Russia has demonstrated a growing willingness to use hybrid tactics – including sabotage, cyberattacks, information operations, and the use of deniable or “throwaway” agents – to create disruption and uncertainty across Europe. This paper examines how those tactics could be combined in a hypothetical Russian operation against Estonia designed not to defeat NATO militarily, but to create a crisis that tests the Alliance’s ability to respond quickly and collectively.
The scenario is deliberately constructed as a red-team exercise rather than a prediction. It envisions Russia exploiting the existence of Estonia’s Russian-speaking population, infiltrating operatives into the Schengen Area through legitimate visa channels, allowing those operatives to move through the largely borderless Schengen zone, and exploiting gaps in European immigration enforcement. The scenario culminates in a deliberately ambiguous armed crisis in Narva, accompanied by cyberattacks and a coordinated information campaign intended to complicate attribution and slow NATO decision-making.
The exercise identified several vulnerabilities. Some elements of the scenario are highly speculative, particularly Russian operatives' ability to obtain weapons once inside Estonia. Other elements, however, reflect existing conditions: Estonia’s large Russian-speaking population, the continued issuance of Schengen visas to Russian nationals, the decentralized nature of internal immigration enforcement, and the absence of a clearly identifiable EU-level capability dedicated to systematically analyzing the EES overstayer population for emerging national-security threats.
The paper therefore recommends three measures: continued EU-wide efforts to disrupt organized criminal networks that could provide support to hostile actors; eliminating tourist visas for Russian nationals except in limited humanitarian circumstances while developing a forward-deployed EU visa-security capability; and establishing a national-security immigration coordination center capable of analyzing immigration data against emerging threats and coordinating responses among Member States.
The central conclusion is that NATO’s military deterrence remains essential, but military strength alone cannot close every avenue through which a sophisticated hybrid operation could develop. Preventing such a crisis requires identifying and closing the less visible vulnerabilities that could allow hostile actors to establish themselves inside Europe before a crisis begins.
I. Introduction
Drones at Leipzig Airport. Drone incursions of NATO airspace. Throwaway agents. Arson and sabotage at facilities throughout Europe. 2026 has been a busy year, and it appears that Russia is engaged in an ongoing hybrid campaign on the European continent. The EU says that Russia’s goal is to spread fear, distrust, and undermine European unity. Additionally, just this Sunday, September 20, European security officials raised alarm that Russia is testing NATO resolve and could potentially even attempt a limited incursion into NATO territory.
This paper takes the current situation and threat picture as a starting baseline and imagines a scenario in which Russia creates a strategic crisis in Estonia, a NATO member, to discredit NATO collective defense and distract from the war in Ukraine by creating a sort of second front for NATO. In working through this thought exercise, the article examines what Russia could gain from escalation, how it might carry it out, and what security gaps the scenario identifies. Like with any hypothetical scenario, I suspect some will wholeheartedly disagree with my assertions. Still, I ask you to think of this as a red teaming exercise designed to identify vulnerabilities, and not an effort at forecasting.
II. Why might Putin want to escalate?
The “special military operation” that was supposed to take Kyiv in 6 days is going on for four years. Russia is not making significant gains on the battlefield, and whatever small gains it makes come at a prohibitive cost. The Center for Strategic and International Studies estimates that, since the full-scale invasion in 2022, Russia has suffered 450,000 dead and 1.4 million battlefield casualties. Moreover, Russian control of Ukrainian territory actually shrank in the Spring of 2026. The situation is so unfavorable that the Russian MoD now resorts to outright fabrication to claim battlefield gains that have not occurred.
Ukraine, on the other hand, seems to have stabilized its position after 4 years of war. It is becoming ever more adept at using drone technology and can finally bring the war home to Russia. Ukrainian long-range drones are now striking infrastructure deep inside Russia every week, including Russian oil refineries. This matters because Russian oil is the last remaining cash cow keeping the Russian economy afloat. And even though official Russian government numbers purport to show economic stability, a June report from the Kiel Institute for the World Economy concludes that “the Russian economy is showing clear signs of structural exhaustion.” Meanwhile, European support for Ukraine is strong across the continent, at least among mainstream political parties. On September 17, the EU Commission disbursed 3.3 billion euros to Ukraine – part of the 90-billion-euro Ukraine support loan. So in this war that increasingly looks like a war of attrition, it is Ukraine, and not Russia, that appears to be coming out on top.
