Deterring Kremlin Grey Zone Aggression Against NATO

At the beginning of 2025, I wrote about the Kremlin’s growing grey zone aggression across Europe and the growing likelihood that the Kremlin’s leaders would ‘test’ NATO’s commitment to collective defence.

Since that article was published, the Kremlin appears to have grown more brazen as concerns continue to be raised about the Trump administration’s commitment to their allies; although Trump’s August meeting with Zelensky was a great improvement from February’s, his statements and track record imply an interest in an announcement of peace that could leave Ukraine vulnerable rather than committing to a long-term peace process combined with pressure on the Kremlin.

Moreover, even if fighting were to cease in Ukraine, the Kremlin’s grey zone aggression would not end with it. Indeed, it is likely to increase to destabilise the West and give the Kremlin an asymmetric advantage. These rapid developments make the discussion of deterring grey zone aggression critical; the Kremlin’s success in the grey zone is emboldening it to escalate its actions, contributing to a sense of impunity that increases the likelihood of kinetic action against more vulnerable NATO states in the Baltics.

This article examines the failures of past deterrence efforts and explores actionable strategies to prepare for and respond to Kremlin operations; particularly its information and influence activities, which play a critical enabling role. By learning from both history and modern successes, enhancing our understanding of our adversary and expanding cooperation, NATO members can develop a resilient framework that combines societal preparedness, strategic communication, and ethical yet robust countermeasures. The goal: to deny Moscow the freedom to act in the grey zone without consequence and undermine its confidence in targeting smaller NATO members.

Lessons from Failures in Grey-Zone Deterrence

The failure to effectively deter grey zone aggression has been most starkly illustrated in two key examples over the past decade and a half: the illegal annexation of Crimea in 2014 and the Syrian Civil War (2011-2024).

The Kremlin’s illegal annexation of Crimea in 2014 and its subsequent undeclared war in eastern Ukraine through to 2022 marked a watershed moment in the West’s understanding of grey zone tactics. Russia employed proxy forces, masked its military presence with ‘little green men,’ and flooded information spaces with disinformation – both to obscure responsibility and to shape perceptions among local populations and international audiences. This ambiguity exploited the West’s legal and political thresholds for response, amplified its anxieties over conflict, and projected an image of a powerful Russia that could not be beaten without apocalyptic sacrifice. This created a fait acompli and exposed NATO’s lack of preparation for countering hybrid tactics.

Similarly, during the Syrian civil war, while the Assad regime’s chemical attacks were overt, the Kremlin’s support shifted the conflict into the grey zone. Moscow not only helped obscure responsibility for the attacks but launched a coordinated campaign of disinformation and cyber interference to discredit evidence, sow doubt, and paralyse international consensus on the attacks and anti-Assad forces. These actions likely contributed to President Obama’s failure to enforce his publicly declared red line, eroding Western credibility. Throughout the conflict, the Kremlin employed aggressive information strategies to empower the Assad regime Despite clear evidence of chemical weapons use and other regime atrocities, Kremlin-backed narratives continued to influence public discourse, demonstrating the lingering effects of grey zone strategies.

Both cases explicitly illustrate how grey zone aggression confuses attribution, divides alliances, and exploits legal grey areas, ultimately undermining timely and unified deterrent action by NATO and its partners. Both examples further demonstrate how information and influence activities often go hand in hand with kinetic operations to produce maximum effect. Repeated studies from the Soviet to the Putin era have demonstrated the importance of ‘informational psychological operations’ and establishing ‘reflexive control’ in Kremlin campaigns and in its political-military mindset to the point it has been elevated to both an objective science and a military religion. It is a key enabler of Kremlin operations and power projection.

Information and influence activities to establish reflexive control precede kinetic actions to weaken the target from the top and bottom of society long before kinetic action takes place. Elites are targeted through weaponised graft to gain influence over individuals and policymaking, and persistent messaging to the wider population serves to undermine their faith in their governments, systems, and the concept of knowable truth. This takes place online but also offline through proxy movements and actors, and unwitting conduits. By the time the kinetic action takes place in a deliberately obfuscated manner, targets are already vulnerable to a state of decision-making paralysis. This is especially true of democracies, where decision-makers are particularly influenced by public opinion. Consequently, deterrence of information and influence activities is critical to disrupting the Kremlin’s ability to conduct kinetic operations.

Concepts of Deterrence are Largely Divided into Two Parts:

1. Deterrence by denial focuses on preparation to ensure adversarial aggression is unlikely to succeed.
2. Deterrence by punishment focuses on response by ensuring adversarial aggression is met with significant consequences.

Although grey zone operations are designed to frustrate conventional deterrence and response models, these two concepts can be adapted to suitably address grey zone operations by analysing lessons from prior preparation and response examples.

