Hybrid Warfare: Attribution is Key to Deterrence

Bernard Siman 

Source Link

As Russia’s illegal war on Ukraine grinds on, it is likely that the intensity and frequency of hybrid attacks against western democracies will increase, targeting a host of vital functions, services, and activities

Hybrid Warfare: Attribution is Key to Deterrence

As Russia’s illegal war on Ukraine grinds on, it is likely that the intensity and frequency of hybrid attacks against western democracies will increase, targeting a host of vital functions, services, and activities, as well as mounting disinformation and influence operations. The latter are aimed at creating as many cracks as possible among the different groups in democratic societies, and to deepen divisions through creating differing perceptions of the same realities. Moreover, the current cost of living crisis is likely to be weaponised with the additional objective of weakening the cohesion around the sanctions imposed on Russia. The febrile environment in most democratic states caused by the various crises, and the nature of democratic discourse, particularly during elections, means that attribution of such attacks has become a pressing security concern.

Attribution and Response: The Twain that should meet

Hybrid attacks have been explicitly identified by both the EU Strategic Compass and the NATO Strategic Concept as qualifying for collective response. NATO Secretary General Jens Stoltenberg expressed this position in various speeches. Even before the war of aggression against Ukraine, in January 2022, Admiral Tony Radakin, Chief of the Defence Staff of the United Kingdom, explicitly said that attacking undersea cables could be treated as an “act of war”. General Bertrand Toujouse, Chief of the French Commandement des Operations Speciales said in May 2022 that “we are in the process of taking another look at our whole military doctrine when it comes to gray areas”. As such, Hybrid Warfare will increasingly become a key component of and how war is fought, and of international relations more broadly. Militarily weaker powers in particular are likely to revert to Hybrid Warfare, to compensate for the gaps in their military arsenal.

The elephant in the room, however, is attribution. Without common standards for, and understanding of, attribution, collective response will be significantly weakened. This is not an invitation to draw up hard and fast rules that will eliminate the flexibility required for political decision-making. It is well understood that collective response is an absolute last resort, given its potential worldwide calamitous implications. Rather, this is a call to create an agreed allied framework for attribution that will support effective deterrence. If attribution is deemed by adversaries and enemies to be hostage to the political whims of the day, thus being open to effective influence operations, deference against hybrid attacks will not be credible.

Allied attribution has a curious provenance in the context of NATO, which is a useful case study for any application of Article 42.7 of the TEU, as well as of NATO’s Article 5 in the case of hybrid attacks. In the one instance when Article 5 was invoked, that of the terrorist attacks of 9/11 on the continental United States, reaching agreement on attribution played a key role in eventually “getting the deal done” among NATO allies on launching offensive operations. Article 5 was not invoked against a state, but against a combine including a non-state actor. Moreover, the mission was not defined in strictly military terms but rather in the broad spectrum of “war against terror” – terror being neither a state nor an entity within the geographic definitions of NATO’s various parameters. This raised the political threshold for attribution. Many states struggled at the time with the issue of “attribution”.

The key question was, and likely will remain in the case of hybrid attacks: How can a state commit its armed forces and resources to a mission in anger without clear attribution? Which thresholds of attribution will be required politically by the different states?

“Who done it?”: An Allied Attribution Framework

The same questions will face both NATO and the EU (and their individual members) should a (near) catastrophic hybrid attack take place. There may be a certain degree of certainty as to who committed the offence, but no clear-cut 100% attribution. For example, attacks disabling the financial system, energy supplies, internet services, and interfering in elections, inciting domestic civil unrest, and so on may have varying degrees of certainty as to “who done it”.

