Russia has demonstrated a growing willingness to use hybrid tactics – including sabotage, cyberattacks, information operations, and the use of deniable or “throwaway” agents – to create disruption and uncertainty across Europe. This paper examines how those tactics could be combined in a hypothetical Russian operation against Estonia designed not to defeat NATO militarily, but to create a crisis that tests the Alliance’s ability to respond quickly and collectively.

The scenario is deliberately constructed as a red-team exercise rather than a prediction. It envisions Russia exploiting the existence of Estonia’s Russian-speaking population, infiltrating operatives into the Schengen Area through legitimate visa channels, allowing those operatives to move through the largely borderless Schengen zone, and exploiting gaps in European immigration enforcement. The scenario culminates in a deliberately ambiguous armed crisis in Narva, accompanied by cyberattacks and a coordinated information campaign intended to complicate attribution and slow NATO decision-making.

The exercise identified several vulnerabilities. Some elements of the scenario are highly speculative, particularly Russian operatives' ability to obtain weapons once inside Estonia. Other elements, however, reflect existing conditions: Estonia’s large Russian-speaking population, the continued issuance of Schengen visas to Russian nationals, the decentralized nature of internal immigration enforcement, and the absence of a clearly identifiable EU-level capability dedicated to systematically analyzing the EES overstayer population for emerging national-security threats.

The paper therefore recommends three measures: continued EU-wide efforts to disrupt organized criminal networks that could provide support to hostile actors; eliminating tourist visas for Russian nationals except in limited humanitarian circumstances while developing a forward-deployed EU visa-security capability; and establishing a national-security immigration coordination center capable of analyzing immigration data against emerging threats and coordinating responses among Member States.

The central conclusion is that NATO’s military deterrence remains essential, but military strength alone cannot close every avenue through which a sophisticated hybrid operation could develop. Preventing such a crisis requires identifying and closing the less visible vulnerabilities that could allow hostile actors to establish themselves inside Europe before a crisis begins.

I. Introduction

Drones at Leipzig Airport. Drone incursions of NATO airspace. Throwaway agents. Arson and sabotage at facilities throughout Europe. 2026 has been a busy year, and it appears that Russia is engaged in an ongoing hybrid campaign on the European continent. The EU says that Russia’s goal is to spread fear, distrust, and undermine European unity. Additionally, just this Sunday, September 20, European security officials raised alarm that Russia is testing NATO resolve and could potentially even attempt a limited incursion into NATO territory.

This paper takes the current situation and threat picture as a starting baseline and imagines a scenario in which Russia creates a strategic crisis in Estonia, a NATO member, to discredit NATO collective defense and distract from the war in Ukraine by creating a sort of second front for NATO. In working through this thought exercise, the article examines what Russia could gain from escalation, how it might carry it out, and what security gaps the scenario identifies. Like with any hypothetical scenario, I suspect some will wholeheartedly disagree with my assertions. Still, I ask you to think of this as a red teaming exercise designed to identify vulnerabilities, and not an effort at forecasting.

II. Why might Putin want to escalate?

The “special military operation” that was supposed to take Kyiv in 6 days is going on for four years. Russia is not making significant gains on the battlefield, and whatever small gains it makes come at a prohibitive cost. The Center for Strategic and International Studies estimates that, since the full-scale invasion in 2022, Russia has suffered 450,000 dead and 1.4 million battlefield casualties. Moreover, Russian control of Ukrainian territory actually shrank in the Spring of 2026. The situation is so unfavorable that the Russian MoD now resorts to outright fabrication to claim battlefield gains that have not occurred.

Ukraine, on the other hand, seems to have stabilized its position after 4 years of war. It is becoming ever more adept at using drone technology and can finally bring the war home to Russia. Ukrainian long-range drones are now striking infrastructure deep inside Russia every week, including Russian oil refineries. This matters because Russian oil is the last remaining cash cow keeping the Russian economy afloat. And even though official Russian government numbers purport to show economic stability, a June report from the Kiel Institute for the World Economy concludes that “the Russian economy is showing clear signs of structural exhaustion.” Meanwhile, European support for Ukraine is strong across the continent, at least among mainstream political parties. On September 17, the EU Commission disbursed 3.3 billion euros to Ukraine – part of the 90-billion-euro Ukraine support loan. So in this war that increasingly looks like a war of attrition, it is Ukraine, and not Russia, that appears to be coming out on top.

In my assessment, these factors are gradually painting Putin into a corner, where he is slowly running out of options and may be forced to “flip the script.” In theory, one option Putin always has is a genuine move towards peace on fair terms, which should at minimum include a complete withdrawal of Russian forces from Ukraine. But he is stuck in a trap of his own making. If he relents on his maximalist demands and opts for fair peace, the entire very expensive and painful 4-year war would appear to have been fought for naught. That might very well threaten his political, or even personal, survival in a cutthroat political system. So, he is not willing to make peace. And sticking to business as usual looks like an eventual dead end as well.

In my imagined scenario, Putin invents a third option and chooses to escalate by launching a proxy military operation in Estonia. The operation has several goals. First, it aims to create a crisis NATO must solve on alliance territory, competing with NATO support for Ukraine. NATO would have to decide how to react to the crisis, and balance the reaction with the risk of escalation and full-blown war with Russia. Thus, as a second goal, Putin might succeed in discrediting Article 5 provisions of the defensive alliance if NATO’s response were to be slow or ineffective. Third, a military operation on NATO territory could force NATO partners to focus on their own defense rather than continuing to support Ukraine.

At first glance, this scenario may seem implausible or even reckless. After all, we have been almost conditioned to see NATO and Article 5 collective defense as an ironclad guarantee. This is one reason why countries that were formerly part of the Warsaw Pact flocked to NATO in the 1990s. But we also need to keep in mind that the concept of collective defense has not been routinely tested. Article 5 was invoked only one time – in the aftermath of the September 11 attacks against the United States. NATO has never dealt with a situation where an opponent seeks to test NATO boundaries by mapping out red lines, which I believe is exactly what Russia is doing. In other words, NATO has not yet been fully tested in hybrid war.

III. What might Putin assume about NATO?

We have discussed how the West views NATO. But what might Putin assume about the alliance, especially NATO’s willingness to go to war?

