← The Lab Explainer  ·  War and peace

The changing nature of war.

For most of the last century, war was something that started and stopped. That picture no longer fits. Some of today's war is on the news. Most of it isn't. This is a guide to both, and to why the difference matters to people who will never see a front line.

A light switch with two positions, off and on, next to a radio volume dial whose needle sweeps between quiet and loud and never reaches zero. ON OFF Then QUIET LOUD never back to zero Now
From a switchto a dial

In short

  1. War used to be pictured as a switch: peace, then war, then peace again. Today it works more like a dial. The pressure rises and falls but rarely stops.
  2. Open fighting and hidden attacks (sabotage, cyberattacks, disinformation) are now parts of the same picture.
  3. What makes an attack "hybrid" is that it is built to be hard to trace. Without proof of who did it, governments struggle to respond.
  4. The law still works on thresholds. A country can be at peace on paper and still be under attack.
  5. For citizens, the useful question is simple. There is the war you can see and the war you can't. Both reach you.
Part 1

The old picture had two boxes.

For most of the twentieth century, Western thinking kept two kinds of conflict apart.

The first box held what most people picture when they hear the word war: tanks, artillery, air strikes and infantry, with one state's army fighting another's. It usually had a clear beginning. Borders were crossed, shots were fired, and sometimes war was formally declared.

The second box held everything kept quiet: sabotage, assassination, bribery, propaganda, covert intelligence work and, later, cyberattacks. This box was never small. In 1948 the American diplomat George Kennan described "political warfare" as "the employment of all the means at a nation's command, short of war, to achieve its national objectives."1 The Soviet Union ran its own version throughout the Cold War, which it called active measures: forged documents, planted stories and front organisations.

Kennan's two words, "short of war", sum up the old way of thinking. Everything in the second box was defined by not being war. Officially it was peacetime business, a matter for spies, police and diplomats. In the 2000s, Western analysts started calling the mix of open and hidden tools hybrid warfare.2

How the twentieth century sorted conflictFigure 1

Box 1 · Conventional war

Looks like
Tanks, artillery, air strikes, infantry, warships
Carried out by
Uniformed armies of states
Starts
Openly: a border crossed, shots fired, sometimes a declaration
Legal status
War. The laws of war apply, and a state may defend itself.

Box 2 · "The other kind"

Looks like
Sabotage, assassination, cyberattacks, propaganda, bribery
Carried out by
Intelligence services, proxies, criminals, "volunteers"
Starts
Never declared, and often never admitted
Legal status
Officially peacetime. Handled by police, courts and diplomats.
Box 1 + Box 2 Today: it all happens together
The second box went by many names over the decades: political warfare, active measures, covert action, irregular warfare, and now hybrid warfare or "the grey zone".

A note on a word that often gets mixed up with these. Asymmetric warfare means a fight between sides of very unequal strength, such as insurgents against a modern army. The weaker side avoids the stronger side's advantages, but the fighting can be very open and very violent. Hybrid is about mixing tools and hiding the hand. Asymmetric is about an imbalance of power. They are different ideas.

Part 2

Clausewitz never said war was a switch.

The most quoted line about war comes from the Prussian general Carl von Clausewitz, writing in the 1820s. War, he said, is "merely the continuation of policy by other means."3 The German word he used, Politik, means both "policy" and "politics".

The line is often heard as a description of a switch: politics stops, and war begins. But the key word is continuation. For Clausewitz, war doesn't end politics. The aims stay the same and only the tools change.

Read that way, the line fits today's world well. If war is politics carried on by other means, then a cyberattack, an act of sabotage, a dragged anchor on the seabed and a disinformation campaign are "other means" too. Nothing in the definition requires a declaration, a front line or a uniform.

Part 3

From a switch to a dial.

The way we see it, the two boxes no longer hold. A better picture is a dial that can be turned up or down but rarely goes all the way back to zero.

Four ideas sit behind that picture:

  • War is no longer binary. It isn't "peace" until a declaration and "war" afterwards.
  • It is continuous. Pressure rises and falls but rarely stops.
  • War and peace can exist side by side. A country can have open shops, working trains and normal elections while its undersea cables are cut, its warehouses set on fire and its public debate poisoned.
  • The tools can be swapped. A state can move up and down the dial, mixing open force and hidden pressure, depending on what works and what it thinks it can get away with.

