CSS Analyses in Security Policy
No. 332, November 2023

Assessing Hybrid War:
Separating Fact from Fiction
Fear of “Hybrid War”, a blanket term describing gray zone aggression
short of all-out war, remains widespread. Many expect information
technology to enable revolutionary gains in this strategic space. Yet,
Hybrid War’s track record does not support these expectations.
Consequently, it is crucial to conduct a more systematic assessmentof the different instruments used under this umbrella term.

By Lennart Maschmeyer
For close to a decade, analysts and defense
planners have now warned of the looming
menace of “Hybrid War”. Yet, it remains
strikingly unclear which instruments ofpower politics this involves, and the extent
of a threat Hybrid War actually poses.
Nonetheless, Western states have expended
significant resources to fend off this threat.
This year, the EU has announced an entire
mission in Moldova tasked with countering “hybrid threats”, its first mission of thiskind. Hence, it is both urgent and important to assess these threats.
Unfortunately, Hybrid War is notoriously
ill-defined. Both policy debates and academia use it mostly as an umbrella term for
all kinds of aggression short of all-out warfare. These include, but are not limited to,disinformation, sabotage, subversion, andcyber operations. Russia’s takeover and illegal annexation of Crimea in 2014, its
support of armed separatists in Ukraine’s
Donbass region (including through unmarked troops of “little green men”), and alarge-scale cyber campaign were perceived
to demonstrate the power of these instruments. Academic interest skyrocketed andmany scholars have argued that such lowintensity aggression would become the future of warfare. Policymakers picked upthese arguments and associated threat perceptions, and have shifted strategy and defense priorities accordingly.

© 2023 Center for Security Studies (CSS), ETH Zürich“Hybrid War” as envisioned by the Midjourney AI, October 2023. Designed by Lennart Maschmeyer andgenerated using Midjourney

A Technological Revolution?

Aggression short of war itself is nothing
new. States have long employed instruments in the “gray zone” between war andpeace. Prevailing conceptions of Hybrid
War assume that the use of information
technologies makes gray zone aggression
more effective. Specifically, there is an expectation that information technologies
expand the speed, scale, and intensity ofgray zone conflict through cyber and social
media influence operations. Cyber operations offer the ability to reach across borders to sabotage infrastructure, cause economic havoc, and disrupt communications
at a moment’s notice. Meanwhile, social
media influence campaigns have the potential to sow panic, create confusion, andsway public opinion to change voting outcomes. Consequently, many expect states

1

CSS Analyses in Security Policy 

can now achieve outcomes that were notpreviously possible without going to war.
Reflecting this common threat perception,states have adjusted their defensive strategies and priorities towards countering Hybrid War. NATO has made countering“hybrid threats” a core priority of its strategy in 2015.These threats are understoodas a combination of “military and non-military as well as covert and overt means, including disinformation, cyber-attacks, economic pressure, deployment of irregular
armed groups and use of regular force”. The
recent establishment of a European Partnership Mission in Moldova, whose priority is to defend against hybrid threats from
Russia, further suggests that policymakers
clearly perceive Hybrid War as a significant
threat, despite a lack of clear definition.
While there are no official figures for budget allocations to this specific threat, given
the prioritization of the concept in strategy
and official statements, it is reasonable toexpect expenditure to be significant. The

No. 332, November 2023

strategic gains. Hence, expectations of atechnologically enhanced revolution in
conflict have not been confirmed.
On the contrary, if Hybrid War allows
states to achieve strategic goals that were
not previously possible without going towar, then the logical assessment of Russia’s“Hybrid War” against Ukraine since 2014is that it failed since it pursued a full-scaleinvasion in 2022. One explanation is that
Russia failed to achieve its strategic goals,
including its primary goal of reversing
Ukraine’s pro-Western foreign policy. In
that case, the core expectation of Hybrid
War theorists is proven false by the very
conflict that made the concept so popular.
Russia went to war precisely because aggression short of full-scale war faltered.