NATO is focused on defense and may prefer to avoid war. First, NATO explicitly describes itself as a defensive alliance and identifies preventing conflict and war as a core purpose of its deterrence and defense strategy. Putin could reasonably assume that NATO governments strongly prefer to resolve a confrontation without escalating it into a direct war with Russia. This does not mean NATO would fail to respond to an attack; rather, it creates a potential vulnerability that Russia could exploit by presenting NATO with an ambiguous crisis in which the costs of escalation are apparent, but the attribution of Russian responsibility remains contested.

NATO may be slow to act. An armed NATO response requires deliberation and consensus among alliance members. Article 5 obligations are triggered in instances of an armed attack, and determining whether an action is an armed attack is addressed on a case-by-case basis. NATO’s own materials note that “events that lack an international element, such as purely domestic acts of terrorism, do not trigger Article.” In Putin’s view, he could see case-by-case deliberations as a vulnerability and conclude that a deliberately vague scenario would make it difficult for the alliance to reach consensus quickly, keeping the window of action open for Russia.

Information operations may complicate consensus. NATO is a collective alliance of democracies, and democratic governments depend to some degree on public support and political legitimacy. In Putin’s assessment of the political situation, he may conclude that Moscow does not need to persuade NATO governments that Russia is innocent. It may only need to create enough confusion and debate within NATO populations to make decisive action more politically difficult. Russia has both the tools and demonstrated experience to flood the information environment with contradictory narratives. The U.S. State Department has documented Russian use of multiple, sometimes contradictory narratives specifically to generate confusion and discourage responses. NATO likewise describes hostile information operations as activities designed to “create confusion, deepen divisions, destabilize societies and ultimately weaken the Alliance,” and notes that such operations are not always intended to persuade audiences of a particular falsehood; they can instead be designed to muddy the information environment and make it more difficult to distinguish fact from fiction.

From Moscow’s perspective, the objective therefore need not be to achieve consensus around a pro-Russian narrative. It may be sufficient to prevent consensus around a coordinated response. If a crisis involving Estonia produced competing narratives about what happened, who was responsible, and whether Russia was directly involved, political divisions within individual NATO member states could complicate the Alliance’s response and make consensus harder to achieve.

Nuclear intimidation may complicate consensus. Putin may believe that nuclear signaling can amplify Western caution. Russia has repeatedly used explicit and implicit nuclear threats during the war in Ukraine. Evidence suggests these threats can have effects beyond traditional military deterrence, including a Chatham House assessment that Russian nuclear threats contributed to Western concerns about escalation and constrained some governments' willingness to provide Ukraine with certain forms of military support. This does not mean that Western populations will automatically oppose confrontation with Russia. Public attitudes toward nuclear deterrence have, in some cases, become more supportive since Russia's invasion of Ukraine. Rather, the point is that nuclear signaling adds an extra political cost to any decision to escalate a confrontation with Moscow. A Russian leadership that believes Western governments are highly sensitive to the prospect of nuclear escalation may therefore conclude that even an ambiguous or limited confrontation could be accompanied by nuclear rhetoric designed to encourage caution, delay, or disagreement within the Alliance.

Taken together, these assumptions suggest that what may appear from NATO’s perspective to be an irrational and extraordinarily risky decision—deliberately creating a crisis on NATO territory—could look considerably more rational from Moscow. Russia would not necessarily need to believe that NATO would stand aside. It would need to believe that NATO’s preference to avoid war, consensus-based decision-making, democratic political constraints, vulnerability to information manipulation, and sensitivity to nuclear escalation could create enough hesitation and disagreement to complicate a unified response. In this model, the objective would not necessarily be to defeat NATO militarily. It would be to create a crisis in which NATO’s overwhelming military advantage becomes difficult to translate into timely, unified political action. If Moscow believed such a crisis could fracture Alliance cohesion, force NATO to divert attention and resources from Ukraine, or show that Article 5 could be challenged without producing an immediate, unified response, the potential payoff might outweigh the risks in the Kremlin’s calculus.

IV. Free Narva – a Baltic hybrid war scenario

With the analysis of the previous sections in mind, I constructed a scenario in which Russia executes a deliberately ambiguous and confusing operation designed to threaten Estonia’s territorial integrity and test NATO’s resolve. In developing the scenario, I considered Russia’s potential objectives, lessons from previous Russian operations, the defensive measures Estonia and NATO have already adopted, and how Moscow might circumvent or exploit those defenses. This paper discusses the vulnerabilities identified through this process in a later section.

Phase 1 – Propaganda and throwaway agents

In October 2026, with the September Duma elections behind him and a comfortable supermajority win for his United Russia party, Putin decides to launch Operation “Narva Spring.” Analysts and think tanks pick up on increased messaging about the so-called “People’s Republic of Narva.” This is an entirely fictitious concept created by Russian intelligence, with a flag, notional borders, and a capital in Narva, a city of about 50,000 residents, 97% of whom are Russian speakers. The online narratives shared on Telegram, TikTok, and other platforms are the usual assortment of Kremlin grievance narratives about marginalized Russian minorities. Ongoing Estonian reforms that aim to make Estonian the official language of education in the country are weaponized and portrayed as “linguistic genocide” against Russian speakers.

The online propaganda campaign is amplified by Kremlin-controlled trolls and shared with pro-Russian Western influencers and political factions who decry Estonian government abuses of the Russian-speaking population. With the propaganda campaign at a fever pitch, the Kremlin is ready to escalate physically. But Russia cannot simply repeat the Crimea or Donbas scenario against Estonia. The Estonian border is one of the most heavily monitored frontiers in the world, where NATO has implemented a “deterrence by denial” strategy. This doctrine holds that defensive measures are so formidable the enemy sees an operation as too costly to attempt. Infiltrating several hundred “little green men” into Narva from Russia just across the river, while maintaining deniability, is not plausible. The Estonian side of the border is teeming with sensors.

But the Russians have been practicing another gray zone tactic recently – the use of “throwaway agents.” So, the Kremlin uses its network of low-level recruits to spray graffiti, place posters and stickers with QR codes, and eventually commit acts of arson and sabotage against local infrastructure and public property – and especially anything linked to law enforcement, security agencies and the courts. The goal is to create the appearance of local resistance against Estonian authority, while staying well beneath the threshold of armed conflict. But propaganda, graffiti, arson, and low-level sabotage are not the intensity of crisis the Kremlin needs. At this point, Russia needs to use specialists trained in fomenting armed violence on the ground.

