Global Affairs Session 98 23 September 2026

GRAY ZONE WARFARE

Europe versus Russia

Gray-zone warfare describes coordinated coercion designed to remain below, blur, or complicate the threshold of open war. The methods are old: Cold War powers used espionage, propaganda, covert action, sabotage and proxies while nuclear deterrence discouraged direct superpower conflict. Russia’s 2014 operations in Ukraine revived attention to ambiguity and deniability; its 2022 full-scale invasion crossed into conventional war. Yet cyber operations, electronic warfare, influence campaigns, sabotage, proxies and infrastructure pressure continued. By September 2026, European governments increasingly treat these activities as a persistent security challenge requiring resilience, intelligence and deterrence.

Summary

Gray-zone warfare describes coordinated coercion designed to remain below, blur, or complicate the threshold of open war.

The methods are old: Cold War powers used espionage, propaganda, covert action, sabotage and proxies while nuclear deterrence discouraged direct superpower conflict. Russia’s 2014 operations in Ukraine revived attention to ambiguity and deniability; its 2022 full-scale invasion crossed into conventional war.

Yet cyber operations, electronic warfare, influence campaigns, sabotage, proxies and infrastructure pressure continued. By September 2026, European governments increasingly treat these activities as a persistent security challenge requiring resilience, intelligence and deterrence.

What it actually is

1. Pressure below war thresholds: Gray-zone warfare uses coordinated pressure below or around war thresholds, deliberately complicating detection, attribution and response.
2. A multi-tool strategy: It can combine disinformation, cyberattacks, economic coercion, covert politics, sabotage, irregular forces and military intimidation.
3. Ambiguity is strategic: uncertainty about authorship, intent or legal status can delay an opponent’s response.
4. Power through plausible deniability: It lets states operate through intelligence services, proxies, criminals, front organizations or unwitting intermediaries.
5. Small acts, cumulative costs: Individual incidents may seem limited, while repeated actions cumulatively impose political, economic, psychological and security costs.
6. Across peace and war: Gray-zone methods can accompany peace, crisis or conventional war; they are not confined to one phase.
7. Separate evidence from suspicion:Responsible analysis must separate proven responsibility, official attribution, intelligence assessment, suspicion and unresolved incidents.

The Cold War: warfare below nuclear threshold

1. Blast from the past: The Cold War normalized intense competition below direct superpower war because nuclear escalation made miscalculation exceptionally dangerous.
2. Both equally culpable: Washington and Moscow used espionage, propaganda, covert political action, economic pressure and support for foreign partners.
3. What Soviets did: Soviet active measures included disinformation, forged documents, front organizations and covert influence exploiting existing Western divisions.
4. What the Americans did: The United States likewise conducted covert propaganda, political warfare, sabotage planning and support for anti-communist groups.
5. So many proxy fights: Proxy conflicts in Korea, Vietnam and Afghanistan let superpowers compete while usually avoiding openly acknowledged bilateral war.
6. And the Germans: Berlin repeatedly combined military signaling, intelligence activity, political pressure and propaganda beneath the threshold of general war.
7. The enduring paradox: Stronger deterrence against direct war could encourage persistent competition through indirect methods.

From Soviet active measures to ‘digital gray zone’

1. Cold War techniques: These survived the Soviet collapse, while digital technology radically increased their speed, reach and scalability.
2. Cyber operations: They enable espionage and disruption without immediately revealing the operator, sponsor, location or strategic purpose.
3. Social platforms in picture: allow influence campaigns to amplify existing grievances rapidly across borders, languages and political communities.
4. Globalized infrastructure: It created vulnerable pressure points including ports, cables, energy grids, satellites, logistics and digital services.
5. Russia’s 2014 seizure of Crimea: It used unmarked forces, propaganda and ambiguity before overt territorial control consolidated.
6. What in Donbas: In Donbas, Russian military support and proxies blurred distinctions among local rebellion, covert intervention and interstate conflict.
7. Ukraine at receiving end: By 2021, cyberattacks, information operations and military pressure were persistent components of Russia’s confrontation with Ukraine.

Ukraine 2022-2026: Full-scale war + Gray-zone warfare

1. Dawn of a new age: After February 2022, conventional warfare and gray-zone methods operated simultaneously rather than replacing one another.
2. Both fronts active: Cyber operations, electronic warfare, espionage and influence activity continued alongside missiles, artillery, drones and ground combat.
3. Drones drones drones: By September 2026, increasingly capable Russian drones were further straining Ukraine’s already pressured air-defence network.
4. Deep into its heart: Russia repeatedly struck Ukrainian energy, transport, industrial, agricultural and port infrastructure, imposing substantial military and economic costs.
5. Food security issues: Attacks on ports, grain facilities and export routes increasingly connected battlefield operations with international food-security consequences. FAO projected 2025-26 cereal exports near 40 million tonnes, approximately twenty percent below the preceding marketing year.

Europe’s sabotage war: parcels, fires and disposable proxies

1. Russian sabotage: European investigations increasingly describe a Russian-linked sabotage campaign expanding alongside Moscow’s conventional war in Ukraine.
2. Incidents: Incendiary parcels exploded in Leipzig, Birmingham and Poland during 2024; investigators later linked the plot to GRU.
3. Poland: Polish prosecutors linked the Marywilska shopping-centre fire and Vilnius IKEA arson to Russian-directed sabotage networks.
4. Russian-linked proxy recruitment: These increasingly uses social media, Telegram and cryptocurrency, lowering barriers for disposable operatives.
5. What IISS says: IISS describes this decentralized model as a “gig economy” of sabotage using expendable locally recruited intermediaries. (International Institute for Strategic Studies, London)
6. What CSIS says: CSIS recorded Russian-attributed European attacks quadrupling from 2022-23, then nearly tripling again from 2023-24. (Centre for Strategic and Int. Studies, Washington)
7. Germany: It attributed an August 2026 explosive-drone attempt at Leipzig/Halle Airport to Russian intelligence; Moscow denied involvement.