Alternatively, one might argue that Hybrid
War alone is incapable of achieving Russia’s strategic goals. This would imply that
Hybrid War is nothing but “old school”
gray zone conflict, making the term irrelevant. Yet, the fear of Hybrid
Prevailing conceptions of
War remains very much alive.
Even Russia’s initial theory ofHybrid War assume that the
victory significantly relied on
use of information technology“hybrid” means such as sleeper
cells, corrupt local officials, andmakes gray zone aggressioncommando forces, which failed
more effective.
in the face of unexpectedly effective resistance by Ukraine.
current debate on adding Hybrid War as a Importantly, the effectiveness of Ukraine’s
fourth core task to NATOs mission further resistance also defies prevailing fears that
underlines this point. Even Russia, ostensi- hybrid threats erode the cohesion of societbly an expert in hybrid warfare, has justi- ies and their capacity to resist aggression
fied a 70 per cent increase in military over the long term.
spending in 2023 by claiming the need tocounter Hybrid War being “unleashed by If anything, one could make a strong casethe West”. Meanwhile, China has made in- that Russia’s persistent aggression has enfluence operations, or cognitive warfare in hanced Ukraine’s resilience by “training” its
military terms, a key component of its doc- defenders in fending off cyber-attacks
trine in order to make up for its forces’ lack among other things. Of course, Ukraineof wartime fighting experience.
has also received significant assistancefrom its Western partners. Still, while theAn Underwhelming Track Record
precise causes of Ukraine’s capacity to resist
In contrast to prevailing fears, however, still require more research, there is a strikHybrid War’s actual track record is rather ing absence of “smoking gun” evidence
modest. The biggest success, by far, is Rus- proving the success of Hybrid War. This
sia’s 2014 takeover of Crimea. However, situation is not unique to Ukraine.
according to recent research, cyber operations and social media disinformation In 2007, Russian hacking groups mounted
campaigns played no role in this feat. a series of disruptive cyber operations
Rather, this was a traditional subversive op- against Estonia in retaliation for the removeration without any cyber component. It al of a Soviet statue in an Estonian town. At
involved subversive proxy actors, primarily the time, this was heralded as the advent offringe religious groups, which handlers cyberwar, illustrating its grave threat tofrom Moscow had groomed over years. Western societies. Yet, these operations had
Conversely, the Russian cyber campaign little measurable impact on Estonia’s econagainst Ukraine that followed in its wake omy, government, or society and are bestlargely fell short of producing measurable classified as temporary nuisances. Instead of© 2023 Center for Security Studies (CSS), ETH Zürich

eroding Estonia’s strength, this aggression
galvanized its resilience and directly contributed to the establishment of NATO’s
Cooperative Cyber Defence Centre of Excellence in its capital Tallinn, which significantly enhanced not only Estonia’s but alsoNATO’s cyber capabilities.
Russia’s meddling in the 2016 US Presidential Elections offers a plausible case of a
successful hybrid warfare operation. Moscow combined the use of cyber operations
to hack and leak the Democratic National
Convention’s emails, as well as the emailsof Hillary Clinton’s campaign manager
John Podesta, social media disinformation
to sway voters and exacerbate polarization,and traditional subversion by placing assets
in Donald Trump’s campaign and subsequent administration. Through thesemeans, Russia may have contributed to theelection win of its preferred candidate. A
vast amount of alarmist news headlines,
followed by dire warning from policymakers and a flurry of academic research mapping purported troll networks on social
media suggest this operation was a great
success. Yet, despite the intense interest in
and research done on this case, there is a
striking absence of evidence indicating
measurable contributions of these Russian
activities toward political outcomes, namely voting outcomes. In fact, a recent study
by New York University showed that exposure to Russian influence operations via
Twitter did not change attitudes or voting
behavior. When assessing Russian hybrid
warfare activities over the past decade,there is a striking lack of clear evidence of
its effectiveness compared to mounting evidence of its limitations.

