Egmont Institute logo

Protect, Strengthen, Prepare: Deterrence through Awareness, the Benefits of Implicit Attribution

Post thumbnail print


To counter the increasingly aggressive hybrid campaign raging on their soil, the EU and its members states are grappling with the challenge to develop efficient instruments to counter this elusive type of warfare.


Protect, Strengthen, Prepare: Deterrence through Awareness, the Benefits of Implicit Attribution

To counter the increasingly aggressive hybrid campaign raging on their soil, the EU and its members states are grappling with the challenge to develop efficient instruments to counter this elusive type of warfare. It is logical that deterrence would be a crucial aspect of any tool, and this could be best achieved through attribution. However, even in the rare cases that there is enough irrefutable evidence pointing to the responsible malign perpetrator, attribution is often very hard to achieve, especially in an EU context, as 27 member states have to agree on it. The protection and enhancement of the EU’s electoral resilience under Belgian Presidency suggests, however, that attribution need not be explicit, as long as the malign actor is made to understand that the countries under attack and their citizens are on to their game. This type of awareness could largely take away the adversary’s power to manipulate.

Efficient EU instruments would therefore need to be able to give a clear message to the malign actor, but can stop short of explicitly attributing, allowing for a degree of plausible deniability. The Hybrid Rapid Response Teams, a belated delivery from the Strategic Compass, created under the Belgian Presidency, are ideal to fulfil exactly such a role.


Vulnerable, but not helpless

When Belgium assumed the Presidency of the Council of the EU (January till June 2024), the European Union was facing the prospect of simultaneous European Parliamentary (EP) elections in every EU country, against a background of a fundamentally different geopolitical paradigm from the last EP elections in 2019 (War in Ukraine, emergence of new technologies and the legacy of a former US President showed the world that much cheaper ways exist to attack the integrity of electoral processes than vote stuffing).

The Belgian Presidency considered it a priority to address the hybrid risks to these elections and realized that strategic communication is key to counter foreign interference, especially in an electoral context, as the threat of disinformation is often underestimated. Therefore, “Council conclusions on democratic resilience” were proposed: “safeguarding electoral processes from foreign interference”, listing all the pioneering instrument the EU has developed in this context (Digital services act, rapid alert system, democracy action plan, etc.).  The Conclusions were adopted at the General Affairs Council of 21 May 2024, purposefully a few weeks before the EP elections and contain a balanced message: we are vulnerable, but not helpless, thus signalling that foreign interference and disinformation campaigns surrounding the elections were increasing, while the EU was monitoring and countering them. The document was welcomed with a declaration from the Foreign Ministers of the Weimar triangle, France, Germany and Poland, joined by a majority of Member States, to underline the timeliness and to call for a swift follow-up.

Simultaneously, at the April European Council, in response to several scandals (e.g. the Voice of Europe scandal uncovered by The Czech Republic whereby several European Politicians had been paid to give pro-Russian interviews.) the Belgian Prime Minister announced that IPCR (Integrated Political Crisis Response Mechanism) would be activated against foreign interference in the run up to the EP elections. Through this mechanism, the presidency of the Council coordinates the political response to the crisis by bringing together EU institutions, affected member states and other key actors. The activation was a bold and surprising move, as this mechanism, in the hands of the rotating Presidency, is rarely activated, usually in reaction to serious crises (Covid, Ukraine War, Middle East, Afghanistan, etc.). Moreover, for the first time ever, a Presidency decided on an activation in information-sharing mode, rather than full activation. This choice contains an important message: there is a clear danger, but not yet a crisis. IPCR-activation requires the European Commission to produce regular reports, drawing from all existing sources, scattered across EU institutions and Member states.  IPCR turned out to be crucial to connect the dots and to link all relevant information.  At the same time, IPCR activation gave the message that this issue was now chefsache and actively scrutinized at the pinnacle of European decision making.

Both Council Conclusions and IPCR-activation allowed the EU to raise the awareness of this threat, as foreign interference was really pushed to the top of the European agenda and came to dominate the work of several institutions for a few weeks. It is the general belief among EU Policy makers and fact checkers that this focused attention given to foreign interference played an important role in mitigating the danger: 2 days after the elections, the Election Task Force of the European Digital Media Observatory concluded that “Awareness around the issue of disinformation by the political and media environment, as well as by the general public – together with the readiness of institutions, platforms, fact-checkers, researchers and of everyone involved in the fight against disinformation – could have deterred malicious actors from any major attempt in the last few days and hours before the vote” and this despite the fact that “Disinformation about the EU increased significantly in the months before the vote”

This example illustrates the point that raising awareness can be a powerful deterrent, especially when it contains a certain degree of attribution, albeit with deniability.


Towards a “hybrid” form of attribution

For a successful instrument of deterrence, it is therefore crucial that the malign adversary clearly gets the message that we are on to its actions. This is why the HRRTs are such an important addition to the EU Hybrid Toolbox. They are teams of experts, deployable at short notice at the request of a Member State or Partner country, facing a sudden hybrid attack. During the Belgian Presidency a compromise was achieved on this file that had been blocked for 2 years and the “Guiding Framework on the Practical Establishment of the HRRTs” was adopted at the same General Affairs Council of 21 May.

Similar Hybrid Counter Support Teams already exist in NATO-context and have been deployed twice (Montenegro, Lithuania). The type of experts needed depends on the type of crisis, as a hybrid attack can be anything from lawfare to the sabotage of undersea internet cables or the weaponization of energy markets. As the EU is more than a military alliance, it covers a lot more policy domains than NATO and it is therefore logical that the EU should have its own mechanism to send experts in a certain hybrid domain.  However, the expertise the teams can provide, is only one aspect of their use.

A major advantage of having such teams is the deterrence those teams can provide through implicit attribution, as they are not an innocent tool:  their deployment in a broad range of circumstances, in response to a hybrid attack, always implies -by definition- the existence of a hybrid actor, engaging in instrumentalizing migration, weaponizing information or even illegally exploring a country’s territorial sea for energy resources.  Thus, sending such a team to an affected country could in most cases serve as instrument of implicit attribution. At the same time, it offers a firm show of solidarity by partner countries.

The main reason for the deployment of the NATO counter hybrid support team to the Lithuanian-Belarussian border, for example, was not to solve the crisis, which was done by other means. In practical terms, there was even little the team could do to counter the instrumentalized migration. They had a range of meetings with Lithuanian authorities and a visit to the border. The goal of the deployment of the team was more political signalling and showing solidarity.  Lithuanian Defence Minister Arvydas Anusauskas declared that “The arrival of NATO Counter Hybrid Support Team is important not only in solving the problems caused by hybrid aggression – once again it was proved that we are not alone, we have allies with whom we work closely and in crisis situations we can rely on their strong support.”

Also in Montenegro, the first team ever was deployed to strengthen the electoral legislative framework, but its stated aim was to “deter hybrid challenges”.



The measures to bolster the EU’s electoral resilience show that demonstrating awareness of malign actions to our adversaries can be a powerful deterrent and could discourage them, which makes a strong argument for HRRT’s. The effect of the IPCR activation illustrates that it pays to be bold.

Therefore, it is important that new tools always contain an important element of deterrence.  The announcement of the deployment of a certain counter hybrid instrument could sometimes be sufficient by itself to deter potential attacks, as perceptions are decisive in deterrence. It is thus important that the EU is clearly seen to make a more intense use of the tools at its disposal, like the Hybrid and FIMI toolboxes it has developed, and that the HRRT’s do not remain a paper tiger but will be effectively deployed when the circumstances demand it.



(Photo credit: Pete Linforth, Pixabay)