Deterrence by Denial: Lessons in Preparation

Despite growing awareness of grey zone tactics and their likely use to test NATO’s collective defence, Western preparation has been largely absent. Historical precedents, however, offer important lessons on how to reinvigorate societal resilience that can be used to fill this knowledge gap.

During the Second World War, governments maintained societal vigilance through public information campaigns and resilience-building exercises to keep their populations vigilant against foreign infiltration and prepared for the disruption bombing raids inflicted. These tools are largely absent in today’s environment.

Further lessons can be drawn from the War on Terror, as societies have become accustomed to daily inconveniences such as increased security at public events. The public has been included in their own security with the encouragement of daily society to speak up through the ‘Prevent’ and ‘see it, say it, sorted’ campaigns.

Further modern examples can be drawn from select NATO member states such as Sweden’s ‘In Case Crisis or War Comes’ campaign - an example of how to empower the public to enhance their own resilience rather than placing the burden solely on the state.

Although Sweden’s measures are not entirely replicable due to many European societies lacking Sweden’s homogeneity and sense of communal service, it nonetheless provides a template for the inclusion and activation of society to increase their own awareness. In the UK, emergency alerts can be broadcasted to millions of phones, a measure that could equally be used to broadcast warnings about developing grey-zone tactics and actors. Doing so would ‘pre bunk’ Kremlin narratives and operations which would decrease their chance of success. This could include selective declassification of intelligence, which was successfully used in the build-up to the Kremlin’s invasion of Ukraine to deprive it of being able to legitimise its war.

Creating preparation campaigns requires cooperation in knowledge sharing. To properly leverage the existing knowledge of NATO’ member states on this issue, they must further deepen their cooperation and draw from others with intimate understandings of Kremlin behaviour - none more so than Ukraine.

The success of Ukraine’s security services in conducting operations in Russia and foiling attacks in Ukraine have demonstrated the potential of collaborating with actors with existing insights into Russian doctrine and mindset and empowering them with resources and methods. This collaboration can be built on to improve anticipatory deterrence and preparation. Cooperation should also be deepened with civil society actors, who remain one of the strongest lines of defence. Providing journalists, activists, and local communities with the tools to trace and expose malign influence campaigns can erode their effectiveness before they take root. Providing access to ‘data lakes’ – by far the most expensive aspect of research – would be a critical first step.

Lastly, preparation must extend beyond NATO borders. The Kremlin has targeted the Multi-Aligned Community (aka Global South) as a ‘land of opportunity’ to evade sanctions, enhance its prestige as a ‘great power’, and increase its diplomatic clout in international institutions. It is almost certain that it will seek to win over these states before testing NATO to better insulate itself from repercussions. Building resilience in these regions through strategic communications, economic engagement, and civil society support with the same intensity as at home is essential.

These measures can prepare populations and policy makers and build resilience in the long-term and therefore build deterrence by denial. They will also guide our responses, which will act as deterrence by punishment.

Deterrence by Punishment: Lessons in Response

Although democratic societies have a mixed record when it comes to responding to grey zone aggression, there have been some notable successes.

In his 2022 article, Joshua Stewart argued that the UK’s response to the 2018 Salisbury poisoning exemplified effective response to grey-zone aggression through an ‘elastic communications’ strategy. This approach was deployed in two phases: initial attribution, followed by sustained reputational pressure. This allowed the UK to seize the informational initiative against Russia while maintaining moral credibility. The strategy was characterised by clarity, unified government messaging, transparent use of intelligence, and adaptability in broadening the narrative beyond Salisbury to expose wider GRU activity. Stewart suggests this agile, phased communication model not only countered Kremlin disinformation but also enhanced the UK’s authority and international standing. Crucially, it avoided the ethical pitfalls often associated with grey-zone operations by upholding democratic values and relying on open-source validation. By combining strength with restraint, the UK achieved tangible outcomes, including the coordinated expulsion of Kremlin operatives and disruption of Kremlin intelligence networks. Stewart concludes that the Salisbury case offers a replicable framework for liberal democracies facing covert threats – demonstrating that moral clarity and strategic communication can be potent tools in contemporary geopolitical competition.

Concurrently, NATO states must return fire in the grey zone. Behaviour in past conflicts has in part been moderated by fears of reciprocity: although Hitler rained bombs down on Britain, he refrained from using poison gas (at least in military campaigns) due to fear that the British would respond in kind against Germany. Throughout the Cold War, the concern over ‘Mutually Assured Destruction’ modulated both sides behaviour to prevent escalation.

