By Eric Vandenbroeck and co-workers

NATO Must Escalate to De-escalate

Russia is prosecuting a war that knows no borders. Ukraine is the open front, but the objective is larger: to defeat a coalition of adversaries, including all of Europe and the Russian opposition figures that have taken refuge there. As a result, Moscow is carrying out repeated attacks on both people and infrastructure within NATO’s borders. What might once have been described as “hybrid operations” or “active measures” across Europe have become nakedly kinetic, aimed not to persuade but to destroy critical systems and the continent’s willingness to fight. Welcome to shadow warfare: a concerted campaign of physical assaults designed to degrade an adversary without provoking military reprisals.

The list of Russian shadow attacks grows longer each month. Moscow’s drone fleets have shut down busy airports in Belgium, Denmark, Germany, and Norway and forced these countries to scramble their jets. Downed Russian drones have damaged property in Poland. Russian-linked ships have dragged their anchors across the Baltic Sea, disrupting vital energy and telecommunications links. Explosive devices planted by Russian operatives have disrupted European railways and logistics depots. Senior European defense-industry leaders have only narrowly escaped assassination attempts. Several Russian exiles have been less fortunate.

With each new act of shadow warfare, the risk of escalation grows. If the West wants to prevent all-out war with Russia, it must therefore begin imposing meaningful consequences. This will require a clearer consultation mechanism within NATO, more cooperation between allies to identify attacks, and a clearer menu of responses, including intelligence and cyber operations that disrupt Russian networks, hair-trigger economic and political penalties, and limited but overt military measures when attacks endanger lives or critical systems.

 A suspected Russian shadow fleet vessel near Sassnitz, Germany, April 2025

 

Mild Rebukes

Moscow already understands itself to be at war with the West, not just over Ukraine but also over the survival of the Putin regime. The Kremlin sees all Western measures—including support for Kyiv, the imposition of sanctions, and the provision of safe harbor to the Russian exiled opposition—as an integrated challenge to its own power. Given that Russian President Vladimir Putin sees the stakes of this conflict as existential, Moscow does not compartmentalize its invasion of Ukraine from covert strikes on Europe and attacks on Russian dissidents abroad. In the Kremlin’s view, these are three fronts in the same war.

Russia pursues shadow aggression because it fears all-out warfare against a more powerful adversary. Moscow knows that when kinetic attacks are carried out below the threshold of what European policymakers and publics usually consider to be war, it can exploit Western inertia and confusion. Western powers struggle to detect an attack, determine its source, and gauge its importance. As a result, their responses almost always come late. These delays weaken deterrence by severing the causal link between actions and consequences.

Europe’s responses are also weak—limited to rhetoric, sanctions, and visa restrictions that do little to scare off Russia. Even as NATO tracks Russian attacks and attempts to coordinate responses, the alliance and its members often default to treating these incidents not as matters of collective or national defense but as problems best taken up by traditional law enforcement agencies. For example, European governments have generally treated sabotage of undersea communications and energy cables in the Baltic and North Seas as a maritime safety or criminal issue, delaying NATO consultation even when vessel behavior, timing, and targeting patterns strongly suggest hostile state action. Similarly, the Europeans have handled cases of arson, infrastructure disruption, and surveillance linked to Russian proxy networks across Europe primarily with arrests and prosecutions, foiling specific plots but leaving Moscow’s broader campaign unaddressed at the alliance level. Treating coordinated campaigns of shadow aggression as isolated crimes has thus weakened deterrence by signaling European caution rather than determination.

Firefighters on a roof that was struck by Russian drones, Poland, September 2025

There is, of course, a reason why the continent has kept to ambiguous responses. It wants to communicate that Europe is not, in fact, at war, and thus avoid escalation. But it still feeds the Kremlin’s narrative of victimhood, which in turn fuels its aggression. Each new sanction or public condemnation confirms Moscow’s perception of being under permanent siege. Russian authorities perpetuate the idea that the country has no choice but to invest in the aggressive capacity of its security services, which are ultimately responsible for executing shadow warfare.