A More Systematic Assessment

This situation underlines the urgent needfor a more systematic assessment of thestrategic role of the diverse gray zone instruments commonly grouped under theconcept of Hybrid War. The first crucial
step is to identify and distinguish these different instruments. There are multiple relevant types of operations and corresponding effects.
First, influence operations aim to sway
public opinion as well as the perception ofpolitical leaders. The desired goal is to manipulate political decision-making andoutcomes, as well as societal trust and cohesion. Second, sabotage degrades anddamages infrastructure and material capabilities. The desired goal is to weaken theadversary and shift the balance of power in
one’s favor. Third, subversion is a specific2

CSS Analyses in Security Policy 

way to achieve some of these goals throughthe targeted infiltration of adversary societies and institutions. Cyber operations are
best conceptualized as new instruments ofsubversion. Apart from influencing andsabotaging, subversion can fulfill more ambitious goals as well, such as overthrowing
a government through an internal coup or
by triggering a revolution, either armed orunarmed. This effect is an especially potent
instrument of power since it changes theunderlying preferences of a state, thusaligning it with one’s own interests in a waythat goes deeper than coercion throughmilitary force. Meanwhile, armed revolution highlights a fourth type of covert operations, namely the clandestine and covert
use of force. Clandestine operations referto hiding the activity itself, such as thestealthy US operation to kill Osama Bin
Laden. Covertness in turn refers to hiding
the identity of the aggressor, such as
through the deployment of unmarked soldiers – the infamous Russian “little greenmen” in Crimea.
Once the instrument is established, thenext steps are determining the larger strategic goals the adversary aims to achieve,
and then a careful examination of available
evidence on the capacity of the instrument
in question to achieve these goals. Finally,
based on this evidence, a systematic assessment of the conditions under which thesedifferent instruments can succeed helps
clarify the extent of the threat.

Lessons from History

No. 332, November 2023

KGB’s decades-long expertise in mounting active measures – the contemporary
term for hybrid warfare – combined withthe openness of Western political and media systems created a ripe environment for
Russian influence operations and subversion and drew a pessimistic picture of resulting threats to Western societies. And
yet, as we now know, the Soviet Union collapsed soon after. Arguably, the situation is
not dissimilar today. Fears among policymakers and defense planners of Soviet influence operations and subversion during
the Cold War were mostly based on what
could potentially happen, neglecting thesignificant obstacles involved in producing
these desired effects in practice. The same
applies to threat perceptions and assessments concerning cyber operations andsocial media disinformation campaigns.
Recent studies found that the vast majority of subversive operations aiming to overthrow regimes failed. Mounting evidenceof the shortcomings of cyber operations
points in a similar direction. Fortunately,
not all that is possible in theory is feasible
in practice.

Reasons for Optimism

Moreover, there are clear signs of unintended “blowback” of influence operations.
Subversion, influence and disinformation
operations are described by experts likeputting a virus in the bloodstream of yourenemy. Yet, just like actual viruses, there is areal risk of spread beyond the targeted society. Accordingly, the Mitrokhin archive (arecord of KGB operations leaked by thedefector Vasili Mitrokhin) documents agrowing paranoia among the KGB’s leadership over the course of the Cold War
about potential traitors in its own ranks,

For policymakers, the first challenge incountering Hybrid War is to separate fiction from fact. Of course, policymakers
must plan for contingencies and consider
both past and hypothetical scenarios. However, the best way A more systematic assessment
to realistically project whatof the strategic role of the diverse
could happen in the future is todraw inferences from what hap- gray zone instruments grouped
pened in the past. Accordingly,
under the concept of Hybrid War
a useful baseline for addressing
future threats is what Hybrid is needed.
War has actually achieved inpractice. Such an assessment, including and correspondingly growing efforts andhistorical examples namely the use of co- expenditure to hunt down and punishvert operations during the Cold War, gives these traitors. These efforts increasingly
reasons for confidence. Fear of influence undermined the KGB’s core mission:
operations and sabotage is nothing new but namely, to weaken the United States. Spewas a key theme among Western defense cifically, there are multiple examples of theplanners and policymakers. Fortunately, KGB leadership, and by extension the Soviet leadership, believing its own propaganthese fears were not always justified.
da and making policy decisions based on it,
A 1981 report by the US Department of with detrimental outcomes. The decision toState on Soviet “active measures” provides invade Czechoslovakia in 1968 is one of
an instructive example. It argues that the them. The Soviet leadership expected an© 2023 Center for Security Studies (CSS), ETH Zürich

