EU capitals are quietly preparing for how the bloc should respond to a major hybrid attack that leaves several citizens dead — an outcome that looks increasingly likely, according to five EU diplomats and officials.
But the efforts to prepare are exposing splits on how much of a role the EU should play on security matters, and whether the bloc’s efforts are redundant with NATO.
The talks about a nightmare attack scenario have taken place in recent weeks among EU ambassadors from all 27 countries gathering in “restricted format,” meaning without phones or assistants. Discussions have ramped up since the discovery of an explosives-laden drone at Leipzig airport in August, said the diplomats and officials, who were granted anonymity to discuss the confidential exchanges.
While the EU has discussed such scenarios for years — unveiling a “hybrid toolbox” geared at coordinating responses to cyberattacks, election interference, and sabotage — the latest talks zeroed in on the risk of more serious attacks that cause large-scale casualties. Two diplomats said a meeting among EU ambassadors last Wednesday focused specifically on such examples.
Since Russia’s full-scale invasion of Ukraine, the EU says Moscow has intensified a campaign of cyberattacks, sabotage and other covert operations across the bloc.
“Europe’s democracies are facing a growing number of threats,” European justice Commissioner Michael McGrath told POLITICO. “We are strengthening our capacity to anticipate and detect threats, improve early warning and ensure that Europe can respond quickly and collectively when our democratic resilience is tested.”
The talks among EU diplomats and ministers have focused on deploying emergency response teams, freeing up pockets of EU money to help the affected state, and how EU institution leaders should communicate, one EU official said.
“We have to be prepared for something serious,” a senior EU diplomat said. “Unfortunately, Leipzig showed us that a very serious incident, something that causes multiple casualties, is not out of the question.”
A second EU official added: “Given the scope and scale of Russia’s action there are bound to be casualties sooner than later. It’s sheer luck there haven’t been any yet.”
The bloc is reeling from near-daily reports of so-called hybrid attacks — a label used by the EU and NATO to describe subversive activity that falls below the threshold of a direct act of war. On Tuesday, several sailors were declared missing after their ship was sunk by drones in the Black Sea, according to Bulgarian officials.
This followed the Leipzig airport incident, a suspicious fire at a Polish ground-link station handling Starlink communications, and a plot to plant incendiary devices in commercial transport hubs around the EU and U.K., alongside regular airspace violations.
“It is quite obvious that when Russia is using more and more lethal tools to test our preparedness and willingness to take counter measures, at some point there will be casualties,” said Teija Tiilikainen, director of the European Centre of Excellence for Countering Hybrid Threats. “At some point, intentionally or unintentionally, this is what happens.”
If several EU or NATO-member citizens are killed in what appears to be an attack, the pressure to act will be overwhelming on both institutions. “We’re very afraid that at some point an allied life” will be taken, said one NATO diplomat, which will make the “pressure very high” to act.
Yet EU-level discussions are prompting criticism from some capitals that the EU is overstepping its security role and potentially duplicating NATO’s core functions, the transatlantic alliance that has underpinned European security for 80 years.
“It risks being very confusing for decision-makers at all levels,” said Oana Lungescu, a distinguished fellow at RUSI and former spokesperson for NATO. “If there is confusion or duplication, that risks slowing down the decision-making, which has implications because time is always of the essence.”
Another problem is the EU’s lack of secure communications and suspicion that sensitive information shared during ambassador gatherings can be leaked, several diplomats said. Reports that Hungary’s ex-foreign minister shared the contents of leader-level talks with his Russian counterpart only deepened these concerns, leading capitals to restrict truly sensitive information to NATO formats.
“My government is very suspicious of sharing sensitive intelligence in Coreper or even in the leaders’ room,” said a diplomat from an eastern flank state. “It either shows up in the media or goes straight to Moscow.”
Overlapping protocols
The pushback coincides with European Commission President Ursula von der Leyen’s efforts to bolster the bloc’s security credentials.
In her latest State of the European Union speech in Strasbourg, the former German defense minister pitched an “emergency security protocol” to help EU states coordinate in exactly the kind of scenario being discussed. The protocol, along with von der Leyen’s pitch to create a “European Security Council,” is expected to feature in a landmark “European Security Strategy” due out in early November, according to two diplomats.
But several diplomats pushed back, arguing these efforts would take months to set up and potentially duplicate functions that already exist inside the EU.
Instead of creating new formats that add complexity, one senior national diplomat said the EU should double down on the crisis-response tools it already has.
“We’re very uncomfortable about [the] emergency security protocol,” the diplomat said. “We already have mechanisms in place. If there is a crisis, we have the Integrated Political Response (IPCR) that worked very well during the pandemic and other crises.”
Putin doesn’t care
Established under the scope of the Lisbon Treaty, the IPCR allows the holder of the EU’s rotating presidency, at the request of an affected country, to call emergency meetings involving experts from NATO, the U.N., or other international bodies.
In the event of a major hybrid attack, the onus remains on the affected country to decide on the best way forward. France triggered the EU’s Article 42.7 following the 2015 Bataclan attacks, marking the only time the mutual assistance clause has been invoked. However, Lungescu noted this was a “political decision” by Paris that did not lead to major displays of mutual assistance beyond coordinating terror investigations between France and Belgium.
To avoid confusion over who does what during a mass-casualty event, Lungescu said both parties should divide labor: NATO handling intelligence-sharing and military deterrence, and the EU focusing on civilian response.
For Tiilikainen, EU efforts to coordinate responses to hybrid attacks are useful — within limits. However, she noted they are “not comparable with resilience measures at a national level,” such as Finland’s “comprehensive security” approach.
Lungescu also stressed that Moscow makes no distinction between the two organizations. “Frankly, [Russian President Vladimir] Putin doesn’t care whether decisions are taken by Coreper 2 or the NAC,” she added, referring to the meetings of EU ambassadors or NATO’s decision-making body. “This is not how Moscow thinks.”
Victor Jack contributed reporting.
The Axel Springer Global Reporters Network harnesses the resources of the company’s newsrooms to publish ambitious scoops, investigations, interviews, opinion pieces and analysis. It allows journalists — including those from POLITICO, The Telegraph, Business Insider, WELT, BILD, Onet and Fakt — to collaborate on major stories for an international audience of hundreds of millions across platforms: online, print, TV and audio.