Will the next war be hybrid?

Hybrid threats are everywhere and nowhere. Cable cutting in the Baltic, drone incursions in Copenhagen and Oslo, the shadow fleet moving sanctioned oil under foreign flags, self-igniting parcels routed through DHL, GPS jamming that no longer triggers Article 5 conversations the way it once might have. What counts as hybrid, what counts as warfare, and where is the line?

Dr. Gabriella Gricius returns to The Circumpolar to map how Russia operates differently across the Barents, the Baltic, and the Black Sea, why the shadow fleet is really about testing political cohesion rather than oil revenue, and why compounding threats keep her up at night. The conversation covers attribution problems, the limits of UNCLOS, what to make of Russia's ambassador to Norway saying Moscow has no interest in hybrid confrontation, and whether the West can hold a coherent red line when it cannot agree on a coherent response.

Dr. Gabriella Gricius is an Associate Professor at the Norwegian Military Academy, a Senior Fellow at The Arctic Institute, and a Fellow with the North American and Arctic Defense and Security Network. Her work focuses on Arctic and northern European security with a focus on Russia.

Transcript

SPEAKER_00 0:01

Will the next war be hybrid? And how does a changed hybrid security landscape affect the Arctic? Welcome to the Circumpolar. I'm your host. My name is Serafima Andreva. And today with me I have an uh expert, an excellent researcher on hybrid threats, Gabriella Grishius. Welcome back. Thanks for having me again. I'm excited to talk about this. First of all, uh, Gabriella, what are hybrid threats and where can we see them?

SPEAKER_01 0:27

So I thought it was interesting when we were talking about what hybrid threats is. To my mind, you could have used so many other terms. You could have said hybrid pressure, asymmetric warfare, nonlinear warfare. You could have used like this dictionary of terms that we use to talk about this concept. And there's no universal definition. But I think we can divide it into two different characteristics. The first is that the threat exists in the gray zone, so somewhere between peace and war, but under the threshold of armed conflict. And the second is that it's hybrid. It encompasses conventional or kinetic threats and non-conventional and non-kinetic threats. But even then, that could mean cyber threats, that could mean election interference, um, sabotage on critical infrastructure, the shadow fleet. What do we actually mean? The term is really vague, I think, and sometimes not useful when it comes to creating good policy because we see it everywhere. You could say these are the little green men in Crimea in 2014. This is also election interference in Europe and the United States. This is the shadow fleet. This is the cable cutting in the Baltic Sea. So I think it's an interesting term, but it also comes with a lot of challenges.

SPEAKER_00 1:35

And when we look at hybrid threats in opposition to other types of definitions, I mean, you mentioned gray zone activities, which threats are kind of more real or which threats are more pressing, which threats are more acute. How should we conceptualize this sub-threshold pressure in the world?

SPEAKER_01 1:53

I think it depends who you ask, unfortunately, and what exactly the threat you're trying to solve is. So, for example, I think if we talk about disinformation, for example, this is a long-term threat. It doesn't have the same sort of kinetic acute implications as cutting a cable or sending drones to bother an airport in Oslo or Copenhagen, for example. But it has this really kind of long-term pervasive threat situation where if you're causing problems with cohesion in a population, that means down the line, that population is going to have a lot of trouble. But I think when we talk about acute threats, I do think about cable cutting in a subsea area. I think about the usage of drones, of aerial and maritime incursions that seem to have significantly scarier or acute ways that these threats are experienced, not only by us in academia, but also by people actually living them.

SPEAKER_00 2:47

One thing that is also often being conceptualized as, at least in part, this hybrid threat is the Shadow Fleet, Russia's Shadow Fleet. And there's been an increase in activity from the Shadow Fleet, France, Sweden, the United Kingdom, they have shifted to blocking or seizing certain types of Shadow Fleet vessels. Are we facing a reality where enforcement is uh substituting for law? And is this sustainable? How do we address this?

SPEAKER_01 3:15

So I wanted to take a step back before I answer your question and actually ask what's the goal of the Shadow Fleet? Because we see them causing disruption. And I think on its face, this is about using unregistered, these poorly maintained ships to transport sanctioned Russian oil. But I think what it's really about is testing political cohesion. It's about amplifying escalation threat and deterring action by states in Europe. And of course, the Shadow Fleet comes with other threats too, maritime safety threats, environmental risks. It erodes the credibility of the sanctions regime. And we've actually seen that, of course, they've been used, by accident or not by accident, to sever cables and potentially as even launch strikes for drones in Northern Europe. I think this new strategy in seizing and blocking ships or blocking areas where the Shadow Fleet could go to, it's not necessarily about substituting for law, because I think unclose the UN Convention of the Law of the Sea, it was made and ratified before these types of threats existed. So I don't know that we can expect law to really do anything here, but I think it's more about creating a stronger deterrence and signaling posture because if we don't do that, all we're doing is enabling increased action and increased challenges.