Phase 2 – Infiltration

In 2014, Igor Strelkov emerged as the face of the armed separatist movement in Donbas, providing Moscow with something enormously valuable: an apparent local actor around whom an armed conflict could coalesce. To bring the Estonia situation from a nuisance to a crisis for NATO, Moscow needs people trained in violence, and a few Strelkov types to direct them. But how to bring them in? Estonia hasn’t allowed free travel for Russian citizens since 2022, and applications for entry for the few exceptions are closely scrutinized.

So, the Kremlin probes for weaknesses in the Schengen zone, and it finds these in Italy, France and Spain. In 2025, France, Italy and Spain collectively issued more than 441,000 Schengen visas to Russian nationals, while more than 477,000 Russian nationals received tourist visas across the entire Schengen zone. The refusal rate for Schengen visas for Russian nationals in 2025 was a mere 6.4%. The Schengen creates an interesting counterintelligence problem for Europe. Once a person has legitimately crossed the EU's external border, Europe's internal geography largely disappears.

In this scenario, Russia begins to infiltrate intelligence and military specialists from units like GRU’s Unit 29155 and the 390th Special Purpose Reconnaissance Point into the Schengen area starting in June 2026, before the launch of the Narva propaganda campaign and increased tensions. Even with the extra scrutiny for Russian visa applicants and shorter admission periods, the Russian operatives obtain tourist visas, enter Italy, and move with ease through Austria, Slovakia, Poland, Lithuania and Latvia via the excellent European train network and private commercial bus services. Once in Estonia, the operatives blend into the large Russian-speaking population and make their way to Narva. In total, just under a hundred Russian operatives follow this and other routes into Estonia over the summer months, and go to ground in the Narva region, supported by a tiny group of local sympathizers and a network of throwaway agents.

Even once the tourist visas of the Russian operatives expire, and they become illegal immigrants within the EU, nothing causes the system to blink red in reaction to this. In a way, no centralized, integrated system focuses specifically on immigration, so no lights blink red. Unlike the United States, Europe does not have an EU-wide interior immigration enforcement agency, and it currently lacks a central entity to monitor immigration violations against emerging national security risks, although that gap has been acknowledged. In terms of what exists today, in 2026, the EU rolled out the Entry/Exit System (EES), which captures biometrics from non-EU nationals entering the EU on short stays. So, in theory, the EES captures the biometrics of the Russian operatives in our scenario. And once their period of admission to the EU ends, typically at 90 days, the operatives are added to the EES “overstayer” list. But at present, unless the overstayer is also matched to additional alerts in the Schengen Information System – an EU-wide law enforcement database – no specific actions are automatically triggered, and law enforcement is not alerted.

Any interior immigration enforcement beyond this point is the responsibility of law enforcement within individual EU member states. If one of the operatives has the bad luck of being stopped by police and this results in a document check, the EES hit would likely show, and he would be detained. But the EES list is not proactively pushed to law enforcement for action. It is simply available to query. And importantly, EES is managed by eu-LISA – the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice – which is an agency focused on IT systems management and not law enforcement or security. In other words, no analysts are scouring the EES list for a sudden uptick in Russian nationals of military age being added to the overstayer list. Unless they attract attention to themselves, no one is coming for the Russian operatives. And in a city with a 97% Russian-speaking population, they don’t attract attention. Meanwhile, they quietly get to work acquiring small arms and mapping out critical infrastructure, communications, and defense and law enforcement sites.

Phase 3 – Estonian Donbas

By the end of 2026, the ground is set to initiate a crisis in earnest, in a way that gets NATO’s full attention. On January 2, 2027, a Saturday, Estonians are still recovering from the raucous New Year’s Eve celebrations. At 0700, Estonia's Information System Authority (RIA) Operations Center in Tallinn begins receiving simultaneous alerts indicating disruptions across government and critical infrastructure networks from unattributed sources. Analysts and incident handlers track the situation as key government and private-sector websites become unreachable due to denial-of-service attacks. Physical equipment begins to act erratically as unknown actors hack industrial control systems. Rail networks are disrupted. Traffic lights rapidly cycle in bizarre patterns. A few urban areas across Estonia lose electricity.

At the same time, radar operators identify air signatures from Russia, apparently heading toward Estonian airspace. Alert aircraft are scrambled. But the real crisis kicks off on the ground in Narva. Masked armed men, dressed in civilian clothing and wearing tricolor armbands, break into the empty Narva City Government building at Peetri Platz 5, climb their way to the top of the tower, and unfurl a green, black, and white flag. As the city government building is occupied and barricaded, another group of armed men attacks a nearby police station, overwhelms the skeleton crew, and takes a handful of hostages.

The last two groups are tasked with seizing the two border crossings across the Narva River. Narva 1 is the main border crossing point between Russia and Estonia, across the Friendship Bridge. A smaller, rarely used secondary crossing, Narva 2, sits about a mile south in a mixed industrial and residential area. The armed group attacking Narva 1 engages the border station building, about 380 meters from the foot of the bridge, drawing Estonian police defenders into a firefight. A second section of attackers takes up positions in the Narva Museum, a complex of 14th-century stone fortification with a commanding view of Friendship Bridge and the surrounding area, and supports the assault. Further south at Narva 2, the attackers similarly engage the border station, while setting up overwatch positions in the massive abandoned Kreenholm textile manufacturing complex.

While Estonian police defenders focus on attacks from the Estonian side of the border, additional attackers cross the bridges on foot and join the fight. These groups of men dressed in plain clothes are armed with heavier weapons including RPGs, squad machine guns and MANPADS. By 0800, both border crossings and bridges across the Narva River are seized, securing a thin but steady supply line from Russia. Reinforcements continue to stream into the city across the two bridges, and attackers strengthen their key defensive positions. Meanwhile, hundreds of small FPV drones appear in the skies above and begin hunting Estonian defenders. Anyone in a police or military uniform becomes a target.