In my assessment, these factors are gradually painting Putin into a corner, where he is slowly running out of options and may be forced to “flip the script.” In theory, one option Putin always has is a genuine move towards peace on fair terms, which should at minimum include a complete withdrawal of Russian forces from Ukraine. But he is stuck in a trap of his own making. If he relents on his maximalist demands and opts for fair peace, the entire very expensive and painful 4-year war would appear to have been fought for naught. That might very well threaten his political, or even personal, survival in a cutthroat political system. So, he is not willing to make peace. And sticking to business as usual looks like an eventual dead end as well.
In my imagined scenario, Putin invents a third option and chooses to escalate by launching a proxy military operation in Estonia. The operation has several goals. First, it aims to create a crisis NATO must solve on alliance territory, competing with NATO support for Ukraine. NATO would have to decide how to react to the crisis, and balance the reaction with the risk of escalation and full-blown war with Russia. Thus, as a second goal, Putin might succeed in discrediting Article 5 provisions of the defensive alliance if NATO’s response were to be slow or ineffective. Third, a military operation on NATO territory could force NATO partners to focus on their own defense rather than continuing to support Ukraine.
At first glance, this scenario may seem implausible or even reckless. After all, we have been almost conditioned to see NATO and Article 5 collective defense as an ironclad guarantee. This is one reason why countries that were formerly part of the Warsaw Pact flocked to NATO in the 1990s. But we also need to keep in mind that the concept of collective defense has not been routinely tested. Article 5 was invoked only one time – in the aftermath of the September 11 attacks against the United States. NATO has never dealt with a situation where an opponent seeks to test NATO boundaries by mapping out red lines, which I believe is exactly what Russia is doing. In other words, NATO has not yet been fully tested in hybrid war.
III. What might Putin assume about NATO?
We have discussed how the West views NATO. But what might Putin assume about the alliance, especially NATO’s willingness to go to war?
NATO is focused on defense and may prefer to avoid war. First, NATO explicitly describes itself as a defensive alliance and identifies preventing conflict and war as a core purpose of its deterrence and defense strategy. Putin could reasonably assume that NATO governments strongly prefer to resolve a confrontation without escalating it into a direct war with Russia. This does not mean NATO would fail to respond to an attack; rather, it creates a potential vulnerability that Russia could exploit by presenting NATO with an ambiguous crisis in which the costs of escalation are apparent, but the attribution of Russian responsibility remains contested.
NATO may be slow to act. An armed NATO response requires deliberation and consensus among alliance members. Article 5 obligations are triggered in instances of an armed attack, and determining whether an action is an armed attack is addressed on a case-by-case basis. NATO’s own materials note that “events that lack an international element, such as purely domestic acts of terrorism, do not trigger Article.” In Putin’s view, he could see case-by-case deliberations as a vulnerability and conclude that a deliberately vague scenario would make it difficult for the alliance to reach consensus quickly, keeping the window of action open for Russia.
Information operations may complicate consensus. NATO is a collective alliance of democracies, and democratic governments depend to some degree on public support and political legitimacy. In Putin’s assessment of the political situation, he may conclude that Moscow does not need to persuade NATO governments that Russia is innocent. It may only need to create enough confusion and debate within NATO populations to make decisive action more politically difficult. Russia has both the tools and demonstrated experience to flood the information environment with contradictory narratives. The U.S. State Department has documented Russian use of multiple, sometimes contradictory narratives specifically to generate confusion and discourage responses. NATO likewise describes hostile information operations as activities designed to “create confusion, deepen divisions, destabilize societies and ultimately weaken the Alliance,” and notes that such operations are not always intended to persuade audiences of a particular falsehood; they can instead be designed to muddy the information environment and make it more difficult to distinguish fact from fiction.
From Moscow’s perspective, the objective therefore need not be to achieve consensus around a pro-Russian narrative. It may be sufficient to prevent consensus around a coordinated response. If a crisis involving Estonia produced competing narratives about what happened, who was responsible, and whether Russia was directly involved, political divisions within individual NATO member states could complicate the Alliance’s response and make consensus harder to achieve.
