We May Already Be at War with Russia

Railway lines are being sabotaged, drones are appearing over airports, and GPS signals are disappearing without explanation along NATO’s eastern flank. Danish intelligence is now warning that Russia may intensify its hybrid war against the alliance in the coming months — raising an uncomfortable question: how long can NATO keep coming under attack before anyone calls it an attack?

I have followed these developments through Norway, Finland and the Baltic states, and what strikes me most is how difficult it has become to see where peace ends and war begins. The incidents arrive one by one. A drone appears over an airport. A railway line is sabotaged. A cyberattack hits a government agency. Each incident can be explained on its own. Put them side by side, and the picture begins to look very different.

On 24 September, the Danish Defence Intelligence Service (FE) sharpened its assessment of Russia, saying the country is likely to escalate its hybrid war against NATO and the West in the coming months. The risk of a limited military attack on a NATO country is still described as low, but rising, while a conventional invasion is considered unlikely — although it can no longer be ruled out entirely.

The US think tank Institute for the Study of War (ISW) uses stronger language. It argues that Russia is already operating according to a wartime logic against Europe, while European countries still largely organise their response as if they were at peace. At the same time, ISW stresses that this does not mean a full-scale war between Russia and NATO is inevitable or imminent. That distinction matters.

Many small attacks can become one strategy

Sabotage against a railway becomes a police investigation. A cyberattack is handled by IT specialists and security agencies. That is how states are organised: every incident goes to its own authority, into its own file. The adversary does not have to think the same way.

ISW describes Russian operations in Europe as several parallel campaigns reinforcing one another. The objectives may include weakening European support for Ukraine, disrupting the movement of military supplies and gradually conditioning NATO countries to accept Russian activity as part of everyday life.

That last point may be the most disturbing. When airports repeatedly close because of drones and new sabotage cases appear at regular intervals, normalisation itself can become an advantage for whoever is behind them. Every time the alarm sounds, it loses a little of its force.

Europe’s supply line

Put the incidents on the same map and the geography becomes clearer. From Germany, transport routes run east through Poland and towards Ukraine, using the same ports, railways and roads that European countries depend on for both civilian and military transport.

During September, Poland has dealt with Russian attacks near its border crossings with Ukraine and repeated drone incidents in the region. ISW links these developments to a broader Russian effort to disrupt the lines of communication that keep Ukraine supplied.

Further north runs another corridor, through the Baltic states, Finland, Sweden and Norway. Undersea cables, energy infrastructure and military installations have become more strategically important since Finland and Sweden joined NATO.

This is the geography I have travelled through while working on what I call NATO’s New Backyard — places that may look peripheral on a map, but have become increasingly central in military terms.

Narva has become a concrete scenario

Few places illustrate the dilemma as clearly as Narva in Estonia. The city sits directly on the Russian border, opposite Ivangorod across the river, and has a large Russian-speaking population.

Narva has long featured in discussions about how Moscow might test NATO without launching a conventional invasion. ISW has now developed a scenario examining what a limited Russian attack on the city could look like.

The analysis is explicitly hypothetical. It is not a prediction that Russia will attack Narva. Its purpose is to examine how a limited operation might be used to test NATO’s Article 5, even though Estonian and Latvian authorities say they do not currently see the Russian military build-up that would be required for a full-scale invasion.

That is precisely what makes the scenario interesting. An attack does not have to be large to create a major political problem. If Russian forces carried out a short operation while Moscow denied its intentions and attempted to create disagreement among NATO members, the alliance would have to agree very quickly on what had actually happened.

That is where hybrid warfare meets Article 5.

Where is the line?

NATO’s Article 5 is built around the concept of an armed attack. During the Cold War, it was easier to imagine what such an attack would look like: aircraft, missiles and soldiers crossing a border.

Today’s conflict environment is far less clear. How severe would a cyberattack have to be before it qualified as an armed attack? And what happens if sabotage knocks out the electricity supply and people are killed?

There is no automatic switch that activates Article 5 once a certain number of incidents has been reached. NATO members must make political and military judgements based on the circumstances of each case. It is precisely within that ambiguity that Russia has room to operate.

Making the abnormal normal

ISW points to a pattern worth watching closely. If more and more Russian provocations come to be accepted as something Europe simply has to live with, the threshold for what triggers a serious response may gradually move.

It can begin with GPS interference and end with sabotage against a railway — each incident slightly more serious than the last, but never quite serious enough for anyone to risk a confrontation between nuclear powers.

That is also why every incident must be assessed on its own evidence rather than automatically combined into one narrative. Not every fire is Russian sabotage. Not every drone comes from Moscow. Attribution has to be documented before responsibility is established.

But it is still possible to recognise a pattern without claiming to know who is behind every individual incident.

The High North is part of the same map

For Norway, this is especially relevant because the country sits at the intersection of the Arctic, the North Atlanticand Russia. On one side is a short land border at Storskog. On the other are vast maritime areas containing oil and gas installations that are difficult to protect.

Further east, Finland shares more than 1,300 kilometres of border with Russia. To the south lie the Baltic states and Poland.

The idea that the High North lies far from Europe’s main security front is becoming increasingly difficult to sustain. So is the idea that there is one clearly defined front line.

The front may just as easily run through a railway station in Poland as across a border bridge in Narva.

The latest assessment from Danish intelligence points towards more activity of this kind in the coming months. ISWgoes further, arguing that Russia is already conducting coordinated campaigns designed to influence European support for Ukraine and NATO’s ability to respond collectively.

The more concrete question, then, is not whether the war has already begun.

It is how many attacks below the threshold of war NATO can absorb before the threshold itself has moved.