NATO is preparing for the wrong war. The alliance’s members have a combined 3 million troops and close to 10,000 tanks. But tomorrow’s battles won’t be fought just by conventional means. As hostile states exploit the blurred lines between war and peace, NATO and its Western allies will have to become more creative in defending against hybrid attacks. That means widening the scope beyond the military.
European countries are woefully unprepared for the type of hybrid warfare being developed across the globe. Last month, Britain’s army chief Nick Carter warned that the U.K.’s failure to keep up with Russian defense capabilities has left it exposed to cyberattacks that could take a heavy toll on civilian life. The U.S. too is failing to keep pace — a recent study found that it could lose a war against Russia or China.
Consider power generation. Germany alone has nearly 2,000 power plants. In a conventional attack, adversaries might bomb a power plant. Today, they’re more likely to hack it or send a missile. Powers like Russia and China are not conventional adversaries; they have the ability — and the willingness — to bring a country to a standstill long before a conventional war takes place.
“We’ve been fooling ourselves into thinking that we’ve constrained warfare,” said General Richard Barrons, who until 2016 commanded Britain’s Joint Forces Command. “But the nature of war never changes; it’s about violence and brutality. Now opponents are moving toward a sophisticated use of hybrid warfare.”
Hostile foreign powers are, nowadays, more likely to attack via hacking or sending a missile.
A potential hack on a power grid would not just plunge citizens into darkness; it would raise mortality rates, disrupt water supplies and shut down ports. “They can paralyze us long before we get to a kinetic war,” said Julian Lindley-French from the National Defense University in Washington. And it could be accomplished with relatively inexpensive cyber tools that are “difficult to predict and hard to trace,” according to Jarno Limnéll, professor of cybersecurity at Aalto University in Finland.
The sea cables that conduct nearly all internet traffic carry no less than $10 trillion of financial transactions every day. They present another easy target. Even if only some of these cables were sabotaged, chaos would ensue among vital services like retail and transport. Here’s the dilemma: Because NATO and its allies can boast of strong conventional armed forces, hostile states are more likely to use different forms of warfare — and then argue that an act of aggression like hacking a power plant doesn’t constitute a true act of war.
Call it “weasel warfare” — the equivalent of throwing pebbles at a neighbor’s windows from a safe location behind a hedge. Modern warfare will be less about territorial invasion than it will be about breaking society’s will and grinding daily life to a halt.
Alarmist? Not at all.
Power companies are already noticing a growing number of hacks. Between 1992 and 2006, Russia engineered 55 energy cut-offs. Throughout 2015 and 2016, “elements in the Russian government” hacked the Danish defense ministry, gaining access to employees’ emails. And in recent months, Russian submarines have also been circling around vital communication cables in the North Atlantic.
As open societies, we’ll never be able to fully defend ourselves against weasel warfare. But we can build resilience. Doing so would be inexpensive (compared to a conventional military buildup). But it would necessitate coordinated action by institutions from across society: Cabinet ministers, government agencies, companies, civil organizations.
International Cybersecurity Forum in Lille | Philippe Huguen/AFP via Getty Images
Denmark’s total defense system is a good model for how this can be done: Every year, the government organizes an exercise for every key sector of society (including the Cabinet, corporations, civic organizations and its military) focused on specific threat scenarios. The most recent one involved a terrorist attack on crucial government targets combined with a cyberattack. If every segment of society is trained in how to respond, the scope of the damage caused by a potential attack will be far smaller.
Governments should also launch public awareness campaigns informing citizens about how the services on which they rely — power, water, transport and the internet — would be affected in case of an attack. Cities and government agencies should offer citizens training in how to get by without this full slate of services.
Together with industry, government agencies should also refine resilience plans. During the Cold War, every country had such plans. But lately they have been collecting dust and are, at any rate, no longer relevant because the nature of warfare has changed. A side effect of globalization also means that governments no longer have the same power to command companies to action.
Countries should also follow in the footsteps of Sweden, which announced in January it would establish a new agency for psychological defense. Creating resilience against the erosion of our democratic institutions is also crucial to defending our societies from modern forms of warfare.
Because weasel warfare targets citizens’ ordinary way of life, we can no longer leave security to a small number of paid troops. The wars of tomorrow call for resilience at every level of society — from school children to prime ministers — and we can only hope to counter them if we boost civil engagement.
Elisabeth Braw is a nonresident senior fellow at the Atlantic Council.
