Identifying state sponsors of gray-zone acts is extremely difficult—by design. But if a targeted country manages to identify the state sponsor of an attack against it, should it make its identity known? Earlier this month, Germany announced that Russia was behind the incident at Leipzig/Halle Airport in which a suspicious drone was identified, thankfully before it could do damage. Berlin’s announcement was a brave decision, because attribution, particularly involving bellicose nations such as Russia, brings the risk of escalation. But with gray-zone acts proliferating in number and variety, this is a decision targeted country should be ready to make.
On Sept. 1, German Interior Minister Alexander Dobrindt and Foreign Minister Johann Wadephul walked up to a podium in Berlin in front of a crowd of journalists.
Identifying state sponsors of gray-zone acts is extremely difficult—by design. But if a targeted country manages to identify the state sponsor of an attack against it, should it make its identity known? Earlier this month, Germany announced that Russia was behind the incident at Leipzig/Halle Airport in which a suspicious drone was identified, thankfully before it could do damage. Berlin’s announcement was a brave decision, because attribution, particularly involving bellicose nations such as Russia, brings the risk of escalation. But with gray-zone acts proliferating in number and variety, this is a decision targeted country should be ready to make.
On Sept. 1, German Interior Minister Alexander Dobrindt and Foreign Minister Johann Wadephul walked up to a podium in Berlin in front of a crowd of journalists.
“For some time,” Dobrindt said, “our security agencies have been monitoring a high level of threat posed by hybrid activities in Germany and across Europe. These actions target critical infrastructure, defense companies, and support efforts for Ukraine. Intelligence gathered by our own services and partner agencies points clearly to Russian involvement in these hybrid operations—whether planned, executed, or thwarted.”
Dobrindt continued: “Regarding the attempted attack at Leipzig airport on Aug. 4, we have the following information: The means employed—including the drone configuration, various components, and the explosive and ignition technology—are consistent with those known to us from other hybrid operations conducted by Russia and from its war against Ukraine. The technology found at the scene and the integration of the individual elements demonstrate a professional level of sophistication, revealing significant technical expertise and substantial organizational effort in both the planning and execution of the act. The actual carrying out of the attempted attack is attributable to low-level operatives.”
The interior minister provided more evidence, but the news had been delivered: Russia was the instigator of the attack. “The Russian consulate-general in Bonn will be closed,” Wadephul declared, adding that the rental agreement for the Russian House in Berlin—a cultural center suspected of also serving as a hub for Russian intelligence activities—would be terminated.
Ten, even five years ago, Germany and most other countries were extremely cautious in attributing gray-zone attacks to Russia or any other country. To be sure, in some cases, hostile states’ involvement was obvious: During the artificial refugee crisis that erupted on the borders of Latvia, Lithuania, and Poland in the summer of 2021, for example, Belarus didn’t even try to hide its involvement; Minsk had provided Belarusian visas for the mostly Middle Eastern nationals, then transported them to the border.
But in many cases where hostile-state participation was more difficult to trace, as in case of the devastating NotPetya malware, or with the assassination attempt on former Russian intelligence officer Sergei Skripal, governments did make attributions—after having identified Russian involvement.
Part of the issue is that establishing state involvement beyond reasonable doubt—the bar that democratic countries set themselves—is difficult and sometimes impossible. There’s a reason why countries such as Russia often use proxies or hire gig workers to do their dirty work. But more importantly, publicly laying blame for an attack can put countries at risk. The attacker is likely to flatly deny involvement, as Russia has with every gray-zone act attributed to it by Western governments.
Worse, even as countries deny involvement, they can still retaliate for being blamed. This is, in fact, what happened after Dobrindt and Wadephul made their announcement.
“Leipzig, at the airport. They found a drone there and said it was Russian. No one ever clarified the matter. Strictly speaking, that marks the beginning of a real war,” Sergey Lavrov told Russian state television. Somehow, the Russian foreign minister managed to blend evasion and denial then add a threat, all in a single statement.
Germany’s response to the Leipzig incident—the closure of the consulate-general and the Russian House—is hardly provocative. If even such a moderate response prompts menacing theatrics from the Kremlin, what’s a targeted country to do?
Saying nothing is certainly not an option, not anymore. With gray-zone acts, especially Russian ones, becoming more common and more brazen, the public has become aware of their existence and destructive power. If governments decided that public attributions were too dangerous and said nothing, then their citizens would call them cowardly and suspect nefarious intrigues.
What’s more, Lavrov can only accuse Germany of having started “a real war” a few times. If he and others complain about supposed new wars each time that a country identifies the Kremlin as the instigator of dangerous acts, they will start looking like the schoolyard bully that only has one response in his arsenal.
No—now that gray-zone acts have become part of daily life, those instigating them must be called out. And the calling out should be directed not only at the hostile state behind the deed but also directed at the public at home. By keeping the nation informed about the activities taking place in society’s midst, governments can help citizens understand the seriousness of the situation (without unduly frightening them).
Public reaction, perhaps predictably, has been mixed, between those who worry that the German government is escalating and those who insist that it should not back down. In one call-in show on the WDR public radio station, a listener voiced suspicion: “Do we really believe that the Russians would attack us using two little pistols and what I would call three toy drones? They have totally different options. Our governments and other governments want this to escalate.”
Another listener, though, wanted an even more forceful reaction: “What would happen if we didn’t react to these kinds of attacks?”
Even without taking radical steps, Germany and other targeted countries could respond more assertively by focusing on transparency. In the Philippines, the authorities have taken to documenting every act of Chinese harassment of Philippine vessels in the South China Sea and sharing the content with the world.
To be sure, documenting random acts of Russian sabotage would be harder than filming constant harassment by Chinese vessels. But whatever can be documented ought to be publicly shared. The public would, among other things, see the sorry figures who, for a small financial reward, set fire to buildings, sabotage railways, and try to wreak havoc with drones. That way, citizens would understand that while gray-zone aggression is dangerous and devious, it is also profoundly pusillanimous.
