It really is a war of subversion

MACIEJ MAKULSKI: You’ve spent a lot of time studying, researching, and writing about hybrid threats or grey-zone activities. I was wondering whether we could start by looking at this problem from the perspective of a process, an evolution in which Russia has gradually increased pressure on Europe and made it more and more expensive and difficult for us to adjust. Do you recall any particular moment or event when you realised or thought: okay, this is surprising, this is something qualitatively new, and we now really need to think about how to adjust to this threat?

ELISABETH BRAW: I think a moment that really stood out for me was the uncovering of the plot involving parcel bombs that were delivered to a DHL facility in Leipzig [in 2024]. It led to Russia and involved gig, or hired, agents. I know Poland was targeted as well. It was such a devious scheme, and one that could have caused significant loss of life if those parcel bombs had been successful, if they had exploded as intended. This was completely different from what we saw five or ten years ago from Russia in the grey-zone domain.

I know many people say “hybrid threats” or “hybrid attacks”. I prefer “grey zone” or “sub-threshold”, because “hybrid” involves kinetic and non-kinetic means. When we talk about these threats, they are non-kinetic. They are below the threshold of armed military violence, but they are serious. What this DHL plot demonstrated was that you can cause significant harm in the grey zone by using ordinary people and tools that are easily found in the criminal world. That was new because, ten or fifteen years ago, when we thought about, studied or discussed Russian grey-zone aggression or sub-threshold aggression, it really was cyber, disinformation, election interference…

The information war?

Exactly. And that’s serious enough, but it didn’t involve people being blown up. It didn’t involve companies losing significant amounts of money in sabotage. Today, what we’re seeing is that, yes, Russia still does those things – disinformation, election interference, cyber – but it has also expanded into other areas, where it blows things up, sets things on fire. We have seen an arson attack against the shopping mall in Poland. There have been sabotages on railways. This is completely different and shows how comfortable Russia is in the grey zone. If you’re Russia, you don’t even care today whether the targeted country eventually has evidence showing that you were behind it. So we have two significant developments here: first, Russia’s expansion into really violent acts that could cause loss of life and have already caused significant financial losses for the companies targeted; and, second, the fact that Russia does not care if we find out that it was behind these activities.

You made the distinction between hybrid and grey-zone activities. I think it helps as we’ve seen that, at the political level, we are now struggling with definitions, notions and concepts and on how to properly name the threat. With all the events you mentioned, we can also add to the list the recent news about attempts to cut undersea cables using technology that is very difficult for us to track. The key question, then, is about this transition, this moment when we stop talking about grey-zone activities or hybrid threats. What would be the next stage, and where is this border as you see it right now?

Well, first of all, it is really important that you mentioned the sub-sea cables and pipelines, since this is exactly what I have been working on very intensely for the past couple of years in The Undersea War, my book which comes this month. It follows the incidents and investigations into suspicious cable activity we’ve seen in the Baltic Sea region and elsewhere in recent years. It is extraordinary that, all of a sudden, just as Russia was becoming more active in the sub-threshold, hybrid, or grey-zone domain, we started seeing these incidents of suspicious cable cuts in the Baltic Sea and elsewhere, involving merchant vessels that sail across the Baltic Sea. All of a sudden they started dragging their anchors in a very dangerous manner which caused cables to be damaged or cut. We hadn’t seen that before. Suddenly, we had several major incidents in a row, and that’s what the book is about. So thank you for mentioning that.

And when is the border crossed and it is no longer a grey-zone activity?

If you want a term other than grey zone, hybrid or sub-threshold, we could also say subversion. Russia wants – and potentially other countries do too, China is active as well, as are Belarus, Iran and North Korea – but here, in this part of the world, we are mostly concerned about Russia, because it is the country that is most active in the grey zone against us. It really is a war of subversion. Russia wants to harm our countries without having to use military force, because if it were to use military force, obviously NATO would respond. If it doesn’t use military force, NATO isn't in charge of responding, and it is also totally unclear who should respond and how. That is our dilemma. when I wrote a book about grey-zone aggression, I called it The Defender’s Dilemma. Russia wants to cause financial losses to our companies and make it very difficult for them to keep operating. If you keep sustaining losses, how are you supposed continue operating as a company? Russia also wants to undermine citizens’ trust in our authorities. We have to remember that in a liberal democracy, the social contract is that we place trust in our authorities. We voluntarily trust our authorities to act on our behalf. But what if we lose trust in our authorities? That is what Russia aims to achieve through its disinformation and sabotage campaigns. If we, as citizens, continue to experience sabotage against critical installations and operations in our countries, then we’ll say: well, hang on, why can’t our authorities stop this? Their job is to keep us safe; they are not keeping us safe. So this, too, is part of the war of subversion against our countries. The same applies, of course, to disinformation, election interference and all of the other forms of sabotage, as each such act causes disruption, losses and inconvenience. It prevents us from doing what we need to do because something has been disrupted, and yet it’s not an act of war.

The question really is then, how can we deal with all of this? What should our response be? Let’s focus on the role of the expert community, for example. What can we do? What should our task be?

I think open-source intelligence can be one area where civil-society can assist the authorities. It’s not that we need to interfere with what the authorities are doing. They have their job. The civil society has its function as well. But there is an opportunity here to help investigate the people involved in these activities. Who are they? What companies keep doing business with Russia and why is that to the detriment of our countries? We shouldn’t hang our fellow citizens out to dry, but people within our countries who act against our countries’ own interests are worth investigating. We can also help with what I call radical transparency. Citizens in our countries need to understand, and be told as much as possible about, the war of subversion being waged against our countries. This is an area where NGOs and news media can contribute by finding information, establishing facts and sharing those facts with the wider public, so that people know exactly what is going on, or at least as much as possible. The more they understand how widespread and intense it is, the more they will realise that they have a part to play in trying to keep it away from our countries and limit the harm.

This interview took place during the 2026 Riga Conference, held September 10-11, 2026.

Elisabeth Braw is a senior fellow at the Atlantic Council, focusing on geopolitics and the globalized economy as well as grey-zone and hybrid threats. her latest book The Undersea War is set to release in October 2026.

Maciej Makulski is the project lead at the In Between Analytical Group and a contributing editor with New Eastern Europe.