Hybrid Warfare Explained

Introduction

Hybrid warfare is a strategic approach to conflict that combines military and nonmilitary methods to weaken an adversary and achieve political or military objectives. It may involve conventional armed forces, irregular fighters, cyber operations, disinformation, economic coercion, and covert political interference. These activities can occur during an armed conflict or form part of a hostile campaign intended to avoid open military confrontation. Their strategic significance often lies in how different methods are combined and directed against an adversary's vulnerabilities.

The term has no universally accepted definition. Military theorists have used it primarily to describe the integration of conventional and irregular methods of combat, while broader interpretations encompass political, economic, technological, and informational activities. NATO and the European Union employ related concepts to address hostile campaigns that extend beyond the traditional military domain. These interpretations overlap, but they do not describe identical categories of conduct.

The distinction is illustrated by two frequently cited conflicts. Hezbollah's operations against Israel in 2006 demonstrated how a non-state armed organization could combine guerrilla tactics with weapons and defensive capabilities associated with conventional forces. Russia's seizure of Crimea in 2014 involved regular military personnel, concealment, information operations, and political intervention. Both have influenced discussions of hybrid warfare, although the actors, methods, and circumstances differed substantially.

The concept also raises questions extending beyond military strategy. Covert operations may complicate the identification of responsible actors, while cyberattacks and political interference can produce serious consequences without necessarily constituting armed attacks under international law. Understanding hybrid warfare requires examining its defining characteristics, operational methods, historical development, practical examples, relationship with gray-zone competition, and implications for international security and law.

1. What Is Hybrid Warfare?

Hybrid warfare describes the combination of different methods of confrontation within a strategy directed against an adversary. Depending on the definition employed, these methods may include conventional combat, irregular operations, political pressure, cyber activity, information manipulation, and economic coercion. Their employment is shaped by the actor's objectives, available resources, and assessment of the target's vulnerabilities.

The expression remains contested because military scholarship and security institutions emphasize different features. Some definitions require the integration of conventional and irregular military capabilities within an armed conflict. Others extend the concept to coordinated campaigns involving military and nonmilitary activities, including operations conducted below the threshold of armed conflict. The difference affects how analysts identify threats, classify campaigns, and assess appropriate responses.

The 2017 Multinational Capability Development Campaign report, Understanding Hybrid Warfare, emphasizes the synchronized employment of multiple instruments of power against vulnerabilities across different societal functions. Its framework treats the relationship between activities as particularly significant. Although influential in military and security analysis, it is an analytical framework rather than a universally accepted definition or binding doctrine (Cullen and Reichborn-Kjennerud, 2017).

1.1 The Military Meaning: Conventional and Irregular Combat

The narrower military conception emerged partly from the difficulty of distinguishing conventional warfare from irregular conflict. Conventional warfare generally involves organized military forces employing established formations, command structures, and weapons systems. Irregular warfare encompasses methods such as guerrilla operations, insurgency, and unconventional attacks that do not necessarily follow the operational patterns of regular armies.

Frank Hoffman helped establish the modern concept through his study Conflict in the 21st Century: The Rise of Hybrid Wars. His analysis emphasized opponents capable of employing conventional capabilities alongside irregular tactics, terrorism, and criminal activity within a common conflict environment. Such combinations could challenge military organizations structured primarily to confront either conventional armies or irregular opponents (Hoffman, 2007).

The distinction goes beyond the presence of different kinds of fighters in the same war. Regular armies have historically cooperated with militias, insurgents, and locally recruited forces. The narrower hybrid concept becomes more useful when conventional and irregular methods are integrated in ways that create complementary operational effects. An armed organization might employ sophisticated anti-armor weapons against conventional formations while relying on dispersed units and guerrilla tactics to avoid unfavorable engagements.

These combinations can impose difficult choices on a technologically superior opponent. Advantages in aircraft, artillery, armored vehicles, or personnel do not necessarily translate into decisive results against an adversary operating from prepared positions or employing unconventional methods. The ability to shift between different forms of combat can reduce the effectiveness of military approaches designed for a more clearly identifiable type of enemy.

1.2 The Wider Meaning: Hybrid Threats and Coercion

The broader conception extends beyond armed operations. It encompasses attempts to influence political decisions, manipulate information, disrupt essential infrastructure, exploit economic dependence, or undermine public confidence in institutions. Military force may support these activities, but some campaigns rely predominantly on methods that do not involve direct violence.

Hybrid threats are closely related to this interpretation. The term commonly describes hostile activities that may affect national security without necessarily constituting warfare in the military or legal sense. A combination of cyber intrusions, covert interference, and economic pressure can create serious security concerns even when the conditions necessary for an armed conflict are absent.

The Hybrid Threats and Hybrid Warfare Reference Curriculum, published in June 2024 under the auspices of the Partnership for Peace Consortium with NATO support, recognizes the continuing diversity of definitions and approaches. It examines the relationship between military and civilian vulnerabilities, information activities, and national resilience. As a multinational educational resource, it should be distinguished from formal NATO policy declarations or legally binding instruments.

States and non-state actors may employ methods described as hybrid, although their capabilities and institutional structures differ. States can draw upon military forces, intelligence organizations, diplomatic relationships, and economic resources. Armed organizations may rely on irregular fighters, clandestine networks, external assistance, and information activities. Identifying a hybrid campaign requires more than establishing that an actor has employed several different methods; the relationship between those methods and the actor's objectives must also be considered.

2. How Hybrid Campaigns Work

Hybrid campaigns seek to impose costs or obtain strategic advantages by exploiting weaknesses across an adversary's military, political, economic, and societal systems. Their effects may arise through the interaction of activities that would otherwise be treated separately. Military pressure can influence political calculations, while cyber disruption and information manipulation may complicate an adversary's ability to respond.

