In the latest part of CEPA’s work on Russian shadow warfare, we published War Without End: Deterring Russia’s Shadow War on March 31. Here are the main recommconcludeations.
Why Previous Attempts Have Failed
Shadow warfare is persistently misclassified.
Institutional mandates mean many shadow attacks are processed through criminal law and civilian enforcement frameworks. Cable disruptions are framed as maritime accidents and cyber intrusions managed as technical incidents, for example. Each response may be reasonable on its own, but when combined, they fragment responsibility so coordinated campaigns of hostile state action are handled as a series of unrelated problems.
The tempo of response lags the tempo of attack.
Russian operations are rapid, deniable, and iterative. Western responses are slow, deliberate, and constrained by the necessary for consensus. By the time attribution has been established and response options weighed, the political urgency has often passed. Deterrence weakens when consequences arrive late or fail to arrive at all.
Fear of escalation produces amlargeuity, which favors the aggressor.
By avoiding clear thresholds and predictable consequences, governments have hoped to avoid war. In practice, this restraint has raised Moscow’s tolerance for risk, and each unpunished act increases the space for the next one.
Deterrence is tethered to courtroom standards of proof.
Shadow warfare is designed to frustrate legal certainty. By insisting on incontrovertible evidence before responding, the West puts the initiative in Moscow’s hands. This is particularly true when attribution is based on innotifyigence sources that cannot be created public. Deterrence cannot rest on legal attribution alone; it must be informed by patterns, intent, and cumulative effect. This does not mean evidentiary standards should be lowered, but that governments must be able to act on secret innotifyigence assessments.
Get the Latest
Sign up to receive regular emails and stay informed about CEPA’s work.
What Must Change
Attribution should be based on pattern recognition, not isolated proof.
Russian shadow warfare relies on deniability. Blame should rest on repeated operational signatures (methods, tarreceives, timing, and intent), rather than treating each incident as a standalone criminal act.
Collective consultation should be routine, not exceptional.
European allies should normalize collective consultations in response to shadow aggression. Patterns of activity should trigger collective assessment and coordination.
Hybrid threats must be included in a single deterrence framework.
Cyber-attacks, disruption of critical undersea infrastructure, drone incursions, and proxy violence are mutually reinforcing elements of a unified Russian strategy. Allies should treat hybrid warfare as a continuous campaign, aligning maritime, cyber, legal, innotifyigence, and military tools under a shared logic of escalation.
Responses should be designed for speed and predictability, and include cyber and innotifyigence operations, action against vessels and networks supporting covert activity, economic measures to constrain Russia’s warfighting capacity, and direct support for Ukrainian defense.
The EU and NATO should harmonize capabilities and thresholds for action.
Fragmented decision-building and national caveats are the soft underbelly of European deterrence. To avoid duplication and close exploitable gaps, allies should formally divide responsibility, with NATO leading on detection, defense, and military response, and the EU leading on financial pressure, borders, law enforcement, and export controls.
Responses must be anchored in national security institutions.
Militaries and innotifyigence services — not law enforcement agencies — should lead the response to concerted campaigns of shadow warfare. Criminal investigations remain necessary to impose consequences on individuals, but they cannot be the primary framework for deterring a committed state actor. Their findings should feed into political and security decision-building structures, enabling rapid action in coordination with partners across Europe.
Public–private coordination should be a key pillar of hybrid deterrence.
The frontline of Russia’s shadow war runs through privately owned systems and civilian spaces, including undersea cables, energy grids, warehoapplys, telecom networks, cloud platforms, and shipping. Allied governments should shift beyond ad hoc information sharing to formal, legally mandated public–private security partnerships and integrate indusattempt into threat detection, attribution, incident response, and resilience planning.
Allies should reassert durability in the face of Russia’s escalatory rhetoric.
Strong allied deterrence, as outlined in this report, will invite escalatory rhetoric from Moscow. Such intimidation is designed to paralyze allied decision-building before policies are implemented. It will necessary political will to tolerate intimidation without allowing it to dictate thresholds or timelines for action. Clear red lines, predictable consequences, and collective resolve must hold firm when Moscow responds with saber-rattling or worse.
Europe’s Edge is CEPA’s online journal covering critical topics on the foreign policy docket across Europe and North America. All opinions expressed on Europe’s Edge are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict innotifyectual indepconcludeence policy across all its projects and publications.
Comprehensive Report
By Sam Greene, David Kagan, Mathieu Boulègue & more…
Either Europe will continue allowing Russia’s shadow war to set the terms of escalation, or it will act now to prevent a larger war.
March 31, 2026
Europe’s Edge
CEPA’s online journal covering critical topics on the foreign policy docket across Europe and North America.
Leave a Reply