The prevalence of hybrid war is increasing. From Russian drones flying into NATO airspace, to cyberattacks and political interference, to the US seizing a Venezuelan oil tanker, war is now rarely black and white, but exists in the grey. Former British Intelligence officer Andy Owen argues the same game-theoretic logic we apply to hot wars needs to be applied in hybrid warfare too. Incursions should be responded to proportionally. If we don't respond, hybrid war will only spread and expand, and could even turn hot.
As the US-backed “liberal international order” in place since the end of the Second World War is collapsing under the pressure of increasing geopolitical competition and internal fragmentation, so too is our understanding of the dichotomy of war and peace. Competition is manifesting in conventional wars, such as the Russian invasion of Ukraine, but also an increasing number of “grey-zone conflicts,” in which autocratic states use hybrid warfare to attack liberal democracies. These conflicts do not fit neatly into post-war legal and moral frameworks. As hybrid tactics fall below the traditional threshold for war, democracies are not providing responses that act as a deterrent for further attacks. Without an urgent rethinking of these frameworks, we are likely to see the expansion of these conflicts.
Our societies are more interdependent and interconnected than ever before. Our reliance on technological, social, economic, and logistical networks has increased the attack surface available to those who see themselves as in geopolitical competition with us. That competition varies in its severity and aggressiveness.
Autocratic powers engage in normal competitive engagements, such as expanding their influence abroad—something China has been particularly effective at with its long-term strategic planning—conducting espionage, or developing their own military and technological capabilities. These may impact the economic and political interests of liberal democracies, but they do not necessarily interfere with their sovereignty or directly threaten their security, and also do not differ materially from activities liberal democracies themselves are undertaking.
However, autocratic competitors are increasingly engaging in more aggressive acts, leveraging hybrid warfare that mixes conventional and non-conventional means in pursuit of their objectives. These means include misinformation and disinformation campaigns designed to sow discord and undermine state authority, cyberattacks, electoral intervention, economic coercion and espionage, diplomatic pressure, trade, provocative military exercises, sabotage, arson, attacks against critical infrastructure, assassinations, and drone activity. They remain below thresholds within current international frameworks that trigger legitimate conventional military responses or legal and political consequences. They are also often deliberately hard to attribute, with aggressors regularly using non-state actors as proxies. By adjusting the scale, concentration and nature of their activities, strategic competitors vary the intensity of competition.
___
Our reliance on technological, social, economic, and logistical networks has increased the attack surface available to those who see themselves as in geopolitical competition with us.
___
Russia’s activities in Europe provide examples across the full spectrum of grey-zone activities. Moscow’s campaign has a focus on targets related to support for the Ukrainian war effort, but more often it is simply aimed at causing chaos and unease.
In recent weeks, drones have forced Belgian airports to close on numerous occasions. German defense minister Boris Pistorius linked these incidents to discussions over the use of Russian frozen assets in Brussels. It follows a series of drone incursions over NATO nations that included approximately 20 Russian drones entering Polish airspace in September during a large-scale attack on Ukraine, prompting Poland and NATO allies to shoot down multiple drones, causing minor damage to residential areas.
This is part of a wider campaign that has escalated in scope and tactics since the annexation of Crimea and the start of the war in eastern Ukraine in 2014. They are part of what Polish Foreign Minister Radosław Sikorski has called a “spectrum of provocations.”
Early attacks focused on factories supplying ammunition for Ukraine, and were mostly carried out by operatives from the GRU (Russian military intelligence), specifically Unit 29155, whose operatives poisoned Sergei Skripal in the UK in 2018. In response, European countries expelled hundreds of Russian intelligence officers working under diplomatic cover.
After the full-scale invasion of Ukraine in 2022, there were more expulsions, leading Russia to activate a network of deep-cover operatives posing as foreigners known as “illegals.” In 2023, illegals were identified in Slovenia, Norway, Greece, and Brazil. Russia also increasingly turned to organized crime members to facilitate operations, such as Orlin Roussev, a Bulgarian based in the UK who ran operations using other Bulgarians he called his “minions,” three of whom were found guilty at the Old Bailey in London in 2025. Separately, individuals recruited by the Russian mercenary group Wagner were charged with arson at a business in East London with links to Ukraine in 2024.
