THE WORLD NEWSREEL
THE STRATEGIC DESK · SPECIAL ANALYSIS
Reconstructing the Hybrid War
How conflict escaped the battlefield, entered the institutions of everyday life, and changed the meaning of peace.
HYBRID WARFARE “Gentlemen, the advantage of modern warfare is that nobody needs to declare it.”
There were exceptions, of course. There were secret operations, political assassinations, propaganda campaigns, economic blockades, and acts of sabotage. But the distinction between war and peace remained a central organizing principle of international relations.
That distinction is now increasingly difficult to maintain.
A submarine cable is damaged in the Baltic. A government ministry suffers a cyberattack. An election becomes the target of a foreign disinformation campaign. An airport closes because unidentified drones appear near its runways. Financial institutions confront coordinated digital disruptions. Political movements receive assistance from abroad, while intelligence agencies investigate sabotage against military supply networks.
Each incident can be described separately. Each may have an innocent explanation, a criminal origin, or an identifiable military purpose.
But what happens when they form part of a coordinated strategy?
What happens when the battlefield is no longer a particular territory, but the entire system through which a society functions?
Welcome to hybrid warfare.
I. AN OLD IDEA IN A NEW WORLD
Hybrid warfare did not begin with Vladimir Putin. Nor did it begin with the internet.
Ancient empires employed bribery, intimidation, commercial restrictions and political subversion alongside military campaigns. Napoleon understood the economic blockade as an instrument of strategic warfare. During the Cold War, both superpowers used intelligence operations, propaganda, proxy forces and political interference while carefully avoiding direct confrontation.
The novelty lies elsewhere.
In 2007, the American military theorist Frank Hoffman described hybrid warfare as the convergence of conventional military capabilities, irregular formations, terrorism and criminal activity, coordinated to produce combined effects.
His original concept was substantially military. It concerned the integration of different forms of combat within a common operational environment.
After Russia's intervention in Crimea in 2014, the expression acquired a much wider meaning. It increasingly came to describe hostile activities conducted across the entire political, economic, informational and technological structure of an adversary.
The contemporary definition employed by NATO includes conventional and unconventional instruments, overt and covert operations, cyberattacks, economic pressure, information manipulation and irregular armed groups. The European Union similarly emphasizes coordinated activities intended to exploit vulnerabilities while remaining below the threshold of recognized armed conflict.
This expansion has produced a conceptual difficulty.
If every hostile economic measure, cyber intrusion or propaganda campaign constitutes hybrid warfare, then virtually all international competition becomes war.
The term would explain everything and distinguish nothing.
We therefore need a more precise definition.
Hybrid warfare is the strategically coordinated use of heterogeneous instruments of coercion, disruption and influence against an adversary, exploiting the boundaries between military and civilian activity, domestic and international jurisdiction, and war and peace.
Three elements are essential: coordination, strategic purpose and the exploitation of institutional vulnerabilities.
Without them, we may be observing espionage, ordinary political competition, criminality or economic rivalry. Not necessarily hybrid warfare.
II. THE ARSENAL: HOW HYBRID WARFARE OPERATES
The traditional army attacks an enemy's military capacity.
Hybrid warfare may attack the systems that make military capacity, political authority and ordinary social life possible.
Its arsenal is correspondingly extensive.
The digital front
Cyber operations can target government networks, communications, financial services, logistics and critical infrastructure.
Their purposes differ.
Espionage seeks information. Disruption interrupts services. Manipulation compromises the integrity of data. Destructive attacks can disable equipment or impose substantial costs.
The strategic advantage is that an operation may achieve important effects without deploying troops across a border.
Attribution is frequently difficult. Technical evidence may identify infrastructure used in an attack without conclusively establishing who ordered it.
The attacker may therefore obtain two benefits simultaneously: operational disruption and political uncertainty.
The information front
Disinformation is not simply the circulation of falsehoods.
In a hybrid campaign, information operations seek to influence how a society understands events, institutions and political choices.
A coordinated operation may amplify existing grievances, circulate fabricated evidence, impersonate credible sources or encourage mutually incompatible narratives.
Its purpose need not be to convince everyone of one particular account.
Sometimes the objective is to make every account appear equally unreliable.
The resulting loss of confidence can be strategically valuable. A society unable to distinguish credible information from manipulation may struggle to reach collective decisions.
NATO explicitly identifies coordinated information manipulation as a means of deepening social divisions and undermining institutional confidence.
