ICDS Hybrid Series: Hired Hands of Hybrid War

On 26 November, the ICDS, in cooperation with GLOBSEC, hosted a public seminar on Hired Hands of Hybrid War: How Crime and Coercion Serve the Kremlin.

A panel discussion was held between Wojciech Solak, Director of GLOBSEC’s Centre for Democracy and Resilience, Julian Lanchès, Research Fellow for the Current and Emerging Threats Programme at the International Centre for Counter-Terrorism (ICCT), Dr Sanshiro Hosaka, Research Fellow at the ICDS, and Harrys Puusepp, Head of Bureau at the Estonian Internal Security Service, moderated by Marek Kohv, Head of Security and Resilience Programme at the ICDS.

Russia’s hybrid war against Europe is no longer conducted solely through state channels or official cover. Increasingly, Moscow relies on a diverse ecosystem of proxies — from individuals motivated primarily by money to organised crime groups with transnational reach — to carry out sabotage, information operations, and disruption on European soil. These actors blur the line between criminality and geopolitics, providing the Kremlin with deniability while multiplying the vectors of attack against democratic societies.

Now, Russian hybrid activities in Europe are being studied in the same way we used to study jihadi and far-right terrorism. Yet, the ‘war’ component in the ‘hybrid war’ has become more pronounced, especially with an increased focus on kinetic operations.

The number of attacks, suspected and attributed, has grown significantly throughout Europe in recent decades. The Russian strategy, meanwhile, has not changed since the Soviet times of the KGB, although its tactics have been adapting.

One has to always remember that we, as the general public, only know about the activities that have come to the surface, get reported by the government or the media, and meet the criteria sufficient to be attributed to a specific malign actor — Russia, in this case. We have to assume, however, that the real scale is much larger. Russia is not reactive but rather opportunistic and aggressive in the long run, so our job is to make our countries a difficult operational environment.

The financial aspect is critical to hybrid warfare, as any operation begins with funding. Thus, cutting the channels used by the perpetrators to fund hybrid activities, as well as by the state actors to generate the financial resources — via illicit trade — for this purpose, is key to countering hybrid warfare. We have to rethink financial crimes not merely as an economic phenomenon but as a security issue. Regulations such as establishing a legal connection between financial crimes and state-sponsored terrorism will enable the use of more tools and measures. Success will also depend on increased cooperation and intelligence sharing between security, customs, and border services and with the private sector.

Telegram — which is not yet recognised as a ‘large platform’ and thus subject to fewer regulations despite accounting for the vast majority of recruitment online, as well as being the entry point for the Russian narratives and disinformation — should come under more scrutiny. Effective and transparent communication, community engagement, and outreach, including awareness campaigns that explain the severe consequences of seemingly ‘petty crime’ actions, will discourage potential hires and help prevent hybrid attacks on our soil.

The GLOBSEC report Russia’s Crime-Terror Nexus: Criminality as a Tool of Hybrid Warfare in Europe is available here.

More photos.