Coordination is particularly important in broader analytical models of hybrid warfare. A cyber operation against communications infrastructure may accompany preparations for military action. Information manipulation can conceal intentions or influence perceptions of a conflict. Economic pressure may constrain governmental choices while other operations increase uncertainty. These activities need not occur simultaneously, but their relationship to a common objective helps distinguish an integrated campaign from unrelated hostile incidents.

Concealment and ambiguity may provide additional advantages. An actor can employ intermediaries, disguise its involvement, or deliberately avoid actions likely to provoke a major military response. Such techniques are neither exclusive to hybrid warfare nor present in every case. Overt military operations can form part of hybrid conflict, and some hostile campaigns are attributable to identifiable state institutions from the outset.

2.1 Conventional Forces, Irregular Tactics, and Proxies

Conventional military forces provide capabilities for territorial control, deterrence, large-scale combat, and the threat of escalation. Irregular formations may perform different functions, including reconnaissance, ambushes, sabotage, harassment, and operations in areas where the deployment of regular forces would be politically or operationally difficult. Their relationship depends on the organization and objectives of the campaign.

Special operations forces can also contribute through intelligence gathering, preparation of military objectives, and support for local armed groups. Their involvement does not automatically make an operation hybrid. The relevant question is whether their activities are connected to other methods in a broader strategy.

Proxy forces introduce an additional dimension. A state may supply weapons, financing, intelligence, training, or logistical assistance to an armed organization pursuing overlapping objectives. Proxy warfare can reduce the visible commitment of regular forces and complicate an adversary's response. Yet external sponsorship does not establish that every operation undertaken by the supported organization is directed by the sponsor.

This distinction is particularly relevant when responsibility for violence is disputed. Armed groups may possess independent political objectives and command structures even when they receive substantial foreign assistance. A strategic assessment must distinguish material support, operational coordination, and direct control. These differences also become significant when international law requires particular conduct to be attributed to a state.

2.2 Cyber Operations and Disinformation

Cyber operations may target systems on which governments, armed forces, businesses, and civilian populations depend. Intrusions can be designed to collect intelligence, compromise communications, alter information, or disrupt essential services. When connected to other forms of pressure, such activities may increase uncertainty or interfere with the targeted actor's decision-making.

Cyber espionage generally involves covertly obtaining information, while disruptive or destructive operations seek to interfere with the availability or functioning of systems. These activities differ in purpose, consequences, and legal classification. The distinction is examined more extensively in the analysis of cyber espionage under international law. Unauthorized access to a network does not necessarily constitute a cyberattack involving destructive effects.

Information operations seek to influence how audiences understand events, institutions, and political choices. Disinformation involves deliberately false or misleading information intended to deceive. Propaganda is a broader form of persuasive communication and does not necessarily consist of false statements. Psychological operations may attempt to influence an adversary's morale, perceptions, or behavior.

Digital communications have expanded the reach of these activities. Information can circulate rapidly across borders, and hostile actors may exploit existing political divisions or institutional distrust. During armed conflict, information operations can accompany battlefield deception or attempts to shape perceptions of military success. The presence of false information, however, does not independently establish foreign coordination or demonstrate that a wider hybrid campaign exists.

2.3 Economic Pressure, Sabotage, and Political Interference

Economic dependence can create opportunities for coercion. States reliant on external energy supplies, transportation networks, financial services, or strategic imports may face pressure when those relationships are deliberately disrupted or manipulated. Such measures can influence political decisions without requiring direct military confrontation.

Energy supplies illustrate the potential relationship between economic vulnerabilities and strategic objectives. Restrictions, threats of interruption, or manipulation of commercial dependencies may place significant pressure on a recipient state. Their legal classification depends on the applicable obligations and circumstances. Economic pressure does not automatically violate international law, and ordinary commercial disputes should not be characterized as warfare without evidence supporting that interpretation.

Sabotage presents a different form of risk. Electricity networks, pipelines, railways, telecommunications systems, and transportation facilities can be vulnerable to destructive interference. Damage to a strategically important facility may disrupt services far beyond the immediate location. Where such conduct forms part of a broader campaign, its effects can extend into public administration, economic activity, and national security.

Covert political interference may pursue similar objectives through nonmilitary means. Attempts to compromise officials, manipulate political organizations, or interfere with electoral processes can be intended to weaken institutions or influence governmental choices. Political criticism, diplomatic advocacy, and legitimate public participation remain distinct activities. The classification of interference depends on the conduct itself and the evidence connecting it to a hostile strategy.

3. Hybrid Warfare Examples

The 2006 Lebanon War and Russia's operations in Ukraine since 2014 are among the most influential examples in contemporary discussions of hybrid warfare. They illustrate different problems confronted by military planners and national security institutions. Hezbollah demonstrated how a non-state armed organization could combine irregular methods with comparatively sophisticated military capabilities. Russia's campaign in Crimea highlighted the interaction between armed force, political intervention, concealment, and information operations.

These conflicts should not be treated as identical operational models. Hezbollah's activities occurred during an established armed conflict against Israel. Russia's seizure of Crimea involved military operations within another state's internationally recognized territory, accompanied by political measures intended to consolidate Russian control. The actors, objectives, methods, and legal circumstances differed.

Their analytical significance also reflects the changing meaning of hybrid warfare. The Lebanon War influenced debates about the capabilities and organization of armed groups. Crimea encouraged wider attention to national vulnerabilities, political institutions, information manipulation, and the difficulty of responding to hostile operations whose military and political dimensions were deliberately intertwined.

3.1 Hezbollah and the 2006 Lebanon War

The conflict between Israel and Hezbollah in July and August 2006 became an important case in the development of hybrid warfare theory. Hezbollah possessed military capabilities exceeding those normally associated with lightly equipped guerrilla forces. Its fighters employed prepared defensive positions, anti-tank guided missiles, rockets, and other weapons alongside irregular tactics.