The infrastructure front
Electricity networks, railways, ports, pipelines, undersea cables, satellites and telecommunications systems are indispensable to modern states.
They are also vulnerable.
An interruption may result from an accident, negligence, criminal conduct or deliberate sabotage. Establishing the cause matters.
When disruption is deliberately coordinated with other hostile activities, however, its significance changes.
A railway incident may interfere with military logistics. Damage to a communications cable may impose economic costs. A prolonged energy disruption may increase political pressure on a government.
Modern military readiness depends heavily on civilian infrastructure. NATO's resilience framework accordingly treats continuity of government, essential services and civilian support to military operations as central elements of collective defence.
The economic front
Economic coercion can involve energy dependence, strategic commodities, market access, investment restrictions and pressure on essential supply chains.
Not every sanction or trade restriction is an act of hybrid warfare. Economic measures are also instruments of ordinary statecraft and may be lawful responses to internationally wrongful acts.
What makes economic pressure part of a hybrid campaign is its coordination with other coercive instruments.
A state facing cyber disruption, energy insecurity and a sustained information campaign may find its freedom of political choice constrained without ever confronting an invading army.
The political front
Political interference may involve covert financing, intelligence activity, corruption, influence networks and the exploitation of domestic divisions.
The central objective is to affect the adversary's decision-making capacity.
The distinction between influencing a government and controlling its decisions is important. Foreign governments have always attempted to influence one another. Hybrid operations seek more intrusive effects through concealment, manipulation or coercion.
The military front
Hybrid warfare does not eliminate conventional military power.
It incorporates it.
Troop deployments, military exercises, airspace violations, naval manoeuvres and threats of escalation may provide the coercive background against which non-military operations become more effective.
A cyberattack has one political meaning when relations are peaceful and another when an army is mobilized across the border.
The military threat changes the interpretation of every other event.
And this brings us to the essential characteristic of hybrid warfare: its instruments are not necessarily novel. Their strategic combination is.
III. THE METHOD: HOW SEPARATE INCIDENTS BECOME A CAMPAIGN
Consider a hypothetical European country.
Its government supports an international policy opposed by a foreign power.
First, its public debate becomes saturated with conflicting narratives about the policy's economic costs.
Then government networks suffer intrusions. A transport system experiences unexplained disruptions. Anonymous accounts amplify public dissatisfaction. An energy supplier threatens to revise commercial arrangements. Military exercises take place near the country's borders.
None of these developments, taken individually, necessarily proves the existence of a coordinated attack.
But suppose intelligence evidence establishes that several of them were planned together, directed toward the same political objective and timed to reinforce one another.
We would then be looking at a hybrid campaign.
The mechanism can be reconstructed in five stages.
First, vulnerability identification. The attacker studies the target's dependencies, institutional weaknesses, political divisions and critical infrastructure.
Second, selective pressure. Different instruments are applied against different vulnerabilities, often through intermediaries or concealed networks.
Third, synchronization. Operations are timed so that their effects reinforce one another. Economic uncertainty magnifies political dissatisfaction; information manipulation amplifies the impact of infrastructure disruption.
Fourth, ambiguity. Responsibility is obscured. Individual incidents remain open to competing explanations, delaying attribution and collective response.
Fifth, strategic exploitation. The accumulated pressure is used to influence the target's decisions, weaken its alliances or reduce its capacity to resist future demands.
The essential effect is cumulative.
A single incident may be manageable. Several synchronized disruptions may overwhelm institutions that were designed to respond to emergencies separately.
This is why the European Parliament's September 2026 resolution emphasizes coordinated, intelligence-led operations that appear isolated while potentially producing consequences comparable to conventional aggression.
IV. THE STRATEGY: VICTORY WITHOUT CONQUEST
What does a hybrid aggressor ultimately want?
Not necessarily territory.
A successful campaign may seek to weaken military assistance to an ally, obstruct sanctions, fragment a coalition, obtain political concessions or reduce public confidence in the institutions of the targeted state.
The objective is to change political behaviour.
This produces a different strategic calculation from conventional conquest.
Occupying territory requires forces, logistics, administration and the assumption of considerable political responsibility.
Coercing another government into changing its decisions may require none of these things.
The adversary remains formally sovereign. Its institutions continue to function. Its elections may proceed. Its territory remains internationally recognized.
Yet the effective independence of its decisions may have been reduced.
