Sep 30

What we talk about, when we talk about ‘Hybrid Threats’

An EUISS research paper prepared for the European Defence Agency

Paris, September 2015




Security analysts and practitioners have a tendency to coin new terms which capture the challenge(s) they are facing or the mandate(s) they are supposed to embrace. Terms such as ‘low-intensity conflicts’, ‘fragile’ or ‘failed states’, ‘asymmetrical threats’ or even, for that matter, ‘comprehensive approach’ are all relevant examples.

‘Hybrid threats’ is, potentially, another case in point.


The concept of ‘hybrid threats’ is not new, nor is the idea that it conveys completely original – namely, the combination of conventional and unconventional methods of warfare so as to confuse an adversary. Russia’s hostile actions in Ukraine and the violence perpetrated by the Islamic State of Iraq and the Levant (ISIL) in several areas neighbouring Europe – but also within Europe itself – are oft-cited examples of these hybrid threats. It could, however, also be argued that Western countries have resorted to these methods themselves, albeit without calling them hybrid, or that warfare itself has never been ‘pure’. But what is certain is that the European Union now considers itself a potential target of such threats and feels ill-prepared to respond.


The May 2015 Foreign Affairs Council invited the HR/VP ‘in close cooperation with Commission services, the European Defence Agency and in consultation with the EU member states, to present by the end of 2015 a joint framework with actionable proposals to help countering hybrid threats and foster the resilience of the EU and its member states as well as partners.’


This paper offers some analytical considerations with regard to hybrid threats. It first looks at the concept itself and the related challenges in terms of both definition and policy response. It then explores the two main (recent) sources of hybrid threats: Russia and ISIL. Finally, it examines some possible implications of the emergence of hybrid threats for EU military and non-military capabilities.


  1. The need for conceptual clarity


The first EEAS-proposed line of EU response to hybrid threats involves ‘improving awareness’ [see the Food-for-Thought paper ‘Countering Hybrid Threats’]. A key element of this is establishing a clear understanding of what exactly hybrid threats are, i.e. how they differ from ‘non-hybrid’ ones. Simply put, for a threat to be of a

‘hybrid’ nature it needs to be the product of multiple ways to threaten or attack its intended target – much as a hybrid species is produced by combining different breeds or varieties. It is therefore the mix of different methods – conventional and unconventional, military and non-military – which makes a threat hybrid.


In this sense, not all contemporary threats are hybrid. For example, a terrorist group which mainly plants bombs or makes use of suicide bombers does not, in and by itself, constitute a hybrid threat. It is only if and when such an outfit combines such tactics with, for example, the launching of military campaigns, systematically spreading disinformation or running criminal activities that the threat mutates into a hybrid one. In this sense, terrorism, cybercrime, trafficking and extortion are not per se of a hybrid nature; they may become hybrid depending on how (and to what extent) they are pursued using multiple tactics simultaneously. It may even be the case that some threats emanating from a particular organisation are hybrid while others coming from the same agent are not. The assessment of threats must therefore be a dynamic process and be constantly reviewed in light of new developments. After all, conceptual coherence is a precondition for crafting a sound policy response.


According to the most recent literature on the subject, hybrid threats are characterised by:


  • the combination of conventional and unconventional, military and non-military, overt and covert actions;
  • the aim of creating ambiguity and confusion on the nature, the origin and the objective of the threat;
  • the ability to identify and exploit the vulnerabilities of the targets;


  • the capacity to keep the level of hostility below the ‘threshold’ of conventional war.



‘Hybrid threats’ as seen by others


The term ‘hybrid warfare’ first appeared in 2002 in a thesis written by William J. Nemeth at the US Naval Postgraduate School.


In the United States, the term ‘hybrid’ does not appear in any of the last three latest National Security Strategies (2006, 2010, 2015). The 2015 National Military Strategy talks about ‘hybrid conflicts’ that may consist of ‘military forces assuming a non-state identity, as Russia did in the Crimea, or involve a violent extremist organisation (VEO) fielding rudimentary combined arms capabilities, as ISIL has demonstrated in Iraq and Syria. Hybrid conflicts also may be comprised of state and non-state actors working together toward shared objectives, employing a wide range of weapons such as we have witnessed in eastern Ukraine. Hybrid conflicts serve to increase ambiguity, complicate decision-making, and slow the coordination of effective responses.’