Hezbollah's defensive arrangements in southern Lebanon complicated Israeli ground operations. Dispersed units could operate from fortified positions and employ anti-armor weapons against Israeli vehicles. Rocket attacks also extended the fighting beyond immediate ground engagements, threatening civilian areas in northern Israel. Hezbollah's anti-ship missile strike against the Israeli vessel INS Hanit illustrated its ability to employ capabilities normally associated with more conventional military forces.

The combination attracted attention because it challenged conventional distinctions between regular and irregular warfare. Hezbollah did not need to organize itself as a conventional army to employ advanced weapons and disciplined defensive methods. Its operational approach demonstrated that a non-state armed organization could combine techniques associated with different military categories.

Frank Hoffman identified the conflict as an important example of the challenges posed by hybrid opponents. Subsequent military research examined Hezbollah's conduct in greater detail. Stephen Biddle and Jeffrey Friedman, in The 2006 Lebanon Campaign and the Future of Warfare: Implications for Army and Defense Policy (2008), analyzed evidence from Israeli participants and challenged overly simple distinctions between conventional and irregular methods.

Their study also illustrates why the conflict cannot be reduced to a straightforward demonstration of hybrid warfare's effectiveness. Hezbollah employed elements of conventional military practice alongside irregular methods, while Israeli forces faced operational, intelligence, and planning difficulties. The outcome cannot be explained solely by the type of warfare employed.

Military performance and strategic success require separate assessment. Hezbollah demonstrated an ability to resist a conventionally superior opponent and sustain attacks during the conflict, but suffered substantial damage and losses. Israel also encountered difficulties translating its military operations into its desired political results. The case establishes the operational significance of mixed methods without demonstrating that hybrid strategies necessarily produce victory.

3.2 Russia's Operations in Ukraine Since 2014

Russia's seizure of Crimea in February and March 2014 became a defining reference point for the broader conception of hybrid warfare. Russian military personnel operated in the peninsula while many initially lacked visible national insignia. Strategic facilities came under Russian control as political measures were undertaken to facilitate Crimea's incorporation into the Russian Federation.

The absence of identifying insignia contributed to uncertainty about the armed personnel involved, although their Russian identity subsequently became established. Moscow initially denied that the unidentified forces were Russian soldiers. President Vladimir Putin publicly acknowledged the involvement of Russian military personnel in April 2014. The initial concealment formed part of the operation's political and informational dimensions.

The referendum conducted in Crimea on March 16, 2014, took place under conditions involving Russian military control. On March 27, the United Nations General Assembly adopted Resolution 68/262, reaffirming Ukraine's sovereignty and territorial integrity. The resolution stated that the referendum had no validity as a basis for altering Crimea's status and called upon states not to recognize the resulting territorial change (UN General Assembly, 2014).

Russia's involvement in eastern Ukraine followed a different operational pattern. Separatist armed groups participated in fighting in the Donbas, while Russia provided military support and deployed its own forces. The relationships between local armed formations, Russian personnel, and political authorities varied across operations and over time. Treating every stage of the conflict as one uniform campaign would obscure significant military and political differences.

Russia's full-scale invasion of Ukraine on February 24, 2022, also demonstrates the limits of treating hybrid warfare as an alternative to conventional conflict. The invasion involved extensive deployments of regular armed forces, missile strikes, armored operations, and attempts to occupy Ukrainian territory. Cyber operations and information campaigns accompanied these activities, but the central military confrontation involved large-scale conventional warfare.

European governments have subsequently raised concerns about sabotage, covert interference, and threats to critical infrastructure. One significant example occurred at Leipzig/Halle Airport, where German authorities discovered a drone carrying explosives during the night of August 4–5, 2026. On September 1, the German government publicly attributed the attempted attack to Russia, citing police investigations, operational characteristics, and intelligence findings. The official statement of September 4 distinguished that political attribution from ongoing criminal investigations and judicial proceedings (German Federal Government, 2026).

Russia rejected the accusation. The incident, examined separately in the Leipzig drone attack, illustrates the distinction between a government's attribution of hostile conduct and the legal determination of international responsibility. It also demonstrates why the wider characterization of a state's strategy cannot substitute for evidence concerning a particular operation.

4. How Hybrid Warfare Became a Strategic Concept

The combination of conventional and irregular military methods predates the expression hybrid warfare. Regular armies have long operated alongside guerrillas, militias, insurgents, and local forces. Historical campaigns involving occupation, resistance, imperial expansion, and civil conflict frequently included several forms of military organization. The contemporary concept emerged from attempts to explain particular combinations rather than from the invention of mixed military methods.

Thomas Huber's work on compound warfare examined the complementary employment of regular and irregular forces, including the resistance to Napoleon's occupation of Spain. His analysis offered a historical framework for understanding how different military formations could impose costs on a common adversary. Compound warfare anticipated aspects of later hybrid warfare discussions, although the concepts are not identical.

During the 2000s, military analysts increasingly questioned whether conventional distinctions between regular war and irregular conflict adequately described emerging opponents. James Mattis and Frank Hoffman contributed to this debate, while Hoffman's subsequent work developed the hybrid warfare concept more systematically. The 2006 Lebanon War provided a prominent case for examining the integration of sophisticated conventional capabilities with irregular methods.

The term acquired wider political significance after Russia's operations in Ukraine in 2014. NATO's Wales Summit Declaration of September 5, 2014, addressed hybrid warfare threats involving overt and covert military, paramilitary, and civilian measures employed in an integrated design. The declaration called for improvements in preparedness, strategic communications, exercises, and coordination with other organizations (NATO, 2014, para. 13).