Phase 4 – Information war

The chaos and fighting across Narva make for online content that quickly goes viral. With the hashtag #FreeNarva, videos of the chaos are shared across social media platforms, and pro-Kremlin trolls immediately label the situation as an uprising of the local population. A network of pro-Kremlin influencers in the West amplifies the content, then mainstream media in Europe and around the world pick it up. At 0900 local time, while the Estonian government and NATO are still trying to determine exactly what is happening in Narva and how to respond, the “separatist government” broadcasts its first official message from the seized City Government building.

Sitting behind a desk, with a black, green and white tricolor flag behind him, and flanked by armed men, the spokesperson announces the establishment of the Narva People’s Republic. In a short speech, delivered intentionally in Russian, he cites grievances against the Estonian government. He says the uprising is an act of self-preservation for Russian speakers in the region. Social media networks and news outlets quickly pick up the speech, adding to the moment's confusion. Kremlin trolls and their proxies call for support for the “world’s newest nation,” while cautioning against being pulled into World War Three by “Estonian fascists.” Memes quickly circulate featuring the mushroom cloud. Meanwhile, Russia expresses understanding of the separatist grievances but categorically denies having taken any part in the events. Putin appears on Russian television from a nuclear launch center and warns that an attack against Russian territory will result in a response using all available means.

Where does the scenario go from here? At minimum, Estonia would seek Article 5 consultations, but beyond that, the crisis could unfold in many different ways. I am not trying to explore every possible path. This hypothetical illustrates one way Russia could attack NATO territory while preserving enough ambiguity to complicate the Alliance’s response.

V. What gaps were identified?

Let us now examine how much of the hypothetical scenario reflects real-world vulnerabilities, how much was speculative, and what potential gaps the exercise identified.

Speculative Risk: Russian operatives' ability to acquire small arms once on the ground. The most speculative element of this scenario is the ability of Russian intelligence officers to acquire weapons through illicit means. While criminal networks trafficking illegal weapons exist and may extend into the Baltics, there is no basis to assume Russian operatives could readily access such networks without increasing the risk of detection. In the hypothetical scenario, weapons acquisition would therefore represent a significant uncertainty and a potential point of failure.

Confirmed Risk: Estonia has a large ethnic Russian and Russian-speaking population, with some evidence of social tensions in Narva, but the situation is nuanced. Official Estonian statistics show that ethnic Russians comprise about 20 percent of the country’s population. In Narva, approximately 97 percent of residents speak Russian. The relationship with Russia in Narva, however, is nuanced. After Estonia regained independence in 1991, many ethnic Russians who had settled in Estonia during the Soviet period did not automatically acquire Estonian citizenship and instead had to obtain citizenship through naturalization. Consequently, in 2014, only about 46 percent of Narva’s residents held Estonian citizenship, while 36 percent held Russian citizenship. Some Estonian government policies have contributed to local resentment, and these kinds of social friction points attract the attention of Russian intelligence services. However, there is no evidence of broad support in Narva for joining Russia, and documented reports indicate otherwise.

Confirmed Risk: The “Narva People’s Republic” is thought to be a Russian information operation. The idea of a “Narva People’s Republic” is not purely hypothetical. The current online campaign appears to have emerged in 2025 and became active in February 2026, when social-media accounts began promoting the idea of Narva and Ida-Viru County separating from Estonia. In March 2026, Estonia’s Internal Security Service characterized the activity as an information operation intended to sow confusion and undermine social cohesion.

Confirmed Risk: Russian nationals continue to receive Schengen visas with a relatively low refusal rate. Russians continue to receive short-stay visas into the Schengen zone. Although applications from Russian nationals receive more scrutiny now than in previous years, in 2025 Russian nationals applied for 679,425 short-stay visas, and 630,641 were issued, including 175,862 multiple-entry visas. The refusal rate for Russian visa applicants was only 6.4 percent according to official European Commission statistics.

Confirmed Risk: Absence of coordinated internal immigration enforcement and interoperability challenges. In our scenario, the fragmented nature of internal immigration enforcement in the EU was the biggest identified risk, as it allowed Russian operatives to move from their initial countries of admission to other parts of the Schengen area. The Entry/Exit (EES) system, fully deployed in April 2026, is a significant step toward gaining an operational picture of who enters and exits the Schengen area. Still, it works best for securing the EU’s external borders and preventing re-entry by previous violators. Individuals who do not leave the EU on time are added to the EES “overstayers” list, which is available to the member state competent authorities. But the overstayer list is just that – a list. To move from list to action, an individual on the overstayer list would need to have a “return order” (the EU version of a deportation order) issued by the competent member state authority. The order would need to be entered in the Schengen Information System (SIS) promptly. At that point, member states would need to coordinate to share SIS alerts and apprehend the individual. That could be facilitated through the SIRENE (Supplementary Information Request at the National Entries) bureaus, 24/7 centers each member state operates to facilitate information exchange. All that is possible if the system works without flaws, but that is not the current operational reality. The European Commission acknowledged in its 2026 State of Schengen report that interoperability and coordination remain challenging. The report specifically points out that “further efforts are required across all Member States to address challenges related to the timely issuance of return decisions, the streamlining of procedures and the implementation of measures to prevent absconding and unauthorized secondary movements.”

Confirmed Risk: Absence of a single entity that monitors the EES overstayer list for emerging security threats. Building on the previous risk factor, I could not confirm in my research the existence of a single EU entity that systematically monitors the EES overstayer population for emerging national-security threats based on targeting criteria. While extensive mechanisms exist for sharing information once a person becomes the subject of a relevant alert, it remains less clear who is systematically examining the EES overstayer population for national-security significance before that threshold is reached. The EU has an entity with extensive experience coordinating Member State investigations and criminal intelligence: EUROPOL, the European Union Agency for Law Enforcement Cooperation. EUROPOL has access to EES data for law-enforcement purposes, but its current EES capabilities are primarily integrated into existing investigative and analytical functions. EUROPOL itself identifies the need for greater interoperability among the EU's large-scale information systems and states that, once the planned changes are implemented by 2027, it will be able to use EES and other systems to “support assessing the security risks associated with third country nationals arriving to Europe.” At present, therefore, I found no evidence of a centralized process dedicated to systematically screening the EES overstayer population for national-security indicators. In other words, the EU has built the haystack and mechanisms for sharing information about individual needles, but it is less clear who is systematically looking for the needles. And because the EES is still new, the size and characteristics of the haystack are not yet fully established.