Nuclear intimidation may complicate consensus. Putin may believe that nuclear signaling can amplify Western caution. Russia has repeatedly used explicit and implicit nuclear threats during the war in Ukraine. Evidence suggests these threats can have effects beyond traditional military deterrence, including a Chatham House assessment that Russian nuclear threats contributed to Western concerns about escalation and constrained some governments' willingness to provide Ukraine with certain forms of military support. This does not mean that Western populations will automatically oppose confrontation with Russia. Public attitudes toward nuclear deterrence have, in some cases, become more supportive since Russia's invasion of Ukraine. Rather, the point is that nuclear signaling adds an extra political cost to any decision to escalate a confrontation with Moscow. A Russian leadership that believes Western governments are highly sensitive to the prospect of nuclear escalation may therefore conclude that even an ambiguous or limited confrontation could be accompanied by nuclear rhetoric designed to encourage caution, delay, or disagreement within the Alliance.
Taken together, these assumptions suggest that what may appear from NATO’s perspective to be an irrational and extraordinarily risky decision—deliberately creating a crisis on NATO territory—could look considerably more rational from Moscow. Russia would not necessarily need to believe that NATO would stand aside. It would need to believe that NATO’s preference to avoid war, consensus-based decision-making, democratic political constraints, vulnerability to information manipulation, and sensitivity to nuclear escalation could create enough hesitation and disagreement to complicate a unified response. In this model, the objective would not necessarily be to defeat NATO militarily. It would be to create a crisis in which NATO’s overwhelming military advantage becomes difficult to translate into timely, unified political action. If Moscow believed such a crisis could fracture Alliance cohesion, force NATO to divert attention and resources from Ukraine, or show that Article 5 could be challenged without producing an immediate, unified response, the potential payoff might outweigh the risks in the Kremlin’s calculus.
IV. Free Narva – a Baltic hybrid war scenario
With the analysis of the previous sections in mind, I constructed a scenario in which Russia executes a deliberately ambiguous and confusing operation designed to threaten Estonia’s territorial integrity and test NATO’s resolve. In developing the scenario, I considered Russia’s potential objectives, lessons from previous Russian operations, the defensive measures Estonia and NATO have already adopted, and how Moscow might circumvent or exploit those defenses. This paper discusses the vulnerabilities identified through this process in a later section.
Phase 1 – Propaganda and throwaway agents
In October 2026, with the September Duma elections behind him and a comfortable supermajority win for his United Russia party, Putin decides to launch Operation “Narva Spring.” Analysts and think tanks pick up on increased messaging about the so-called “People’s Republic of Narva.” This is an entirely fictitious concept created by Russian intelligence, with a flag, notional borders, and a capital in Narva, a city of about 50,000 residents, 97% of whom are Russian speakers. The online narratives shared on Telegram, TikTok, and other platforms are the usual assortment of Kremlin grievance narratives about marginalized Russian minorities. Ongoing Estonian reforms that aim to make Estonian the official language of education in the country are weaponized and portrayed as “linguistic genocide” against Russian speakers.
The online propaganda campaign is amplified by Kremlin-controlled trolls and shared with pro-Russian Western influencers and political factions who decry Estonian government abuses of the Russian-speaking population. With the propaganda campaign at a fever pitch, the Kremlin is ready to escalate physically. But Russia cannot simply repeat the Crimea or Donbas scenario against Estonia. The Estonian border is one of the most heavily monitored frontiers in the world, where NATO has implemented a “deterrence by denial” strategy. This doctrine holds that defensive measures are so formidable the enemy sees an operation as too costly to attempt. Infiltrating several hundred “little green men” into Narva from Russia just across the river, while maintaining deniability, is not plausible. The Estonian side of the border is teeming with sensors.
But the Russians have been practicing another gray zone tactic recently – the use of “throwaway agents.” So, the Kremlin uses its network of low-level recruits to spray graffiti, place posters and stickers with QR codes, and eventually commit acts of arson and sabotage against local infrastructure and public property – and especially anything linked to law enforcement, security agencies and the courts. The goal is to create the appearance of local resistance against Estonian authority, while staying well beneath the threshold of armed conflict. But propaganda, graffiti, arson, and low-level sabotage are not the intensity of crisis the Kremlin needs. At this point, Russia needs to use specialists trained in fomenting armed violence on the ground.
