European countries are discussing new ways to respond in a coordinated manner to hybrid attacks attributed to Russia, amid concerns that current mechanisms are not sufficient to prevent sabotage, cyberattacks, arson and other interventions that fall below the threshold of an armed attack. The EU has described these actions as part of Russia's destabilizing campaigns and has discussed strengthening common measures, including sanctions. European Defense Commissioner Andrius Kubilius has argued that if Europe faces a hybrid war, there must also be a common mechanism to respond. According to him, the response to such provocations must be coordinated and impose a significant cost on the perpetrators.
New European security protocol
European Commission President Ursula von der Leyen has proposed the creation of a “European Emergency Security Protocol,” which would be activated in cases where a member state faces an incident that does not rise to the level of an armed attack but poses a clear threat to national security. According to the proposal, if the mechanism is activated by one member state, other countries would come together to coordinate a common response, prevent escalation and limit the consequences. Von der Leyen has described it as a mechanism that would complement NATO’s Article 4, not replace it.
The proposal comes at a time when specific discussions are taking place within the EU on hybrid threats. EU Council documents show that working groups met in September to strengthen resilience and counter these threats. However, the idea of a new mechanism has also raised questions in some European capitals, particularly about how it would coexist with existing NATO structures and whether it would create parallel decision-making processes.
Sabotage, cyberattacks and drones
In recent months, European countries have reported a series of incidents they have linked to Russian hybrid campaigns, including cyberattacks, sabotage of critical infrastructure, arson, and drone incidents.
The European Union says Russia's hybrid activities include information interference, damage to underwater infrastructure and attempts to influence democratic processes. Meanwhile, NATO has taken its own measures to strengthen security on its eastern flank and protect critical infrastructure. The debate in Europe is precisely about how to respond to incidents that are serious but do not automatically activate collective defense mechanisms.
Von der Leyen: We must adapt to the new reality
Presenting her proposals in her State of the Union address, Von der Leyen said that cyberattacks, sabotage, arson and drone incursions are on the rise and that European preparedness must therefore be stepped up. She argued that Europe’s doctrine, institutions and decision-making processes have not been sufficiently adapted to the new security reality. For this reason, the Commission is also working on a “European handbook against hybrid threats”, alongside the new emergency security mechanism.
Von der Leyen has also proposed the creation of a European Security Council, which would include partners such as the United Kingdom, Norway, Ukraine and Canada in addition to EU countries. On the NATO side, Secretary General Mark Rutte has stated that the Alliance is prepared for hybrid threats and that it has a range of options to respond. However, he has emphasized that these responses are not necessarily public and do not always have to be symmetrical. In this context, Europe is trying to build a more coordinated way of responding to actions that remain below the threshold of a direct military conflict, but that European authorities increasingly consider as direct threats to security.