This broader interpretation also produced controversy. Discussions of Russian strategy sometimes portrayed the 2013 writings of General Valery Gerasimov as evidence of a formal Russian military doctrine governing the coordinated use of military and nonmilitary instruments. The expression "Gerasimov Doctrine" became influential in Western commentary, but its authority as a description of Russian doctrine was subsequently challenged.

Ofer Fridman examined this problem in his 2019 article On "Gerasimov Doctrine": Why the West Fails to Beat Russia to the Punch. He argued that Western interpretations had frequently misunderstood the context of Russian military discussions and attributed excessive doctrinal significance to Gerasimov's statements. The expression does not identify a formally established Russian military doctrine, and its use can obscure differences between Russian strategic thought and Western interpretations of Russian conduct (Fridman, 2019).

Technological developments have nonetheless expanded the opportunities for combining military and nonmilitary pressure. Digital communications, cyber capabilities, financial networks, and interconnected infrastructure permit operations to affect targets far removed from an immediate battlefield. These developments concern the scale, speed, and reach of particular methods rather than the historical invention of deception, economic coercion, or indirect military intervention.

5. Hybrid Warfare and Gray Zone Warfare

Hybrid warfare and gray zone warfare are related concepts, but they emphasize different aspects of strategic competition. Hybrid warfare generally concerns the combination of methods employed against an adversary. Gray-zone warfare emphasizes coercive activity conducted between ordinary peacetime competition and open armed conflict, often with the intention of obtaining strategic advantages while limiting the likelihood of major military escalation.

Gray-zone operations may involve maritime harassment, cyber intrusion, covert interference, economic pressure, or other measures intended to alter an existing political or strategic situation. Their significance often lies in remaining below thresholds that might provoke a decisive response. Those thresholds may be political, operational, or legal, and they should not be treated as equivalent.

Hybrid methods can operate within the gray zone, but they are not confined to it. Hezbollah's operations in 2006 occurred during an armed conflict. Russia's conventional military operations in Ukraine have also been accompanied by cyber and information activities. The combination of different methods during an established war remains compatible with military understandings of hybrid warfare.

Asymmetric warfare presents another related concept. It concerns the use of different capabilities, strategies, or methods to offset an opponent's advantages. A weaker force may avoid direct confrontation and exploit vulnerabilities that conventional superiority cannot readily overcome. Hybrid operations can employ asymmetric methods, but asymmetry does not necessarily require the integration of multiple instruments of power.

Irregular warfare and proxy warfare have their own distinctive characteristics. Irregular warfare generally concerns methods associated with insurgency, guerrilla operations, and other unconventional forms of conflict. Proxy warfare concerns the conduct of hostilities through armed intermediaries supported by external actors. Both may feature within a hybrid campaign, but neither necessarily involves cyber operations, economic coercion, or political interference.

The distinctions prevent excessive conceptual overlap. A cyberattack does not automatically constitute hybrid warfare because it targets another state. An insurgency does not become hybrid simply because its fighters possess sophisticated weapons. The classification is more useful when the available evidence establishes a relationship between the methods employed, the actors involved, and the strategic objectives pursued.

6. Hybrid Warfare Under International Law

International law does not recognize hybrid warfare as an independent legal category governed by a separate body of treaty rules. The expression describes a strategic approach rather than a legally defined condition comparable to international armed conflict, military occupation, or an internationally wrongful act. The applicable rules depend on the conduct involved and the circumstances in which it occurs.

A hybrid campaign may contain activities with substantially different legal consequences. Unauthorized military operations on foreign territory may violate the prohibition on the use of force. Covert interference in another state's political decisions may engage the principle of nonintervention when the relevant coercive element exists. Cyber espionage, economic restrictions, and information manipulation raise additional questions that require separate legal assessment.

Different branches of international law may also apply simultaneously. The law governing the resort to force, international humanitarian law, human rights obligations, and the rules of state responsibility address distinct questions. The strategic classification of a campaign cannot determine whether every individual activity is internationally wrongful.

6.1 Sovereignty, Nonintervention, and the Use of Force

Article 2(4) of the United Nations Charter prohibits member states from threatening or using force against the territorial integrity or political independence of another state, or in any other manner inconsistent with the purposes of the United Nations. The prohibition extends beyond formally declared war and applies to armed operations regardless of whether they are conventional, covert, or described as hybrid (United Nations, 1945, art. 2(4)).

The distinction between armed force and other forms of coercion is essential. Economic pressure, propaganda, and political interference do not automatically constitute uses of force under Article 2(4). Cyber operations may present more difficult questions when their consequences resemble destructive physical attacks. The relevant rules and thresholds are considered in greater detail in Article 2(4) of the UN Charter Explained.

The customary principle of nonintervention addresses coercive interference in matters that states are entitled to determine freely. In Military and Paramilitary Activities in and against Nicaragua, the International Court of Justice identified coercion as a defining element of prohibited intervention. The Court also distinguished the prohibition of intervention from the rules governing the use of force and armed attacks (ICJ, 1986, paras. 202–205).

A further distinction concerns the right of self-defense. Article 51 of the Charter recognizes the inherent right of individual or collective self-defense if an armed attack occurs. In Nicaragua, the Court distinguished the gravest forms of force, constituting armed attacks, from less grave forms that may nevertheless violate the prohibition on force (ICJ, 1986, para. 191).

The exercise of self-defense must also satisfy necessity and proportionality. Necessity requires a defensive response to be genuinely needed to address the armed attack, while proportionality limits the nature and extent of the response to what is required for that defensive purpose. The characterization of hostile conduct as hybrid warfare does not independently establish these conditions or authorize military retaliation.