I do not advocate that we mirror the Kremlin in our responses – this would be self-defeating by playing at the Kremlin’s game which, with far more experience, the Kremlin would have a significant advantage. However, we can learn from the Kremlin. Giles notes that ‘achieving successful reflexive control requires and in-depth study of the enemy’s inner nature, ideas, and concepts’. Although the Kremlin is highly familiar with our political-military systems, our own knowledge of Russian society, its political systems of power distribution, and its culture (including core interests, prides, and shame) remains confined to circles of experts. By expanding knowledge-sharing with the aim to enhance learning at all levels of decision-making, NATO states could prepare a suite of offensive overt and covert policy options to employ in response to grey zone actions against NATO members and calibrated in response to the seriousness of the aggression designed to convey maximum effect on the Kremlin. These measures could include legal measures (in other words, sanctions on the Kremlin’s critical oil industry), deplatforming dangerous disinformation superspreaders, cyber operations against inauthentic accounts amplifying disinformation and Kremlin mouthpieces, and, most importantly, information campaigns targeting the Kremlin from within Russia itself.

One of the Kremlin’s greatest fears is losing of control over their domestic narrative. Drawing on lessons from the Cold War, the use of human rights pressure in denied areas, modern examples of activism in authoritarian environments, and an understanding of Russian society, NATO governments can create tailored operations to increase access to free-information sources, and undermine the authority of the Kremlin. Corruption and elite privilege are particularly sensitive points for the Kremlin and historical context demonstrates casualties, crime, and economic hardship have proved to be major factors in Russian society breaking with the Kremlin – all focused on self-interest. These should be primary targets.

A common argument against these types of responses is that they may risk escalation or undermine our moral standing. While these concerns are legitimate, it is important they do not become overblown; an overtly timid stance undermines effectiveness and encourages increased aggression. Indicators suggest that the Kremlin’s typical response to escalation in the face of a more powerful rival is to back down – hence its focus on grey zone activities to confront NATO. Furthermore, as the Kremlin regularly broadcasts and amplifies conspiracy theories about Western plots, it is unlikely any unveiling of our responses would significantly increase the traction of their narrative, especially if our responses avoid attacking Russian national interests and focus on discrediting leadership and emphasising Russian self-interest.

It is important that these responses do not exist as a predictable ‘playbook’ but as an intuitive method of interoperability between departments and allied organisations. To do so would require addressing likely obstacles and stoppages that have so often plagued interoperability. Firstly, establishing common understandings and terminology regarding the threat and terms of effects. My own experiences in studying foreign interference and manipulation operations (FIMI) have highlighted how many terms can exist for the same act and how two organisations use of the same term can mean radically different things. NATO’s common military doctrine offers an example in how commonality can be institutionalised and the DISARM Framework works as an example of creating a common framework for coding threat tactics in information operations. Both can be built upon to create a common identification system.

Second is addressing who leads in addressing the threat. At an alliance level central coordination is key and fortunately such a system was already designed and built at the end of World War Two. NATO’s military branch, the Supreme Headquarters of Allied Powers Europe (SHAPE) hosts a Supreme Commander for all NATO troops as well as a Strategic Communications Director who oversees all NATO military action related to the communications side of grey-zone operations. Additionally, SHAPE is equipped with one of the largest and most comprehensive military archives in the world, an additional source of potential tactics from historical examples. At an individual state level, it becomes more nuanced.

The issue with a top down, government focused, response is that it itself becomes a target of attack, mainly due to concerns over government overreach. While government institutions such as intelligence agencies, military groups, and civil servants should play the primary role in response, civil-society actors must play a greater role in identification and communication of the threat to the wider public and the government response. Concurrently, the private sector increasingly offers capabilities that augment the capabilities of both government and civil society. These bottlenecks are unlikely to be fully resolved in a single article, but these suggestions act as a starting point.

Conclusion

Many of the suggestions given here will need further work and exploration to establish as effective strategies. And although this article has focused on deterring a significant grey-zone test of NATO’s collective defence by undermining the Kremlin’s asymmetric information advantage, it is important not to wait for such an event to take place. The Kremlin will likely continue to steadily increase its grey-zone aggression, gradually moving beyond the norm, until Russia’s behaviour is addressed by NATO states in Europe. How we respond will influence how the Kremlin believes NATO will respond to openly aggressive action against smaller NATO members such as those in the Baltics. Preparation must begin now.

In September 1940, more than a year before the Japanese attack on Pearl Harbour, President Franklin Roosevelt attempted to rally US society to look beyond the current moment and understand the need for preparation: ‘to meet that attack we must prepare beforehand – for the simple reason that preparing later may and probably would be too late.’

© Joe Morley-Davies, 2025, published by RUSI with permission of the author.

The views expressed in this Commentary are the author's, and do not represent those of RUSI or any other institution.

For terms of use, see Website Terms and Conditions of Use.

Have an idea for a Commentary you'd like to write for us? Send a short pitch to commentaries@rusi.org and we'll get back to you if it fits into our research interests. View full guidelines for contributors.