks. It should step up its “name and shame” campaign by making public undeniable evidence of Russian state-level involvement in actions against Europe. This would include calling out senior Russian intelligence and military figures and placing maximum sanctions against any organization or individual involved.
The West has initiated such sanctions, especially since the war in Ukraine began, but they have fallen short, largely because of inconsistent application and the Russians’ ability to find ways around them, such as using shell companies, alternative currencies and a “shadow fleet” of tankers. While a handful of those ships have been detained, a more aggressive effort to board and seize them is called for.
A second necessary step is to prepare in advance for stronger responses to Russian actions. This means adding more surveillance and intelligence devoted to Russian plots and building a quick-reaction element at the headquarters of the supreme allied command in Mons. Kinetic capabilities should include mobile air-defense units that can be shifted to protect vulnerable targets (such as airports and railheads); on-call fighters around alliance borders to intercept drones that may “accidentally” cross NATO borders; and special forces units that can rapidly deploy to counter the “little green men” that might turn up in, say, the Baltic states or Poland.
Finally, the alliance must be prepared to go beyond defensive responses and go on the offensive. The first layer is obvious: Put more and better offensive weapons in the hands of the Ukrainians. They have shown themselves capable of launching sophisticated, long-range strikes against Russian oil and gas facilities and strategic aircraft. The more trouble Putin is having with Ukraine, the less capability he has to harass the rest of Europe.
The second layer is more controversial and risky: The alliance must be prepared to conduct its own brand of hybrid warfare. While NATO would not copy Putin’s techniques that are clearly illegal and immoral — threatening civilian transportation systems, for one — going after his military assets is fair game. I’d start by using cyber to disrupt operations at Kaliningrad, a Russian enclave on the shores of the Baltic Sea that has become Moscow’s front line for sophisticated electronic warfare and intelligence collection against Europe.
Putin needs to see that NATO knows what he is up to and is willing not only to defend its members but to create a real military cost if he continues to strike in the gray zone.
____
Stavridis is dean emeritus of the Fletcher School of Law and Diplomacy at Tufts University. He is on the boards of Aon, Fortinet and Ankura Consulting Group.
____
This column reflects the personal views of the author and does not necessarily reflect the opinion of the editorial board or Bloomberg LP and its owners.
James Stavridis is a Bloomberg Opinion columnist, a retired US Navy admiral, former supreme allied commander of NATO, and vice chairman at Carlyle.
©2026 Bloomberg L.P. Visit bloomberg.com/opinion. Distributed by Tribune Content Agency, LLC.