Cyber operations complicate the assessment because their effects may differ substantially. Operations causing destruction or consequences comparable to conventional armed attacks may engage the prohibition on force and, if sufficiently grave, the right of self-defense. Other activities, including unauthorized access to networks or interference with information systems, require separate analysis. States continue to disagree about aspects of sovereignty's application to remote cyber operations and the precise classification of particular nonphysical effects.

6.2 When the Law of Armed Conflict Applies

International humanitarian law applies when an armed conflict exists under the relevant legal criteria. Its applicability does not depend on whether the parties describe their operations as hybrid warfare, counterterrorism, security measures, or something else. A government cannot avoid humanitarian obligations through terminology, while hostile political or economic activity does not automatically create an armed conflict.

Common Article 2 of the 1949 Geneva Conventions provides the principal treaty framework for international armed conflicts between states. The Conventions apply to declared war and other armed conflicts between contracting parties, even when one party does not recognize a state of war. They also address occupation, including occupation that encounters no armed resistance (Geneva Conventions, 1949, Common Article 2).

Non-international armed conflicts involve different criteria. The assessment generally considers the organization of the armed groups involved and the intensity of the violence. In its Decision on the Defence Motion for Interlocutory Appeal on Jurisdiction of October 2, 1995, the Appeals Chamber of the International Criminal Tribunal for the former Yugoslavia addressed the existence of armed conflict in Prosecutor v. Tadić. Its reasoning became influential in the interpretation and classification of contemporary armed conflicts (ICTY, 1995, para. 70).

Once the applicable threshold is met, humanitarian law regulates the conduct of hostilities. The relevant treaty and customary rules govern attacks against military objectives, civilian protection, and the treatment of persons affected by conflict. The principles of distinction, proportionality, and precautions apply according to the legal framework governing the particular conflict.

The distinction between international and non-international armed conflict remains significant because the applicable treaty provisions are not identical. Many central protections are also recognized under customary international humanitarian law, but their treaty basis and precise scope must be identified rather than assumed to be uniform across all conflicts.

Cyber operations conducted during armed conflict raise particular interpretive difficulties. The International Committee of the Red Cross considers that an operation designed to disable a computer or computer network may constitute an attack under humanitarian law even without physical destruction. Some states adopt narrower interpretations of the term. In its 2024 report International Humanitarian Law and the Challenges of Contemporary Armed Conflicts, the ICRC acknowledged these differing state positions and the importance of protecting civilian infrastructure from cyber operations that impair essential services (ICRC, 2024).

The classification of cyber operations causing loss of functionality without physical damage remains contested, although operations expected to cause death, injury, or physical destruction fall within the more established understanding of attacks. The disagreement concerns the application of existing humanitarian rules to particular technological effects, not whether international humanitarian law applies to cyber operations conducted during armed conflict.

Hybrid activities outside armed conflict remain subject to other applicable obligations. International human rights law, sovereignty, nonintervention, and specialized treaty regimes may regulate particular conduct. International humanitarian law cannot be extended to every hostile relationship solely because political or military actors consider the situation part of a wider confrontation.

6.3 State Responsibility and the Problem of Attribution

Attribution is among the most difficult legal questions arising from covert and indirect operations. A cyberattack may be traced to particular individuals or technical infrastructure without establishing that a state directed the operation. An armed organization may receive substantial foreign assistance while retaining independent decision-making authority. Political suspicion, technical identification, intelligence attribution, and legal responsibility are separate matters.

The International Law Commission's 2001 Articles on Responsibility of States for Internationally Wrongful Acts provide the principal general framework. Article 4 concerns conduct by state organs. Article 8 addresses persons or groups acting on a state's instructions or under its direction or control. Article 11 concerns conduct subsequently acknowledged and adopted by a state as its own. The Articles are not a treaty, although several provisions reflect customary international law (ILC, 2001).

In Nicaragua v. United States, the International Court of Justice examined whether the conduct of the contra forces could be attributed to the United States. Despite extensive American financing, training, equipment, and other assistance, the Court did not attribute all contra operations to the United States. Attribution of particular violations required evidence of effective control over the operations concerned (ICJ, 1986, para. 115).

The Court reaffirmed the relevance of effective control in its February 26, 2007 judgment in Application of the Convention on the Prevention and Punishment of the Crime of Genocide. It rejected the proposition that overall control, without the degree of control required for attribution under the general rules of state responsibility, was sufficient to attribute the specific conduct of an armed organization to a state (ICJ, 2007, paras. 398–407).

The overall-control approach discussed by the ICTY in Tadić concerned a different legal context, particularly the classification of armed conflict involving organized armed groups and foreign state involvement. The ICJ expressly distinguished that inquiry from the attribution of particular wrongful acts for purposes of state responsibility. The two standards cannot be used interchangeably.

These distinctions are developed more fully in the doctrine of state responsibility in international law. Attribution identifies when conduct is legally treated as conduct of a state. Responsibility also requires a breach of an international obligation binding on that state.

A state may incur responsibility for its own internationally wrongful assistance or intervention even when an armed group's conduct cannot itself be attributed to the state. Article 16 of the ILC Articles also addresses responsibility for aiding or assisting another state in the commission of an internationally wrongful act, subject to its specific conditions. That rule must be distinguished from Article 8, which concerns the attribution of conduct to the state itself.

Concealment, intermediaries, and deniable operations complicate these inquiries without creating legal immunity. A sound legal assessment must identify the relevant conduct, establish the relationship between the actors involved, and determine whether an applicable international obligation has been breached.

7. How NATO and the European Union Respond

NATO and the European Union have developed institutional responses to hybrid threats because conventional military defense may be insufficient against coordinated activities involving civilian infrastructure, information systems, economic dependencies, and political institutions. Their approaches reflect different institutional mandates and capabilities. NATO operates as a collective-defense alliance, while the European Union possesses regulatory, economic, diplomatic, and civilian instruments alongside its developing security and defense arrangements.