SPEAKER_00 4:25

Would you say that some hybrid threats are more serious than others? Should we have a system on how to address the different versions of acuteness?

SPEAKER_01 4:37

I think so. I think it's not useful to just say hybrid threats generally, but I think rather than saying an issue is more serious than another issue, we have to really put things into context with one another. For example, in the Barents Sea, the situation is very different from the Baltic, is different from the Black Sea case. And so I think rather than focusing on what's more serious, we can say in the case of the Baltic area, we know that we're seeing increased maritime, increased aerial incursions. We also know there's a lot of local sabotage efforts, and these have really kind of actual physical challenges. So for example, in the Baltic, there were these self-igniting packages that were being put together by criminals, of course, supported by Russia and the GRU, that were then supposed to be kind of trialing to be sent through DHL across Europe, and they exploded before they were meant to, meaning that they did kill some people in the processing time. And this is directly very scary, I think, and acute. On the other hand, I've also recently read that this was a trial phase to try to see whether these could be used on transatlantic commercial and cargo flights. And to my mind, well, this is significantly very acute.

SPEAKER_00 5:45

Yeah, that's that's really scary. As a person with flight anxiety, this does not help at all. Um, but I mean you mentioned uh comparing Barnes, Bering, Black Sea region. I mean, we are for our listeners, me and Gabriella and uh a colleague of ours, uh Giulio Arlini, we're working on the paper uh comparing these regions. But Gabriella, you have been working on hybrid threats across these regions before. Uh, this is not new uh to you. So how would you say the compare the different landscapes of hybrid threats on the eastern flank, on Europe's eastern flank? I mean, are there any characteristics, things that we see more in the north that we don't see closer to the Black Sea? Something unique to the Baltic? What's up?

SPEAKER_01 6:25

Yeah, so I mean, you're right. There's absolutely significant differences between these areas, and I think it really shows us that Russia has different sub-regional approaches to these particular regions. So in the Barons, in the north, we see this sort of uneven and gradual increase in type of threats over time. But the threats are much more about espionage, intelligence collection. There is the usage of drones, of course, and there is more ability to attribute these challenges, but there's no spillover from the war in Ukraine. And I think a lot of this comes to how does Russia perceive themselves in the Arctic? Although, of course, we know they're acting in very different ways in Ukraine, across Eastern Europe, they largely are concerned about their secondary nuclear capability. In the Mermonth, they're of course worried about Kaliningrad. So I think they're hesitant to overpush in the Barents and northern parts of Europe. Whereas by contrast, in the Baltic, we've seen this really sharp increase in attacks from 2022, specifically an increase in 2024 as well. And the type of threats here are much more dynamic. So they include the usage of drones, these incursion attempts in the maritime and aerial domain, sabotage on the ground, sin attempts, vandalism. And there is some indirect spillover from the war in Ukraine when it comes to how Russia is really targeting support for Ukraine. So they're looking for where are weapons coming from, where is material coming from, and focusing on targeting that through their efforts. And I think that's part of the reason why for that is that Russia sees the Baltic, I think, as a testing bed. You know, they say, well, now the strategic situation has changed with Finland and Sweden here. So we need to act more assertively to protect Kaliningrad and disrupt NATO in a way that we can in this space. And then of course the Black Sea is even more different because it's so close to the war in Ukraine. So we see a huge amount of spillover incidents. So there is a high number, but it hasn't been escalating per se. It's just remained quite high. But attribution here is very challenging because we don't know if a lot of the spillover comes from Ukraine or from Russia. But I think across these different regions, what I've noticed, and I think in our research that we've both noticed is that there's this pattern of learning and adaptation, that Russia is not just has this master plan in the Kremlin for how to deal with these threats, but they have really clearly been learning and kind of shifting really cautiously how to do this. And I would be remiss to mention, of course, not the Shadow Fleet, and of course the GPS jamming that is common across most of these spaces.

SPEAKER_00 8:53

If we go back to the Arctic, then I mean Russian ambassador Nikolai Khrushchev to Norway, he said in May 5th in an interview that Russia is not interested in a hybrid confrontation with Norway or any NATO country. But from your standpoint, this hearing or hearing this, I mean, you're researching hybrid threats. I mean, what's your take on this? Is this true? Can we uh I mean can we uh attribute hybrid activity in Europe to to Russia? And can we kind of disprove or or approve or in any way approach that statement?

