Helsinki Commission Report on the war against NATO from the shadows: How Russia is undermining democratic values through various methods
Since the start of Russia’s large-scale invasion of Ukraine in 2022, Russian sabotage campaigns across North America and Europe have increased, according to, among other things, a comprehensive report by the US Helsinki Commission entitled “Russia’s Shadow War Against NATO”. The report is based on hearings held in September 2024, in which experts testified about Moscow’s extensive and calculated efforts to destabilise its democratic adversaries. The map identified nearly 150 hybrid operations carried out on NATO territory since the start of the Russian invasion of Ukraine that are attributed to Russia or suspected to have been perpetrated by Russia. The identified hybrid operations fall into four categories: attacks on critical infrastructure, violent campaigns, militarisation of migration, and interference in elections and information campaigns.
Why is Russia targeting NATO? Russia’s active measures against NATO countries are a calculated effort to undermine democratic values, instil distrust in free societies and destabilise the unity of the Alliance. Hybrid warfare – a mix of cyber-attacks, disinformation, sabotage, covert operations and other active measures – offers Moscow a cheap, deniable and highly disruptive method to challenge the stability and solidarity of the West. This tactic allows Russia to exploit vulnerabilities within open democratic systems while avoiding a direct military confrontation with NATO.
These hybrid operations, which are often disguised as the work of hooligans, dangerous coincidences or powerful information campaigns, are deliberate and large-scale, and represent a shadow war waged within NATO’s borders. Attacks on critical infrastructure Attacks on critical infrastructure such as hospitals, trains and water facilities are a way of undermining public safety and undermining confidence in vital resources. Cyber campaigns against hospitals have accounted for a large number of Russian attacks in the last two years.
For example, in February this year, a hybrid ramsomware attack in the United States disrupted thousands of pharmacies around the world and reportedly affected the personal data of “a significant percentage of people in America.” In the same month, more than 100 healthcare facilities in Romania were taken offline after a ransomware attack. Cyber attacks on healthcare facilities account for more than a fifth of attacks on critical infrastructure in the last two years, the report says, adding that cyber attacks can also have physical consequences. A worrying trend of GPS signal interference originating from the Russian enclave of Kaliningrad is increasingly affecting European aviation.
In December 2023, widespread GPS jamming affected flights in Sweden, Finland, Denmark, Germany, Poland and the Baltic. In March 2024, Russia was suspected of jamming the GPS signal of a plane carrying the British Defence Secretary. Cyber criminals linked to Russia have also infiltrated water facilities in Texas, France and Poland, which could threaten the safety of drinking water. Hybrid attacks on critical infrastructure go beyond cyberspace to physical sabotage. In September, the US warned of a build-up of Russian military activity near critical undersea cables in the Baltic Sea – raising concerns about the potential sabotage of these critical lines for global internet and telecoms access.
Campaigns of violence can range from minor vandalism to attempted acts of terrorism. In early 2024, Polish authorities arrested a man who had been recruited and paid thousands of dollars by Russian or Belarusian operatives to carry out a bomb attack on a paint factory in south-west Poland. In June, French authorities arrested a man near Charles de Gaulle International Airport on charges of bomb-making in connection with a sabotage plot organised by Russia north of Paris. Bomb threats from Russian servers were sent by e-mail to schools and other institutions in the USA, Greece, North Macedonia, Slovakia and the Baltic States to instil fear. In February 2024, a British citizen with links to the Russian paramilitary group Wagner was charged under the UK’s National Security Act with plotting to burn down a Ukraine-linked business. In April, German authorities arrested a group of men who were monitoring a number of targets for possible bombings, including Grafenwöhr airbase in Germany, a US military base where Ukrainian soldiers train to use M1 Abrams tanks.
Attempts to kill the Kremlin’s enemies have also been made on NATO soil. In 2023, Italian intelligence services also intercepted messages from the Kremlin offering the Wagner Group $15 million to assassinate Italian Defence Minister Guido Crocetto. In July 2024, US and German authorities foiled a plot to assassinate Armin Paperger, a German defence director whose company runs the production of artillery shells for the Ukrainian army.