Phase 2 – Infiltration
In 2014, Igor Strelkov emerged as the face of the armed separatist movement in Donbas, providing Moscow with something enormously valuable: an apparent local actor around whom an armed conflict could coalesce. To bring the Estonia situation from a nuisance to a crisis for NATO, Moscow needs people trained in violence, and a few Strelkov types to direct them. But how to bring them in? Estonia hasn’t allowed free travel for Russian citizens since 2022, and applications for entry for the few exceptions are closely scrutinized.
So, the Kremlin probes for weaknesses in the Schengen zone, and it finds these in Italy, France and Spain. In 2025, France, Italy and Spain collectively issued more than 441,000 Schengen visas to Russian nationals, while more than 477,000 Russian nationals received tourist visas across the entire Schengen zone. The refusal rate for Schengen visas for Russian nationals in 2025 was a mere 6.4%. The Schengen creates an interesting counterintelligence problem for Europe. Once a person has legitimately crossed the EU's external border, Europe's internal geography largely disappears.
In this scenario, Russia begins to infiltrate intelligence and military specialists from units like GRU’s Unit 29155 and the 390th Special Purpose Reconnaissance Point into the Schengen area starting in June 2026, before the launch of the Narva propaganda campaign and increased tensions. Even with the extra scrutiny for Russian visa applicants and shorter admission periods, the Russian operatives obtain tourist visas, enter Italy, and move with ease through Austria, Slovakia, Poland, Lithuania and Latvia via the excellent European train network and private commercial bus services. Once in Estonia, the operatives blend into the large Russian-speaking population and make their way to Narva. In total, just under a hundred Russian operatives follow this and other routes into Estonia over the summer months, and go to ground in the Narva region, supported by a tiny group of local sympathizers and a network of throwaway agents.
Even once the tourist visas of the Russian operatives expire, and they become illegal immigrants within the EU, nothing causes the system to blink red in reaction to this. In a way, no centralized, integrated system focuses specifically on immigration, so no lights blink red. Unlike the United States, Europe does not have an EU-wide interior immigration enforcement agency, and it currently lacks a central entity to monitor immigration violations against emerging national security risks, although that gap has been acknowledged. In terms of what exists today, in 2026, the EU rolled out the Entry/Exit System (EES), which captures biometrics from non-EU nationals entering the EU on short stays. So, in theory, the EES captures the biometrics of the Russian operatives in our scenario. And once their period of admission to the EU ends, typically at 90 days, the operatives are added to the EES “overstayer” list. But at present, unless the overstayer is also matched to additional alerts in the Schengen Information System – an EU-wide law enforcement database – no specific actions are automatically triggered, and law enforcement is not alerted.
Any interior immigration enforcement beyond this point is the responsibility of law enforcement within individual EU member states. If one of the operatives has the bad luck of being stopped by police and this results in a document check, the EES hit would likely show, and he would be detained. But the EES list is not proactively pushed to law enforcement for action. It is simply available to query. And importantly, EES is managed by eu-LISA – the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice – which is an agency focused on IT systems management and not law enforcement or security. In other words, no analysts are scouring the EES list for a sudden uptick in Russian nationals of military age being added to the overstayer list. Unless they attract attention to themselves, no one is coming for the Russian operatives. And in a city with a 97% Russian-speaking population, they don’t attract attention. Meanwhile, they quietly get to work acquiring small arms and mapping out critical infrastructure, communications, and defense and law enforcement sites.
Phase 3 – Estonian Donbas
By the end of 2026, the ground is set to initiate a crisis in earnest, in a way that gets NATO’s full attention. On January 2, 2027, a Saturday, Estonians are still recovering from the raucous New Year’s Eve celebrations. At 0700, Estonia's Information System Authority (RIA) Operations Center in Tallinn begins receiving simultaneous alerts indicating disruptions across government and critical infrastructure networks from unattributed sources. Analysts and incident handlers track the situation as key government and private-sector websites become unreachable due to denial-of-service attacks. Physical equipment begins to act erratically as unknown actors hack industrial control systems. Rail networks are disrupted. Traffic lights rapidly cycle in bizarre patterns. A few urban areas across Estonia lose electricity.
