Matthias Monroy

Since the Lisbon Treaty, the EU Commission and the Council intertwined internal and external security and thus closer cooperate with NATO. In 2015, a fighting word was created for this, which is being positioned against disinformation, cyber attacks and migration.

Several thousand refugees have attempted to cross the Belarusian border with Lithuania and Poland in recent weeks, subsequently seeking asylum in countries such as Germany. The two Eastern European states have responded by hastily erecting fences and a martial, including military, build-up. Lithuania was the first EU state to activate the European Crisis Reaction Mechanism (IPCR) in the area of migration. Poland is relying solely on measures without EU involvement, even though Prime Minister Mateusz Morawiecki sees “Europe, our common house” in danger. Great Britain and Estonia are therefore offering to send troops to the government in Warsaw.

Council President Charles Michel and EU Commission President Ursula von der Leyen refer to migrants as a “weapon”. This framing is echoed by US Secretary of State Antony Blinken, who threatens that the Washington administration will keep up the pressure on Belarusian President Alexander Lukashenko as long as Belarus is “undermining peace and security in Europe “. On Thursday, G7 countries also showed solidarity with Poland, Lithuania and Latvia, condemning “this provocative use of irregular migration as a hybrid tactic”.

12 governments and Frontex director in favour of new Schengen rules

The European Commission, the Council and numerous EU member states have also called the attempted border crossings a “hybrid threat”, saying it was orchestrated by the government in Minsk. Greek Prime Minister Kyriakos Mitsotakis, for example, said that Lukashenko had been “drawn inspiration from a strategy that has already been tested and which caused chaos and misery on Europe’s borders”. Mitsotakis is referring to Turkey, which had brought mainly Syrian refugees en masse to the Turkish-Greek land border in February 2020. Von der Leyen praised Greece at the time as a “European shield” against irregular migration, and the EU border agency then deployed its new “Standing Corps” with robust equipment to the Evros border river for the first time.

In early October, 12 EU members sent a letter to the EU Commission calling for the Schengen Border Code to be amended “in case of a hybrid attack”. Countries like Hungary, Cyprus, Austria and the Baltic states want new Schengen rules to counter an “artificially created large scale inflow of irregular migrants” by a third country. On 1 December, the Commission wants to present a proposal on this.

In an interview with the German newspaper “WELT”, Frontex Director Fabrice Leggeri also demands clarity for missions in which EU border troops are confronted with such “hybrid threats”. Leggeri refers to the Greek government. In a video message more than a year ago, its national security advisor spoke of a “hybrid war” by Turkey against Greece, with the government in Ankara using “non-conventional forces, influential companies, spreading fake news”.

“Exploiting EU vulnerabilities to their own advantage”

The tactics referred to as “hybrid threats” are nothing new in the military sphere. The Commission defines them as attacks by state or non-state actors seeking to “exploit the vulnerabilities of the EU to their own advantage”. This can include diplomatic, military, economic and technological means, without crossing the threshold of formal warfare. States can also use so-called “proxy actors”, which then serve as vehicles for “hybrid threats”.

At the EU level, the term “hybrid threats” first appeared in 2015. A year after the Crimean crisis, in which Russia occupied the peninsula that originally belonged to Ukraine and sent unmarked troops to eastern Ukraine, the Council sought responses to the intervention. The External Action Service installed a Strategic Communications Team East (StratCom East), which is to detect Russian “disinformation and propaganda” and counter it with its own narratives. According to the EU Action Plan against Disinformation, the centre, which now also deals with China, has 55 staff members.

Before that, NATO had already set up a Stratcom Centre of Excellence in Riga, where “counter-narratives” in response to “pro-Kremlin narratives” are also part of the tasks, and joint exercises and simulations of the NATO countries are being developed.

From 2016, migration is considered a “hybrid threat”

In May 2015, the topic was on the agenda of the External Relations Council in Brussels, which was also attended by the EU defence ministers. The German government at the time had sent Ursula von der Leyen and Foreign Minister Frank-Walter Steinmeier to the meeting. One month later, the EU member states mentioned “hybrid threats” for the first time in Council conclusions on the renewed Internal Security Strategy. The Baltic states and Poland in particular advocated this, while the Greek government, for example, rejected the term because of its military connotation.

As of 2016 at the latest, EU member states have directly linked migration to “hybrid threats”. In Council conclusions on the Common Security and Defence Policy, the Council urged the creation of further synergies between civilian and military security and defence policies, including in the areas of “irregular migration, hybrid threats, border management”. This should also involve the agencies Europol and Frontex as well as the non-EU European Gendarmerie Force.

