In the latest part of CEPA’s work on Russian shadow warfare, we published War Without End: Deterring Russia’s Shadow War on March 31. Here are the main recommendations.
Why Previous Attempts Have Failed
Shadow warfare is persistently misclassified.
Institutional mandates mean many shadow attacks are processed through criminal law and civilian enforcement frameworks. Cable disruptions are framed as maritime accidents and cyber intrusions managed as technical incidents, for example. Each response may be reasonable on its own, but when combined, they fragment responsibility so coordinated campaigns of hostile state action are handled as a series of unrelated problems.
The tempo of response lags the tempo of attack.
Russian operations are fast, deniable, and iterative. Western responses are slow, deliberate, and constrained by the need for consensus. By the time attribution has been established and response options weighed, the political urgency has often passed. Deterrence weakens when consequences arrive late or fail to arrive at all.
Fear of escalation produces ambiguity, which favors the aggressor.
By avoiding clear thresholds and predictable consequences, governments have hoped to avoid war. In practice, this restraint has raised Moscow’s tolerance for risk, and each unpunished act increases the space for the next one.
Deterrence is tethered to courtroom standards of proof.
Shadow warfare is designed to frustrate legal certainty. By insisting on incontrovertible evidence before responding, the West puts the initiative in Moscow’s hands. This is particularly true when attribution is based on intelligence sources that cannot be made public. Deterrence cannot rest on legal attribution alone; it must be informed by patterns, intent, and cumulative effect. This does not mean evidentiary standards should be lowered, but that governments must be able to act on secret intelligence assessments.
What Must Change
Attribution should be based on pattern recognition, not isolated proof.
Russian shadow warfare relies on deniability. Blame should rest on repeated operational signatures (methods, targets, timing, and intent), rather than treating each incident as a standalone criminal act.
Collective consultation should be routine, not exceptional.
European allies should normalize collective consultations in response to shadow aggression. Patterns of activity should trigger collective assessment and coordination.
Hybrid threats must be included in a single deterrence framework.
Cyber-attacks, disruption of critical undersea infrastructure, drone incursions, and proxy violence are mutually reinforcing elements of a unified Russian strategy. Allies should treat hybrid warfare as a continuous campaign, aligning maritime, cyber, legal, intelligence, and military tools under a shared logic of escalation.
Responses should be designed for speed and predictability, and include cyber and intelligence operations, action against vessels and networks supporting covert activity, economic measures to constrain Russia’s warfighting capacity, and direct support for Ukrainian defense.
The EU and NATO should harmonize capabilities and thresholds for action.
Fragmented decision-making and national caveats are the soft underbelly of European deterrence. To avoid duplication and close exploitable gaps, allies should formally divide responsibility, with NATO leading on detection, defense, and military response, and the EU leading on financial pressure, borders, law enforcement, and export controls.
Responses must be anchored in national security institutions.
Militaries and intelligence services — not law enforcement agencies — should lead the response to concerted campaigns of shadow warfare. Criminal investigations remain necessary to impose consequences on individuals, but they cannot be the primary framework for deterring a committed state actor. Their findings should feed into political and security decision-making structures, enabling fast action in coordination with partners across Europe.
Public–private coordination should be a key pillar of hybrid deterrence.
The frontline of Russia’s shadow war runs through privately owned systems and civilian spaces, including undersea cables, energy grids, warehouses, telecom networks, cloud platforms, and shipping. Allied governments should move beyond ad hoc information sharing to formal, legally mandated public–private security partnerships and integrate industry into threat detection, attribution, incident response, and resilience planning.
Allies should reassert durability in the face of Russia’s escalatory rhetoric.
Strong allied deterrence, as outlined in this report, will invite escalatory rhetoric from Moscow. Such intimidation is designed to paralyze allied decision-making before policies are implemented. It will need political will to tolerate intimidation without allowing it to dictate thresholds or timelines for action. Clear red lines, predictable consequences, and collective resolve must hold firm when Moscow responds with saber-rattling or worse.
Europe’s Edge is CEPA’s online journal covering critical topics on the foreign policy docket across Europe and North America. All opinions expressed on Europe’s Edge are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict intellectual independence policy across all its projects and publications.
War Without End: Deterring Russia’s Shadow War
Either Europe will continue allowing Russia’s shadow war to set the terms of escalation, or it will act now to prevent a larger war.
CEPA Forum 2025
Explore CEPA’s flagship event.