The United Nations talks about ‘asymmetric threats’ (in peace operations) but does not use the term ‘hybrid’.


The latest NATO Strategic Concept (2010) also does not mention the term ‘hybrid’. However, the document titled ‘NATO 2020’, prepared by a group of ‘wise persons’ for the 2010 Lisbon Summit of the alliance, did note the ‘hybrid variations’ of threats. The 2014 Wales Summit Final Declaration refers to ‘hybrid warfare threats’ where ‘a wide range of overt and covert military, paramilitary, and civilian measures are employed in a highly integrated design’. Furthermore, the 25 June 2015 Statement by NATO Defence Ministers talks about ‘hybrid threats’, for which ‘we will seek close coordination and coherence with the EU’s efforts in this field.’




Beyond the ‘comprehensive approach’


The multi-layered and multi-faceted nature of hybrid threats calls for an equally multi-pronged response, theoretically embracing the widest range of actions with a view to – as the aforementioned Food-for-Thought paper puts it – ‘building resilience’ and ‘responding to attacks’. Here, the EU’s ‘comprehensive approach’ comes to the fore, as it a priori provides an appropriate framework for policy response and an added value for the Union. The key challenge is to correctly calibrate the civilian-military balance of the response. So far, the thinking on countering hybrid threats has been rather military-centric, in particular in the NATO context. Yet the non -military and mostly unconventional nature of hybrid threats presumably requires them to be tackled also – and possibly, in some cases, mainly – through non-military means.


Most importantly, in an EU context, it is the mix of external and internal security policies and instruments which is likely to provide the most appropriate response.


Consequently, the comprehensive approach, insofar as it is mainly about the EU’s external action, would need to be broadened so as to include elements of internal security. In operational terms, this means that any common EU-wide response to hybrid threats would need to feature a clear division of responsibilities and identify synergies between three sets of actors/instruments: 1) EU internal security instruments (Freedom, Security and Justice [FSJ] tools); 2) EU external security instruments (including CSDP operations and missions), as well as NATO activities; 3) member states’ instruments and activities.


One example which requires such an approach is the handling of ‘foreign fighters’, i.e. individuals who spend time in war-torn or lawless areas before returning and becoming potential threats to their own country (or others). For any EU member state dealing with this issue, the response will combine a) exclusively national policies, b) cooperation at an EU level on law enforcement, border controls, intelligence sharing, as well as c) possible EU initiatives aimed at capacity-building in third countries or at disrupting hostile activities wherever they take place. This makes the coordination of various lines of response all the more vital, and takes them far beyond the current ‘comprehensive approach’ and any primarily military-focused response.


In the meantime, the confusion intentionally created by hybrid tactics is likely to further complicate the ability of EU countries and institutions to craft a truly coherent and comprehensive response. In order to respond effectively, the EU not only has to develop a cyber-security strategy, a maritime strategy or a broader ‘global’ strategy; it must also learn how to synchronise all these aspects – and in a tailor-made fashion.


That said, the first and arguably main line of response will likely lie with the member states. The EU, therefore, needs to prove its added value when it comes to improving awareness, building resilience, and responding to attacks. Both the EU (through its various institution, bodies, DGs and agencies) and its member states will then have to develop generic responses to what are, in reality, very different types of threats. The Ukraine crisis (Section II) and the emergence of ISIL (Section III) occurred concomitantly in the spring of 2014, thus allowing for a conceptual grouping of the two threats under a common ‘hybrid’ label. In practice, however, policy responses are likely to be distinct and, possibly, differ significantly from one case to the other. Indeed, this has been the case to date at all the three of the aforementioned levels (awareness, resilience, response). Can a generic policy response be designed to usefully address threats that, by nature, vary greatly in their ‘hybridity’? Ultimately, the very heterogeneity of hybrid threats may cast doubts on the utility of developing a general, catch-all strategy to counter them.