Hybrid warfare therefore targets something more subtle than territorial possession: the capacity of a political community to determine its own conduct.
But the strategy has limitations.
Disruption does not automatically produce compliance. Coercion can strengthen national solidarity. Information operations can fail. Sabotage can generate retaliation. Economic pressure can encourage diversification.
Hybrid campaigns may also expose the aggressor to sanctions, diplomatic isolation and military countermeasures.
They are not an inexpensive substitute for victory in every circumstance.
They are an attempt to achieve strategic effects without necessarily paying the full costs of conventional war.
V. THE LEGAL PARADOX: A WAR THAT MAY NOT BE WAR
Here we encounter the most consequential problem.
International law does not classify every hostile act as an armed conflict.
Espionage, propaganda, economic coercion, cyber intrusion and sabotage may fall under different legal regimes. Some acts may violate international obligations without amounting to an unlawful use of force. Others may constitute a use of force or, in sufficiently grave circumstances, an armed attack.
The classification depends on the facts, including the nature, scale and effects of the operation.
A government's declaration that it is experiencing hybrid warfare does not, by itself, establish that an international armed conflict exists or that the legal conditions for self-defence have been satisfied.
Nor does the absence of conventional combat necessarily establish the absence of an armed conflict.
This creates a distinction between three different realities.
Hostility describes antagonistic conduct.
Armed conflict is a legal classification governed by its own criteria.
Hybrid warfare describes a strategic method involving the coordinated employment of different instruments.
The three categories can overlap. They are not interchangeable.
This distinction explains much of the political attraction of hybrid methods.
A state may conduct operations that produce significant cumulative harm while keeping individual incidents below the thresholds associated with military retaliation.
But the thresholds are not magical legal safe harbours. A sufficiently grave cyber operation or other use of force may engage international law regardless of the label applied to it. Multiple operations may also require assessment as a connected campaign rather than in artificial isolation.
The deeper problem is institutional.
Traditional legal systems are comparatively comfortable with identifiable acts, identifiable perpetrators and recognizable categories of responsibility.
Hybrid campaigns exploit precisely the spaces between those categories.
They operate across different jurisdictions, institutions and evidentiary standards.
The difficulty is not that international law has ceased to exist.
It is that the strategic organization of hostile conduct increasingly differs from the institutional organization of legal responses.
VI. EUROPE: THE EVIDENCE
We can now return to the European situation.
On March 16, 2026, the Council of the European Union adopted conclusions condemning persistent hybrid activities, including sabotage, malicious cyber operations, electoral interference, information manipulation and the instrumentalisation of migration.
The Council specifically identified coordinated Russian campaigns directed against European security and support for Ukraine.
The European External Action Service has likewise documented a pattern of hostile activities involving sabotage, disruption of critical infrastructure, cyberattacks and political interference. It attributes a significant part of this pattern to Russia, while acknowledging that other actors also employ hybrid methods.
On September 16, the European Parliament adopted a resolution concerning hybrid warfare and the protection of territorial integrity and critical security infrastructure. The vote was 470 in favour, 129 against and 62 abstentions. The resolution identified Russia, including operations conducted through proxies, as the principal state source of hybrid threats against the Union.
These are not isolated rhetorical statements.
The European Union has established a hybrid-response framework, developed mechanisms for coordinated sanctions and created rapid-response capabilities. NATO has similarly expanded its work on hybrid threats and civil resilience.
The institutional response demonstrates that European governments regard the threat as sustained rather than episodic.
It does not follow that every unexplained drone, damaged cable, suspicious fire or cyber incident is necessarily part of a Russian operation.
Attribution must remain evidence-based.
That distinction is essential. Otherwise the analytical concept of hybrid warfare risks becoming an explanation for every accident and every political disagreement.
Nevertheless, the existence of a broader campaign is no longer merely a theoretical proposition. It is the stated assessment of the principal European security institutions.
In September, European officials warned of increasing sabotage and airspace incidents while distinguishing those activities from an imminent conventional Russian attack against NATO.
That distinction is precisely the point.
Europe may be experiencing sustained hostile operations without experiencing a general conventional war on its territory.
VII. HOW LONG CAN SUCH A WAR LAST?
Traditional wars possess recognizable, although not always clearly defined, mechanisms of termination.
An army surrenders. A government capitulates. Territory changes hands. A ceasefire takes effect. A peace treaty establishes new obligations.
Hybrid warfare has no equally reliable ending.