VI. Recommendations

I deliberately fashioned this scenario to unfold as a Russian operation against NATO might: deliberately ambiguous, difficult to attribute, and accompanied by an aggressive information campaign designed to complicate the Alliance’s response. The incursion itself would not necessarily need to be militarily successful. If Russia could create a crisis that divided NATO, delayed a unified response, or exposed weaknesses in the Alliance’s ability to defend its territory, the crisis itself could constitute a strategic success. For that reason, the most effective defense is to prevent the scenario from occurring in the first place—by identifying the vulnerabilities that could make such an operation possible and closing those gaps before Russia can exploit them.

NATO and Estonia are doing many things well, including their strategy of “deterrence by denial,” and I will not spend time analyzing those efforts here. They should continue. My recommendations instead focus on less frequently recognized vulnerabilities outside the traditional military sphere that could still be exploited in a hybrid conflict.

Recommendation 1: Continue EU-wide coordination targeting organized criminal activity. A key element of the hypothetical scenario depended on Russian operatives gaining access to firearms through criminal networks. Organized crime can provide illicit infrastructure that terrorists, intelligence services, and other national-security threats may exploit. Continued EU-wide efforts to disrupt these networks therefore serve a purpose beyond traditional crime reduction: they deny hostile actors access to networks, resources, and capabilities that could facilitate operations inside Europe.

Recommendation 2: Eliminate tourist visas for Russian nationals and create a forward-deployed EU visa security program for high-threat regions. One of the larger gaps identified in this scenario is that Russian nationals still have legal avenues to obtain visas to enter the EU. My recommendation would be to stop issuing tourist visas to Russian nationals, with exceptions for limited humanitarian circumstances. The EU should also consider a uniform, EU-wide mechanism to systematically assess the security risks posed by visa applicants and incorporate those assessments into visa issuance decisions. While the EU has a sophisticated common visa-information system, including biometric screening and mechanisms for sharing information among Member States, responsibility for visa adjudication and national-security assessment remains distributed among national authorities. The United States provides one potential model. Through HSI’s Visa Security Program, trained special agents are assigned to diplomatic posts overseas to conduct law-enforcement interviews and identify terrorists and other national-security threats before they enter the United States. A comparable EU capability, whether centralized or deployed through participating Member States, could add an investigative and intelligence dimension to the existing European visa-screening architecture.

Recommendation 3: Establish a national-security immigration coordination center within an appropriate European agency. The EU should consider establishing a dedicated national-security immigration coordination capability within an existing agency such as EUROPOL. The center would proactively analyze the EES overstayer list and other relevant databases against current threats, identify concerning emerging patterns, centralize alerts concerning visa overstays and other significant immigration violations, and provide a mechanism for Member State coordination. Where an overstay or other immigration violation involves additional security indicators, the center could elevate the case for immediate coordination with the appropriate law-enforcement and intelligence authorities in the affected Member State. The objective would be to move beyond simply recording immigration violations toward proactively identifying those that may represent emerging national-security threats.

VII. Conclusion

The purpose of this exercise was not to predict that Russia will attack Narva, or that events would unfold exactly as described. It was to show how a deliberately ambiguous hybrid operation could exploit vulnerabilities outside the traditional military sphere. Russia would not necessarily need to defeat NATO on the battlefield. It could seek to create a crisis in which attribution is uncertain, information is contested, political leaders face competing pressures, and the Alliance must make consequential decisions under extreme uncertainty.

That is why prevention matters. Once armed men are occupying buildings in a NATO member state and information operations are shaping the narrative faster than governments can establish the facts, the opportunity to prevent the crisis has already passed. The objective should therefore be to identify the vulnerabilities that make such a scenario possible while there is still time to address them. NATO's military deterrence and Estonia's defenses remain essential, but closing the less visible gaps in Europe's immigration, intelligence, law-enforcement, and information-security architecture may be just as important in preventing the next hybrid crisis from becoming a reality.

At minimum, these measures would make it significantly harder for Russia, or any hostile actor, to establish the personnel, infrastructure, and freedom of movement needed to conduct such an operation inside Europe.

Disclaimer

The views expressed in this article are the author’s own and do not reflect the official position of the U.S. Department of Homeland Security, Homeland Security Investigations, or the U.S. government.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

In the preface to volume one, “The Gathering Storm,” of his six-volume memoir of World War II, British Prime Minister Winston Churchill recalls a conversation with U.S. President Franklin Roosevelt, in which Roosevelt asked what the war should be called. Churchill responded instantly, “the unnecessary war,” noting that it was the easiest war to stop. The world is now at war in Europe and the Middle East and at risk of escalation that could become a world war. This escalation is unnecessary and could be stopped by relearning some of the lessons that led to the Second World War.

French President Macron called a meeting of French political leaders on Friday to receive briefings on the changing and more aggressive nature of Russian hybrid attacks against European states, citing the attempted explosives-laden drone attack against Leipzig airport. Macron also announced an upcoming G7 meeting to address energy security and joint measures to address Russian airspace violations, surveillance of defense sites, maritime meddling, and sabotage and assassination operations. Macron’s concerns reflect assessments in 2026 by the intelligence services of the Baltic States as well as Sweden and Finland that Russia is planning a provocation against a NATO state in the near term. These assessments, as well as information gathered by U.S. intelligence, may have contributed to the decision by the U.S. to send CIA Director Ratcliffe to Moscow to warn President Putin against such a provocation.

Putin intends to bring the war to the U.S. The September 15 indictments of five operatives linked to a Russian intelligence network in the U.S. for conspiring to finance terrorism and orchestrate a murder-for-hire plot against a Russian dissident in the U.S. may have been a bit of a wake-up call in Washington that the type of hybrid “grey zone” operations Europe has experienced from Russian intelligence in recent years is heading to the U.S. This should come as no surprise. To Putin, the U.S. is the “main enemy,” and anything to weaken the ability or willingness of the main enemy to stay in the fight is certain to be a key part of Putin’s escalation strategy. Messaging to Moscow is important, and President Trump should no longer be under any illusions about the nature of his relationship with the Russian dictator. Putin is his enemy.