NATO's response includes military preparedness, intelligence cooperation, cyber defense, strategic communications, and national resilience. Its 2014 Wales Summit Declaration recognized the need to address highly integrated overt and covert military, paramilitary, and civilian measures. Subsequent alliance declarations have reaffirmed the importance of preparing for, deterring, and countering hybrid threats.

Article 5 of the North Atlantic Treaty establishes a collective-defense commitment following an armed attack within the treaty's applicable scope. NATO's 2024 Washington Summit Declaration reaffirmed that hybrid operations against allies could reach the level of an armed attack and lead the North Atlantic Council to invoke Article 5. This remains a case-specific assessment rather than an automatic consequence of classifying an incident as hybrid warfare (NATO, 2024, para. 13).

Under Article 5, each ally must assist the party attacked by taking such action as it deems necessary, which may include armed force. The treaty does not require every ally to respond militarily in every case. The legal provisions governing consultation, collective defense, and the relationship with the United Nations Charter are examined in North Atlantic Treaty (1949).

Article 4 provides a separate mechanism for consultations when an ally considers its territorial integrity, political independence, or security threatened. It may be relevant to serious hostile activities that do not meet the armed-attack threshold. Consultations under Article 4 do not automatically activate Article 5 and are not a legal prerequisite for collective defense.

The European Union has developed a hybrid toolbox combining preventive, cooperative, restrictive, and response measures. Its Strategic Compass for Security and Defence, adopted in March 2022, provided an important policy framework. Council conclusions adopted in June 2022 established a framework for coordinated EU responses to hybrid campaigns. These instruments complement the EU's cyber diplomacy toolbox and arrangements addressing foreign information manipulation and interference (Council of the European Union, 2022).

The Council approved the guiding framework for EU Hybrid Rapid Response Teams on May 21, 2024. These teams were designed to provide targeted, short-term assistance to member states, Common Security and Defence Policy missions and operations, and partner countries facing hybrid threats. Their purpose is to strengthen existing national and institutional capabilities rather than replace the responsibilities of the states concerned (Council of the European Union, 2024).

The teams subsequently moved beyond planning into operational activity. The European External Action Service confirmed their first mobilization in Moldova ahead of the country's September 2025 parliamentary elections, providing assistance intended to strengthen resilience against hybrid threats. EU institutional reporting in 2026 also recorded deployments supporting democratic and institutional resilience in Moldova and Armenia, including electoral integrity (EEAS, 2026; European Commission and High Representative, 2026).

The Union has continued developing restrictive measures and coordinated responses. In October 2024, the Council established a sanctions framework addressing Russia's destabilizing activities. On March 16, 2026, it adopted conclusions reaffirming the use of the hybrid toolbox, cyber diplomacy instruments, legislation, and restrictive measures to prevent, deter, and respond to hostile campaigns. The conclusions specifically addressed sabotage, malicious cyber activities, foreign information manipulation, electoral interference, and threats to critical infrastructure (Council of the European Union, 2026).

These developments demonstrate how the EU employs several institutional capacities rather than relying on a single military response. The Council's March 2026 conclusions also emphasized cooperation with international organizations, partner countries, civil society, academia, and the private sector. This approach reflects the fact that hybrid threats often affect sectors outside the direct responsibility of armed forces.

The distinction between institutional policy and binding legal obligations remains essential. NATO summit declarations and EU Council conclusions express agreed policy positions and institutional priorities, but they do not automatically modify treaty obligations. EU restrictive measures adopted through the relevant legal instruments have a different status from general political declarations or strategic guidance.

Practical responses also face substantial constraints. Hybrid campaigns may involve incidents falling within military, criminal, administrative, diplomatic, and economic responsibilities. Effective coordination requires information sharing among institutions operating under different legal mandates and evidentiary standards. Measures against suspected interference must also respect applicable human rights obligations, domestic constitutional requirements, and other relevant legal limits.

8. The Limits of the Hybrid Warfare Label

The growing use of hybrid warfare has produced a problem of conceptual breadth. When the expression includes conventional military operations, insurgency, espionage, cybercrime, disinformation, economic pressure, and political interference, identifying what distinguishes it from other forms of conflict becomes increasingly difficult.

Military scholars have questioned whether hybrid warfare describes a genuinely distinct form of confrontation or reorganizes familiar methods under a new label. The coordination of regular and irregular forces has substantial historical precedent.

Deception, political subversion, economic coercion, and information manipulation have also been employed for centuries. Contemporary technologies may alter their scale and implementation without necessarily changing their underlying strategic purposes.

James Wither has emphasized the continuing definitional difficulties surrounding hybrid warfare and the consequences of those difficulties for military and governmental responses. Ofer Fridman's criticism of Western interpretations of Russian strategy illustrates a related concern: an analytical framework can become misleading when it imposes assumptions that do not accurately reflect the adversary's military thinking or political objectives.

The distinction between an analytical concept and a political label is particularly important. Governments may characterize hostile incidents as components of hybrid warfare because they suspect a wider coordinated campaign. Such assessments may rely on classified intelligence or information unavailable to the public. The political use of the label cannot independently establish operational coordination, state direction, or legal responsibility.

An excessively broad definition can distort threat assessment. Cyber intrusions, economic disputes, infrastructure incidents, and political interference may have different perpetrators and causes. Treating every hostile or ambiguous incident as part of a coordinated campaign risks overlooking criminal activity, technical failures, independent political movements, or unrelated security events.

The opposite difficulty arises when authorities examine incidents separately despite evidence of coordination. Individually limited operations may produce greater strategic effects when directed toward a common objective. Assessing a possible hybrid campaign requires attention to timing, methods, actors, target selection, operational relationships, and available evidence of strategic purpose.

