Five Steps NATO Should Take after the Nord Stream Pipeline Attack

Last week’s attack on the Nord Stream 1 and 2 pipelines in the Baltic Sea brought to life a challenge which is fast becoming ubiquitous in an era of strategic competition: so-called hybrid attacks, threats, or warfare. Also referred to as “gray zone” aggression, the purpose is to cause similar damage to conventional attacks—without any of the consequences.

This attack will come as little surprise to North Atlantic Treaty Organization (NATO) allies who have been preparing to combat hybrid threats for many years. Yet the pipeline explosions appear to be the most brazen hybrid attack since Russia annexed the Ukrainian peninsula of Crimea in 2014 by sending in “little green men.” By apparently sabotaging its own pipelines, Russia’s regime has signaled how far it will go to put pressure on Europe to reduce its support for Ukraine, erode European security and subvert international order. NATO should now rise to this challenge by taking five key steps at next week’s timely meeting of allied defense ministers.

The (Not So) Gray Zone

Hybrid aggressors dodge reprisal by staying below known thresholds of response by creating enough doubt and ambiguity to prevent quick and decisive counteraction. As a result, deterring hybrid threats is difficult. Sufficient ambiguity was achieved in the pipeline attacks through tactical subterfuge and strategic denial. If Russia conducted the attacks, it likely did so in secret, perhaps through proxy actors or using the advanced underwater capabilities NATO allies have been concerned about for many years. Russian officials immediately denied any responsibility and treated accusations with incredulity, calling the idea it was involved “predictably stupid.” The attack was also in international, rather than territorial, waters.

If this playbook sounds familiar, that’s because it is. Russia took the same approach when it shut down Estonian public services through a massive cyberattack in 2008 and when special forces infiltrated Crimea in 2014. In both those cases—and in many others—stringent denials of involvement by Russian officials were soon proven false. While NATO has been careful not to point fingers at Russia until the facts have been established, it seems likely this pattern will be repeated again.

NATO has been concerned about hybrid threats since at least 2010. It agreed on a strategy in 2015 and helped launch a center of excellence alongside the European Union in 2017. Most significantly, NATO expanded its Article 5 mutual defense clause to include hybrid threats in 2016—a fact which was reiterated in the new strategic concept recently agreed by allies in Madrid.

NATO’s Response: Five Steps to Counter Hybrid Threats

Following the pipeline attacks, NATO should build on this groundwork in the weeks and months ahead to implement the three pillars of its own strategy to counter hybrid threats: prepare for (and detect) further attacks, deter them from happening, and defend allies in the event of hybrid attack. To achieve these goals, NATO defense ministers should consider taking five steps next week.

  1. Deploy NATO Counter Hybrid Support Teams.

NATO allies have already helped each other in the wake of the pipeline attacks. So far, assistance has been organized bilaterally to maximize speed. Now is the time for vulnerable allies to ask for more substantive and enduring assistance. They should ask NATO to assemble and deploy counter hybrid support teams designed to assess, advise, and help improve their resilience in the face of renewed hybrid threats to their energy and critical infrastructure.

Since their inception at the 2018 Brussels summit, NATO’s Counter Hybrid Support Teams have been deployed twice: in 2019 to help Montenegro counter Russian election interference and in 2021 to help Lithuania deal with a migration crisis manufactured by Belarus and Russia. It should now be deployed to the Baltic and North Sea region to provide civil-military expertise in three areas: protection against further physical threats to pipelines and energy infrastructure, cyber threats to Europe’s energy grid, and broader physical and cyber threats to other vital infrastructure and services, from undersea data cables to public health services. They should also work with counterparts in the European Union to make the most of its planned stress test on energy assets and to implement its recommendations for enhancing the resilience of undersea cables and infrastructure.

  1. Bolster NATO regional force presence.

The second step NATO should take is to bolster allied force presence in the Baltic Sea and North Sea region. In Madrid, NATO already added to its existing missions in eastern Europe to deter conventional Russian escalation out of Ukraine into NATO territory—now is the time to add more forces to the Baltic and North Sea region designed to deter Russian hybrid attacks against vulnerable nonmilitary targets. So far, NATO’s military response has been timely but ad hoc—the alliance should now take the opportunity to set out a more strategic and enduring approach to its force presence in the Baltic and North Sea region in two main ways.

First, NATO should create a third Standing NATO Maritime Group, or SNMG3. The two task groups that already exist are too thinly spread across European waters. Both SNMG1 and SNMG2 were on NATO exercises in southern Europe last week when the attack occurred (Exercise Dynamic Messenger off the coast of Portugal, and Exercise Dynamic Mariner near Turkey).