  1. Russia’s hybrid tactics


It was after Russia’s military operation to occupy and annex Crimea in the spring of


2014 that the term ‘hybrid warfare’ (or tactics), hitherto only used in specialised military debates, was adopted by the world’s media and the political mainstream.


There are two main sets of opinion concerning the phenomenon, which largely overlap but still have interesting nuances: one Western and one Russian.



In the west


Several aspects of Russia’s hybrid operations have been classified as ground-breaking. First, the ‘surprise’ they created did not lie primarily with the tools used (deception and disinformation campaigns, cyberattacks, economic coercion and corruption, which all play a supportive role for military action) but rather with the efficiency and multi-dimensionality with which they were employed in Crimea and beyond. The novelty, in other words, was how well old tools were utilised in unison to achieve the desired goal.


Second, until Crimea, hybrid operations were thought to be mainly conducted by non-state actors (e.g. Chechen separatists or Hizbullah). In the Ukraine crisis, however, it was a major state – and one of the strongest military powers in the world – which adopted hybrid tactics to remain below the threshold of outright conflict.


In simultaneously seizing control of Crimea, spreading confusion in Kiev and wrong-footing the West, Russia demonstrated the strategic impact of hybrid warfare. By resorting to plausibly deniable insurgency tactics in eastern Ukraine, Russia has proved its ability destabilise its opponents while keeping its tactical and diplomatic options open in light of developments on the ground.


Russia’s actions elevated hybrid operations from a tactical to a strategic danger. The threat does not simply lie with Russia’s tools and capabilities (be it tanks or TV channels), but also with how their combined use can affect political and strategic thinking inside the EU and NATO.


The potentially strategic nature of the challenge could affect:


  • Collective deterrence: hybrid operations might have an impact on the credibility of deterrence – both conventional and nuclear. A hybrid and limited operation – say, the swift takeover of a town in a NATO country bordering

Russia by unmarked groups of ‘little green men’ or a cyberattack on critical infrastructure by ‘private’ hackers – could lead to a dilemma over whether and how to respond. Hybrid operations might be a risky but not implausible tool to circumvent both NATO’s Article 5 and collective deterrence. Their deniability represents a specific threat to the applicability of tested rules of engagement and standard operating procedures. At the same time, Russia’s repeated references to its nuclear capabilities (e.g. in response to an increase in allied, and especially US, military personnel in the Baltic states) hint at a readiness to escalate beyond the threshold of conventional warfare – something which is not present (or at least not in the same way) in the debate over ISIL.


  • Inter-state response: just as hybrid operations blur the distinction between war and peace, they also complicate responses to them. Politically, it would be relatively easy for NATO or the EU to assess and then decide to respond to an open, large-scale, frontal military attack against any of their members. In the case of a hybrid operation, the risk is that instead of discussing possible responses, NATO or EU members would get bogged down in arguments over what is really happening. This could, for example, be over whether the aggressors are foreign troops or local radicalised activists, or whether an act of sabotage against sensitive national infrastructure has been carried out by state-sponsored proxy organisations or by individual hackers with malicious intent. By the time a degree of clarity could be achieved, it might be too late or at least much more difficult to dislodge or track down the perpetrators – with all the related risks of military and political escalation.


  • Domestic response: the challenge of maintaining inter-state cohesion may also filter down to domestic politics. Here the ‘info-war’ aspect of Russia’s hybrid operations is of great significance as it directly targets the general publics and political elites in EU and NATO countries. If effective and swallowed, it has the potential to constrain governmental responses and undermine political support for common responses. In this regard, Russia’s activities again differ from those of non-state actors like ISIL, whose information and outreach efforts tend to target small and often marginalised segments of society.


