Intelligence officials warn that Europe is struggling to counter Russia's escalating "hybrid" warfare, as Germany launches an investigation into a recent substation fire in Berlin. Defence officials, speaking to the Financial Times, have urged NATO to rapidly develop new methods to deter what they describe as "sub-Article 5 provocations."
"It is completely clear that we aren't doing enough to deter sub-Article 5 provocations," one source stated, adding that while deterrence exists against conventional and nuclear escalation, the approach to hybrid threats needs reevaluation.
The fire at the Berlin substation on Monday is part of a recent string of incidents targeting infrastructure across Germany. Authorities are examining whether the blaze was caused by sabotage or a technical malfunction. This incident follows a series of attacks on substations in North Rhine-Westphalia and Brandenburg last week, which led to temporary equipment shutdowns but no major blackouts.
Separately, German police are searching for a suspected militant climate activist who has claimed responsibility for attacks on substations in protest against the fossil-fuel industry. While left-wing militants have claimed some recent power grid attacks, authorities remain alert to potential Russia-linked sabotage.
Germany has previously attributed hybrid attacks to Russia, including an incident involving an explosive-laden drone at a strategic airport in Leipzig last month. The drone, found near a Ukrainian cargo plane, carried explosives and was defused by police. Another drone with traces of explosives was reportedly discovered near the airport weeks later. The Leipzig/Halle Airport is significant for military and NATO logistical operations, as well as serving as a base for Ukraine's Antonov Airlines.
German officials have voiced concerns about increased Russian activity. Chancellor Friedrich Merz noted Germany has "found itself in the crosshairs of hybrid attackers," while Defense Minister Boris Pistorius warned of the Kremlin's focus on the country. German MP Roderich Kiesewetter suggested potential threats against "high representatives of our armaments industry."
Western intelligence sources indicate that Russia has recently targeted European defense manufacturers, employing local criminals for sabotage. These attacks are believed to be calibrated to avoid triggering Article 5 of the NATO treaty, which mandates mutual defense among member states.
"We are clearly seeing a manifestation of Russia's increased risk tolerance and recklessness," stated a senior official from a NATO frontline state, citing "unprecedented levels" of Russian activity. Keir Giles, an associate fellow at Chatham House, commented that while Russia's objectives may not have changed, the West's perception of what constitutes an Article 5 provocation is unclear, allowing Russia to continually test boundaries.
Moscow has been accused of waging a "shadow war" across Europe through sabotage, cyber attacks, disinformation, and intimidation. Russian cyber units have targeted critical systems, including power plants, since the mid-2010s. A significant cyber attack against the Viasat satellite internet system on the day of Russia's full-scale invasion of Ukraine in 2022 caused widespread outages across central and eastern Europe.
In recent years, Nordic and Baltic countries have reported increased GPS jamming and spoofing affecting civilian and military navigation. British spy chief Anne Keast-Butler has described the current security environment as "a space between peace and war," with Russian activities spanning from undersea infrastructure to cyberspace.
Security experts have advised the UK to prepare for potential Russian responses to its support for Ukraine. Former British Army commander Colonel Hamish de Bretton-Gordon warned that Russia is building bases to launch drones into NATO territory and that the assumption Putin is too committed to Ukraine to open another front may be incorrect. He added that while many malign activities are thwarted by security services, "grey zone attacks may be a precursor for a direct attack."