The Netherlands, Slovakia and Malta were more specific in their eighteen-month programme for the Presidency in 2016 and 2017, which lists “hybrid threats” at the top of the list of challenges for the European Defence Agency. In it, the three Presidencies promised to pay attention to “better link between migration, security and external policy”.

Joint EU-NATO exercises

Also in 2016, the Commission’s Common Framework for Defence against Hybrid Threats called for the development of cooperation between the EU and NATO. As a common platform, they have been working together since 2017 in the Centre against Hybrid Threats (Hybrid CoE). Based in Helsinki, Finland, the Centre does not conduct its own operations, but focuses on information exchange, early warning and risk analysis, and organises training and exercises to this end. CoE’s activities were initially limited to Eastern Europe and were gradually extended to southern EU neighbours and Western Balkan states. Greece became the 21st member of the CoE in 2019. The reason given is that the country is “extremely important” due to its geostrategic location “in a region with high security dynamics”.

NATO has also broadened its understanding of “hybrid threats”, which, according to a study by the European Parliament’s Scientific Service, include a dozen areas, the third of which is “facilitated migration”. This refers to the instrumentalisation of refugees at the borders of other countries in order to put them under pressure or influence them. The study correctly notes that originators such as Turkey “take advantage of Europeans’ concern” regarding flight and migration.

For the first time, the EU and NATO centres conducted a joint civil-military exercise against “hybrid threats” in 2017 with EU PACE17. The focus was on interdepartmental cooperation in the field of strategic communication in the event of cyber attacks. The information necessary for such an operation is provided by the EU Hybrid Fusion Cell at the intelligence situation centre INTCEN in Brussels, in which domestic and foreign intelligence services of all EU member states participate.

Secret Service Information against “flow of refugees”

To combat “hybrid threats”, NATO has also set up a corresponding department within its Joint Intelligence Security Division; the information processed by this Hybrid Analysis Branch also comes from foreign intelligence services as well as some military secret services. The intelligence centres of the EU and NATO now work closely together and produce an annual joint threat analysis.

A year later, Hybrid Exercise Multilayer 18, the first complex exercise of the EU with NATO and other actors of the Common Security and Defence Policy, followed. For the first time, the scenario also included “creating a flow of refugees” across the Mediterranean. Greece was appointed as the commander. The exercise was also intended to test the EU crisis response mechanism.

In the crisis management exercises MILEX 19 and MILEX 21, the EU and NATO finally rehearsed a response to the instrumentalisation of refugees by a state “proxy”. The headquarters were again at the air force base in Larissa, Greece. There, at the opening of MILEX 21, Deputy Minister of National Defence Alkiviadis Stefanis spoke of an “an agenda of particular challenges and hybrid threats” and mentioned military conflicts in the same breath as migration.

High-level Council working group

Two years ago, the Finnish Council Presidency had made the topic of “hybrid threats” a priority; for example, the interior ministers were allowed to conduct a corresponding simulation game at their Council meeting. In 2019, the Council established a Horizontal Working Group on Resilience and Countering Hybrid Threats (ERCHT). It is to coordinate joint EU action in all policy areas. NATO has been invited to the group meetings from the beginning, with joint responses to cyber attacks and the management of “migration flows” on the agenda.

In the meantime, the new Council working group is increasingly dealing with military measures against “hybrid threats” within the framework of the EU Strategic Compass. To this end, the Council intends to present a paper next year that will define the military orientation of the Common Security and Defence Policy for the coming years. Under the German and Portuguese Presidencies, the EU Intelligence Situation Centre INTCEN and StratCom East were also involved.

The EU-NATO initiatives against “hybrid threats” bring to a close the interaction in the field of internal and external security, as launched by the EU member states in the framework of the Lisbon Treaty 14 years ago. This entanglement concerns military, police and secret services. Of importance, therefore, is the EU Anti-Terrorism Coordinator, whose remit has recently been expanded by the Council to include cyber-attacks and “hybrid threats”. The director’s post reports to the Council’s Secretary General, and since October the post has been filled by Ilkka Salmi, the former head of the security police responsible for state protection in Finland. In the EU, Salmi was already Director of the Commission’s Security Directorate, before which he headed the intelligence INTCEN.

Image: Poland deploys military and police with counter-insurgency equipment against “hybrid threats” on the border with Belarus (Polish Army on Twitter).