At the same time, radar operators identify air signatures from Russia, apparently heading toward Estonian airspace. Alert aircraft are scrambled. But the real crisis kicks off on the ground in Narva. Masked armed men, dressed in civilian clothing and wearing tricolor armbands, break into the empty Narva City Government building at Peetri Platz 5, climb their way to the top of the tower, and unfurl a green, black, and white flag. As the city government building is occupied and barricaded, another group of armed men attacks a nearby police station, overwhelms the skeleton crew, and takes a handful of hostages.
The last two groups are tasked with seizing the two border crossings across the Narva River. Narva 1 is the main border crossing point between Russia and Estonia, across the Friendship Bridge. A smaller, rarely used secondary crossing, Narva 2, sits about a mile south in a mixed industrial and residential area. The armed group attacking Narva 1 engages the border station building, about 380 meters from the foot of the bridge, drawing Estonian police defenders into a firefight. A second section of attackers takes up positions in the Narva Museum, a complex of 14th-century stone fortification with a commanding view of Friendship Bridge and the surrounding area, and supports the assault. Further south at Narva 2, the attackers similarly engage the border station, while setting up overwatch positions in the massive abandoned Kreenholm textile manufacturing complex.
While Estonian police defenders focus on attacks from the Estonian side of the border, additional attackers cross the bridges on foot and join the fight. These groups of men dressed in plain clothes are armed with heavier weapons including RPGs, squad machine guns and MANPADS. By 0800, both border crossings and bridges across the Narva River are seized, securing a thin but steady supply line from Russia. Reinforcements continue to stream into the city across the two bridges, and attackers strengthen their key defensive positions. Meanwhile, hundreds of small FPV drones appear in the skies above and begin hunting Estonian defenders. Anyone in a police or military uniform becomes a target.
Phase 4 – Information war
The chaos and fighting across Narva make for online content that quickly goes viral. With the hashtag #FreeNarva, videos of the chaos are shared across social media platforms, and pro-Kremlin trolls immediately label the situation as an uprising of the local population. A network of pro-Kremlin influencers in the West amplifies the content, then mainstream media in Europe and around the world pick it up. At 0900 local time, while the Estonian government and NATO are still trying to determine exactly what is happening in Narva and how to respond, the “separatist government” broadcasts its first official message from the seized City Government building.
Sitting behind a desk, with a black, green and white tricolor flag behind him, and flanked by armed men, the spokesperson announces the establishment of the Narva People’s Republic. In a short speech, delivered intentionally in Russian, he cites grievances against the Estonian government. He says the uprising is an act of self-preservation for Russian speakers in the region. Social media networks and news outlets quickly pick up the speech, adding to the moment's confusion. Kremlin trolls and their proxies call for support for the “world’s newest nation,” while cautioning against being pulled into World War Three by “Estonian fascists.” Memes quickly circulate featuring the mushroom cloud. Meanwhile, Russia expresses understanding of the separatist grievances but categorically denies having taken any part in the events. Putin appears on Russian television from a nuclear launch center and warns that an attack against Russian territory will result in a response using all available means.
Where does the scenario go from here? At minimum, Estonia would seek Article 5 consultations, but beyond that, the crisis could unfold in many different ways. I am not trying to explore every possible path. This hypothetical illustrates one way Russia could attack NATO territory while preserving enough ambiguity to complicate the Alliance’s response.
V. What gaps were identified?
Let us now examine how much of the hypothetical scenario reflects real-world vulnerabilities, how much was speculative, and what potential gaps the exercise identified.
Speculative Risk: Russian operatives' ability to acquire small arms once on the ground. The most speculative element of this scenario is the ability of Russian intelligence officers to acquire weapons through illicit means. While criminal networks trafficking illegal weapons exist and may extend into the Baltics, there is no basis to assume Russian operatives could readily access such networks without increasing the risk of detection. In the hypothetical scenario, weapons acquisition would therefore represent a significant uncertainty and a potential point of failure.