SPEAKER_01 9:27

I think in short, yes, that said, I think for Russia, I think the term hybrid confrontation is really interesting because they don't even like to use the term hybrid threats or hybrid warfare. They instead talk about this idea of a full spectrum approach to conflict and competition. So for them, hybrid warfare is not the type of way that we talk about it in the West, but rather their political and military goals are inseparable from one another. So it's about using all possible aims in the Russian playbook to achieve their goals. But of course, attribution is really challenging. Um, and I think Russia uses a lot of proxies to get at what it wants to do, so that sometimes directly pointing to the Kremlin and saying, we know 100% this was you, is not very useful or helpful. So Russia uses individual criminals, they use criminal organizations, they use their allies, like Belarus to send drones to Lithuania through or balloons to disrupt flights in villaineus. Private military companies are also used. And of course, it depends on the type of threat. So in the maritime realm, for example, the Shadow Fleet, many of these ships are not waving the Russian flag when they fly. They're on foreign ships from the Cook Islands, for example. So even if we see that a ship has dragged its anchor and we can say, we know this happened, we probably know that they're carrying sanctioned Russian oil, to directly link it in this way is really challenging. And I think this also comes back to UNCLOS in a way, because when there is a ship on the high seas and something goes amiss, the state that's actually responsible for that is the flag under which the ship is flying. And we saw this actually with the case of the Eagle S ship, where Finnish authorities were able to apprehend the ship, take them to Finnish court, but the Finnish court actually came back and said, but we don't have the jurisdiction to solve this. This is, I think, a big attribution and legal.

SPEAKER_00 11:16

I remember I was at a meeting when they were discussing like hybrid activities and and and the shadow fleet. And um there was an official that said that once they called the state and the legal authorities in in the state under the which under the flag which the vessel was sailing, and uh they said, Well, your vessel is here trying to address it, and the state answered, like, we don't have a fleet. Oh god. We don't we like this is this cannot physically be us. And also, I mean, you mentioned Russia views doesn't really view hybrid in the same way, it's like the full spectrum war. I was thinking about one thing is that how, for example, in Svalbard, I mean, there is limits to how much you can militarize a Svalbard due to the treaty, but one of their May parades, there was an airplane which was taking off uh Barnsburg, and it was taking off with all of the windows covered in propaganda posters, essentially. So this is like a major safety concern, and then there were some other safety concerns with that flight. Per se one would think that okay, this is single link, can this be hybrid? Somehow, yes. But then we can look at how the Duma and the Kremlin uh have talked about these incidents, and there have been people praising, saying, Oh, this is such a wonderful job, what you were doing at Svalbard. So it's clear that the linkage is still there. Is this something that you can see too? Like when it comes to like the state, non-state uh link?

SPEAKER_01 12:41

I think it depends on the situation. I think they're much more cautious when it comes to the GRU, for example, and like how they work with criminal organizations. I haven't read how they've promoted that inside of Russia, but I do think that I don't know, they play this really interesting game in how they decide to take attribution or to not take attribution. And often I find that they frame it as, well, the situation just turned out in our favor. Who could say how it happened? I don't really know what to make of in a way. And this is kind of a similar case when it comes to Belarus, right? We all know that Belarus and Russia are extremely tight allies, but I think when Belarus does something, like sending the balloons to Lithuania, I think Russia sort of treats it as, well, it's our ally choosing to do what our ally wants to do, whereas we all know there's a clear hierarchy in that relationship.

SPEAKER_00 13:26

What would you say, uh, especially looking at these increasing hybrid threat activities? I mean, they're increasing all across the board. What would you say keeps you up at night, if anything does?

SPEAKER_01 13:37

I think I was actually just speaking with someone at the Lithuanian um foreign ministry, and she told me something that has now kept me up at night. And she mentioned this concept of compounding threats, which I hadn't really thought about before, which is essentially this idea that we're getting really good at responding to individual threats. We say, okay, disinformation campaign, we know how to deal with this, cable cutting, we've got it. But in Ukraine, what's often used as a tactic in the war is that they will bomb something, they'll wait until all the first responders get there to put out a fire, and then they'll bomb again. And we don't have a good way, I think, of saying, okay, let's say there's a cyber operation, we know how to respond to that. But what if there's a cyber operation and that's then tied with a drone incursion or an aerial incursion? And I think that to me is very frightening because I haven't read too much about how states are signaling to Russia how to respond to that, and I haven't heard it within the Arctic or Baltic communities.

SPEAKER_00 14:34

That's, I mean, such a horrible thing to do as well. I mean, bombing, and then once all the rescue missions come as in. The I remember when I was a kid, I was reading Hungry Games, and this was like this exact this exact scene happened in one of the end books, and it was this major turning point of a political scandal, and here it's it's normalized. It's it's so just in to say that this is uh kind of either it's sci-fi or fantasy or dystopian novels, it's it's all here, it's all uh reflected in in the truth. I was at the Heinor Dialogue earlier this month, and there was a person who said a representative who said that several years ago there were discussions in NATO whether GPS jamming would trigger Article V. Those discussions would never make it today, because it is so uh so usual. And yes, right now one can say that yes, maybe GPS jamming has to do with protecting the Kola Peninsula from drones from Ukraine or or whatnot. But still, this makes me think about essentially what you also said. The threats are increasing. And what then I want to ask you, what is there to be of red lines? How would you approach that?