In the east

Russian analysts tend to talk about hybrid threats with a mixture of pride and contestation. The pride is fuelled by the belief that it was Moscow’s efficient military and information campaign which catapulted the term ‘hybrid’ into mainstream political discourse worldwide. EU and NATO concerns about hybrid threats are thus seen as indirect compliments to the conduct of the Crimea operation. Yet there is also a tendency to contest the term. It is argued that Russia did not do anything particularly unique, and that such terms are bandied about in order to play up to clichés rather than describe something truly new in terms of military affairs. In the Russian debates prior to the Crimea campaign, in fact, such operations were referred to as ‘network-centric’, ‘asymmetric’ and, in particular, ‘non-linear’ warfare (as defined in the so-called ‘Gerasimov doctrine’ of 2013).

Russian analysts and commentators are quite firm in their conviction that the West, and notably the US, also pursues hybrid tactics – in Afghanistan in the 1980s, for instance, but also over the last decade in the Middle East. They argue that this has been done, inter alia , through the use of special forces coordinating with local paramilitary groups in Iraq, Afghanistan, or Libya, and/or through sustained public relations campaigns – ‘embedding’ journalists in military units in Iraq or fuelling the case linking Saddam Hussein’s regime to weapons of mass destruction.

The implicit assertion is that Russia imported and adapted a tactic which had already been widely used by the West’s militaries. There is also a claim that the West is carrying out its own hybrid operation against Russia in the shape of smear campaigns and the imposition of economic and financial sanctions.


  • ISIL’s hybrid tactics

In the Middle East and North Africa (MENA), hybrid tactics are the norm rather than the exception. Although they resemble those of Russia, they differ sharply in terms of who uses them, who is targeted and for what reasons these methods were chosen.

Hybrid warfare in the MENA is mainly used by non-state actors (though they often harbour state-like ambitions) to target governments perceived to be illegitimate. And, more often than not, their use is determined by resource constraints rather than tactical considerations.

As a method of warfare, hybrid tactics have long been present in the region. But it was in the summer of 2006 during Hizbullah’s conflict with Israel that they really rose to prominence, with the Shia organisation displaying a remarkable capacity to blend guerrilla methods with more conventional ones in the face of a substantial military assault by the Israeli Defence Forces.

ISIL, which gained notoriety in the summer of 2014, is a continuation of this regional trend while taking it to the next level of territoriality. Although not the first non-state organisation with aspirations to govern (others include the Palestinian Liberation Organisation, al-Shabab in Somalia, and Lebanese militias during the country’s civil war), ISIL has succeeded in conquering and holding a territory roughly the size of Austria. The group now manages a population of some 8 million and remains on the military offensive in spite of a concerted international effort to neutralise it. Although it is debatable how much of this largely depopulated desert area is actually under ISIL’s jurisdiction, the organisation nevertheless controls oil infrastructure, a number of major urban settlements and network of roads – and has therefore been described as a ‘proto-state’ (i.e. an entity in the early stages of statehood).



From terror to governance

The adoption of hybrid tactics is to a large extent what allowed ISIL to evolve from being a terrorist organisation to the political-military entity it is today. This occurred in 2010 when the organisation exclusively tasked former Baath officers (with the necessary tactical know-how) with military decision-making. It is for this reason that ISIL was able to employ conventional military tactics, acquire and learn to use sophisticated heavy military equipment, and develop ways to demoralise Iraqi military personnel. ISIL, however, has not ceased ‘asymmetric’ tactics altogether: when required, it continues to use improvised explosive devices, for example. It is therefore a quintessential hybrid organisation in military terms.

As of mid-2015, ISIL’s troop strength ranges somewhere between 20,000 and 60,000 – a number which places it closer to militias rather than terrorist organisations, and which has increased in parallel to its military successes thanks to volunteers. However, in contrast to militias which tend to have a national or even local agenda, ISIL has ‘franchised’ into Egypt and Libya through resident terrorist organisations which have sworn allegiance to it. Its territorial outlook is therefore regional or even global, whereas its military outlook is always determined by the local strategic environment.