In France, coffins inscribed with the words “French soldiers in Ukraine” were placed under the Eiffel Tower. Denmark has reported Russian naval provocations as well as drone incursions. In Estonia, car windows of the interior minister and a journalist were smashed, and there have been incursions into Estonian airspace by Russian military jets. There have been suspicious fires in Poland, including one that destroyed a Warsaw shopping centre. In recent months, Polish authorities have arrested 55 people for illegal activities on Russia’s behalf. In Lithuania, an Ikea shop was set on fire. In Romania, a former French Foreign Legionnaire has been accused of conspiring with far-right politician Călin Georgescu to “overthrow the constitutional order”. Figures close to the Kremlin attempted to halt his extradition from Dubai back to Romania.
These activities were all run in parallel with attacks in cyberspace. In 2017, Russia targeted Ukraine, using leaked US National Security Agency (NSA) capabilities, in what became known as the “NotPetya” global cyberattack after it spread out from its intended targets. In the build-up to the 2022 invasion, cyber attacks spiked. Russia is still regularly launching cyber-attacks using NSA-designed tools in support of ground offensives or to compound the impacts of kinetic strikes, as well as stealing targeting information from everything from government intranet sites to cafe webcams.
Cyber activities continue to support the recruitment of operatives for attacks. As well as organized crime networks, Russia has used far-right networks to both conduct attacks and sow division and discord within European states. A Telegram group was identified by Polish authorities that had been used to recruit a potential saboteur sharing white supremacist content. The message stated, “Attention! Fight with blacks. We are looking for partisans in Europe… who make arson to the store of black migrants.” The reward was $5,000 (most recruits are paid in crypto). Polish authorities have linked the account to a GRU officer. After the terrible attack on a girls’ dance school in Southport, UK in 2024, authorities tracked the amplification of far-right narratives by foreign threat actors, aimed at inflaming the social unrest that followed.
___
With the recent escalation between the US and Venezuela, we may be witnessing a new grey-zone campaign.
___
Grey-zone activities have not been restricted to Europe. In 2024, court indictments in Kansas indicated that three Federal Security Service (FSB) officers tried to hide malware in software updates used by systems that control the equipment in power plants. Russian operatives are alleged to have compromised the business network of nuclear power stations in Kansas and also Nebraska. Their activities could risk a nuclear meltdown. Before President Trump returned, presenting Putin with new diplomatic opportunities to achieve his objectives, an apparent plot to send exploding parcels to the US was identified. This had the potential to bring down an aircraft and was taken seriously enough for security officials to call their Russian counterparts to warn them that such an attack would force a US response.
Russian grey-zone activity is yet to cause a civilian death in Europe or the US; however, this is more down to luck than the precision of the activities. This month, commenting on the two incidents of sabotage in Poland on the railway line to Ukraine, one on the track and one on the overhead power lines, Deputy Prime Minister Radek Sikorski told the Polish parliament that the incidents were “an act of state terrorism” from Russia and “the clear intention was to cause human casualties.”
Nor is Russia the only country using such tactics. China's grey-zone noose continues to tighten around Taiwan. As an alternative to a full-scale invasion, China uses provocative military exercises and its massive fishing fleet, which acts as a maritime militia, to assert its claims near Taiwan, whilst also combining cyber-attacks with misinformation, disinformation and election interference in an overall campaign of diplomatic and economic pressure to force the reunification of the sovereign island state with China.
With the recent escalation between the US and Venezuela, we may be witnessing a new grey-zone campaign. In recent weeks, the US has escalated its diplomatic and economic pressure on the government of Nicolás Maduro in an attempt to force regime change. In addition to the military targeting of Venezuelan vessels allegedly being used by narco-terrorists, US forces have seized an oil tanker off the coast of Venezuela, claiming it to be part of an illicit oil shipping network supporting foreign terrorist organizations. The recently released US National Security Strategy makes several references to the Monroe Doctrine, the foundational US foreign policy establishing US primacy in the Western Hemisphere. The escalation with Venezuela demonstrates that, despite the isolationism of the America First Doctrine, the US will still consider military intervention in its own backyard. The National Security Strategy states its goals for the Western Hemisphere can be summarised as “Enlist and Expand.” We may be witnessing the beginning of new grey-zone campaigns to support the “expanding" of American influence in states in its sphere of influence, currently more allied with its strategic competitors.