Moreover, each ambiguous response on the part of the West raises Moscow’s tolerance for risk, increasing the chance of escalation. Without consistent, harsh responses from its adversaries, the Kremlin sees an open field, limited only by its own imagination and resources. Little wonder, then, that Russia is intensifying its shadow war activities. According to research by the International Institute for Strategic Studies and the Center for Strategic and International Studies, Russian shadow war incidents in Europe increased nearly threefold between 2023 and 2024, after a fourfold increase the preceding year.

The dangers of this situation are clear. Eventually, Moscow will miscalculate. Russian drones might inadvertently down a passenger plane, much as a Russian missile did over Ukraine in 2014. A cyberattack could cause a critical health-care or heating system to collapse. Hundreds, perhaps thousands, would die not in Ukraine but in a NATO member state. The pressure for Europe to respond with force would then be enormous. A shadow war designed to avoid open conflict could end up triggering one.

 

Restoring Deterrence

Traditional Western approaches to countering shadow warfare are clearly not up to the task. The standard playbook emphasizes resilience building through redundancy, crisis management, and damage mitigation; intelligence sharing with allies; sanctions against the adversary; and disruptions of espionage and organized crime networks that provide financing, logistics, recruitment, and deniability. But that approach remains grounded in a deterrence logic that misunderstands the system it is trying to deter. Western policymakers must accept a hard truth: retaliation through legalistic measures does not work. Neither does focusing on strengthening defenses.

Instead, Moscow must be made to fear that its mistakes will prove far more costly. Europe needs to ensure that Russia believes that continued shadow warfare will cause it to lose the war, both in Ukraine and with Europe more broadly, and potentially prompt the regime’s collapse. That requires clear thresholds for what kinds of actions will trigger alliance consultation and responses, credible countermeasures, and a readiness to act swiftly and predictably.

The NATO alliance should first agree to clear thresholds for Article 4 proceedings, which any member can initiate if it believes that “the territorial integrity, political independence or security of any of the Parties is threatened.” Consultations should be the norm in response to shadow aggression rather than the exception. Since NATO’s founding in 1949, Article 4 has been invoked only nine times and only twice in response to Russian shadow warfare—when Russian warplanes and military drones invaded Estonian and Polish airspace last September. Such consultations should become the norm even when Russia operates through arms-length proxies and deniable networks.

European states must then work through both NATO and the European Commission to set up responses that are sufficient not just to dissuade or disrupt further attacks but also to degrade Russia’s capabilities. These should include automatic cyber and intelligence operations against Russian military and security services involved in sabotage and proxy activity. They should also include expanded maritime and air interdiction of vessels and aircraft linked to covert Russian operations and the rapid imposition of economic and logistical penalties that directly constrain Moscow’s warfighting capacity rather than symbolic sanctions.

When shadow attacks endanger lives or inflict major damage on critical infrastructure (such as undersea cables, energy facilities, civilian telecommunications networks, or transportation hubs), NATO’s menu of options must also include proportionate military responses, including cyberattacks or kinetic strikes against Russian assets. For example, a confirmed Russian-linked sabotage operation against a major undersea cable could trigger a coordinated cyber retaliation to disable Russian command-and-control, logistics, or maritime surveillance systems; NATO can also seize Russian-linked vessels or equipment. Strategic ambiguity is important here, so that Moscow is unable to harden itself against retaliation, but the scale and seriousness of potential European responses must be legible to the Russian leadership to shift its risk calculations and restore deterrence.

An effective strategic response also necessitates that NATO allies build on the alliance’s progress in intelligence sharing, in order to ensure that shadow warfare attacks are swiftly detected and their source determined. From there, each member’s national security apparatuses—that is, militaries and intelligence services, not law enforcement agencies—should coordinate a response. Ensuring such coordination is all the more urgent now that Washington appears more ambivalent toward European security concerns. This month, the Trump administration announced plans to withdraw from the NATO-affiliated European Centre of Excellence for Countering Hybrid Threats—a move that weakens shared situational awareness at precisely the moment Russia is intensifying its shadow aggression.

In the years to come, Europe’s success vis-à-vis Russia will not be measured by how forcefully it condemns shadow attacks, or even by how effectively it punishes them, but by how consistently it deters them. The task, then, is to make plain to the Kremlin that any act of shadow warfare will be met not with mild rebuke, as in the past, but with a strong response. Moscow must understand that there are escalating costs to its aggression.

 

 

For updates click hompage here