The concept remains useful when employed with sufficient precision. It can identify forms of coordination that conventional military categories do not adequately describe and direct attention toward vulnerabilities extending beyond the armed forces. Its explanatory value declines when the classification substitutes for evidence concerning how operations were organized, who directed them, and what objectives they pursued.

The legal limitations are equally significant. Strategic descriptions cannot replace the factual tests governing armed conflict, the prohibition on the use of force, self-defense, or state responsibility. Each operation must be assessed under the rules applicable to its conduct, regardless of the terminology employed by governments, military

organizations, or commentators.

Conclusion

Hybrid warfare describes the deliberate combination of different methods of confrontation to pursue strategic objectives. Its narrower military meaning concerns the integration of conventional and irregular forms of combat, while broader interpretations include cyber operations, disinformation, economic pressure, and political interference. The absence of a universally accepted definition makes it necessary to identify which conception is being employed.

Historical experience demonstrates that combining different instruments of conflict is not new. The 2006 Lebanon War highlighted how an armed organization could challenge conventional forces through the integration of irregular tactics and sophisticated military capabilities. Russia's operations in Ukraine since 2014 contributed to a broader interpretation emphasizing the relationship between military force, political intervention, deception, and information activities.

Modern technologies have increased the speed, reach, and potential effects of certain methods, particularly against digitally dependent institutions and infrastructure. These developments have expanded the circumstances in which states and other actors may face simultaneous pressure across military and civilian domains.

The concept is most useful when it explains the relationship between activities that might otherwise appear separate. Strategic purpose, identifiable vulnerabilities, operational coordination, and the effects of combined methods provide a stronger analytical basis than the mere presence of several hostile techniques.

International law remains applicable to the conduct concerned. Describing a campaign as hybrid warfare does not determine whether an armed conflict exists, whether a prohibited use of force or armed attack has occurred, or whether particular conduct is attributable to a state. Those questions require independent legal assessment. Hybrid warfare can help explain how contemporary adversaries pursue their objectives, but understanding their actions still depends on careful evidence, military analysis, and the applicable rules of international law.

References

Biddle, S.D. and Friedman, J.A. (2008) The 2006 Lebanon Campaign and the Future of Warfare: Implications for Army and Defense Policy. Carlisle, PA: Strategic Studies Institute, U.S. Army War College. Available at: https://press.armywarcollege.edu/monographs/641/ (Accessed: 21 October 2026).

Charter of the United Nations (1945) Signed at San Francisco, 26 June 1945; entered into force 24 October 1945, 1 UNTS XVI. Available at: https://www.un.org/en/about-us/un-charter (Accessed: 21 October 2026).

Council of the European Union (2022a) A Strategic Compass for Security and Defence: For a European Union That Protects Its Citizens, Values and Interests and Contributes to International Peace and Security. Council document 7371/22, 21 March. Brussels: Council of the European Union. Available at: https://data.consilium.europa.eu/doc/document/ST-7371-2022-INIT/en/pdf (Accessed: 21 October 2026).

Council of the European Union (2022b) Council Conclusions on a Framework for a Coordinated EU Response to Hybrid Campaigns. 21 June. Brussels: Council of the European Union. Available at: https://www.consilium.europa.eu/en/press/press-releases/2022/06/21/council-conclusions-on-a-framework-for-a-coordinated-eu-response-to-hybrid-campaigns/pdf/ (Accessed: 21 October 2026).

Council of the European Union (2024a) Hybrid Threats: Council Paves the Way for Deploying Hybrid Rapid Response Teams [online]. 21 May. Available at: https://www.consilium.europa.eu/en/press/press-releases/2024/05/21/hybrid-threats-council-paves-the-way-for-deploying-hybrid-rapid-response-teams/ (Accessed: 21 October 2026).

Council of the European Union (2024b) Council Decision (CFSP) 2024/2643 of 8 October 2024 Concerning Restrictive Measures in View of Russia’s Destabilising Activities. Official Journal of the European Union, L 2024/2643, 9 October. Available at: https://eur-lex.europa.eu/eli/dec/2024/2643/oj/eng (Accessed: 21 October 2026).

Council of the European Union (2026) Council Adopts Conclusions on Advancing the EU’s Capacity to Counter Hybrid Threats [online]. 16 March. Available at: https://www.consilium.europa.eu/en/press/press-releases/2026/03/16/council-adopts-conclusions-on-advancing-the-eu-s-capacity-to-counter-hybrid-threats/ (Accessed: 21 October 2026).

Cullen, P.J. and Reichborn-Kjennerud, E. (2017) Understanding Hybrid Warfare. Multinational Capability Development Campaign, Countering Hybrid Warfare Project, January. Available at: https://www.southwales.ac.uk/media/university-of-south-wales/site-assets/documents/news-/2021/07-july/dar_mcdc_hybrid_warfare.pdf (Accessed: 21 October 2026).

European Commission and High Representative of the Union for Foreign Affairs and Security Policy (2026) Joint Report to the European Parliament and the Council on the Implementation of the EU Strategic Approach to the Black Sea Region. JOIN(2026) 15 final, 3 July. Brussels: European Commission. Available at: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52026JC0015 (Accessed: 21 October 2026).

European External Action Service (2026) Countering Hybrid Threats [online]. Available at: https://www.eeas.europa.eu/eeas/eu-action-countering-hybrid-threats_en (Accessed: 21 October 2026).

Fridman, O. (2019) ‘On “Gerasimov Doctrine”: Why the West Fails to Beat Russia to the Punch’, PRISM, 8(2), pp. 101–112. Available at: https://ndupress.ndu.edu/Media/News/News-Article-View/Article/1981229/on-the-gerasimov-doctrine-why-the-west-fails-to-beat-russia-to-the-punch/ (Accessed: 21 October 2026).