President Trump’s choice of negotiators to send to Moscow to try and reach a negotiated solution to the conflict could not have been more poorly chosen. The Kushner-Witkoff team should not have been used to deliver the message Ratcliffe delivered because they do not have the standing or credibility in Moscow’s eyes. Witkoff’s sad gushing about the history of the moment and his memories of Putin are sad and embarrassing. More importantly, though, they deliver exactly the wrong message to Putin. Putin doesn’t respect flattery from characters like Kushner and Witkoff. Putin’s choice of their principal interlocutor from the Russian side, Kirill Dmitriev—the CEO of the Russian Direct Investment Fund—shows that Putin has assessed accurately the real motivation of the Kushner-Witkoff team: business deals and money.

There is a reason for sending the CIA Director to deliver different messages. One might recall the visit of then-CIA Director Burns to Moscow in 2021 to warn Putin against again invading Ukraine. Burns clearly delivered a message based on intelligence information on Russian plans and intentions—which proved correct—and I suspect Ratcliffe delivered the same type of message based on similar intelligence. Using CIA Directors to deliver such messages is important because Putin mirror-images. He trusts information from his intelligence and security services far more than information from his Ministry of Foreign Affairs or other sources. If the information carried to Moscow comes from the CIA Director, it, by definition, has more credibility than information from any other source. This doesn’t mean Putin will heed the message, but it will reach his ear. But the key to the efficacy of messages delivered by CIA Directors is the credibility of consequences. Clearly, Putin correctly assessed that the consequences he would face from President Biden for invading Ukraine in February 2022 would be gradual and, in the end, inconsequential. He may believe the same will be the case with the Trump/Ratcliffe messaging.

If it hasn’t been clear for years, it should be absolutely clear now: Putin is all in on this war. There is no indication from Moscow of any change in Putin’s absolutist terms for ending the war. Putin cannot negotiate a peace short of capitulation by Kyiv. Ending the war short of Putin’s definition of victory risks a disgruntled army returning to Moscow, and history is not kind to Russia’s leaders in such a scenario. Perhaps as important, ending the war short of victory leaves Russia in a much worse strategic situation with Ukraine’s emergence as the preeminent military power in central Europe. Germany and the EU are rearming. NATO membership has increased with the addition of Sweden and Finland. Russia’s economy is in tatters as a result of sanctions and Ukrainian strikes against energy, military, and military support infrastructure deep in the territory of the Russian Federation. The war cannot be hidden from the Russian people any longer. The pressure of his handling of the war may possibly be starting to take a toll on Putin himself. His performance at the Navy Day celebration in St. Petersburg this July, where for the second consecutive year the parade of warships was cancelled and Putin’s appearance was indoors in front of a poster of a Russian submarine, was widely ridiculed. The city was essentially on lockdown for security reasons. Putin followed the widely ridiculed appearance in St. Petersburg with a highly staged visit to Russia’s Far East that was received locally with widespread cynicism but included a first visit to Iturup Island, triggering strong criticism from Japan but serving as a symbol of Putin’s determination to keep and increase the boundaries of the Russian Federation.

Putin’s determination and perhaps conviction that he is on a path to victory belies objective analysis of the war against Ukraine and Russia’s economic and strategic situation. Putin’s determination is likely reinforced by the approach the Trump Administration has taken, accommodating Moscow and putting pressure on the victim. This may be starting to change, and perhaps President Trump is starting to realize that Putin is his enemy, the enemy of the United States and the West, and a supporter of Iran—currently engaged in active military activity to kill Americans and wreck energy markets (among other markets) to undermine Western economies.

Trump signed the long-delayed sanctions legislation sponsored by the late Senator Lindsey Graham. This legislation allows for primary and secondary sanctions on Russia and other countries by allowing tariffs on the largest importers of Russian crude oil or gas and the top five countries that aid Russia’s energy sanctions evasion. There has been a suggestion that officials in the Trump Administration are trying to create more incentives for members of the Russian elite to seek peace. If true, this is an interesting change in the Administration’s approach, which has thus far been to ingratiate itself to Putin. Putin seems highly resistant to pressure from outside the Russian Federation, and there is no level of economic hardship or war casualties Putin is unwilling to inflict on the docile Russian population. His latitude to resist pressure from disenfranchised or recently relatively impoverished Russian elites may be less so.

There is a path to making the coming war unnecessary. The key to the problem is Putin. He is at the center of the spider’s web of the cabal acting against the free world. Iran, its surrogates, principally the Houthis at the moment, China, and North Korea are key pieces in Putin’s architecture of disruption. To destroy this architecture, you have to destroy its architect. Defeat Putin in Ukraine, and Iran’s position in the Middle East will surely erode, and a powerful message will have been sent to Chinese President Xi to keep his hands off Taiwan.

Unlike Churchill and Roosevelt at the onset of World War II, the free world has a valiant and effective military partner eroding Putin’s power: Ukraine. Therefore, the first step in deterring the coming unnecessary war is to provide Ukraine the military and financial support it needs to win. This starts with air defense to protect against Putin’s increasing use of modified drones and ballistic missiles to target Ukraine’s energy infrastructure and civilians in an attempt to erode Ukrainian willingness to resist—a problem which could become more acute as winter approaches.

Secondly, Ukraine should be encouraged to continue its effective targeting of Russian energy, economic, and military infrastructure, which is helping to erode support within Russia for Putin’s regime and his war of aggression. Ukraine should be encouraged and given the support it needs to continue its current offensive northeast of Lyman in the Donetsk Oblast. Ukraine should be encouraged to engage in operations to liberate Crimea, which is the jewel in the crown of Putin’s territorial “achievements.”

It would be well worth the effort of the U.S. and the West to put pressure on Russia’s periphery, starting with enhancing support for pro-Western elements in the Republic of Georgia—long an outlier of Western support in the Caucasus and itself a victim of Putin’s aggression in August 2008 and currently under pressure from pro-Russian elements supported by Russia’s intelligence services. The U.S. decision to deploy forces to Poland and NATO’s decision to deploy more forces to the Baltic States are another useful way to stretch Putin’s resources and pressure him.

The lessons of history are clear: appeasement of aggression brings more aggression. Strength and resolve are the key to avoiding unnecessary wars. It is time the Trump Administration learned history.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Russia, China, and Iran are all sharing the same playbook for corrupting Western elections. The United States is on track to be the next target this November.