The militarisation of migrants A particularly heinous tactic, according to the report, used by Russia and Belarus, is the militarisation of migrants. In November 2023, Finland closed its border with Russia after a surge in border crossings allegedly triggered by Russia. This summer, Poland saw an increase of almost 400 illegal border crossings per day. Poland’s efforts to combat the migration crisis caused by Belarus are costing nearly USD 615 000 a year. But the costs are not only financial. Unfortunately, in May this year, a Polish soldier stationed at one of the border crossing points was fatally stabbed. Interference in elections Interference in elections is a hallmark of Russian hybrid warfare. Spreading false narratives and funding pro-Moscow candidates is a ubiquitous tactic.
In March 2024, Czech and Belgian officials uncovered a vast Russian propaganda network spread across Europe that sought to influence the European Parliament elections, including efforts to bribe EU lawmakers to promote Kremlin rhetoric. In the United States, Georgia’s Secretary of State Brad Raffensperger revealed bomb threats at several locations on election day, attributing them to Russian origin. At least five other countries received similar false threats as Americans went to the polls. Beyond the elections, Moscow’s disinformation campaigns aim to break NATO unity. In 2023, the Swedish government accused the Russian “state and state actors” of instigating disinformation campaigns in connection with the burning of the Koran earlier that year.
During Sweden’s efforts to join NATO, demonstrations ensued which inflamed relations between Turkey and Sweden, delaying Turkey’s approval for Sweden’s accession. Earlier this year, the French authorities took down a fake army recruitment website that invited 200,000 French people to sign up to fight in Ukraine. Similarly, in May, a fictitious article appeared several times on the website of a Polish news agency, a cyber-attack probably orchestrated by Russia. A map drawn up by the Helsinki Commission team shows almost 150 alleged and attributed cases of Russian hybrid operations on NATO territory since February 2022, underlining the breadth and insidiousness of Russia’s shadow war.
While Russia continues to escalate its war against Ukraine, it is also escalating its shadow war against NATO. The report argues that a bilateral approach is needed to deter Russia. Firstly, NATO must take this shadow war seriously and understand these operations as a real and present threat to the stability and security of the Alliance’s Member States. Secondly, and equally critically, NATO and its Member States must take decisive action to support Ukraine in its fight against Russian aggression. Because, as has been said, limiting aid or failing to meet Ukraine’s urgent needs only signals weakness and invites further escalation by Russia, both in Ukraine and within NATO’s borders.
Russia’s hybrid war in the Balkans Russia is using similar methods to gain and maintain influence over the countries of the Western Balkans. In July this year, the US reported that Russia was trying to exploit inter-ethnic tensions in the Western Balkans region to create “instability and hinder the region’s integration into Euro-Atlantic institutions”. “It is clear that Russia does not support the same European future for the Western Balkan countries that they have chosen and that the people of the region deserve,” a US State Department spokesman told Radio Free Europe.
During her visit to the region in October this year, European Commission President Ursula Von der Leyen condemned Russia’s hybrid attacks on democracies in the Western Balkans and beyond and said that the EU is working every day to expose disinformation. It is also not infrequently the view of the professional public that Russia, through its proxy Serbia, is waging a hybrid war in Kosovo, through diplomatic, informational and military channels aimed at harming Kosovo’s vital interests. Serbia, on the other hand, is ‘defending’ itself by counter-accusing that a hybrid war is being waged against it. Belgrade’s ally, Moscow, wants to distract the West from its war in Ukraine, according to Balkan experts. That is why, as Ivana Stradner, a senior fellow at the Washington Foundation for Defense of Democracies, has repeatedly reiterated, Russia is looking for “vulnerable spots in the West, and right now the most vulnerable spots in Europe are the Balkans: Bosnia and Herzegovina (BiH) and Kosovo”./ Edited by The Geopost/