The former head of Poland’s foreign intelligence service, Piotr Krawczyk, claims that “The strategic aim is to sow discord and insecurity…They are concentrating on soft targets that influence a general perception of insecurity in society.” In her work currently on display in Warsaw’s Museum of Modern Art, Ukrainian artist Kateryna Aliinyk explores the nature of violence not through direct depiction, but through the disruption of the usual order of things. Her work, inspired by events in her homeland, emphasizes how the everyday can become a source of deep horror. Russia is expanding the horror it is inflicting on the people of Ukraine to other populations. It is not at the same scale or concentration, and is, so far, significantly less kinetic, but like in Ukraine it is undermining the sovereignty of democratic states and causing psychological damage to civilian populations. And the intensity of its activities is increasing. Civilian deaths will occur.
Whilst there are fears that such activities are a prelude to war, the US and the majority of European countries do not consider themselves currently at war with Russia. There are many in the Baltic States and Poland who are exceptions to this. The response from European countries has therefore been defensive. As the individual actions do not meet the threshold of an act of conventional war, European states have adopted a policy of strong words and weak actions.
Philosopher Michael Walzer said, when referring to nuclear deterrence, “In international as in domestic society, deterrence works by calling up dramatic images of human pain.” Hybrid operations rarely conjure up dramatic images or the violence that can occur further down the chain of causality, making it hard to conceptualize: an already ill patient dying in a hospital that is the victim of a cyberattack, a citizen attacked in a hate crime, or someone crushed by falling drone wreckage. Unlike the established escalating deterrence of nuclear strikes, there is currently no deterrence of an escalating response to the hybrid tactics being used. War is a unique state of human affairs; its declaration establishes an equal right to kill under rules that permit activities that would otherwise be illegal, but that also provide legal and moral frameworks to restrict these activities.
Current international frameworks owe their origins to Just War theory, in development since the time of Augustine of Hippo. Another Medieval theologian, Thomas Aquinas, was a key architect. In his Summa Theologica, Aquinas asserted that it is not always a sin to wage war and set out criteria for a just war. The theory was developed by legal scholars in the context of international law. It focuses on the reasons states have for fighting, jus ad bellum, (the justice of war), and then the way in which they are fought, jus in bello, (justice in war).
Jus ad bellum requires us to make judgments about aggression and self-defense. It obliges us to define Russia’s war against Ukraine (regardless of its historical claims and Western provocations, perceived or not) as an unjust war of aggression. Jus in bello allows us to make judgments about violations of the established norms of how wars are fought, such as condemning the use of chemical weapons (a weapon thought to be malum in se or wrong in itself). Jus in bello also includes the principles of discrimination (between combatants and non-combatants), proportionality, and necessity (only appropriate force should be used against legitimate military objectives necessary for achieving your overall war aims, and the harm caused to civilians or civilian property must be proportional). Using jus in bello, we must judge that Russia, through its targeting of civilians, including the kidnapping of children, reckless attacks on civilian and nuclear infrastructure, and treatment of PoWs, is acting unjustly in how it is fighting its unjust war in Ukraine.
Traditional Just War theorists see a logical independence: a just war can be fought unjustly, and an unjust war can be fought justly. This can lead to judgments that feel morally counterintuitive. It is a crime to commit aggression, but aggressive war is a rule-governed activity. It is right to resist aggression, but the resistance is subject to moral and legal restraint. Revisionist theorists differ in believing that the two are intrinsically linked and that individual soldiers have a moral responsibility for jus ad bellum judgments. Therefore, soldiers who participate in unjust wars are morally responsible, even if they follow the rules associated with jus in bello.
Whilst grey-zone hybrid activities are not considered to be occurring in war, they sit outside of jus ad bellum and jus in bello. In this, they are comparable to espionage activities. In Cécile Fabre’s Spying Through a Glass Darkly, Fabre sees the Just War approach as unsuitable as a framework for considering the moral and legal aspects of spying because it is designed for war, not activities also conducted in peacetime.
___
The US and UK are recognising that international law is not beyond the reach of geopolitical competition, sitting above great geopolitics, attempting to constrain it with greater or lesser success. It is part of what geopolitical competition is competing for.