Geneva Convention (I) for the Amelioration of the Condition of the Wounded and Sick in Armed Forces in the Field (1949) Adopted 12 August 1949; entered into force 21 October 1950, 75 UNTS 31. Available at: https://ihl-databases.icrc.org/en/ihl-treaties/gci-1949 (Accessed: 21 October 2026).

Geneva Convention (II) for the Amelioration of the Condition of Wounded, Sick and Shipwrecked Members of Armed Forces at Sea (1949) Adopted 12 August 1949; entered into force 21 October 1950, 75 UNTS 85. Available at: https://ihl-databases.icrc.org/en/ihl-treaties/gcii-1949 (Accessed: 21 October 2026).

Geneva Convention (III) Relative to the Treatment of Prisoners of War (1949) Adopted 12 August 1949; entered into force 21 October 1950, 75 UNTS 135. Available at: https://ihl-databases.icrc.org/en/ihl-treaties/gciii-1949 (Accessed: 21 October 2026).

Geneva Convention (IV) Relative to the Protection of Civilian Persons in Time of War (1949) Adopted 12 August 1949; entered into force 21 October 1950, 75 UNTS 287. Available at: https://ihl-databases.icrc.org/en/ihl-treaties/gciv-1949 (Accessed: 21 October 2026).

German Federal Government (2026) Entschlossenes Vorgehen gegen hybriden Angriff [online]. 4 September. Available at: https://www.bundesregierung.de/breg-de/aktuelles/reaktion-angriff-leipzig-2451522 (Accessed: 21 October 2026).

Hoffman, F.G. (2007) Conflict in the 21st Century: The Rise of Hybrid Wars. Arlington, VA: Potomac Institute for Policy Studies. Available at: https://www.potomacinstitute.us/images/stories/publications/potomac_hybridwar_0108.pdf (Accessed: 21 October 2026).

Huber, T.M. (ed.) (2002) Compound Warfare: That Fatal Knot. Fort Leavenworth, KS: U.S. Army Command and General Staff College Press. Available at: https://www.armyupress.army.mil/Portals/7/combat-studies-institute/csi-books/compound_warfare.pdf (Accessed: 21 October 2026).

International Committee of the Red Cross (2024) International Humanitarian Law and the Challenges of Contemporary Armed Conflicts: Building a Culture of Compliance for IHL to Protect Humanity in Today’s and Future Conflicts. Geneva: International Committee of the Red Cross. Available at: https://www.icrc.org/en/publication/international-humanitarian-law-and-challenges-contemporary-armed-conflicts-building (Accessed: 21 October 2026).

International Court of Justice (1986) Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States of America), Merits, Judgment of 27 June, ICJ Reports 1986, p. 14. Available at: https://www.icj-cij.org/node/103143 (Accessed: 21 October 2026).

International Court of Justice (2007) Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v. Serbia and Montenegro), Judgment of 26 February, ICJ Reports 2007, p. 43. Available at: https://www.icj-cij.org/node/103164 (Accessed: 21 October 2026).

International Criminal Tribunal for the Former Yugoslavia (1995) Prosecutor v. Duško Tadić, Case No. IT-94-1-AR72, Decision on the Defence Motion for Interlocutory Appeal on Jurisdiction, Appeals Chamber, 2 October. Available at: https://digitallibrary.un.org/record/237150 (Accessed: 21 October 2026).

International Law Commission (2001) Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries. Yearbook of the International Law Commission, 2001, Vol. II, Part Two, UN Doc. A/56/10. Available at: https://legal.un.org/avl/ha/rsiwa/rsiwa.html (Accessed: 21 October 2026).

Mattis, J.N. and Hoffman, F.G. (2005) ‘Future Warfare: The Rise of Hybrid Wars’, Proceedings, 131(11), pp. 18–19. Available at: https://www.usni.org/magazines/proceedings/2005/november/future-warfare-rise-hybrid-wars (Accessed: 21 October 2026).

North Atlantic Treaty (1949) Signed at Washington, D.C., 4 April 1949; entered into force 24 August 1949, 34 UNTS 243. Available at: https://nato.int/en/about-us/organization/founding-treaty (Accessed: 21 October 2026).

North Atlantic Treaty Organization (2014) Wales Summit Declaration. Issued by the Heads of State and Government participating in the meeting of the North Atlantic Council in Wales, 5 September. Available at: https://nato.int/en/about-us/official-texts-and-resources/official-texts/2014/09/05/wales-summit-declaration (Accessed: 21 October 2026).

North Atlantic Treaty Organization (2024) Washington Summit Declaration. Issued by the Heads of State and Government participating in the meeting of the North Atlantic Council in Washington, D.C., 10 July. Available at: https://www.nato.int/en/about-us/official-texts-and-resources/official-texts/2024/07/10/washington-summit-declaration (Accessed: 21 October 2026).

Partnership for Peace Consortium of Defence Academies and Security Studies Institutes (2024) Hybrid Threats and Hybrid Warfare Reference Curriculum. Brussels: NATO Headquarters. Available at: https://www.nato.int/content/dam/nato/webready/documents/deep/Hybrid-threats-and-hybrid-warfare-ENGLISH.pdf (Accessed: 21 October 2026).

United Nations General Assembly (2014) Territorial Integrity of Ukraine. Resolution 68/262, UN Doc. A/RES/68/262, adopted 27 March. Available at: https://digitallibrary.un.org/record/767883 (Accessed: 21 October 2026).

Wither, J.K. (2020) ‘Defining Hybrid Warfare’, per Concordiam, 10(1), pp. 7–9. Available at: https://perconcordiam.com/defining-hybrid-warfare/ (Accessed: 21 October 2026).