Take a real example. On Christmas Day 2024, the Estlink 2 power cable between Finland and Estonia was damaged on the floor of the Baltic Sea. Finnish authorities seized a tanker, the Eagle S, which they suspected of dragging its anchor across the seabed and which EU officials linked to the "shadow fleet" that carries Russian oil around sanctions.4 There were no soldiers, no front line and no declaration. Most people heard about it, if at all, as a technical story. On the dial, it sits somewhere in the middle.

The dial: from quiet to loudFigure 2
Rarely at zero
Quiet · hard to traceLoud · impossible to miss
  • A rumour in a group chatDisinformation
  • A hacked public websiteCyber
  • A teenager paid via TelegramProxy recruitment
  • An undersea cable cutInfrastructure
  • A warehouse set alightSabotage
  • Missiles on a power gridStrikes
  • Tanks across a borderInvasion
Illustrative, not a ranking of harm. A quiet attack can do more damage than a loud one. What changes along the dial is how visible the attack is, and how easy it is to say who did it.
Part 4

The hidden hand: why attribution matters.

If it all happens together, why keep the word hybrid at all? Because one thing still matters a great deal, especially to governments: attribution, meaning working out who carried out an attack and being confident enough to say so in public.

A hybrid attack is designed to make that hard. The tools are chosen so the trail goes cold: recruits found on messaging apps and paid small sums, a ship sailing under a distant flag, criminal hackers who "just happen" to share a government's goals, an anchor that "slipped". The country behind it keeps plausible deniability. It can deny involvement and sound believable, or believable enough.

That denial works because responses depend on proof. A government that can't publicly and confidently say who did something will struggle to expel diplomats, impose sanctions, call on its allies or explain itself to its own voters.

So the difference between hybrid and conventional war isn't how much damage is done. It is how visible the attacker's hand is. A tank has a flag painted on it. A fire in a warehouse doesn't.

The attribution gapFigure 3

Open attack: the flag is visible

How visible is the attacker?

Troops in uniform, a missile with a known launch site. Everyone can see who did it.

What the victim can doSelf-defence, call on allies, sanctions, a clear public case.

Hybrid attack: the hand is hidden

How visible is the attacker?

A fire, a cut cable, a hacked system. Investigators may take months, and the answer may never be public.

What the victim can doInvestigate, prosecute the people caught, and wait for proof that may never come.
No clear attribution, no clear response. That gap is what hybrid attacks are built to exploit.

A working definition, then. Hybrid warfare is aggression by one state against another using tools chosen so they can't easily be traced back to it, and kept deliberately below the point where they would count, legally and politically, as an armed attack. The European Union's own definition, from 2016, puts the second half in similar terms: activity carried out "while remaining below the threshold of formally declared warfare."5

Part 5

The war you see and the war you don't.

Governments ask, "can we prove who did it?" Citizens can ask a simpler question. There is the war you can see, and the war you can't see. You are part of both.

The war you can see is what reaches the news as war: missiles, a front line, soldiers, a declared emergency. The war you can't see is the cable cut on a holiday, the warehouse fire, the hacked water system, the teenager recruited for a few hundred euros, the rumour that spreads in a neighbourhood chat group.

Above the surface · the war you can see

  • Missile strikes
  • A front line
  • Soldiers and tanks
  • A declared emergency

Below the surface · the war you can't see

  • Undersea cables cut
  • Warehouse arson
  • Hacked utilities
  • Recruited teenagers
  • Rumours in group chats
  • Energy price shocks
  • Election interference
Your home sits across both.
Figure 4. Most Europeans look around, see no war, and conclude there isn't one. What you can see is a poor guide to what is happening.

There is a famous line that captures this, though it needs handling with care.

You may not be interested in war, but war is interested in you.
Quote checkUsually credited to Leon Trotsky. He almost certainly never said it.6 The earliest known version comes from the American writer Fannie Hurst in 1941. The philosopher Michael Walzer used the modern wording in 1977 and called it a paraphrase of Trotsky; later writers dropped that word.7 Whoever said it first was right.

The story of the quote is a small lesson in itself. A line travels, loses its context and picks up a more famous author along the way. The same thing happens to rumours during a crisis, which is one reason the hidden war often runs through information.

Part 6

When the boxes merge: Ukraine.

