In the last two editions of this newsletter, I’ve explored the ways in which concerns about hybrid threats are dominating European security debates and identified the flaws with the concept itself. This week, I want I want to offer a pathway out of the jungle and identify key characteristics that an event or behaviours should display to qualify as a hybrid threat.

Here’s what you’ll find this week:

• Accepting the inevitable
• Establishing the fundamentals
• Identifying the key features

To read this newsletter in your browser, click here.

Accepting the inevitable

Hybrid threats are not disappearing from debates around European security anytime soon. Not only is the concept well-established and politically useful, but it refers to an issue that provokes legitimate concerns: destabilising, hostile activity that falls below the threshold for war. This activity needs a name. For better or for worse, hybrid threats is the one that it has.

This does not mean, however, that we need to tolerate conceptual anarchy. If the term is stretched too far, if it is not differentiated from other types of activity, it ceases to be analytically useful. If we want the debate around hybrid threats to be productive, we need a clear understanding of what constitutes a hybrid threat — and, no less importantly, what does not.

In other words, we still need a workable, operationalisable definition — one that allows us to assess a specific event or type of activity.

Establishing the fundamentals

A definition offered by Monaghan (2019: 87) provides us with a reasonable starting point — not so much because it is adequate, but because it helps make the problems more legible:

This has much in common with NATO’s definition, which I discussed in the last newsletter. I will not revisit the problems I identified then; even though this attempt is more rigorous, it succumbs to many of the same problems. However, even if we accept this definition as it is, we are immediately faced by two issues that warrant recognition. First, it operates at a strategic level and is very hard to operationalise: You would struggle to look at any individual incident and say whether it qualifies or not. Second, it is always impossible to definitively classify any single event or activity as an exemplar of hybrid activity. Since the concept refers to the combination of means and actions, events must always be viewed in context. We can use a definition to definitively exclude an event from consideration, but not to include it.

Identifying the key features

Rather than offer an alternative, more practical definition, we can draw on existing debates to identify some key characteristics that an event or activity should have to qualify as an exemplar of a hybrid threat:

• The incident or behaviour should be deliberate: This is a fairly obvious point but one that is often overlooked. In considering hybrid activity, we are considering purposeful, agentic action, not accidents.
• The intent of those commissioning the act should be political: Almost all existing definitions make reference to the goals of those engaging in hybrid activity. Identifying intent is extremely challenging, but this becomes less problematic if the definition is used as a basis for exclusion rather than inclusion: If there is evidence that a particular behaviour was not pursued for political goals, then it should be excluded. This only applies to commissioners, not to perpetrators though, since there are plenty of examples of people on the ground being seemingly unaware of the purpose of the act — or even, when they play only a part in it, the act as a whole.
• The intent of those commissioning the act should be hostile: Another non-controversial component, but hybrid activity is harmful, not benevolent, and seeks to destabilise something or undermine the status quo in the target polity.
• The target should be non-military: The popular debate may sometimes encompass military targets and there is a perpetual blurring of the boundaries between hybrid threats and hybrid warfare, but the distinction is worth maintaining: hybrid warfare should only exist in a state of war. If, as NATO asserts, “hybrid methods are used to blur the lines between war and peace” and this is considered problematic, then the very definition of the concept should not facilitate this. The distinction also allows for analysis of how non-military means are used alongside military ones: hybrid warfare thus becomes an umbrella discussion of warfare + hybrid methods. The distinction only applies to targets, not perpetrators — since many hybrid activities are undertaken by or involve state security units.
• It should breach international laws and norms: This is a crucial point raised by Monaghan and, interestingly, those laws and norms continue to be supported even by perpetrating states. Russia, for example, denies responsibility for its hybrid activity while at the same time rhetorically asserting that such activity is illegitimate — because it does not want it to be used against it.
• It should breach domestic laws: This is an extension of the previous, but an activity should be illegal in the state where it is perpetrated. This places a responsibility on policymakers to ensure that any policies they design around hybrid threats operate within a legal framework. If legislators fail to define a problem, they can have few legitimate complaints. The UK, for example, banned disinformation sponsored by foreign states in 2022.
• The activity is unacknowledged: Cormach and Aldrich (2018) note that plausible deniability has rarely existed in practice, and this is certainly true with regard to Russia — where activity tends to be implausibly deniable. They reconceptualise this as “unacknowledged activity”, which relates to the points about breaching laws and norms without creating the assessment issues that accompany discussions of covert action (visible to whom? Covert for how long?)

Anything that does not satisfy these criteria should not be considered as hybrid activity and should therefore be omitted from the debates. We can also identify several characteristics that are often included in definitions but should arguably be excluded:

• There is no discussion of or inferences about the identity of the perpetrator: References to people seeking to disrupt the Western-led international order are partisan and add little by way of clarity. At least in theory, Western countries are as capable of engaging in hybrid activity as their non-Western counterparts. This avoids conceptualising hybrid activity in such a way that target states can only ever be reactive.
• There is no requirement that an act be nonviolent: Monaghan argues for the exclusion of violent activity, on the grounds that inclusion makes hybrid activity indistinguishable from simple warfare. That distinction matters, but a nonviolent requirement isn’t the way to achieve it. On the one hand, acts of sabotage are clearly acts of violence and firmly within the current debate around hybrid threats. On the other hand, if we narrow the focus to exclude only violence against people, then what of assassinations of non-military figures outside of war zones? Excluding these would leave us with a category of grey zone activity that is not warfare and not terrorism (where the primary audience and primary target are not the same), and therefore leave us with a problematic gap in how we think about security. The distinction Monaghan seeks is better maintained through the specification of the target as non-military, not the act.

This, hopefully, provides a workable approach to the concept. It may require refinement over time, particularly as new types of activity emerge or when I consider more marginal activity, but this at least establishes the fundamentals — and provides a reference point for future debates.

Think someone else would find this useful? Why not forward this to them?

About me

I'm Dr Mark Youngman, an open-source investigator specialising in Russian security, and I run Threatologist. You can explore the free research and resources available in the Russian Security Research Lab (RSRL). If you need bespoke analysis or data — a dataset, literature review, or tailored report scoped to your question — check out my services.