For the first few years of the war in Ukraine, Russia’s hybrid warfare attacks in Europe remained just below the threshold that might trigger a collective response. As the United States’ permanent representative to NATO from 2021 to 2024, I watched the campaign develop: undersea cables cut, incendiary devices hidden in cargo packages, and arson attacks on weapons factories and depots across Europe. To address the threat, allies reinforced critical infrastructure, increased patrols in the Baltic Sea, and expanded intelligence sharing. But NATO’s approach remained largely defensive: these attacks were scattered, small in scale, and just deniable enough that Moscow could wave them away.

Today, that is no longer the case. In late July, a Russian cruise missile crashed into Polish territory. Days later, three explosive-laden drones were found at and near an airport in Leipzig, Germany. Two weeks after that, Romanian F-16s scrambled to intercept three Russian drones over Romanian airspace, and a Spanish jet shot down a fourth near the Moldovan border. If someone had described this state of affairs two years ago as where NATO would be now—drones over allied airspace, a Russian cruise missile in Polish territory, explosives at a German airport—without any meaningful collective response from the alliance, it would have sounded unbelievable.

There is little ambiguity about Russian President Vladimir Putin’s aims. These attacks are designed to fracture the alliance’s unity, test the strength of members’ commitment to Article 5—the principle that an attack on one member is an attack on all—and raise the cost of supporting Ukraine. Less expected, however, has been the speed with which his deniable campaign has become undeniable.

NATO has not looked away. The alliance tracks these incidents, investigates them, and sometimes intercepts attacks. But a response built incident by incident is not deterrence, and Putin knows the difference. As long as each provocation costs Moscow nothing more than a downed drone, Putin has every reason to keep escalating. And every escalation in turn increases the risk that one of these incidents will end in catastrophic loss of life. Mobilizing collective action to impose costs is the best chance the alliance has of preventing such a scenario.

For Russia, hybrid tactics are far from a new tradecraft. As early as the 1920s and continuing throughout the Cold War, the Soviets relied on what they called “active measures”: the use of local proxies, front groups, and irregular forces to achieve political aims. Today, Putin follows essentially the same model, seeking to erode allies’ confidence in NATO’s Article 5 by relying on tactics that fall below the threshold of a conventional warfare and leave unaffected members hesitant to respond. Plausible deniability has always been a critical part of these operations. Whatever the method, whether it be severing undersea fiber-optic cables in the Baltic Sea, a coordinated cyberattack, or an explosion at a plant in eastern Europe that produces artillery shells for Ukraine, Russia is quick to deny its direct involvement. Often, it flips the script, accusing NATO members of “Russophobia” and directing blame at Ukrainian or rogue actors.

NATO members have long been familiar with this Russian playbook. Most European members have experienced multiple hybrid attacks over the past two decades. But since its 2022 invasion of Ukraine, Russia has changed its strategy in two meaningful ways. First, it has significantly increased the frequency of attacks; during the first year of the war, the number of Russian incursions in Europe quadrupled, according to the Center for Strategic and International Studies. It has also diversified its tactics. In addition to familiar disinformation campaigns, airspace violations, and cyberattacks, actors linked to Moscow have sabotaged railways, placed........

© Foreign Affairs