States may even doubt the answer to the most basic question of all: Does such an attack qualify for collective response in the first place”. If yes, then answering the question of “who done it” becomes paramount. This is mainly because, as a rule, the quality of any decision made in a panicked reactive mode is poor. In the case of hybrid attacks this is particularly true as the institutions aim to apply yesterday’s lessons to today’s attacks and to tomorrow’s threats in haste and confusion, whilst simultaneously meeting the requirements of the democratic political dynamics. These dynamics will require raising the awareness of the public quickly, whilst also designing and deploying effective and deliverable post-attack measures, that will need to be very well thought out to ensure resilience and proportionality of response.

In other words, a merely reactive response will not be effective; being very well prepared is key to both resilience and deterrence. A key part of such preparation will be agreements ahead of any such attacks on the framework for attribution, that will enable the political decision-makers to deploy resources, including for mutual assistance.

Perceptions Are Decisive in Deterrence

This is the point at which the threshold of certainty of attribution, required politically and technically, becomes the lynchpin for creating a credible collective deterrence. If adversaries and enemies perceive this threshold to be liable to becoming a political football, deterrence will fail. The political football can be bounced and kicked both domestically (i.e. within each state), as well as between states according to their general appetite for conflict with the attacking actor. This is also a fertile ground for hostile political and information influence operations to weaken the public’s support for retaliatory action. The success of these operations in democratic states can mean that the response might be weak. In defence and security terms this will at best delay military or security response time, water down any response, and achieve key tactical or strategic advantages in favour of the attacking state. Moreover, the perception of “relative power” starts to shift in favour of the attacking state, although that state may in fact be militarily weaker. This is a key advantage that can be achieved by the attacking state as it aims to increase the threshold of tolerance in the target society through a combined set of hybrid tools.

Needless to say that the risk of miscalculation by the adversaries is embedded in identifying the wrong threshold of tolerance, or if strategic ambiguity fails. Establishing an effective attribution framework weakens strategic ambiguity and deprives attacking states from a corner stone in launching successful (i.e. deniable) hybrid attacks.

Conclusions

Realistically, any collective response to hybrid attacks will have to have two stages, based on how attribution, in the majority of cases, is likely to progress over time, from more ambiguity at the outset of an attack to the subsequent increased certainty of “who done it”. What level of certainty is required by each state should become a key theme on the agenda of preparing for hybrid attacks and collective response, through the creation of an attribution framework.

The two stages are:

1/ A defensive deployment phase in which attribution is not clear, i.e. pending agreed attribution. However, all allied states should be able to agree on deploying defensive measures in support of an ally (such as in energy, financial services, food security, information and political operations), and should develop the national legislative frameworks to enable them to do so.

2/ An offensive collective response phase once the allies agree on attribution.

In reality, agreement can be swiftly reached in phase one. Measures could include pre-arranged practical support for logistics and payment systems (including food vouchers under emergency measures). They could also include agreement that, within the EU, it may be possible to act initially under Article 22.2 of the TEU rather than the more sensitive 42.7.

However, without a pre-agreed attribution framework, the second phase might take a long time, if at all, to mature to agreement. Even if agreed, without a framework the response itself is likely not only to be delayed, but also to be diluted. If this will be so perceived, deterrence can fail.

Moreover, it seems necessary for any credible EU deterrence that a broader interpretation of Art 42.7 of the TEU, that explicitly identifies hybrid attacks as a trigger for collective response, is formulated and made public. This will help to ensure that deterrence will acquire a clear legal framework to further discourage hostile states and non-state actors from launching hybrid attacks.

Attribution in the processes of countering Hybrid Threats is the lynchpin of deterrence, and it is one of the weakest links for democratic states in Hybrid Warfare. Any necessary and practical measures aimed at closing the gap of uncertainty of attribution will help support political decision-making in democratic states. Adversaries exploit the decision-making processes necessary for the proper functioning of liberal democracies. The better prepared the democratic political process is before an attack takes place for dealing with high levels of uncertainty, the more resilient a system is in cases of hybrid attacks. This, in turn, will strengthen deterrence not just by denial, but crucially by the real threat of punishment and higher collective resilience as well, as the costs will exceed the benefits of hybrid attacks against democracies.