The explosives-laden drones discovered near a runway at Leipzig/Halle Airport and the recent attack on a Warsaw-bound train just kilometres from the Ukrainian–Polish border point toward a new escalation in Russia’s behaviour toward Europe.  

Acknowledging the problem in her State of the Union address, European Commission President Ursula von der Leyen proposed developing a joint European playbook for responding to hostile actions falling short of armed aggression.  

The playbook’s effectiveness will depend on the measures it contains. If Europe continues to rely primarily on resilience, strengthening critical infrastructure, improving monitoring and absorbing the effects of hostile operations, it is unlikely to alter Moscow’s calculus. Europe must impose tangible costs to deter Russia from escalating further. 

Why Europe needs deterrence by punishment 

Resilience reduces the damage an adversary can inflict and may deter attacks by denying their intended effect. However, focusing almost entirely on hardening the target allows Russia to pursue a salami-slicing strategy — using a series of actions to achieve a cumulative effect. Moscow keeps its operations across Europe below the threshold of armed attack, creating uncertainty over attribution and forcing governments to decide whether each incident warrants a serious response. 

Russia’s hybrid campaign has expanded. Moscow-linked arson and sabotage incidents rose from two in 2022 to 12 in 2023 and 34 in 2024. Hybrid methods have included cyber operations, airspace violations and sabotage of defence companies and railway infrastructure.  

These attacks have significantly changed over the last two years. They are more aggressive, span more sectors and involve greater risks, such as plots to assassinate German defence executives or the recent incident at Leipzig/Halle airport. These operations aim to establish a “new normal”, making subsequent events less likely to spark outrage. 

Europe’s current resilience-centred approach, under which Russia often pays little to no price, risks encouraging further escalation. The fallout from the next attack on critical infrastructure could cause casualties, intentionally or otherwise, making escalation harder to contain. European governments should therefore strengthen deterrence by punishment: imposing tangible costs on Russia. This will change Moscow’s reasoning and dispel its belief that it can harm European states without meaningful consequences. 

What exactly Europe should deter 

Europe does not need to threaten punishment for every hostile grey-zone activity. Unlike nuclear deterrence, where the objective is to prevent any use of a nuclear weapon, or conventional deterrence, where NATO seeks to prevent an armed attack on allied territory, hybrid warfare encompasses actions of very different severity. Deterring every cyber intrusion, influence operation or act of sabotage would be unrealistic.  

Deterrence by punishment should focus on the most high-profile cases, particularly operations that could result in mass-casualty events. 

This does not require a fixed threshold for Russian actions. Instead, European governments should communicate — through discreet, non-public channels — that sabotage posing a foreseeable risk of fatalities will trigger a collective, cross-domain response. This is necessary to decrease the risk of miscalculation by Russia and manage escalation.  

Potential courses of action  

Russia may carry out separate operations across national jurisdictions but these are a broader campaign against the West. European responses should therefore be collective and coordinated. This is challenging given neither the EU nor NATO possesses executive control over national intelligence services nor armed forces. Neither organisation can mount one overwhelming response on behalf of all its members. Nor have all intelligence agencies within NATO the legal mandate for counter operations. 

Institutional limitation can work to Europe’s advantage. The EU, NATO or a coalition of countries can set a common political objective while national governments with the necessary legal authorities carry out measures across different domains. For instance, the UK’s Government Communications Headquarters (GCHQ) has an explicit offensive cyber mandate, while France’s Directorate-General for External Security (DGSE) operates under a broad statuary mandate for intelligence and covert action. Distributing action among several governments would make it harder for Moscow to predict the response or retaliate against one state in isolation. 

Germany’s ongoing reform of its intelligence agencies’ legal authorities to conduct offensive operations against foreign adversaries, notably in the cyber domain, is a step in the right direction. So is Sweden’s announcement to open a stand-alone civilian foreign intelligence service in January 2027. Other European governments should follow these efforts.  

Deterrence by punishment does not mean copying Russia’s playbook. While a reciprocal attack on water-treatment plants or other essential civilian infrastructure might appear proportionate, mirroring Russia’s approach would be neither appropriate nor strategically desirable. Possible responses should instead target assets connected to Russia’s capacity to conduct hostile operations, including financial networks, intelligence infrastructure, logistics providers and enabling entities.  

The response can extend into conventional signalling. For instance, NATO should consider changing its Baltic mission from air policing to air defence. The aim would be to demonstrate that repeated airspace violations will no longer be passively monitored but will be dealt with more assertively.  

Russia has learned that the threshold for triggering Article 5 is high and hostile action below it carries few consequences. Europe must therefore show that the space below Article 5 is not cost-free.

Juraj Majcin is a Policy Analyst with the European Policy Centre.  

Jannik Hartmann is a Non-Resident Associate Fellow at NATO Defence College (NDC).

The views expressed reflect the personal opinions of the authors and not those of their institutions. 

The support the European Policy Centre receives for its ongoing operations, or specifically for its publications, does not constitute an endorsement of their contents, which reflect the views of the authors only. Supporters and partners cannot be held responsible for any use that may be made of the information contained therein.