Just like Hizbullah, ISIL has displayed the capacity to adapt to its local context: its strategy consists of the sum of its tactics – essentially a bottom-up approach in military terms. Wherever it cannot employ conventional forces, it makes use of terrorist methods, such as planting bombs. Yet it also conquered areas in Syria and Iraq using armoured vehicles and coordinated movements of several teams of eight to ten men carrying out building-by-building, block-by-block clear and hold operations in urban terrain. Its command-and-control structures are flexible and use social networking tools such as WhatsApp and Facebook to communicate orders. And the battle ‘rhythm’ and morale of a regular ISIL fighter far surpasses those of its opponents.

ISIL has also managed to develop a powerful propaganda machine, mostly through social media. In addition to being a tool for recruitment and fundraising, it is also used to demoralise its opponents before an attack is launched. The same machinery is then used following a battle to convey a message of invincibility to Western and Arab audiences alike. Its messaging is carefully adapted: decapitation videos are not only digitally enhanced and display a dramatic quality, they also omit the most gory parts in order to ensure they are aired on TV. Blocking ISIL propaganda is virtually impossible: although Twitter shut down its main account, some 55,000 sympathisers are still actively promoting the group. Earlier in 2015, ISIL hackers managed to break into the account of US Central Command, sending threatening messages to American soldiers. A few months later, they took control of the Twitter account of French television network TV5Monde and tweeted the personal details of French military personnel.

Perhaps most worryingly, ISIL is not only an efficient military hybrid organisation, but has also managed to hold the territory under its control thanks to its governance capacity. The organisation has taken on mundane tasks such as garbage, water and electricity management, traffic control and customs, and is running a gruesome judicial system which keeps the population firmly under control. An insurgency from within its territory would therefore be difficult to organise, regardless of whether it is an entirely internal-driven process or whether it receives support from outsiders in terms of equipment and funds.


Western responses

The challenge with entities operating in a hybrid manner is that defeating them requires an equally hybrid approach. Defeating ISIL or similar groups will therefore require not only ‘classical’ military means such as airpower, but also elements drawn from counterinsurgency operations. For the time being, the international community has fought ISIL mainly with aerial strikes, whereas the Iraqi military and Shia or Kurdish militias have conducted ground operations. This approach, however, has not been very successful. Since strikes against its positions (mainly in Iraq) began in 2014, ISIL has lost 9.4% of its territory and suffered around 10,000 casualties. Although it initially lost ground, it has made up for this loss with spectacular gains (such as the cities of Ramadi and Palmyra), and therefore regained momentum. Furthermore, ISIL’s recruitment drive continues unabated.

It has successfully adapted to the strikes, reducing its teams to two or three vehicles or eight to ten men, thereby making them more difficult to spot. Its troops continue to show superior levels of morale compared to the Iraqi infantry, and any attempts to resist or desert in its territories have been met with brutal force. By and large, attempts to weaken the political support or acquiescence ISIL enjoys amongst Iraqi Sunnis have failed because Baghdad has dragged its feet on major reforms such as repealing all remaining elements of de-Baathification measures. To make matters more complicated, in contrast to Russia, ISIL is not seen by any state as a potential interlocutor for negations, thus reducing political options.

Europe has treated ISIL as a conventional military force in Iraq and to some extent in Syria, but as a terrorist organisation back home. Consequently, ISIL is being fought with conventional military means in the MENA, and with counter-terrorist measures in Europe. However, in Syria and Iraq, ISIL needs to also be battled with typical counter-terrorist measures such as increased intelligence gathering, political measures targeting the population under the group’s control, and tailored incentives to defect and collaborate (similar to ‘crown witness’-type schemes).

In Europe, ISIL is likely to go beyond al-Qaeda-style hit-and-run or suicide attacks. In fact, the organisation’s ambition and capacity for territorial control might indeed lead to a hypothetical scenario in which ISIL seizes key infrastructure in European cities, even for a short period of time. As well as causing severe disruption, this would be a boon to its narrative of invincibility. Treating ISIL as the hybrid organisation it is – and responding to it regardless of the terrain – is, therefore, the first step in defeating it.


