Hybrid Threats – A Comprehensive Resilience Ecosystem

Hybrid threats constitute a combination of different types of tools, some expected and known, some unexpected and clandestine, applied to achieve an undeclared strategic objective, and without officially admitting to doing so. The common denominator for hybrid threat actors is their desire to undermine or harm democratically established governments, countries or alliances. By their very nature, hybrid threats constitute a risk to European values, governments, countries and individuals.

Their overarching aim is to constrain the freedom of manoeuvre of democracies in order to discredit its model compared to authoritarian regimes or gain other advantages over democracies.

In particular, hybrid threat actors may be characterised by their wish to:

• undermine and harm the integrity and functioning of democracies by targeting vulnerabilities of different domains, creating new vulnerabilities through interference activity, exploiting potential weaknesses, creating ambiguity and undermining the trust of citizens in democratic institutions;

• manipulate established decision-making processes by blurring situational awareness, exploiting gaps in information flows, intimidating individuals and creating fear factors in target societies; and

• maximise impact by creating cascading effects, notably by tailoring attacks, combining elements from specific domains to overload even the best prepared systems, with unpredictable, negative consequences. These domains were outlined in a conceptual model which we, the European Commission’s Joint Research Centre and the Helsinki-based European Centre of Excellence for Countering Hybrid Threats, published in 2020.

Today, Europe is facing growing and increasingly complex security challenges. Hybrid threats have become integral part of our security concerns; war has returned to Europe; instability is increasing in Europe’s neighbourhood regions; there are attempts to manipulate election outcomes; and democracies increasingly are portrayed as weak governance systems. The possibility to spread disinformation rapidly and with great outreach via social media further exacerbates the potential impact of hybrid threats. Moreover, our increasing dependency on IT tools for our daily work, banking, health management as well as for elections and governance, means that every European, Member State and company is at some risk of being impacted by hybrid threats. We should also be aware that the impact of hybrid threats is not simply restricted to the security domain but also links to defence. As seen in the Communication ‘Commission contribution to European defence, it urgently calls for a major boost to European resilience and defence.

Hybrid threats have become increasingly common over the past 10-15 years, and we can fully expect them to grow both in frequency and impact in future. The problem of hybrid threats is however not one that can be solved just at national and/ or regional level: a concerted effort across Europe, involving all relevant partners, is crucial. For this reason we already proposed in 2020 a conceptual
9 Executive summary model that has proven a useful tool for policymakers when addressing hybrid threats.

As outlined in recent EU policy initiatives such as the ‘Communication on the EU Security Union Strategy’3 and ‘A Strategic Compass for Security and Defence’4 we are seeing fast-moving developments and an increased level of sophistication in hybrid threats. Resilience against hybrid threats therefore needs to be designed and implemented at all levels, and has to consider resilience measures, not only from multiple domains’ perspective but as a comprehensive ecosystem approach. In other words, developing resilience against hybrid threats necessitates looking beyond resilience in individual areas, building it systemically while considering dependencies and interdependencies between the different parts of society.

To address these issues, we in this report for the first time apply a systems-thinking approach to hybrid threats, with representation of society as a whole. Throughout the elaboration of the report and the underpinning scientific work, we have been in dialogue with Member States, notably via the Horizontal Working Party on Building Resilience and Countering Hybrid Threats of the Council of the European Union, as well as other key stakeholders. In concrete terms, we in this report propose a comprehensive resilience ecosystem (CORE) model to facilitate decision-making for policymakers. The novelty of the CORE model is how it allows policymakers to estimate how adversaries employ hybrid threats in order to alter democratic decision-making capabilities. It shows how the hybrid threat activity bit by bit challenges democratic systems by introducing different types of stress. It also allows monitoring the dependencies and possible cascading effects. This is important for the detection of hybrid threats.

Foresight plays a crucial role in this process. The CORE model is based on the following elements, as also visualised in the following page:

1. Seven foundations of democratic systems lie at the heart of the ecosystem. The foundations are the ultimate goals that hybrid threat actors aim to undermine, while scoring some of their own strategic interests.

2. The domains from the conceptual model also are an integral part of the ecosystem. If resilience is well developed in the domains, they can act as shields against malicious activities. On the other hand, a lack of resilience in the domains can open entry points for hostile actors.

3. The ecosystem consists of three spaces – Civic, Governance and Services – which represent the three sectors of society.

4. The layers of the ecosystem represent the different ‘levels’ that exist in society – from the more local levels to international levels. The connections between the four types of elements represent the whole-of-society approach. Since elements are interconnected, resilience-building measures for one element will affect other elements, positively or negatively. Actors behind hybrid threats aim to exploit the various elements and their interconnectedness to maximise their impact. Therefore, policymakers need to understand the interdependencies between the various elements, in order to build resilience against hybrid threats and for early detection of malign activity.

This ecosystem model supports anticipation and foresight work in imagining developments, assessing the scale of risks and disruptions, and representing worst case scenarios. Used as a strategic design board, the CORE model can help identify the right measures to counter the effects of hybrid threats in all spaces and layers of the ecosystem. It can help to implement a holistic approach against hybrid threats and serve as a foundation for the creation of the EU Hybrid toolbox which was announced in ‘A Strategic Compass for Security and Defence’.

The seven case studies presented in this report demonstrate the extent to which hybrid threat activity can undermine and weaken the foundations of a well-functioning democratic ecosystem.

Written in response to the above-mentioned EU policy initiatives, this report may therefore be considered a strategic manual for Member States and EU institutions on how to anticipate hybrid threats, evaluate their potential impact, and identify how to pre-empt or minimise their negative impact. Of particular value are the various case studies, the timeline outlining how hybrid threats have developed, and the cultural/linguistic comparisons. All of these contribute to a broad, multi-cultural perspective that lead to a deeper understanding of what hybrid threats constitute in this day and age, while offering tangible guidance on building resilience and preparing for future challenges.

Looking ahead, the Russian invasion of Ukraine in particular highlights the need for further research on the following points:

• The Conceptual Model on hybrid threats can be further optimised by taking into account experiences from the ongoing war including the increasing role of disinformation by Russia, and how this to a large extent has been countered, not least by the Ukrainian president who has communicated well and continuously with his people and the rest of the world, being visible and transparent in showing what is going on, addressing fellow democracies to ask for support, and creating positive reactions to his country and people, successfully making Ukraine’s cause the entire democratic world’s cause.

• The particular case of countries in an ongoing democratisation process could be explored further, as they already have the systemic vulnerabilities of democracies but not all the protection of established institutions, traditions, and processes of democracy.

• Seeing how Russia escalated from priming and destabilizing to actual coercion, crossing the threshold from hybrid threats to conventional war, it is essential to develop a better understand of the influence of culture, mind-set and values of hostile actors, to understand their thinking. That way we will be in a better position to understand, interpret and anticipate their strategic goals, and, crucially, to pre-empt of minimise their impact.

This report is a Science for Policy report by the Joint Research Centre (JRC), the European Commission’s science and knowledge service, prepared together with the European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE).
Jungwirth R., Smith H., Willkomm E., Savolainen J., Alonso Villota M., Lebrun M., Aho A., Giannopoulos G.,