For more than ten years, Propastop has been writing about influence operations in the information space. Their purpose has been to sow distrust, uncertainty, hostility, polarisation and fear. At times, their impact has also spilled over into the physical world, resulting in protests and demonstrations or even physical confrontations between people with opposing worldviews.
Hybrid attacks are an extremely effective weapon for putting society under pressure. A single operation can achieve several objectives at once: put pressure on the government, which is expected to identify and punish those responsible; consume the resources of state agencies investigating, documenting and processing the incident; reduce society’s sense of security; and increase public anxiety about a threat that people struggle to understand.
At the same time, trust in the state, including both the government and the agencies responsible for investigating and responding to the incident, can decline. The public expects rapid reactions and explanations that are often almost impossible to provide within such a short timeframe.
What is a hybrid attack?
Hybrid attacks have long been defined as operations involving several components, with influence activity in the information space consistently forming one of them. The past six months have brought numerous hybrid attacks, and analysing them makes it increasingly clear that information influence has been one of their central objectives, with the broader aim of spreading distrust, uncertainty and fear throughout society.
From Propastop’s perspective, recent hybrid attacks can be understood as a more powerful version of information attacks. The objective is essentially the same as with information manipulation, but the starting point is an event that has actually taken place in the physical world. This gives the subsequent information attack an additional layer of credibility. Previously, there was a tendency to avoid the term “hybrid attack” and instead use more specific terms describing what had happened, such as sabotage or cyberattack. Recent events, however, have demonstrated that the hybrid element can be understood as sabotage + an information component, or cyberattack + an information component. Information influence is always at the heart of it.
Many recent incidents have also been accompanied by filmed “evidence” appearing in the information space. On the one hand, such material can serve as a kind of proof of completion, demonstrating that the assigned task has been carried out so that the perpetrators can receive payment. On the other hand, it becomes material for an influence operation designed to increase tension within society.
What is the role of journalism in explaining hybrid attacks?
Hybrid attacks present a particularly difficult problem because those expected to explain what has happened to society often do not have enough information to do so quickly. Official statements by governments or state agencies must be based on verified facts and need to withstand scrutiny.
At the same time, this creates a dilemma for the state. Once you say A, you are expected to say B. In other words, if an incident is officially identified as a hybrid attack carried out by country X, the immediate question becomes: what punishment or countermeasure will follow? Society expects a response to every such attack.
This is where journalism and independent experts can play an important role. Just as Propastop has identified and described Russian information influence operations, hybrid attacks also need to be identified and explained to the public. Doing so can reduce their intended impact by decreasing uncertainty, fear, and distrust.
Journalists and independent analysts can also help give meaning to attacks in ways that governments often cannot publicly do. There are already enough examples where journalists have been able to attribute an incident by bringing together available evidence and pointing towards those responsible. This is something governments are generally more reluctant to do, although there are exceptions. States and government agencies have instead tended to investigate and describe each incident as an individual case. Yet in the minds of members of society, these individual incidents may already have merged into a single pattern and acquired a common meaning, collectively increasing the perception of threat.
Individual incidents or part of a bigger picture?
Consider the incidents involving pipelines and cables in the Baltic Sea. Looking back, the emerging pattern tells a different story in people’s minds than the description of each individual incident did at the time.
On 8 October 2023, the Balticconnector gas pipeline between Estonia and Finland was damaged by a dragging anchor. On 25 December 2024, Estlink 2 between Estonia and Finland was put out of service by another dragging anchor. On 31 December 2025, a communications cable in the Baltic Sea was damaged, again by a dragging anchor.
Three consecutive years, three incidents involving cables and other critical infrastructure. Unfortunately, Estonia and its authorities have once again found themselves on the front line of such attacks.
Estonia was on the front line of the first major targeted wave of cyberattacks in 2007. We then spent years dealing with targeted propaganda attacks, and in recent years Estonia has increasingly become a testing ground for acts of sabotage developing into hybrid attacks. At the same time, Estonia’s security agencies deserve recognition for successfully bringing several cases through the courts. The activities of Russia’s military intelligence service, the GRU, in Estonia were ultimately attributed to the GRU.
The impact of hybrid incidents and how to reduce it
The purpose of hybrid incidents is to sow distrust, uncertainty, and fear while keeping the seriousness of the physical event below the threshold that might prompt the targeted state to launch retaliatory measures carrying significant consequences.
If society begins paying attention to events that ten years ago would have passed almost unnoticed, hybrid attacks have already achieved part of their objective.
People begin noticing an airship beyond the eastern border, hearing the sound of a drone engine at night, seeing a flock of birds on radar and wondering whether they might actually be drones. A telling example came just last week, when floating objects were spotted above Tartu. In reality, they were connected to a fair taking place in the city.
If every backpack, cardboard box or cup left in an unusual place begins to look dangerous and makes people wonder whether they should call the bomb squad, something has already gone badly wrong.
Psychological defence has an important role in neutralising the cumulative effect of such incidents: helping society return to normality and maintain calm despite events designed to produce fear and uncertainty.
With hybrid attacks becoming increasingly frequent, Propastop calls on the media and independent experts to devote more attention to describing and explaining these incidents to society. Better public understanding can help reduce uncertainty and anxiety and, in doing so, diminish one of the effects these attacks are intended to achieve.
Read more:
Russia’s Shadow Army in Europe: How Small Attacks Serve the Kremlin’s Bigger Goals
Think Tank: Responding to Russia’s Hybrid Warfare Requires Strong Deterrence
Photos:
Flickr / Nick Normal, CC BY-NC-ND 2.0
Flickr / Andrew Kuznetsov, CC BY 2.0
Screenshot from the ERR website