Not all modern war is hidden. Russia's full-scale invasion of Ukraine in February 2022 brought back tanks, trenches and artillery on a scale Europe had not seen in generations. But it also shows how tightly the two boxes are now tied together.

At Homefront we have started calling this complex war (our own working term): war in which the open fighting and the hidden pressure are so closely linked that you can't pull them apart, and politics runs through all of it.

One campaign, many frontsFigure 5

The front line

Tanks, drones, artillery and infantry in eastern and southern Ukraine.

Cyberattacks

On 24 February 2022, an attack on the Viasat satellite network also cut remote control of about 5,800 wind turbines in Germany.8

Energy strikes

Missiles on power stations through winter, aimed at civilian morale as much as at soldiers.

One campaign. The politics can't be pulled out of the fighting.

Information

Campaigns aimed at Ukrainians, Russians and Europeans, meant to split support and wear down patience.

Sabotage in Europe

Arson and explosions aimed at countries supplying Ukraine, from London to Poland.9

Economic pressure

Gas cut-offs in 2022, and a "shadow fleet" of tankers moving oil around sanctions.

Political measures belong here too: staged "referendums" in occupied areas, passports handed out there, and the deportation of Ukrainian children.

In a war like this, asking "is this the military part or the hybrid part?" stops being useful. The same campaign that fires the missile also cuts the cable and writes the rumour. That is why it matters to people living far from Ukraine. The campaign that runs through the trenches also runs through European airports, seabeds and phone screens.

Part 7

A different map: how Russian strategy sees it.

Not every country thinks of war and peace as opposite ends of a line. Europe's main adversary, in its official writing, does not.

In 2013, General Valery Gerasimov, Russia's Chief of the General Staff, wrote a widely quoted article arguing that "wars are no longer declared and, having begun, proceed according to an unfamiliar template," and that non-military means had in many cases become more effective than force of arms.10 Western commentators later called this the "Gerasimov doctrine". The analyst who coined that phrase, Mark Galeotti, has since said it was never a doctrine at all.11 It is more accurate to call it Gerasimov's article.

A more useful word is protivoborstvo, usually translated as "confrontation" or "struggle". Russian strategic writing uses it to describe relations with the West as a lasting condition, with no clear beginning or end, carried on in peacetime as much as in war.12 Russia's 2014 Military Doctrine describes modern conflict as combining military force with "political, economic, informational and other non-military measures."13

Two ways of drawing the same lineFigure 6

Western law and habit

A threshold separates two states. Crossing it changes what is allowed, and what a victim can do in response.

Russian strategic writing

One continuous struggle that only changes intensity. There is no clean line to cross.

Simplified. Russian military writers disagree among themselves about where war begins, but the official framing treats the struggle as permanent.

If you see yourself as permanently in a confrontation, acts the West would call acts of war (sabotage, assassination, attacks on infrastructure) can be justified in what is formally peacetime. Those acts are exactly what hybrid warfare is made of. Put plainly, the grey zone is not a gap in this way of thinking. It is where this way of thinking operates.

One distinction matters here. This describes a state's doctrine and official narrative, which are well documented. It does not describe what every Russian believes. Opinion polling under censorship is unreliable, and many Russians are disengaged from politics rather than mobilised by it.

Part 8

What the law says, and where it falls short.

If war is now a dial, what does the law say? The short answer is that the law has already moved away from the old idea of declared war, but it still works on thresholds.

International law speaks of force, not war

The UN Charter of 1945 hardly uses the word "war". It bans the threat or use of force against another state, and keeps the right to self-defence against an armed attack.14 The Geneva Conventions of 1949 apply to declared war "or any other armed conflict", even if one side doesn't recognise a state of war. Since then, what counts in law is the fact of armed force between states, not a declaration.15 Formal declarations have almost disappeared. Russia did not declare war on Ukraine; it called the invasion a "special military operation".

But "use of force" and "armed attack" are not the same thing. In 1986 the International Court of Justice confirmed that some uses of force are not grave enough to count as an armed attack.16 So a state can act unlawfully against another, and the victim may still have no right to respond with military force. The law works less like a switch and more like a ladder.