Confirmed Risk: Estonia has a large ethnic Russian and Russian-speaking population, with some evidence of social tensions in Narva, but the situation is nuanced. Official Estonian statistics show that ethnic Russians comprise about 20 percent of the country’s population. In Narva, approximately 97 percent of residents speak Russian. The relationship with Russia in Narva, however, is nuanced. After Estonia regained independence in 1991, many ethnic Russians who had settled in Estonia during the Soviet period did not automatically acquire Estonian citizenship and instead had to obtain citizenship through naturalization. Consequently, in 2014, only about 46 percent of Narva’s residents held Estonian citizenship, while 36 percent held Russian citizenship. Some Estonian government policies have contributed to local resentment, and these kinds of social friction points attract the attention of Russian intelligence services. However, there is no evidence of broad support in Narva for joining Russia, and documented reports indicate otherwise.
Confirmed Risk: The “Narva People’s Republic” is thought to be a Russian information operation. The idea of a “Narva People’s Republic” is not purely hypothetical. The current online campaign appears to have emerged in 2025 and became active in February 2026, when social-media accounts began promoting the idea of Narva and Ida-Viru County separating from Estonia. In March 2026, Estonia’s Internal Security Service characterized the activity as an information operation intended to sow confusion and undermine social cohesion.
Confirmed Risk: Russian nationals continue to receive Schengen visas with a relatively low refusal rate. Russians continue to receive short-stay visas into the Schengen zone. Although applications from Russian nationals receive more scrutiny now than in previous years, in 2025 Russian nationals applied for 679,425 short-stay visas, and 630,641 were issued, including 175,862 multiple-entry visas. The refusal rate for Russian visa applicants was only 6.4 percent according to official European Commission statistics.
Confirmed Risk: Absence of coordinated internal immigration enforcement and interoperability challenges. In our scenario, the fragmented nature of internal immigration enforcement in the EU was the biggest identified risk, as it allowed Russian operatives to move from their initial countries of admission to other parts of the Schengen area. The Entry/Exit (EES) system, fully deployed in April 2026, is a significant step toward gaining an operational picture of who enters and exits the Schengen area. Still, it works best for securing the EU’s external borders and preventing re-entry by previous violators. Individuals who do not leave the EU on time are added to the EES “overstayers” list, which is available to the member state competent authorities. But the overstayer list is just that – a list. To move from list to action, an individual on the overstayer list would need to have a “return order” (the EU version of a deportation order) issued by the competent member state authority. The order would need to be entered in the Schengen Information System (SIS) promptly. At that point, member states would need to coordinate to share SIS alerts and apprehend the individual. That could be facilitated through the SIRENE (Supplementary Information Request at the National Entries) bureaus, 24/7 centers each member state operates to facilitate information exchange. All that is possible if the system works without flaws, but that is not the current operational reality. The European Commission acknowledged in its 2026 State of Schengen report that interoperability and coordination remain challenging. The report specifically points out that “further efforts are required across all Member States to address challenges related to the timely issuance of return decisions, the streamlining of procedures and the implementation of measures to prevent absconding and unauthorized secondary movements.”
Confirmed Risk: Absence of a single entity that monitors the EES overstayer list for emerging security threats. Building on the previous risk factor, I could not confirm in my research the existence of a single EU entity that systematically monitors the EES overstayer population for emerging national-security threats based on targeting criteria. While extensive mechanisms exist for sharing information once a person becomes the subject of a relevant alert, it remains less clear who is systematically examining the EES overstayer population for national-security significance before that threshold is reached. The EU has an entity with extensive experience coordinating Member State investigations and criminal intelligence: EUROPOL, the European Union Agency for Law Enforcement Cooperation. EUROPOL has access to EES data for law-enforcement purposes, but its current EES capabilities are primarily integrated into existing investigative and analytical functions. EUROPOL itself identifies the need for greater interoperability among the EU's large-scale information systems and states that, once the planned changes are implemented by 2027, it will be able to use EES and other systems to “support assessing the security risks associated with third country nationals arriving to Europe.” At present, therefore, I found no evidence of a centralized process dedicated to systematically screening the EES overstayer population for national-security indicators. In other words, the EU has built the haystack and mechanisms for sharing information about individual needles, but it is less clear who is systematically looking for the needles. And because the EES is still new, the size and characteristics of the haystack are not yet fully established.
