In yesterday’s piece, I touched upon the silent tensions building in the Baltic Sea and how cCapabilities are being assembled out of the public eye. As I was finalizing that draft, fresh statements from Finnish military intelligence and Parliament hit the headlines: Finland and its key decision-makers have already been targeted by coordinated gray-zone operations.
This is no longer an abstract “future threat scenario.” It is here now. Targeted harassment of MPs, critical infrastructure reconnaissance, GPS jamming, and sabotage conducted through proxies and clandestine networks are part of the environment we now have to operate in.
The question isn’t simply what Russia will attempt next. The more important question is: Where is the West’s critical threshold, and at what point do we shift from passive defense to active counter-measures?
The Escalation Ladder: From Gray-Zone Pressure to Strategic Retaliation
When analyzing hybrid warfare through a strategic lens, there is a recognizable escalation ladder. But it should not be understood as a fixed sequence in which every rung must automatically be climbed.
It is better understood as a response matrix: different combinations of attribution, severity, strategic effect, and escalation risk produce different possible responses. For too long, the West has sometimes appeared to play a game where the opponent lands strikes while we merely patch up the holes.
Level 1: Low-Threshold Disruption — Current State
Russia’s current playbook across Finland and the Nordic-Baltic region.
The objective is not necessarily territorial conquest. It is to complicate political decision-making, create uncertainty and fear, strain civil-defense resources, and impose costs while remaining below the threshold of conventional armed conflict. The methods include political harassment, cyber operations, GPS interference, infrastructure reconnaissance, influence operations, and — where attribution permits — sabotage through deniable proxies.
The important point is that not every incident can or should automatically be attributed to Moscow. Strategic analysis requires distinguishing between a genuine Russian operation, criminal activity, opportunistic disruption, and an incident whose perpetrator remains unknown. As noted in reoports the operations agains 20ish members of Finnish parliamentis a very iffy thing: Methods are straight for STASI/KGB playbook, but no signs of brake ins and activities in premises are hard to attribute to anyone. but it is clear that pay-per-do operation was not used. These perps were skillfull. Catburglars are almost unheard of phenomena in Finland
Level 2: Defensive Response and Attribution
The West’s default reaction.
Incremental sanctions packages, intelligence cooperation, attribution, expelling intelligence officers operating under diplomatic cover, and public exposure of hostile activity. These measures are necessary. But if they become the only response, the adversary can eventually begin to regard them as a predictable operating cost.
Level 3: Active Enforcement
Transitioning from passive monitoring to active enforcement.
This could include more aggressive use of existing maritime, environmental, sanctions, insurance, port-state and flag-state authorities against vessels belonging to or supporting Russia’s so-called shadow fleet.
The key distinction is legal authority. A vessel cannot simply be boarded because it is suspected of belonging to the shadow fleet. Any physical interception must rest on a defensible legal basis. Nevertheless, the strategic principle is clear: where existing law permits enforcement, enforcement should actually be enforced.
Level 4: Asymmetrical Countermeasures
The West steps beyond a purely defensive posture.
This does not necessarily mean publicly acknowledged cyberattacks on Russian infrastructure. It could involve a broad spectrum of countermeasures designed to impose costs on Russian state interests, military logistics, intelligence networks, or strategic infrastructure.
The important strategic point is ambiguity. Deterrence does not necessarily require a published retaliation menu. In fact, strategic ambiguity can sometimes be more effective. If Moscow knows exactly which action triggers which response, it can calibrate provocations accordingly.
If, instead, the adversary knows that a range of responses exists — and cannot confidently predict which one will be selected — the expected cost of gray-zone activity rises. This is where the old “madman” logic becomes relevant, albeit in a very different context from nuclear MAD. Deliberate uncertainty about the precise response can itself become part of deterrence.
Level 5: Direct Strategic Disruption
The final threshold before open kinetic confrontation.
Specialized operations or long-range strategic disruption directed against Russian military logistics, supply chains, or strategically important infrastructure.
This is precisely where escalation risks become acute.
The objective should therefore not be to climb the ladder for its own sake. The objective is to make sure Moscow understands that the West possesses credible options considerably beyond simply repairing the damage and issuing another statement of concern.
Concrete Tit-for-Tat Tools: What Real Deterrence Looks Like
| Russian Action | Traditional Western Reaction | Possible Countermeasure |
|---|---|---|
| Undersea cable / infrastructure sabotage | Condemnation & new sanction lists | Aggressive use of existing maritime, environmental and sanctions authorities against implicated vessels |
| DDoS & cyber attacks | System repair & public attribution | Proportionate counter-cyber measures and disruption of hostile infrastructure where legally authorized |
| Political harassment & proxy sabotage | Increased security & diplomatic notes | Tighter diplomatic restrictions, expulsions, and restrictions on intelligence-linked personnel |
| Gray-zone escalation across the flank | Expressions of concern | Predefined but deliberately flexible response options, including stronger support for Ukraine |
The important word here is possible.