  1. Implications for EU capabilities

The conflict(s) in Ukraine and the success of ISIL in the MENA have brought territorial defence and homeland security back onto the agenda in Europe. While outright military invasion of any EU (or NATO) member state remains unlikely, the dangers of hybrid threats and operations against the EU and its partners are real. After some 15 years of focusing on overseas international crisis management operations, the EU and its member states are now facing the challenge of building appropriate capabilities to address such new contingencies. As mentioned above, hybrid tactics are generally considered to be hostile actions below the level of recognised war which combine conventional and unconventional, military and non-military, overt and covert action aimed at creating confusion and ambiguity on their nature, origin and objective. Since these actions do not take place in wartime (legally speaking), the primary responsibility for directing any response is, in most countries, civilian. Similarly to traditional terrorist threats or attacks, it is the national police and civilian judicial authorities that are in charge of prevention and response.

The multi-layered and multi-faceted characteristics of hybrid threats require a multi-pronged response, combining internal and external security tools in both individual member states and the EU, and possibly also in third countries. In many, if not most, cases, non-military hybrid threats should also be met by non-military means. Nevertheless, there are important roles for the military to play in countering such threats. Most importantly, a military should have the capability to:


  • act as a deterrent. No EU member state is strong enough to withstand a large-scale Russian operation on its own, but even a smaller yet capable military force will impact the calculation for any opponent contemplating hybrid operations;


  • quickly react even without outside help. If a group of ‘little green men’ lacking visible insignias were to occupy a village in an EU or NATO member state bordering Russia, that country’s military and security forces must have the capability to rapidly respond on their own. The very nature of hybrid operations makes rapid collective defence responses difficult – if not near impossible – in consensus- and rules-based organisations such as the EU and NATO;


  • rapidly deploy to another EU or NATO member state in case of request and need. While the US keeps a rotating force of 150 troops in each of the Baltic states and Poland since April 2014 (occasionally joined by similar-sized units from other NATO allies), more troops would be needed in the event of a crisis;


  • effectively support civilian authorities and police. Since hybrid operations are below the level of war, most responses will be led by civilian authorities.


However, in cases of large-scale violent riots or acts of domestic terrorism associated with hybrid operations, police forces may be overwhelmed, contributing to the sense of confusion and hopelessness. In some countries, the police have the possibility to draw on military assets and personnel to act under civilian command. This capability should be further improved.

In all these cases, increasing operational readiness entails the reinforcement of special forces, an increased use of strategic communications and psy-ops, a targeted use of air forces with limited ground coordination, as well as the potential preparation of peace-stabilisation missions. These, in particular, include tasks like policing semi-permissive environments and require close cooperation with civilian actors.

By definition and nature, hybrid threats challenge the traditional boundaries (bureaucratic, legal, and operational) between military and civilian, public and private, national and collective capabilities. Cyberattacks and online activities are typical cases in point: they are both enablers of action and actions in their own right; they call into question existing silos and competencies; they have – but also represent – moving targets; and they are often outsourced and not easily attributable. This is where ‘intelligence’ (including monitoring, surveillance, early warning and preparedness) comes to the fore as a crucial capability to share and consolidate across geographical borders and functional boundaries – and at all stages and levels: awareness, resilience, and response proper.

Finally, today’s focus on hybrid threats also demonstrates a certain lack of institutional memory. While not called hybrid back then, the threat of Soviet covert or subversive acts to influence and intimidate domestic audiences and governing political structures was very real during the Cold War.

Concerns about Soviet propaganda and influence led several countries in Western Europe to set up ‘psychological defences’. As late as 1989, for example, the Swedish government prepared the distribution of leaflets to all Swedish households warning that, in case of war, ‘the enemy will try to trick us, make us uncertain and confused’ and stating that ‘any announcement of surrender is false’. Moreover, the Swedish Board of Psychological Defence – a government agency operating under the Ministry of Defence – continuously polled the Swedish population on their willingness to defend the country and their confidence in Swedish defence preparations. Both defensive and offensive tactics and strategies used in the past may therefore still prove useful when attempting to understand the current hybrid challenges.




Jan Joel Andersson

Florence Gaub

Antonio Missiroli

Nicu Popescu

Thierry Tardy




Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>