EU Begins Discussions on a Protocol for Hybrid Attacks as States Seek Clarification and Coordination with NATO

European Union defense ministers have begun discussions on an emergency security protocol that would coordinate the use of European instruments in response to hybrid attacks and other threats below the threshold of armed aggression. Kaja Kallas, the EU High Representative for Foreign Affairs and Security Policy, presented the proposal as a mechanism in its initial phase and said that member states want to see concrete measures before deciding whether to support it.

In brief

1. The protocol would seek to establish how the instruments of the member states, the Commission, and the European External Action Service can be used together in the event of hybrid threats.

2. Kallas cited sabotage, arson, and airspace violations that she attributes to Russia, but the protocol has not yet been adopted and the available materials contain no list of automatic measures.

3. Several states insisted on complementarity with NATO and on avoiding duplication of the Alliance’s structures.

4. It is unclear whether there is a majority in favor of the proposal. Kallas said that not all states had spoken and that discussions would continue at the governmental and ambassadorial levels.

5. Preparatory work included scenarios, a simulation exercise, and an inventory of European instruments that could be used in such situations.

Kallas linked the initiative to what she described as persistent acts of sabotage, arson, and airspace violations attributed to Russia, and argued that the European response needs to be better coordinated. The EU already has sanctions and other instruments for responding to hybrid threats, but the new protocol should clarify how existing means can be combined when an incident does not reach the level of armed aggression.

This distinction is important for the mechanism’s legal architecture. Article 42(7) of the Treaty on European Union establishes the obligation of aid and assistance between member states when one of them is the victim of armed aggression on its territory. The proposal discussed by the ministers specifically targets situations below this threshold and was not presented by Kallas as a new collective defense clause.

Within NATO, Article 4 allows consultations among allies when the territorial integrity, political independence, or security of one of them is threatened, while Article 5 concerns collective defense in the event of an armed attack. Kallas insisted that the European protocol must be designed to complement these mechanisms, not create parallel structures. NATO also specifies that consultations under Article 4 do not automatically entail activation of Article 5.

The European External Action Service and the Commission have already carried out part of the preparatory work. According to Kallas, this included a simulation exercise, scenarios, and an inventory of instruments that could be mobilized in a crisis. The situations analyzed include threats that do not reach the threshold of armed aggression and the case of an EU member state that is not part of NATO. The scenarios do not describe real incidents but are used to test how the available instruments could work together.

Coordination with NATO emerged as one of the main conditions formulated in the ministerial discussions. Kallas said she had been in contact with Secretary General Mark Rutte during the preparation of the exercises and scenario documents and that the same cooperation must continue if the protocol moves forward. The aim is to avoid duplication, but also to clarify what European states can do when faced with a threat that does not clearly fall into the category of an armed attack.

National positions, however, are not settled. Not all ministers spoke on the proposal, and several states requested concrete information about the available instruments, intervention thresholds, and decision-making procedures before defining their positions. Kallas said she could not determine at this stage whether there was a majority in favor and that discussions would continue with governments and at ambassadorial level.

The Council already had hybrid threats on the agenda for the defense ministers’ meeting on 28 September, alongside military support for Ukraine and other security files. The new protocol does not replace the existing European framework for responding to hybrid campaigns or NATO mechanisms. In the form described by Kallas, it should organize more clearly how the instruments already in existence are brought together in a concrete situation.