The ladder of thresholdsFigure 7
4

Armed attackGrave use of armed force against a state

UnlocksMilitary self-defence (UN Art. 51); NATO Article 5 and EU Article 42(7) can apply
The threshold
Where hybrid attacks aim to stay
3

Use of forceUnlawful, but below an armed attack

UnlocksProtest, countermeasures, UN action. No military self-defence.
2

Unlawful interventionCoercion in another state's affairs

UnlocksSanctions, expulsions, prosecutions
1

Unfriendly actHostile, but not illegal

UnlocksDiplomatic responses
Each rung unlocks a different set of responses. Hybrid warfare is the skill of staying on the lower rungs while doing upper-rung damage.

Alliances have stretched the trigger, on paper

NATO's Article 5 says an armed attack on one ally is an attack on all.17 It has been invoked only once, after the attacks of 11 September 2001. Since 2014, NATO has said several times that cyber and hybrid attacks could trigger it, to be decided case by case.18 In practice it has never done so for a hybrid attack. Allies have more often used Article 4, which simply calls for consultation when a member feels threatened. The vagueness is deliberate. NATO wants an attacker to be unsure where the line is. The cost is that the line may be unclear to the alliance too.

The EU has its own mutual assistance clause, Article 42(7), whose wording is in some ways stronger than NATO's.19 It has been used once, by France after the Paris attacks in 2015. For hybrid activity, the EU has mostly reached for sanctions rather than defence. In October 2024 it created a sanctions regime aimed at Russia's destabilising activities, from sabotage and cyberattacks to election interference, and this month it extended that regime to October 2027.20

How Europe's guarantees have stretchedFigure 8
NATOEuropean Union
  1. 1949North Atlantic Treaty. Article 5: an armed attack on one is an attack on all.
  2. 2001Article 5 invoked for the first and only time, after 9/11.
  3. 2014Wales summit. Cyber defence declared part of collective defence.
  4. 2015Article 42(7) used for the first time, by France after the Paris attacks.
  5. 2016EU Joint Framework on hybrid threats sets out a first shared definition.
  6. 2018Brussels summit. Allies agree that hybrid warfare could lead NATO to invoke Article 5.
  7. 2021Brussels summit. Many smaller cyberattacks, added together, could count as an armed attack.
  8. 2024EU hybrid sanctions regime created against Russian destabilising activity.
  9. 2025Preparedness Union Strategy advises households to be ready for 72 hours on their own.21
  10. 2026Sanctions regime extended to October 2027.
The direction is clear: more of the hidden war is named in official texts. The response is still mostly through sanctions and courts rather than through defence.

National constitutions still describe a switch

Most European constitutions still treat war as a formal state that a parliament switches on. In Germany, for example, a "state of defence" is declared by parliament when the country is attacked by armed force.22 Italy's constitution goes further and repudiates war as a way of settling disputes. These rules exist for good reasons. They keep war-making under democratic control and stop every incident from becoming a reason to fight.

But put the pieces together and the gap is plain. The legal framework is built around thresholds that can be crossed. The threat is designed never to cross them. A country can be under sustained attack while its legal status stays "peace".

Part 9

What this means for you.

None of this means every power cut is an attack. Some incidents turn out to be crime, accident or bad luck. Assuming the worst every time helps an attacker as much as ignoring the problem does, because both make it harder to see what is actually going on.

It also doesn't mean "we are at war" in the old sense. That would be alarming and, legally, untrue. A more accurate way to put it is this: you can be at peace on paper and still be under attack.

Our view

Europe doesn't need to copy Russia's worldview, and it shouldn't militarise everyday life. But it no longer has the luxury of not seeing what is happening. If one side acts on a dial and the other only reacts to a switch, the side waiting for the switch is always late.

Seeing the dial is not about fear. It is a starting point for understanding what is happening, asking questions of the people who decide, and taking part in the response.

Some questions worth asking, of yourself and of the people who represent you:

  1. 1Who in my country decides that a hidden attack has happened, and who tells the public?
  2. 2When a government blames another state for an attack, what evidence does it share?
  3. 3What is my town's plan if power, water or phone networks go down for three days?
  4. 4Where did the story I just shared come from, and who benefits if I believe it?
Words to know

A short glossary.