A troveof Russian documents leaked in May outlines Moscow’s plans to use AI to warp foreign decision-making and sway elections. The Kremlin’s “Projects 2026” strategy reveals Russia’s plot to influence upcoming elections in Europe and Israel. Their tactics are similar to those used by China and Iran for years, and what emerges isn’t a Russian innovation — it’s a shared authoritarian playbook.

Projects 2026 calls for the creation of an opinion leader database to monitor the social media profiles of 10,000 influential individuals across Europe, including the 100 most prominent opposition figures in France alone. This is precisely the model Chinese state-aligned company GoLaxy piloted against the United States in 2025. The firm reportedly built constantly evolving psychological profiles of 117 members of Congress and roughly 2,000 additional American opinion leaders.

Researchers at Vanderbilt University warned that GoLaxy appeared prepared to target these individuals with messaging aligned with Beijing’s priorities. By monitoring the social media profiles of Western leaders, China and Russia are able to map the target’s values, beliefs, emotional tendencies, and vulnerabilities, making their influence operations more tailored and impactful.

In addition to using AI to build psychological profiles, the authoritarian playbook calls for countries like Russia and Iran to flood their targets with tailored generative AI content. Projects 2026’s “AI News” initiative calls for producing more than 500 short videos to target French audiences across six social media platforms. This tactic mirrors Iranian information operations during the 2025 and 2026 wars with Israel and the United States, when pro-Iranian networks pushed AI-generated and AI-assisted videos tailored to different audiences across X and TikTok, which racked up millions of views. These countries are running highly productive propaganda engines.

The most durable piece of Projects 2026 isn’t the content at all — it’s the plan to create fictitious think tanks and research institutes that can hand Russian narratives a “legitimate information source,” making them more likely to be cited by real news outlets and large language models. The leak shows this already underway: A site called the “World Center for Strategic Studies,” registered in March 2026, published unsigned analysis aimed at Western think tank audiences, with versions planned in German, French, and Spanish. The fake think tank doesn’t need to fool a discerning reader. It needs to get quoted, indexed permanently, and cited by the next AI model that goes looking for sources on the topic.

Iran ran a cruder version of this same play: Iranian state-sponsored cyber espionage groups have repeatedly impersonated real institutions — such as the Royal United Services Institute, the Aspen Institute, and the Washington Institute — to steal credentials and plant material under a trusted name. Projects 2026 proposes something more sustainable: Don’t just hijack existing credibility but manufacture new institutions and let them accrue it over time.

Projects 2026 also proposes building a real Israel-based research institute staffed by Israeli citizens with genuine academic credentials. This approach is reminiscent of the 2014 “Iran Expert Initiative,” where Iranian Foreign Ministry officials attempted to court and influence Western think tank researchers to promote their perspectives and give them legitimacy. Emails leaked in 2023 showed that Iranian diplomats had worked with Western experts across 10 think tanks to aggressively tout the merits of the 2015 nuclear deal between Tehran and major world powers, formally known as the Joint Comprehensive Plan of Action.

In the age of AI, influencing think tanks is narrative laundering at its most dangerous. Once a fabricated or state-aligned source gets cited by a legitimate outlet or indexed by a search engine, it can become part of the training and retrieval corpus that AI systems draw upon.

While the plays are reusable, the targets are new, and for Russia, the target is European elections.

The leaked documents outline a plan to swing Armenia’s parliamentary vote through a Russian-diaspora outlet and a “Mitteleuropa” initiative aimed at reshaping alignments in Hungary and Slovakia. This is where the surveillance, flooding, and laundering modules converge. To counter it, policy solutions must be swift and targeted.

First, allied governments should require disclosure of foreign funding and foreign state links for any media outlet, think tank, or “research institute” operating ahead of an election in an at-risk state — closing exactly the gap that lets a “World Center for Strategic Studies” pass as domestic and independent. Research by the Foundation for Defense of Democracies (FDD) into Qatari money in American higher education shows what a real transparency regimen requires: disclosures reaching individual researchers, not just institutions; low reporting thresholds with real penalties; registration in the style of the Foreign Agents Registration Act for state-directed “institutes” masquerading as independent organizations; and provisions against the kind of obstruction Qatar used to block Texas A&M’s funding records in court. Russia is proposing to build the same laundering vehicle in Europe that Gulf money has already normalized in American academia. The fix already exists — it just needs to be strengthened.

Second, platforms should both demonetize and remove unlabeled AI-generated political content during designated pre-election windows in at-risk states. X’s own emergency policy during the Iran war, which suspended digital influencers’ ability to monetize their content for 90 days on undisclosed AI-generated war footage, shows platforms already have the infrastructure to act fast when the stakes are high enough. But demonetization alone left the content up and circulating; independent researchers found AI-generated war footage kept flooding feeds regardless of the policy. Elections warrant a harder line: If posts feature undisclosed AI-generated content during an active election period, they shouldn’t just lose ad revenue. They should come down.

Third, Washington should prepare for future attempts at election influence by boosting the protection mechanisms it already has in place. Currently, 31 states have passed election deepfake laws, but they are under legal scrutiny because they touch on domestic speech. Federal action targeting foreign actors rests on firm ground. The 2002 McCain-Feingold Act prevents electioneering communications by foreign actors, but this only applies to broadcast, cable, and satellite communications. It must be updated to explicitly include paid internet and digital advertisements. It should also close the gap on AI-generated political content and require labeling so that foreign deepfakes can’t hide behind current ambiguities.

Projects 2026 is not evidence that Russia has cracked something new. It’s evidence that Moscow, Beijing, and Tehran are now running the same AI playbook against the same democracies, taking turns testing which module works best. The future outlined in Projects 2026 may not be here yet, but objects in the mirror are closer than they appear.

Leah Siskind is director of impact and an AI research fellow for the Center on Cyber and Technology Innovation (CCTI) at the Foundation for Defense of Democracies (FDD). For more analysis from Leah and FDD, please subscribe HERE. Follow FDD on X @FDD and @FDD_CCTI. FDD is a Washington, DC-based, nonpartisan research institute focusing on national security and foreign policy.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

As Washington works on the historically large defense budget, there is one theme which should loom large in the budget but comparatively, will cost little. Key to our national security is countering the gray zone activity that our adversaries are waging against the US and developing our own offensive gray zone strategies. Just as we would not ignore a kinetic strike against the US, we cannot ignore the targeted gray zone attacks by adversaries but we must be careful that our approach is thoughtful, and expertly executed in order to guard against escalation. Developing such offensive and defensive strategies will require gray zone expertise, proficient knowledge of the targeted adversary, a government wide strategy, and patience. As global leaders, we also must be open and clear that we will take on these gray zone activities, but we do not have to and should not discuss the details of our actions. We need to publicly put our adversaries on notice that we will not tolerate their actions against the US and we will counter them with our own, more debilitating gray zone activities.