A deterrence policy should not publish a neat menu saying “Russia does X, therefore the West does Y.” That would make the system easier to game.
A better approach is to make the existence of multiple response options unmistakable while retaining uncertainty over which option will actually be selected.
The Nicaragua Question
There is also an important legal distinction that should not be lost in the strategic argument.
The 1986 Nicaragua judgment is sometimes invoked to argue that arming and assisting another state remains below the threshold of an “armed attack.”
That is overly simplistic. The International Court of Justice distinguished between an “armed attack”, other forms of unlawful force, and unlawful intervention. The Court did not establish that military assistance is simply “below the threshold of war” and therefore legally unproblematic.
This distinction matters in case Russia against west 2024-202?. European and NATO states can provide weapons, intelligence, training and other forms of assistance to Ukraine without that assistance automatically constituting an “armed attack” against Russia. But the legal categories involved are more complicated than a simple war/no-war binary. The same caution applies to Western countermeasures against Russian gray-zone activity.
The question is not simply whether something is “an act of war.”
The questions are:
- What does international law permit?
- What constitutes an armed attack?
- What constitutes unlawful use of force?
- What constitutes intervention?
- What measures are available as lawful countermeasures?
- And, perhaps most importantly, what actions create an unacceptable risk of escalation?
Those distinctions matter because strategic deterrence built on an incorrect legal premise is not deterrence. It is wishful thinking.
The Turkey 2015 Example
Historical precedents do show that clearly enforced boundaries can change an adversary’s calculations.
When a Russian Su-24 violated Turkish airspace in November 2015, Turkey shot the aircraft down. NATO subsequently emphasized both Turkey’s right to defend its airspace and the need for de-escalation and mechanisms to prevent further dangerous incidents.
The lesson here is not as straightforward as “shooting down the aircraft made Russia back down.”
The more defensible lesson is narrower: When an adversary is testing a clearly defined boundary, uncertainty about whether that boundary will actually be enforced can create incentives for further testing. Credible rules of engagement can therefore matter. But the same example also demonstrates the danger: enforcement can produce immediate strategic costs and simultaneously create a serious escalation crisis. That is precisely why red lines require both credibility and restraint.
The Trump Variable
One particularly uncomfortable question concerns Washington. President Trump’s public posture toward Putin and Russia has repeatedly generated speculation about why his approach differs from that of many European leaders. There are several possible explanations: domestic political constraints, different strategic priorities, a desire to preserve negotiating leverage, personal political calculations, or something less visible.
Claims about Russian kompromat belong in the category of hypotheses rather than established facts. There isn’t public evidence sufficient to establish that the Kremlin is controlling US policy through blackmail. But IMHO this seems to be most likely explanation.
But that does not make the underlying strategic question irrelevant. Moscow does not need to know the real reason for Washington’s behavior. It only needs to believe that the United States is unusually constrained, reluctant to impose costs, or politically divided. Perception itself can alter an adversary’s calculations.
And this is where the European question becomes particularly important. If Moscow perceives the United States as unwilling or unable to impose meaningful costs for gray-zone aggression against European states, the incentive structure changes. That perception can be wrong. But deterrence depends partly on what the adversary believes.
The Power of Clear — and Deliberately Unclear — Red Lines
The West faces a difficult paradox.
Completely undefined red lines invite testing.
Completely predictable red lines can be gamed.
The solution may therefore be neither total ambiguity nor a rigid escalation ladder, but a credible response matrix in which the adversary knows that consequences exist without knowing precisely what form they will take.
The objective is not to threaten war. The objective is to make gray-zone aggression less attractive. Calculating adversaries do not necessarily stop because of diplomatic concern. They stop when the expected cost of an action exceeds its expected benefit. That calculation can be changed without crossing into open war.
A Shield Alone Is Not Deterrence
The boundary between peace and war has been deliberately blurred.
If the West and NATO define security solely as absorbing attacks and repairing the damage, strategic initiative gradually shifts to whoever is willing to take the initiative in the gray zone.
Effective deterrence is therefore not established merely by building a thicker wall or issuing formal protests. It is established when the adversary understands three things:
We can detect your actions.
We can attribute them.
And we possess multiple credible ways of imposing costs in response.
The final question for Parliament and our Western allies is therefore not simply:
How far up the ladder are we prepared to climb?
It is:
How much uncertainty are we prepared to create in Moscow about where the next rung actually is?
