An unidentified object crosses into Lithuanian airspace from Kaliningrad and is quickly picked up by NATO radar systems. It’s small, fast, and unregistered. Shortly thereafter, three more similar objects joined in formation.
NATO aircraft are scrambled. Commercial flights in and out of Vilnius are rerouted, and ground traffic is halted completely. For a few tense hours, everything stops while NATO is on high alert. But the incident passes — the drones were only in Lithuanian airspace for a few minutes. Yet another close call on a growing list.
Now reimagine the same sequence, only this time the worst-case scenario ensues: A passenger jet on approach to Vilnius is suddenly on a collision course with a handful of unidentified unmanned aerial objects that have drifted into the jet’s flight plan. Air traffic control is saturated. The objects are misclassified or detected too late. There is no time to adjust the jet’s trajectory.
This time, Europe wakes up to not just another near-miss incident, but instead to a disaster that has resulted in mass civilian casualties.
Troubling as it may sound, there is nothing hyperbolic or exaggerated about this scenario — the conditions for this sort of catastrophe are already in place. Indeed, it is chillingly close to events at Dublin airport in December as President Zelenskyy’s plane was landing. Such is the present reality of Russia’s shadow war against Europe.
There are dozens of variations of Russian shadow war tactics, many of which are designed for more deliberately catastrophic outcomes. A bomb planted by a proxy agent could derail a passenger train on its way through Poland. A severed cable in the Baltic could kill the power in an Estonian intensive care unit. The list goes on – and each of these possibilities mimics real events of the past few years.
Since the beginning of the full-scale invasion in 2022, Russia has systematically expanded its war against Ukraine into Europe’s interior. Unable to confront NATO and EU allies conventionally, Moscow is deploying diffuse and deliberately hard-to-attribute operations across European land, sea, and airspace. The objective? To challenge EU/NATO cohesion, readiness, and willingness to support Ukraine’s defense with attacks that fall just below the threshold that would trigger an allied military response.
Effectively deterring Russian shadow war has been a persistent challenge for NATO and the EU. Allies are inherently constrained by several factors, including uneven threat perceptions, domestic political divisions, and differing thresholds for escalation. Moscow is keenly aware of these disconnects and has mastered the ability to exploit them.
But there is a deeper issue among allies compounding these restraints. Most problematically, Russian shadow war is persistently mischaracterized by allies. Instead of understanding the various tactics that make up Russian shadow war as one comprehensive campaign, they are generally dealt with on a case-by-case basis. Sabotage is generally handled through law enforcement; cyber incidents are considered technical concerns; subsea disruptions are considered maritime incidents.
Attribution further compounds the problem. Russian shadow operations are deliberately designed to obscure responsibility, making it exceedingly difficult for allies to efficiently carry out the legal process and respond in a timely manner. Moscow increasingly relies on proxies, criminal networks, and deniable intermediaries to blur the line between state action and criminality. This ambiguity is not a byproduct — it is the strategy. By denying allies a clear “smoking gun,” Russia slows decision-making, fractures consensus, and reinforces a pattern of restraint.
Over the last year, CEPA has undertaken an intensive study of Russian shadow war. We have analyzed and tracked how the shadow war system propagates the Kremlin’s philosophy of perpetual war with the West; the actors, methodology, and governance structure involved in carrying out Russia’s shadow war; and most importantly, where NATO and the EU’s key vulnerabilities lie.
Our findings show that deterrence has failed not for lack of awareness, but for lack of coherence. In order to effectively deter Russian shadow war, several key reorientations must take place. Perhaps the most essential will be building responses under a single deterrence framework: Cyberattacks, cable cuts, drone incursions, proxy violence — these are not isolated threats. They are parts of a single, coordinated campaign. Until allies respond with the same unity — by aligning military, intelligence, legal, and economic tools into a single deterrence framework — effective deterrence will remain out of reach.
Hereto, attribution and deterrence must rest on cumulative pattern recognition, not courtroom standards of proof. To paraphrase Riley: if it looks like a duck, walks like a duck, and quacks like a duck, allies shouldn’t wait for a court ruling to attribute an attack to Russia and respond accordingly.
Finally, restoring deterrence will require the political will to withstand inevitable escalatory rhetoric from Moscow. Stronger, more coherent responses to shadow war will provoke threats and saber-rattling; this intimidation is designed precisely to paralyze allied decision-making before action is taken. Allies must not allow Russian bluster to dictate thresholds or timelines. Instead, they should establish a standing, predictable menu of consequences, ranging from cyber and intelligence operations to economic pressure and expanded support for Ukraine, that can be deployed quickly, decisively, and consistently. The objective is not to seek confrontation, but to ensure that every act of shadow aggression carries a clear and unavoidable cost.
Time is of the essence. Every day that passes without a more cohesive allied strategy for deterring Russian shadow war leaves the door open for the sort of catastrophe outlined earlier. Must we wait for our Lusitania to be sunk before taking decisive action?
David Kagan is the Senior Program Officer for the Democratic Resilience program at CEPA. He is the author of “The Veiled Invasion: Deterring Russian Infiltration in Europe” in CEPA’s study of Russian shadow war, “War Without End: Deterring Russia’s Shadow War”
Europe’s Edge is CEPA’s online journal covering critical topics on the foreign policy docket across Europe and North America. All opinions expressed on Europe’s Edge are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict intellectual independence policy across all its projects and publications.
War Without End: Deterring Russia’s Shadow War
Either Europe will continue allowing Russia’s shadow war to set the terms of escalation, or it will act now to prevent a larger war.
CEPA Forum 2025
Explore CEPA’s flagship event.