Its campaigns may be interrupted, reduced, redirected or suspended. Their instruments can remain available even after the immediate political dispute has been settled.
Cyber capabilities do not disappear when diplomats sign an agreement. Intelligence networks may survive a ceasefire. Information operations can be reactivated. Economic dependencies may endure for decades.
The duration of a hybrid campaign therefore depends on three conditions.
The first is the persistence of the strategic dispute. So long as an aggressor seeks to alter another state's political conduct, the incentive to employ coercive instruments may remain.
The second is the cost of continuing operations. Successful attribution, sanctions, counterintelligence, defensive improvements and international cooperation can reduce their effectiveness and increase their price.
The third is the resilience of the target.
A society capable of maintaining essential services, protecting institutions and distinguishing credible information from manipulation is more difficult to coerce.
This explains why NATO places civil preparedness at the centre of its security strategy. Resilience is not merely an administrative precaution. It is a form of deterrence.
A hybrid campaign can last months, years or decades. Its intensity may fluctuate substantially.
The Cold War provides an instructive historical comparison: sustained hostile intelligence and influence operations existed for decades without continuous direct warfare between the principal antagonists.
Yet an analogy is not a prediction.
There is no evidence-based timetable establishing when Europe's present hybrid confrontation will end.
Nor does a settlement in Ukraine necessarily guarantee its termination.
A settlement might reduce important incentives for hostile operations. It could also leave unresolved the wider confrontation over European security, military alliances and the political order of the continent.
VIII. THE NEW GEOGRAPHY OF WAR
The fundamental transformation is not simply technological.
It is geographical, institutional and political.
Conventional war distinguishes the front from the rear.
Hybrid warfare deliberately weakens that distinction.
The port, the railway, the data centre, the electricity grid, the election campaign and the public information system become potential elements of a common strategic environment.
This does not mean that every citizen is a combatant or that every civilian institution is a lawful military target. International humanitarian law continues to impose protections and restrictions wherever it applies.
It means that the functioning of civilian society has become central to the strategic contest.
There is also a paradox.
Modern states have become extraordinarily powerful in their ability to collect information, organize resources and project military force.
Yet their increasing technological sophistication has created new dependencies.
The more interconnected a society becomes, the greater the number of systems whose disruption may have consequences beyond their immediate location.
A bridge can be repaired. A damaged database may be restored. An energy supply can be diversified.
Confidence in the reliability of institutions is harder to reconstruct.
That is why hybrid warfare is ultimately a contest over political authority.
The attacker seeks to demonstrate that the state cannot fully protect the systems on which its citizens depend.
The defender seeks to demonstrate that those systems can withstand disruption without surrendering political independence.
The battlefield is not everywhere in the literal sense.
But the strategic contest can reach almost anywhere.
IX. THE QUESTION EUROPE CANNOT AVOID
We began with a simple question.
Is there a hybrid war in Europe?
The answer depends on what we mean by war.
If we mean a formally declared conflict between Russia and the European Union, the answer is no.
If we mean a general international armed conflict between Russia and NATO, that description is likewise not established by the evidence considered here.
But if we mean a sustained, coordinated campaign employing cyber operations, sabotage, information manipulation, covert interference and coercive pressure to weaken European institutions and influence European strategic decisions, then the answer is yes.
That is the assessment expressed by the European Union and reflected in the security policies now being adopted across the continent.
And how long can it last?
Potentially for as long as the underlying strategic confrontation persists.
It may continue after a ceasefire in Ukraine. It may fluctuate between periods of visible escalation and relative quiet. It may end gradually rather than through a recognizable diplomatic event.
This creates an unsettling possibility.
Europe may not be approaching a war that will begin on a particular date.
It may already be living through a form of confrontation whose beginning was never formally announced and whose conclusion will not necessarily be marked by a peace treaty.
For generations, Europeans learned to recognize war by the arrival of armies.
Today, the warning may arrive as a railway failure, a compromised network, a suspicious explosion or a political crisis whose origins are difficult to establish.
None of these events proves the existence of war by itself.
Together, when coordinated and strategically directed, they can constitute a method of warfare.
The decisive question is therefore no longer simply whether Europe is at war or at peace.
It is whether the distinction itself still adequately describes the security environment in which Europeans live.
And if the conflict has no formal beginning, no continuous battlefield and no necessary peace treaty, one final question remains.
How will we know when it is over?
Good night, and good luck