Baltic cables, GPS disruption and the attribution trap

1. Undersea infrastructure incidents: These illustrate why gray-zone attribution can be strategically important yet evidentially difficult.
2. November 2024 damage hit C-Lion1 between Finland and Germany and BCS East-West between Sweden and Lithuania.
3. Investigators focused on Chinese-flagged Yi Peng 3, but deliberate sabotage and Russian direction remained publicly unproven.
4. December 2024’s Eagle S anchor damaged Estlink 2 and telecommunications cables, according to Finnish investigators.
5. Who was linked: Its Russian-oil and shadow-fleet links raised concern, but those links alone did not prove Kremlin direction.
6. GPS problems: Baltic and Nordic authorities report persistent GPS interference originating from Russia; Moscow rejects those accusations.
7. Narva People’s Republic: The 2026 “Narva People’s Republic” episode shows attribution discipline: Estonia’s intelligence chief saw no Kremlin role.

When does gray zone become war

1. NATO states that significant cyber or hybrid attacks may constitute an armed attack under Article 5. Whether Article 5 applies depends on case-by-case assessment, making scale, effects, attribution and intent especially important.
2. European responses combine sanctions, cyber defence, infrastructure protection, counter-drone measures and expanded intelligence cooperation.
3. Germany, Sweden and other countries are reforming intelligence capabilities after shortcomings exposed around Russia’s 2022 invasion.
4. The EU developed a hybrid toolbox and in 2026 proposed stronger coordinated counter-hybrid response mechanisms.
5. Europe faces two simultaneous risks: underreacting to cumulative coercion and overreacting to ambiguous or misattributed incidents.
6. The strategic challenge is deterrence without automatic escalation: identify patterns, strengthen resilience, attribute carefully and respond proportionately.

Conclusion

Gray-zone warfare matters because it changes how states compete without eliminating conventional war.

The Cold War showed how deterrence, espionage, propaganda, proxies and covert action could coexist for decades. Ukraine since 2014 demonstrates how ambiguity can precede overt force, while the 2022-2026 war shows hybrid methods continuing during full-scale combat.

Europe’s challenge is therefore dual: recognize genuine patterns of sabotage, cyber activity and coercion, yet avoid treating every accident or provocation as proven state action. Effective deterrence depends on resilience, intelligence, attribution, proportionality and collective response under sustained pressure.

Value addition

Glossary and related terms

Gray-zone warfare

Coordinated coercion designed to remain below, blur or complicate the threshold of open war; the session presents it as pressure that can combine multiple political, informational, cyber, economic and security tools.

War threshold

The boundary between competition or coercion below open war and conduct serious enough to be treated as armed conflict or an armed attack.

Ambiguity

Uncertainty about authorship, intent or legal status. The session describes this uncertainty as strategically useful because it can delay a response.

Plausible deniability

The ability to operate through intelligence services, proxies, criminals, front organizations or unwitting intermediaries in ways that complicate direct attribution.

Attribution

The process of identifying who is responsible for an incident. The session stresses separating proven responsibility, official attribution, intelligence assessment, suspicion and unresolved cases.

Proxy

An intermediary or partner used to exert pressure or pursue objectives without relying only on openly acknowledged direct state action.

Active measures

The Cold War-era Soviet practices named in the session, including disinformation, forged documents, front organizations and covert influence.

Cyber operations

Digital activity used for espionage or disruption that can complicate immediate identification of the operator, sponsor, location or strategic purpose.

Electronic warfare

The communications- and signal-related layer of conflict discussed alongside cyber operations, including interference affecting GPS and communications.

Influence campaign

Organized information activity intended to shape narratives or amplify grievances across political communities and borders.

Critical infrastructure

Essential systems highlighted in the session as pressure points, including ports, cables, energy grids, satellites, logistics and digital services.

Conventional war

Open military conflict involving forces and weapons such as missiles, artillery, drones and ground combat; the session emphasizes that gray-zone methods can continue alongside it.

Disposable proxy

A locally recruited intermediary used for sabotage or other covert activity; the session discusses recruitment through social media, Telegram and cryptocurrency.

“Gig economy” of sabotage

The IISS phrase quoted in the session for a decentralized model using expendable, locally recruited intermediaries.

GRU

The Russian intelligence organization named in the session in connection with investigators’ attribution of the 2024 incendiary-parcel plot.

Undersea infrastructure

Subsea systems such as power and telecommunications cables. The session uses Baltic cable incidents to illustrate the difficulty of proving intent and state direction.

Shadow-fleet link

A connection described in the session around the Eagle S case; the session explicitly cautions that such links alone did not prove Kremlin direction.

GPS interference

Disruption of satellite-navigation signals. The session notes that Baltic and Nordic authorities attributed persistent interference to Russia while Moscow rejected those accusations.

Article 5

The NATO collective-defence provision discussed in the session. NATO states that significant cyber or hybrid attacks may constitute an armed attack, with application assessed case by case.

Hybrid attack

A cyber or other mixed-method attack that may combine military and non-military means; the session treats scale, effects, attribution and intent as important to assessing its seriousness.

Deterrence

Efforts to discourage coercion or attack by raising expected costs or reducing expected gains; the session frames the challenge as deterrence without automatic escalation.

Resilience

The capacity to withstand and recover from sustained pressure, supported in the session by cyber defence, infrastructure protection, counter-drone measures and intelligence cooperation.

Proportionality

The principle of matching a response to the seriousness and evidence of the incident rather than escalating automatically.