The National Intelligence Council describes gray zone activities as “coercion and subversion . . . below what constitutes armed conflict but outside the bounds of historically legitimate statecraft.” The IC defines the gray zone as a realm of international relations between peaceful interstate diplomacy, economic activity, and people-to-people contact on one end of the spectrum, and direct armed conflict on the other. State-led activities that happen in that space that weaken governments’ resolve to confront the US or its allies, endeavor to change a nation’s policies, or strengthen a country's global leadership would be considered gray zone activities. Deniability is critical to the success of this strategy because attribution risks escalation.

David Pitts, another Cipher Brief Expert, has written about the current phase of warfare which he calls endless wars and the need to counter them. These endless wars are the gray zone activities that our adversaries pursue against us. The White House has made an important step in that direction by appointing the first US National Security Council Director for Cognitive Advantage. There is still a way to go, however, because cognitive advantage is just one part of gray zone activity.

The US must develop expertise for whole of government strategies that bring together all of the tools for gray zone activities. Some of those activities are:

• Cyber, and information operations efforts focused on undermining public/allied/local/ regional resistance, and information/propaganda in support of US goals;
• Covert and clandestine operations such as espionage, infiltration, and subversion;
• Enlistment of non-governmental actors and assistance to irregular military and paramilitary forces;
• Economic pressures that go beyond normal economic competition;
• Calculated ambiguity to include deception and denial operations.

Autocracies tend to have an advantage in executing gray zone operations. It is generally believed that non-democratic states can operate more effectively in the gray zone than open democratic societies as non-democratic nations are not limited by domestic law and regulation. The nature of their centralized systems allows them to marshal whole-of-state (and whole-of-society) resources to execute operations. The United States lags behind its autocratic adversaries in the information domain, for example, because our adversaries have ingrained gray zone tactics into their doctrines.

In democratic societies, the use of gray zone tactics can be controversial because the nature of these activities is meant to covertly shape actions. It can be challenging for democratic states to respond to gray zone threats because our legal and military systems are geared towards seeing conflicts through the perspective of war and peace with little consideration for anything in between. Democracies have failed to build consensus around gray zone concepts. The US government has been arguing over the definition and leadership of gray zone and information operations for years.

Gray zone activities are not a new concept and historically have been accepted as a long standing form of statecraft. What are now being called gray zone methods have been well documented actions throughout history. These activities have been called by such titles as “political warfare,” “covert operations,” “irregular or guerrilla warfare,” and “active measures.” It is worth examining the historic record and recalling the benefits and rationale for gray zone activities that kept nations out of kinetic fights, allowed for de-escalatory engagement, arguably shortened warfare, and saved lives.

Examples:

• The Trojan Horse operation exploited many of the instruments of a gray zone campaign– creating confusion and division among the enemy, extending ostensible inducements, implanting hidden military forces, deception, and clandestine infiltration of enemy territory.

• During the Peloponnesian War between Athens and Sparta, the Spartans recognized that they needed to prevent an uprising by the Helots, who were key to Sparta’s agricultural and military systems. Athenians were trying to create the conditions for a Helot uprising, which would then add an irregular dimension to the conventional conflict with Sparta. The Athenians used proxy forces who were experts on the language and culture of the Helots to sow distrust among the Helots against the Spartans. The Helots began to desert Spartan forces, thereby creating a national emergency in Sparta. The Athenian historian Thucydides reported that as a result of Sparta losing Helot support, it reached out to Athens to discuss ending the wars.

• The Han Empire used economic and cultural engagement—such as trade agreements, marriage alliances, and cultural exchanges—to manage tensions with nomadic powers. These actions helped secure borders and reduce the need for large-scale wars
• During the Cold War, superpowers like the U.S. and USSR engaged in gray zone tactics such as espionage, sabotage, and proxy support to influence outcomes in regions like Latin America, Korea and Vietnam. These active measures as they were called, kept the competition a contested space, avoiding immediate escalation with the US.

Gray zone campaigns are likely to increase and diversify because of more enabling technologies, the erosion or absence of accompanying norms, and challenges with attribution. There is a growing awareness among some in the US national security community that if we do not develop gray zone strategies against our adversaries, then we will find ourselves no longer the global power that we have been. Without these strategies, we also limit potential responses to our adversaries to kinetic ones.

As a national security community, we have trained only a narrow group of special operators and intelligence professionals to be able to think creatively enough to devise irregular warfare plans and strategies. To produce gray zone strategies the US will need to train a work force in creativity and out of the box thinking. It also will require organization and orchestration from all assets of the US government and the development of and use of technology to bring some of the ideas to fruition. A fully conceived gray zone strategy needs to marshal all aspects of the US government: military, intelligence, economic, trade, diplomacy, and public relations.

The US is not organized as a nation to devise these strategies. Our State Department is focused on developing relationships. Our National Security Council is hollowed out. Due to issues with legal authorities, neither the Department of War nor the intelligence community can take the lead in implementing whole of government strategies. We are at a standstill and have been for several years.

What to do?

We need to be upfront that leading in gray zone operations is good for US national security. If we do not quickly make gray zone strategies a key part of our national security then we risk our global leadership role. We must put in place the tools and organization to execute these strategies. Using part of the large defense budget to show US resolve on this matter would go a long way. Putting a seasoned professional at the NSC and making him/her in charge of integrating the USG gray zone activities against specific adversaries is key to winning in this realm. A lack of coherent command-and-control, as well as jurisdictional and philosophical boundaries between government agencies, inhibits the synchronized activities needed for successful and truly whole-of-government gray zone activities and responses. We also should use the trained Department of War and intelligence community planners, working with the rest of government, to develop government-wide plans that are implemented at the White House. While we move out in this way, we should also be training our national security professionals across the government in how to develop gray zone strategies. Now is the time to make this a national imperative.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief