The old picture had two boxes.
For most of the twentieth century, Western thinking kept two kinds of conflict apart.
The first box held what most people picture when they hear the word war: tanks, artillery, air strikes and infantry, with one state's army fighting another's. It usually had a clear beginning. Borders were crossed, shots were fired, and sometimes war was formally declared.
The second box held everything kept quiet: sabotage, assassination, bribery, propaganda, covert intelligence work and, later, cyberattacks. This box was never small. In 1948 the American diplomat George Kennan described "political warfare" as "the employment of all the means at a nation's command, short of war, to achieve its national objectives."1 The Soviet Union ran its own version throughout the Cold War, which it called active measures: forged documents, planted stories and front organisations.
Kennan's two words, "short of war", sum up the old way of thinking. Everything in the second box was defined by not being war. Officially it was peacetime business, a matter for spies, police and diplomats. In the 2000s, Western analysts started calling the mix of open and hidden tools hybrid warfare.2
Box 1 · Conventional war
- Looks like
- Tanks, artillery, air strikes, infantry, warships
- Carried out by
- Uniformed armies of states
- Starts
- Openly: a border crossed, shots fired, sometimes a declaration
- Legal status
- War. The laws of war apply, and a state may defend itself.
Box 2 · "The other kind"
- Looks like
- Sabotage, assassination, cyberattacks, propaganda, bribery
- Carried out by
- Intelligence services, proxies, criminals, "volunteers"
- Starts
- Never declared, and often never admitted
- Legal status
- Officially peacetime. Handled by police, courts and diplomats.
A note on a word that often gets mixed up with these. Asymmetric warfare means a fight between sides of very unequal strength, such as insurgents against a modern army. The weaker side avoids the stronger side's advantages, but the fighting can be very open and very violent. Hybrid is about mixing tools and hiding the hand. Asymmetric is about an imbalance of power. They are different ideas.
Clausewitz never said war was a switch.
The most quoted line about war comes from the Prussian general Carl von Clausewitz, writing in the 1820s. War, he said, is "merely the continuation of policy by other means."3 The German word he used, Politik, means both "policy" and "politics".
The line is often heard as a description of a switch: politics stops, and war begins. But the key word is continuation. For Clausewitz, war doesn't end politics. The aims stay the same and only the tools change.
Read that way, the line fits today's world well. If war is politics carried on by other means, then a cyberattack, an act of sabotage, a dragged anchor on the seabed and a disinformation campaign are "other means" too. Nothing in the definition requires a declaration, a front line or a uniform.
From a switch to a dial.
The way we see it, the two boxes no longer hold. A better picture is a dial that can be turned up or down but rarely goes all the way back to zero.
Four ideas sit behind that picture:
- War is no longer binary. It isn't "peace" until a declaration and "war" afterwards.
- It is continuous. Pressure rises and falls but rarely stops.
- War and peace can exist side by side. A country can have open shops, working trains and normal elections while its undersea cables are cut, its warehouses set on fire and its public debate poisoned.
- The tools can be swapped. A state can move up and down the dial, mixing open force and hidden pressure, depending on what works and what it thinks it can get away with.
Take a real example. On Christmas Day 2024, the Estlink 2 power cable between Finland and Estonia was damaged on the floor of the Baltic Sea. Finnish authorities seized a tanker, the Eagle S, which they suspected of dragging its anchor across the seabed and which EU officials linked to the "shadow fleet" that carries Russian oil around sanctions.4 There were no soldiers, no front line and no declaration. Most people heard about it, if at all, as a technical story. On the dial, it sits somewhere in the middle.
- A rumour in a group chatDisinformation
- A hacked public websiteCyber
- A teenager paid via TelegramProxy recruitment
- An undersea cable cutInfrastructure
- A warehouse set alightSabotage
- Missiles on a power gridStrikes
- Tanks across a borderInvasion
The hidden hand: why attribution matters.
If it all happens together, why keep the word hybrid at all? Because one thing still matters a great deal, especially to governments: attribution, meaning working out who carried out an attack and being confident enough to say so in public.
A hybrid attack is designed to make that hard. The tools are chosen so the trail goes cold: recruits found on messaging apps and paid small sums, a ship sailing under a distant flag, criminal hackers who "just happen" to share a government's goals, an anchor that "slipped". The country behind it keeps plausible deniability. It can deny involvement and sound believable, or believable enough.
That denial works because responses depend on proof. A government that can't publicly and confidently say who did something will struggle to expel diplomats, impose sanctions, call on its allies or explain itself to its own voters.
So the difference between hybrid and conventional war isn't how much damage is done. It is how visible the attacker's hand is. A tank has a flag painted on it. A fire in a warehouse doesn't.
Open attack: the flag is visible
Troops in uniform, a missile with a known launch site. Everyone can see who did it.
Hybrid attack: the hand is hidden
A fire, a cut cable, a hacked system. Investigators may take months, and the answer may never be public.
A working definition, then. Hybrid warfare is aggression by one state against another using tools chosen so they can't easily be traced back to it, and kept deliberately below the point where they would count, legally and politically, as an armed attack. The European Union's own definition, from 2016, puts the second half in similar terms: activity carried out "while remaining below the threshold of formally declared warfare."5
The war you see and the war you don't.
Governments ask, "can we prove who did it?" Citizens can ask a simpler question. There is the war you can see, and the war you can't see. You are part of both.
The war you can see is what reaches the news as war: missiles, a front line, soldiers, a declared emergency. The war you can't see is the cable cut on a holiday, the warehouse fire, the hacked water system, the teenager recruited for a few hundred euros, the rumour that spreads in a neighbourhood chat group.
Above the surface · the war you can see
- Missile strikes
- A front line
- Soldiers and tanks
- A declared emergency
Below the surface · the war you can't see
- Undersea cables cut
- Warehouse arson
- Hacked utilities
- Recruited teenagers
- Rumours in group chats
- Energy price shocks
- Election interference
There is a famous line that captures this, though it needs handling with care.
You may not be interested in war, but war is interested in you.
The story of the quote is a small lesson in itself. A line travels, loses its context and picks up a more famous author along the way. The same thing happens to rumours during a crisis, which is one reason the hidden war often runs through information.
When the boxes merge: Ukraine.
Not all modern war is hidden. Russia's full-scale invasion of Ukraine in February 2022 brought back tanks, trenches and artillery on a scale Europe had not seen in generations. But it also shows how tightly the two boxes are now tied together.
At Homefront we have started calling this complex war (our own working term): war in which the open fighting and the hidden pressure are so closely linked that you can't pull them apart, and politics runs through all of it.
The front line
Tanks, drones, artillery and infantry in eastern and southern Ukraine.
Cyberattacks
On 24 February 2022, an attack on the Viasat satellite network also cut remote control of about 5,800 wind turbines in Germany.8
Energy strikes
Missiles on power stations through winter, aimed at civilian morale as much as at soldiers.
Information
Campaigns aimed at Ukrainians, Russians and Europeans, meant to split support and wear down patience.
Sabotage in Europe
Arson and explosions aimed at countries supplying Ukraine, from London to Poland.9
Economic pressure
Gas cut-offs in 2022, and a "shadow fleet" of tankers moving oil around sanctions.
In a war like this, asking "is this the military part or the hybrid part?" stops being useful. The same campaign that fires the missile also cuts the cable and writes the rumour. That is why it matters to people living far from Ukraine. The campaign that runs through the trenches also runs through European airports, seabeds and phone screens.
A different map: how Russian strategy sees it.
Not every country thinks of war and peace as opposite ends of a line. Europe's main adversary, in its official writing, does not.
In 2013, General Valery Gerasimov, Russia's Chief of the General Staff, wrote a widely quoted article arguing that "wars are no longer declared and, having begun, proceed according to an unfamiliar template," and that non-military means had in many cases become more effective than force of arms.10 Western commentators later called this the "Gerasimov doctrine". The analyst who coined that phrase, Mark Galeotti, has since said it was never a doctrine at all.11 It is more accurate to call it Gerasimov's article.
A more useful word is protivoborstvo, usually translated as "confrontation" or "struggle". Russian strategic writing uses it to describe relations with the West as a lasting condition, with no clear beginning or end, carried on in peacetime as much as in war.12 Russia's 2014 Military Doctrine describes modern conflict as combining military force with "political, economic, informational and other non-military measures."13
Western law and habit
A threshold separates two states. Crossing it changes what is allowed, and what a victim can do in response.
Russian strategic writing
One continuous struggle that only changes intensity. There is no clean line to cross.
If you see yourself as permanently in a confrontation, acts the West would call acts of war (sabotage, assassination, attacks on infrastructure) can be justified in what is formally peacetime. Those acts are exactly what hybrid warfare is made of. Put plainly, the grey zone is not a gap in this way of thinking. It is where this way of thinking operates.
One distinction matters here. This describes a state's doctrine and official narrative, which are well documented. It does not describe what every Russian believes. Opinion polling under censorship is unreliable, and many Russians are disengaged from politics rather than mobilised by it.
What the law says, and where it falls short.
If war is now a dial, what does the law say? The short answer is that the law has already moved away from the old idea of declared war, but it still works on thresholds.
International law speaks of force, not war
The UN Charter of 1945 hardly uses the word "war". It bans the threat or use of force against another state, and keeps the right to self-defence against an armed attack.14 The Geneva Conventions of 1949 apply to declared war "or any other armed conflict", even if one side doesn't recognise a state of war. Since then, what counts in law is the fact of armed force between states, not a declaration.15 Formal declarations have almost disappeared. Russia did not declare war on Ukraine; it called the invasion a "special military operation".
But "use of force" and "armed attack" are not the same thing. In 1986 the International Court of Justice confirmed that some uses of force are not grave enough to count as an armed attack.16 So a state can act unlawfully against another, and the victim may still have no right to respond with military force. The law works less like a switch and more like a ladder.
Armed attackGrave use of armed force against a state
Use of forceUnlawful, but below an armed attack
Unlawful interventionCoercion in another state's affairs
Unfriendly actHostile, but not illegal
Alliances have stretched the trigger, on paper
NATO's Article 5 says an armed attack on one ally is an attack on all.17 It has been invoked only once, after the attacks of 11 September 2001. Since 2014, NATO has said several times that cyber and hybrid attacks could trigger it, to be decided case by case.18 In practice it has never done so for a hybrid attack. Allies have more often used Article 4, which simply calls for consultation when a member feels threatened. The vagueness is deliberate. NATO wants an attacker to be unsure where the line is. The cost is that the line may be unclear to the alliance too.
The EU has its own mutual assistance clause, Article 42(7), whose wording is in some ways stronger than NATO's.19 It has been used once, by France after the Paris attacks in 2015. For hybrid activity, the EU has mostly reached for sanctions rather than defence. In October 2024 it created a sanctions regime aimed at Russia's destabilising activities, from sabotage and cyberattacks to election interference, and this month it extended that regime to October 2027.20
- 1949North Atlantic Treaty. Article 5: an armed attack on one is an attack on all.
- 2001Article 5 invoked for the first and only time, after 9/11.
- 2014Wales summit. Cyber defence declared part of collective defence.
- 2015Article 42(7) used for the first time, by France after the Paris attacks.
- 2016EU Joint Framework on hybrid threats sets out a first shared definition.
- 2018Brussels summit. Allies agree that hybrid warfare could lead NATO to invoke Article 5.
- 2021Brussels summit. Many smaller cyberattacks, added together, could count as an armed attack.
- 2024EU hybrid sanctions regime created against Russian destabilising activity.
- 2025Preparedness Union Strategy advises households to be ready for 72 hours on their own.21
- 2026Sanctions regime extended to October 2027.
National constitutions still describe a switch
Most European constitutions still treat war as a formal state that a parliament switches on. In Germany, for example, a "state of defence" is declared by parliament when the country is attacked by armed force.22 Italy's constitution goes further and repudiates war as a way of settling disputes. These rules exist for good reasons. They keep war-making under democratic control and stop every incident from becoming a reason to fight.
But put the pieces together and the gap is plain. The legal framework is built around thresholds that can be crossed. The threat is designed never to cross them. A country can be under sustained attack while its legal status stays "peace".
What this means for you.
None of this means every power cut is an attack. Some incidents turn out to be crime, accident or bad luck. Assuming the worst every time helps an attacker as much as ignoring the problem does, because both make it harder to see what is actually going on.
It also doesn't mean "we are at war" in the old sense. That would be alarming and, legally, untrue. A more accurate way to put it is this: you can be at peace on paper and still be under attack.
Europe doesn't need to copy Russia's worldview, and it shouldn't militarise everyday life. But it no longer has the luxury of not seeing what is happening. If one side acts on a dial and the other only reacts to a switch, the side waiting for the switch is always late.
Seeing the dial is not about fear. It is a starting point for understanding what is happening, asking questions of the people who decide, and taking part in the response.
Some questions worth asking, of yourself and of the people who represent you:
- 1Who in my country decides that a hidden attack has happened, and who tells the public?
- 2When a government blames another state for an attack, what evidence does it share?
- 3What is my town's plan if power, water or phone networks go down for three days?
- 4Where did the story I just shared come from, and who benefits if I believe it?
A short glossary.
- Hybrid warfare
- Aggression using tools chosen so they can't easily be traced back to the state behind them, kept below the point where they'd count as an armed attack.
- Grey zone
- The space between peace and war where hybrid activity takes place. Hostile and damaging, but kept below the legal and political line.
- Attribution
- Working out who carried out an attack, and being confident enough to say so in public.
- Plausible deniability
- Arranging an attack so the country behind it can deny involvement and sound believable doing so.
- The threshold
- The line above which an attack counts as an armed attack and can trigger a military response or an alliance guarantee.
- Armed conflict
- The legal term for states using armed force against each other, declared or not.
- Asymmetric warfare
- Conflict between sides of very unequal strength. Not the same as hybrid warfare.
- Confrontation protivoborstvo
- In Russian strategic writing, a permanent state of struggle with an adversary, run in peacetime and wartime alike.
- Political warfare
- Kennan's 1948 name for using every means short of war to reach national goals.
- Complex war Our term
- War where open fighting and hidden pressure are so linked they can't be separated. Ukraine is the clearest case.