VI. Recommendations
I deliberately fashioned this scenario to unfold as a Russian operation against NATO might: deliberately ambiguous, difficult to attribute, and accompanied by an aggressive information campaign designed to complicate the Alliance’s response. The incursion itself would not necessarily need to be militarily successful. If Russia could create a crisis that divided NATO, delayed a unified response, or exposed weaknesses in the Alliance’s ability to defend its territory, the crisis itself could constitute a strategic success. For that reason, the most effective defense is to prevent the scenario from occurring in the first place—by identifying the vulnerabilities that could make such an operation possible and closing those gaps before Russia can exploit them.
NATO and Estonia are doing many things well, including their strategy of “deterrence by denial,” and I will not spend time analyzing those efforts here. They should continue. My recommendations instead focus on less frequently recognized vulnerabilities outside the traditional military sphere that could still be exploited in a hybrid conflict.
Recommendation 1: Continue EU-wide coordination targeting organized criminal activity. A key element of the hypothetical scenario depended on Russian operatives gaining access to firearms through criminal networks. Organized crime can provide illicit infrastructure that terrorists, intelligence services, and other national-security threats may exploit. Continued EU-wide efforts to disrupt these networks therefore serve a purpose beyond traditional crime reduction: they deny hostile actors access to networks, resources, and capabilities that could facilitate operations inside Europe.
Recommendation 2: Eliminate tourist visas for Russian nationals and create a forward-deployed EU visa security program for high-threat regions. One of the larger gaps identified in this scenario is that Russian nationals still have legal avenues to obtain visas to enter the EU. My recommendation would be to stop issuing tourist visas to Russian nationals, with exceptions for limited humanitarian circumstances. The EU should also consider a uniform, EU-wide mechanism to systematically assess the security risks posed by visa applicants and incorporate those assessments into visa issuance decisions. While the EU has a sophisticated common visa-information system, including biometric screening and mechanisms for sharing information among Member States, responsibility for visa adjudication and national-security assessment remains distributed among national authorities. The United States provides one potential model. Through HSI’s Visa Security Program, trained special agents are assigned to diplomatic posts overseas to conduct law-enforcement interviews and identify terrorists and other national-security threats before they enter the United States. A comparable EU capability, whether centralized or deployed through participating Member States, could add an investigative and intelligence dimension to the existing European visa-screening architecture.
Recommendation 3: Establish a national-security immigration coordination center within an appropriate European agency. The EU should consider establishing a dedicated national-security immigration coordination capability within an existing agency such as EUROPOL. The center would proactively analyze the EES overstayer list and other relevant databases against current threats, identify concerning emerging patterns, centralize alerts concerning visa overstays and other significant immigration violations, and provide a mechanism for Member State coordination. Where an overstay or other immigration violation involves additional security indicators, the center could elevate the case for immediate coordination with the appropriate law-enforcement and intelligence authorities in the affected Member State. The objective would be to move beyond simply recording immigration violations toward proactively identifying those that may represent emerging national-security threats.
VII. Conclusion
The purpose of this exercise was not to predict that Russia will attack Narva, or that events would unfold exactly as described. It was to show how a deliberately ambiguous hybrid operation could exploit vulnerabilities outside the traditional military sphere. Russia would not necessarily need to defeat NATO on the battlefield. It could seek to create a crisis in which attribution is uncertain, information is contested, political leaders face competing pressures, and the Alliance must make consequential decisions under extreme uncertainty.
That is why prevention matters. Once armed men are occupying buildings in a NATO member state and information operations are shaping the narrative faster than governments can establish the facts, the opportunity to prevent the crisis has already passed. The objective should therefore be to identify the vulnerabilities that make such a scenario possible while there is still time to address them. NATO's military deterrence and Estonia's defenses remain essential, but closing the less visible gaps in Europe's immigration, intelligence, law-enforcement, and information-security architecture may be just as important in preventing the next hybrid crisis from becoming a reality.
At minimum, these measures would make it significantly harder for Russia, or any hostile actor, to establish the personnel, infrastructure, and freedom of movement needed to conduct such an operation inside Europe.
Disclaimer
The views expressed in this article are the author’s own and do not reflect the official position of the U.S. Department of Homeland Security, Homeland Security Investigations, or the U.S. government.
The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.
Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.
Read more expert-driven national security insights, perspective and analysis in The Cipher Brief