Hybrid warfare
Aggression using tools chosen so they can't easily be traced back to the state behind them, kept below the point where they'd count as an armed attack.
Grey zone
The space between peace and war where hybrid activity takes place. Hostile and damaging, but kept below the legal and political line.
Attribution
Working out who carried out an attack, and being confident enough to say so in public.
Plausible deniability
Arranging an attack so the country behind it can deny involvement and sound believable doing so.
The threshold
The line above which an attack counts as an armed attack and can trigger a military response or an alliance guarantee.
Armed conflict
The legal term for states using armed force against each other, declared or not.
Asymmetric warfare
Conflict between sides of very unequal strength. Not the same as hybrid warfare.
Confrontation protivoborstvo
In Russian strategic writing, a permanent state of struggle with an adversary, run in peacetime and wartime alike.
Political warfare
Kennan's 1948 name for using every means short of war to reach national goals.
Complex war Our term
War where open fighting and hidden pressure are so linked they can't be separated. Ukraine is the clearest case.

Notes.

Every claim can be traced. Tap a number in the text to see its note.

  1. George F. Kennan, "The Inauguration of Organized Political Warfare", Policy Planning Staff memorandum, 4 May 1948. US Department of State; Wilson Center Digital Archive. ↩
  2. Frank G. Hoffman, Conflict in the 21st Century: The Rise of Hybrid Wars, Potomac Institute for Policy Studies, 2007. ↩
  3. Carl von Clausewitz, On War (Vom Kriege), Book 1, Chapter 1, §24: "eine bloße Fortsetzung der Politik mit anderen Mitteln." ↩
  4. Finnish Police and Finnish Border Guard statements on the seizure of the Eagle S, 26–28 December 2024; EU High Representative statement on the Estlink 2 incident, December 2024. The investigation's findings are those of the Finnish authorities. ↩
  5. European Commission and High Representative, Joint Framework on countering hybrid threats, JOIN(2016) 18, 6 April 2016. ↩
  6. Quote Investigator, "You May Not Be Interested in War, But War Is Interested in You", 2 August 2021. Trotsky made a similar remark in 1940 about dialectics, not war. ↩
  7. Fannie Hurst, speech at a rally in Cleveland, November 1941, as traced by Quote Investigator (note 6); Michael Walzer, Just and Unjust Wars, 1977. ↩
  8. Enercon, statement on the loss of satellite communications to wind turbines, March 2022. The US, UK and EU later attributed the Viasat KA-SAT attack to Russia in May 2022. ↩
  9. In 2025 a British court convicted men recruited on behalf of the Wagner Group for the March 2024 arson of a London warehouse holding Ukraine-linked goods. In November 2025 Poland's government said Russian intelligence was behind an explosion on a railway line used to supply Ukraine. Attribution in each case is that of the authorities named. ↩
  10. Valery Gerasimov, "The Value of Science Is in the Foresight", Voyenno-Promyshlennyy Kurier, February 2013. English translation in Military Review, January–February 2016. ↩
  11. Mark Galeotti, "I'm Sorry for Creating the 'Gerasimov Doctrine'", Foreign Policy, 5 March 2018. ↩
  12. Centre for Security, Diplomacy and Strategy (VUB), "How Russia sees war: an examination", Policy Brief 33/2025; NDU Press, "The Russian Understanding of War: Blurring the Lines Between War and Peace", 2020. ↩
  13. Military Doctrine of the Russian Federation, December 2014. ↩
  14. Charter of the United Nations, 1945, Articles 2(4) and 51. ↩
  15. Geneva Conventions of 1949, Common Article 2; ICRC, "How is the term 'armed conflict' defined in international humanitarian law?", opinion paper. ↩
  16. International Court of Justice, Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States of America), Judgment, 27 June 1986. ↩
  17. North Atlantic Treaty, 1949, Articles 4 and 5. ↩
  18. NATO Wales Summit Declaration, 2014; Warsaw Summit Communiqué, 2016; Brussels Summit Declaration, 11 July 2018, para. 21; Brussels Summit Communiqué, 2021. See also CEPA, "Using NATO's Article 5 against hybrid attacks". ↩
  19. Treaty on European Union, Article 42(7). ↩
  20. Council of the EU, sanctions framework on Russia's destabilising activities, 8 October 2024; Global Sanctions, "EU extends Russia hybrid threats sanctions regime to October 2027", 8 October 2026. ↩
  21. European Commission, EU Preparedness Union Strategy, 26 March 2025. ↩
  22. Basic Law for the Federal Republic of Germany, Article 115a; Constitution of the Italian Republic, Article 11. ↩

Part of The Lab, Homefront's articles, research and maps.

More from the LabThis week's Signals