___
Fabre develops an approach based on two claims: that espionage is “morally justified as a means, but only as a means, to thwart violations of fundamental human rights or risks thereof, in the context of foreign policy,” and that in these cases it can become “morally mandatory.” Fabre grounds these claims in principles of universal human rights. This approach can provide states with a justification—indeed an obligation—to respond to grey-zone attacks that violate the human rights of their citizens, including increasingly careless attacks that threaten to violate their right to life, as well as causing damage to the global rights-based framework of which, while it is fragmenting, we still remain a part.
Her claims result in justifications for espionage but also provide limits on such activity. A criticism of Fabre’s approach from MI6’s ethics officer claims that, in doing, so she underestimates the role of national interests, claiming that “all foreign policy has to balance values and interests…[intelligence services] must promote the national interests as well as defend our core values.” When I raised this with her, Fabre responded by stating that, “This distinguishing of interests from values is problematic. It suggests appeals to interests are not value-laden: of course, they are, and can be assessed in those terms.”
States invest in international law because it defines the terms of their competition, including within grey-zone conflicts. Both the National Security Strategy of the US and the Integrated Review of the UK recognize the need for democracies to proactively shape the future international order, including its rules, institutions, and norms, so that it reflects democratic values and is conducive to their interests, rather than those of autocracies. Whilst Fabre maintains that the moral norms she discusses hold irrespective of whether organizations share them, the US and UK are recognising that international law is not beyond the reach of geopolitical competition, sitting above great geopolitics, attempting to constrain it with greater or lesser success. It is part of what geopolitical competition is competing for.
___
Instead of seeing a threshold between war and peace, we should see a continuous spectrum of competition from low to high intensity.
___
As the UK review states, we will need to work with “countries to protect our shared higher interest… accepting that we may not share all of the same values.” There are certain values that form part of the existing body of international law that we may believe are not just core to the identity of liberal democracies but universal, such as a respect for human rights. We must fight hard for these to remain within future frameworks. We must also accept that the set of universal values is much smaller than we believe. There are many ways to live a good life and many ways to order a society. Some Western values, such as a belief in a democratic form of government that is politically pluralist, are Western values, not universalist.
Influential autocratic states such as China want frameworks that place value on the right of states to conduct internal politics unhindered by external interference. There is an opportunity to work with China to develop a framework that does this by limiting grey-zone activities that undermine such sovereign rights. We will need to pick which battles we fight, managing the tension between values and short-term political interests, but Fabre is right: the two are intrinsically connected. The strain on current frameworks means the alternative to shaping new frameworks is having no frameworks in a world where, simply, might is right.
There is another option in the meantime to use existing frameworks to mitigate grey-zone activity. Instead of seeing a threshold between war and peace, we should see a continuous spectrum of competition from low to high intensity, containing activities that can be judged using the current jus in bello framework that would be determined as unjust both in terms of discrimination between combatants and non-combatants, and also in proportionality and necessity. A response would consider the instability caused by the grey-zone activity (the instability impact of the attack minus resiliency of the victim) to comply with the requirement of proportionality. Adopting this approach, we can establish precedents across the spectrum of grey-zone activities. Driven by our values, there will still be activities we refuse to undertake as malum in se, but when activities are conducted against us that would not be acceptable under jus in bello judgments, we would respond offensively, fulfilling our moral responsibility to deter future attacks, in peacetime as we would in war.
There is a precedent for this in cyber warfare. Since 2018, in response to Russian activities, US Cyber Command has taken the fight to Russia in response to its cyber activities, planting malware inside Russian systems, networks, and hardware at new levels of depth, and with a new aggressiveness.
Since 1945, “peace” for many civilians has not meant the absence of violence, both individual and systematic. The idea of war as a precise legal condition that equally permits two or more groups to carry on a conflict by armed force has become outdated. Unchecked, grey-zone conflict will spread to new areas of increasing competition, including the Arctic as global warming opens up new routes and new mineral opportunities, cyberspace, and actual space as we become more reliant on technology outside the earth’s atmosphere, and as astro-politics becomes as competitive as geo-politics. To adapt Leon Trotsky’s misappropriated aphorism: “You may not be interested in grey-zone conflicts, but grey-zone conflicts are interested in you.” It is in all our interests to develop new frameworks. We are all on the grey-zone battlefield of geopolitical competition, and the competition is intensifying.
12th December 2025
Join the conversation