Further Reading
Chiara Libisller, “’Hybrid Warfare” as an
Academic Fashion,” Journal of Strategic
Studies 46:4 (2023), pp. 1–23.
Rory Cormac / Richard J. Aldrich, “Grey Is the
New Black: Covert Action and Implausible
Deniability,” International Affairs 94:3
(2018), pp. 477–94.
Christopher S. Chivvis, “Hybrid War: RussianContemporary Political Warfare,” Bulletin of
the Atomic Scientists 73:5 (2017) pp. 316–21.
Arsalan Bilal, “NATO Review – Hybrid
Warfare – New Threats, Complexity, and‘Trust’ as the Antidote,” NATO Review,
30.11.2021.
Mark Galeotti, “Hybrid, Ambiguous, and
Non-Linear? How New Is Russia’s ‘New Wayof War’?,” Small Wars & Insurgencies 27:2
(2016) pp. 282–301.
Lennart Maschmeyer, “The Subversive
Trilemma: Why Cyber Operations Fall Shortof Expectations,” International Security 46:2
(2021) pp. 51–90.

impending counterrevolution and overwhelming public support for the Soviet intervention, both of which only existed in
Soviet propaganda. Consequently, what
was supposed to be a short-term occupation had to be extended for the rest of theCold War. Russia’s invasion of Ukraine,with troops expecting public support for“liberating” the country, suggests a similar
situation now. In fact, there is a growing
consensus among analysts that Putin, having expelled any non-loyalists from his administration, has been misinformed andprone to believe Russian propaganda.
Without access to the Kremlin, this remains hard to prove.
Perhaps counterintuitively, closed and autocratic systems may be more vulnerable toblowback and dysfunction than open anddemocratic systems. While the openness of
democratic systems facilitates influence
operations, the existence of multiple sources of information and competing narratives
within the public sphere provides opportunities to challenge and counter disinformation narratives. Of course, this depends ona functioning media ecosystem and becomes increasingly less possible as polarization increases. In closed autocratic systems, however, there are typically far lessalternate sources of information and competing narratives. Therefore, autocratic systems are intimately vulnerable to fall preyto their own disinformation and manipula-3

CSS Analyses in Security Policy 

No. 332, November 2023

tion. These structural differences provide
strengths and weaknesses, both of which

key conclusion is not to dismiss HybridWar. Rather, effective counterstrategies require a more systematic assessment of the specific instruClosed and autocratic systems
ments involved and how to
may be more vulnerable toneutralize them. On the one
hand, this means acknowledgblowback and dysfunction thaning the lasting importance ofopen and democratic systems.
traditional (non-technologically enhanced) influence, saboshould be considered. Such an assessment tage and subversion operations and priorisuggests a relative advantage for democrat- tizing responses accordingly. On the otheric systems that should be a source of confi- hand, considering the strategic heritage ofdence in countering disinformation and the gray zone instruments that Hybrid
influence operations.
War comprises is also crucial. Since these
instruments are not as new as they may apEven if Hybrid War is less effective than is pear, building on counterintelligence stratcommonly assumed, it still constitutes a egies and lessons learned from the past canpotentially significant threat. Hence, the help. In particular, the logic of deception

CSS Analyses in Security Policy is published by the Center for Security
Studies (CSS) at ETH Zürich. The CSS is a center of competence for Swiss andinternational security policy. Each month, two analyses are published inGerman, French, and English.
Editor: Névine Schepers
Language editing: Névine Schepers
Layout and graphics: Miriam Dahinden-Ganzoni
Feedback and comments: analysen@sipo.gess.ethz.chMore editions and online subscription: www.css.ethz.ch/cssanalyses

and its value both in offense and defense isimportant to consider. A significant challenge will be the fact that integrated campaigns, which are comprised of a range ofgray zone instruments – both traditionaland “cyber” – , will require an integrated response that bridges existing institutionaland doctrinal silos.

For more on Military Doctrine and Arms
Procurement, see CSS core theme page.

Lennart Maschmeyer is Senior Researcher at theCenter for Security Studies (CSS) at ETH Zürich,where he focuses on cyber conflict, power politics,
and subversion.

Most recent editions:
The Role of Mediation Support Structures No. 331
UN Peacekeeping No. 330
German Military Planning: Aims and Trade-Offs No. 329
Managing Disaster Costs No. 328
Central Asia in an Era of Great-Power Rivalry No. 327
The Promise and Paradox of Science Diplomacy No. 326© 2023 Center for Security Studies (CSS), ETH Zürich
ISSN: 2296-0244; DOI: 10.3929/ethz-b-000638728 

4