Second, NATO should enhance its posture in the Baltic region to prevent further hybrid attacks. This should include maritime-, air-, and space-based surveillance and reconnaissance capabilities that can provide early warning of suspicious activity, above and below the water, using crewed and uncrewed platforms—which may contribute to “deterrence by detection.” NATO should also increase its persistent naval and air presence in the region to reassure allies and deter attacks, building on the constant presence and multinational operations in the Baltic Sea, delivered by the UK-led Joint Expeditionary Force—which was designed to deter hybrid attacks, and includes Swedish and Finnish forces.

  1. Develop a Resilience Action Plan for Article 3.

In Article 3 of the Washington Treaty, NATO allies commit to “maintain and develop their individual and collective capacity to resist armed attack.” Given the extension of “armed attack” to include cyber and hybrid threats, allies are incumbent to boost their own resilience to resist and deter these forms of attack too—hence their “Strengthened Resilience Commitment” in Warsaw last year. NATO’s new strategic concept also emphasizes that “national and collective resilience is critical to all our core tasks.” Resilience is a crucial component of deterrence against modern hybrid threats through deterrence by denial.

Yet NATO’s focus on resilience is still evolving. For example, there are no resilience measures in NATO’s annual review of defense spending, no common resilience standards across the alliance, and no resilience capability targets in the NATO defense planning process. This risks incoherence in alliance resilience efforts. Instead, allied defense ministers should commit the alliance to producing a resilience action plan by its next summit in Vilnius. This plan should assess the resilience readiness of allies and recommend steps to improve national and collective efforts, embedding resilience into the heart of NATO’s plans, processes, and culture. NATO would also benefit from closer coordination with the European Union and the European Centre of Excellence for countering hybrid threats to spread best practice in Cold War style “total defense”—an area which Finland and Sweden excel and could lead an alliance-wide resilience renaissance.

  1. Develop a Counter Hybrid Playbook for Article 4 and Article 5.

Given Russia’s apparent appetite to step up hybrid threats against Europe, NATO should prepare now for allies to invoke Article 4 (consultation) or Article 5 (collective defense) in the event of further incidents or hybrid attacks. This might not even require another attack—evidence linking the pipeline attack to Russia uncovered through further investigation might be enough for some allies to seek consultation and demand a decisive NATO response.

Defense ministers should instruct NATO military planners to refine operational plans that set out a playbook of available responses to both contingencies. While any response would be smaller than the last time Article 4 was invoked—which led to the biggest deployment of NATO forces to eastern Europe since the end of the Cold War—a significant, alliance-wide response would still be required, which takes time to agree on and prepare for. Better now than following another incident or attack in allied waters or territory. It may also require nations to increase the readiness of critical units and response forces in advance of any attack. Putting credible plans in place now would help reassure vulnerable allies and deter attackers. The credibility of NATO’s Article 5 mutual defense clause, which now includes hybrid (and cyber) attacks, is on the line.

However, in devoting resources to preventing hybrid attacks, NATO should not lose sight of the bigger picture: its most important job is to deter armed aggression through conventional and nuclear deterrence. This is even more vital given the risks of spillover from the war in Ukraine, which opens up escalation “wormholes” that did not previously exist. NATO should refine its approach but avoid overcorrecting to the detriment of deterrence.

  1. Double down on support for Ukraine.

Finally, NATO’s best response to Russia’s brazen attempts to undermine European support for Ukraine through energy blackmail is to double down. NATO defense ministers should announce further measures to help the Ukrainian people defend themselves. They could also rhetorically link the provision of assistance to any further hybrid attacks—including the pipeline attack, if the evidence points to Russia—to signal that international terrorism does not pay.

One area NATO could focus on is training Ukrainian troops to prepare them for further offensive operations to take back and defend their own territory—an effort which Russia’s partial mobilization has made even more urgent. Several NATO allies have already contributed to the UK-led program to train Ukrainians through Operation Interflex. These efforts could be transformed by coordinating them through NATO and stepping up contributions from all allies.

A Wake-Up Call

The attack on the Nord Stream pipelines, for which it appears Russia is likely responsible, is a wake-up call for NATO and Europe. It vividly demonstrates the vulnerability of critical infrastructure, the damage hybrid attacks can wreak, and the difficulty of preventing and responding to them. Now is the time for NATO allies to draw on their years of preparation against hybrid threats by taking decisive measures to prepare, deter, and defend against further attacks while doubling down on their support for Ukraine.

Sean Monaghan is a visiting fellow in the Europe, Russia, and Eurasia Program at the Center for Strategic and International Studies in Washington, D.C.

Commentary is produced by the Center for Strategic and International Studies (CSIS), a private, tax-exempt institution focusing on international public policy issues. Its research is nonpartisan and nonproprietary. CSIS does not take specific policy positions. Accordingly, all views, positions, and conclusions expressed in this publication should be understood to be solely those of the author(s).

© 2022 by the Center for Strategic and International Studies. All rights reserved.

Sean Monaghan
Visiting Fellow, Europe, Russia and Eurasia Program