SPEAKER_01 15:42

I think I think of this in like a three-pronged way. I think first we have to have increased presence in the area, you know, and I think we can't have an understanding of what's going on, how we decide what a red line is, unless we know what's happening, which means more presence, more domain awareness. But when it comes to red lines, I think we what we need is more coherent and strategic communication from the West. Too often we do different things, we respond in different ways to the same threats. Maybe some states close their borders to instrumentalized migration, others don't. That sends a signal, I think, to Russia and other adversaries that says, well, the West is not as one in responding to this, so why would we trust or feel that their red lines are credible? So I think a lot of conceptualizing red lines comes back to alliance cohesion and also to regional cohesion. Because of course, as we both know, NATO is challenging to get a cohesion with on a good day. So imagine, like on a day where something is going wrong, there's a big threat, that would be even more challenging. So I think it might be about what's a Nordic Baltic red line when it comes to a drone incursion or an alien incursion? What's a Baltic Sea red line or a Barents red line? So really having a shared understanding of the different theaters of operation and also who should be involved, and that we all have the same response.

SPEAKER_00 16:59

I think before before we move over to ask you for policy recommendations, I have one more question. And this one is about, I think, what is an X factor in in both NATO and the world right now, the United States. Because we are seeing two wars happen at once right now, the Russian war against Ukraine and the United States-Israel war against Iran. And and these are both creating an increased hybrid environment in each theaters. How much can we expect the United States to contribute, participate in handling hybrid activities? Can we see can we expect them to contribute less than before, like capacity or policy Trump-wise? What would you say the landscape is there?

SPEAKER_01 17:43

It's a really complicated question. But I think I have less faith in the United States than usual. Well, not than usual than normally. But I think I'm always worried, not necessarily about what's happening on the political level, but instead I'm trying to focus on the operational level. And at least from what I've heard, there continues to be a lot of really close operational collaboration, specifically between the US and Canada. US and Norway have such a strong relationship. I remember I was speaking to someone in the Norwegian military once, and I asked, well, was it really difficult to work with the US during the first Trump administration? And they said, no, you know. Norway and the US, while there are, of course, political differences, they share strategic aims. And that's deterring Russia, deterring China. And so I am always concerned about a disinterested US. What do we think about will the US send reinforcements to Europe? If conventional war comes, I think that is a very frightening prospect because the answer is we don't know right now. We hope so. And we hope that the signal to Russia is consistent with that uh deterrent. But I think when it comes specifically to hybrid threats, I think the US does come with a lot of expertise in this area. But I think what they may be able to help with the most has to do with space-based surveillance. I think they may be able to provide a lot of help with attribution or at least to build a more coherent picture of what's going on in Europe. And even if the US becomes or is already disinterested from NATO, we can at least count on the US having pretty close bilateral relationships with several European states. So hopefully we can draw upon these areas if large-scale cooperation is missing.

SPEAKER_00 19:19

So when we look at handling the future, predicting the future and handling it, you know the drill. You have all the power in the world. You can do what you want. What do you do? How do you how do you fix these hybrid problems?

SPEAKER_01 19:32

Well, I mentioned some of them already. Of course, building presence, I think, is really important and building domain awareness. And I think luckily we've already seen this has been really successful in the Baltic Sea when it comes to Baltic century. So I feel confident that these two measures are things that we can improve upon. I already mentioned the strategic communication and the signaling. I think also capabilities could be improved as well. I know that a lot of military exercises now do include a hybrid threat component, but I think building upon that even more so, refining command and control practices, not only in specific exercises, but areas that stretch across the North Atlantic and the Arctic and the Baltic and so on. But I think maybe something different that I mentioned earlier has to do with learning and adapting. Because so often when we hear about how do we respond to hybrid threats? What's the policy response? It's really difficult to come up with this because we're reacting. And there's always this sense that you've like squashed one possible opportunity, but Russia's just going to find another way, another hole. And there's always more opportunities because we as democratic societies aren't going to close down every single opportunity for this. So rather than constantly reacting, constantly being on the back foot, I think that we need to be better at learning and adapting. That means listening to states in Central and Eastern Europe that have been dealing with this for a really long time. And I think even in like investing in technological innovation, there are so many small companies that want to work with defense and want to come up with better ways of dealing with this. So I think building better public private partnerships here would be really the way to go.

SPEAKER_00 21:10

Fantastic, Gabriella. Thank you so much. Thank you. And uh thank you to our listeners for listening.