Hybrid War at the Border: Russia’s Covert Assault on Latvian Sovereignty

Latvia stands on the front line of NATO’s contest with Russian hybrid warfare. The threat is pervasive and evolving: cyber attacks, propaganda, subterfuge, and covert saboteurs can be as damaging in their cumulative impact as tanks and missiles. This analysis has shown that Russia’s hybrid tactics against Latvia are not a hypothetical future risk but an ongoing challenge rooted in history and geopolitical intent. Yet, Latvia is not a weak or isolated target. Its NATO membership, improved defense investments, and societal measures have greatly raised the bar for any adversary seeking to undermine it. The scenarios discussed underscore that while Russia may attempt to destabilize Latvia in the gray zone, any escalation carries immense risks – for Moscow most of all. NATO’s unified stance, reinforced by explicit warnings that even hybrid attacks may trigger Article 5, serves as a powerful deterrent. The coming years will likely see continued Russian pressure short of war, but also continued strengthening of Latvia’s resilience and Allied solidarity. By understanding the hybrid threat in all its dimensions and acting proactively on the recommendations outlined – from building cyber defenses to integrating minority communities – Latvia and NATO can navigate the treacherous waters of hybrid warfare. In doing so, they not only secure Latvia, but also uphold the principle that sovereign nations have the right to choose their alliances free from coercion. The ultimate strategic imperative is clear: deny the Kremlin any opportunity to fracture NATO or re-subjugate a free Baltic state. With vigilance, unity, and adaptive strategy, the prospects of Russia succeeding in a hybrid campaign against Latvia can be minimized, preserving peace and stability on NATO’s eastern flank.

October 27, 2025 — The Latvian State Security Service (VDD) has submitted a request to the Prosecutor’s Office to initiate a criminal case against four individuals for malicious actions committed against key critical infrastructure facilities, as well as other sites on the territory of the Republic of Latvia.

The criminal proceedings were launched on June 10, 2024. Two of the detained individuals are Latvian citizens.

The VDD investigation revealed that, under the initiative of Russian special services, a group was formed with the goal of committing particularly serious crimes against the Latvian state. These individuals were involved in the planning, organization, and execution of malicious acts across various sites in Latvia, including deliberate arson attacks. In particular, during the fall of 2023, a targeted arson attack was carried out on a facility owned by a private company implementing a project commissioned by the Latvian Ministry of Defense.

The arrested individuals conducted surveillance and video documentation of the surroundings of critical infrastructure sites and potential access points. It was discovered that the photographic and video materials were sent to the organizers of the malicious activity in Russia. Three of the suspects are currently in custody, one of whom is already serving a sentence for a different crime. This supports the assertion that Russian intelligence services actively collaborate with criminal groups in other countries.

Latvia has the largest number of ethnic Russians among the three post-Soviet Baltic states. As of January 1, 2024, 437,587 ethnic Russians lived in Latvia — the highest absolute number in the region — making up 23.38% of the country’s total population.

For the past 34 years, Moscow has consistently exerted diplomatic pressure on Riga, accusing the Latvian government of oppressing ethnic Russians as a national minority. Following Russia’s full-scale invasion of Ukraine in February 2022, the Kremlin intensified its hybrid war against the Baltic states in general, and Latvia in particular.

Russia’s hybrid aggression against the Baltics includes several key dimensions:

• Military Exercises: The joint Russian-Belarusian “Zapad-2025” exercises included crisis scenarios in the Baltic region, which may serve as preparation for actual military actions. In 2025, the Russian Navy deliberately conducted maneuvers in the Baltic Sea at the same time as NATO naval drills.
• Intelligence Operations: A crucial aspect of the Kremlin’s hybrid warfare is the targeting of EU and NATO maritime infrastructure. Russian and Chinese vessels have been documented damaging underwater cables and pipelines in the Baltic Sea.
• GPS Jamming: Over the past four years, Russia has persistently jammed GPS signals to disrupt maritime navigation in the Baltic Sea and hinder civilian and military aviation in Baltic airspace.
• Information Warfare: Russia continues to wage an information war against its former colonies. The Kremlin aggressively promotes narratives such as the “Russian World” and “protection of Russian speakers” to justify potential hostile actions against the Baltics.
• Political Provocations: A recent example includes the deportation from Latvia of Russians who failed the mandatory Latvian language exam. Moscow used the incident to claim “persecution of compatriots,” employing it as a tool of political pressure.
• Cyber Threats: Cyberattacks from Russia against the Baltic states date back to April 27, 2007, when Estonia was targeted after relocating the “Bronze Soldier” monument in Tallinn. These attacks crippled state and banking infrastructure and marked one of the earliest instances of coordinated state-sponsored cyber aggression. Since then, cyberattacks from Moscow have continued against all three Baltic countries.
• Drone and Balloon Incursions: Russia is actively using drones and meteorological balloons as hybrid tools, launching them from Russian and Belarusian territory, as well as from Russian vessels near EU and NATO coastlines. A recent wave of drone incursions was observed over strategic Baltic infrastructure, including oil fields, military bases, and airports in Lithuania, Denmark, Norway, Sweden, and Finland.

.

Russian Hybrid Warfare Threats to Latvia: Strategic Analysis

Introduction

Latvia, a NATO member on Russia’s western frontier, faces a unique security challenge from Russian hybrid warfare. This threat blends military pressure with non-military subversion in an effort to destabilize target states while avoiding a full NATO military response. Given Latvia’s history under Soviet rule and its sizable ethnic Russian minority, the country is considered especially vulnerable to Moscow’s hybrid tactics. 

Hybrid Warfare: Definition and Russian Approach

Defining Hybrid Warfare: Hybrid warfare refers to the integrated use of military and non-military means to achieve strategic objectives, often below the threshold of open war. In the Russian context, it involves a “blurring of conflict between war and peace” and a combination of overt and covert tools – diplomatic pressure, information operations, cyber attacks, economic coercion, and use of proxy forces. A succinct definition in . Moscow’s aim is to exploit adversaries’ vulnerabilities across multiple domains while maintaining ambiguity about its direct involvement.

Russian Hybrid Warfare Characteristics: Under President Vladimir Putin, Russia’s security strategy emphasizes “non-linear” conflict, where non-military measures can exceed the effect of conventional arms. Western analysts have categorized Russia’s hybrid threats into several key areas. For example, Atlantic Council experts Franklin Kramer and Lauren Speranza identify low-level use of force, cyber attacks, economic and political subversion, and information warfare as core categories of Russian hybrid operations. These methods are often executed by a diffuse array of actors – spies, state media, cybercriminals, oligarchs, and even ostensibly private “patriotic” hackers – giving the Kremlin plausible deniability. The overarching political goal is to sow confusion, exploit societal divisions, and weaken the target’s pro-Western orientation so that neighbors remain neutral or aligned with Moscow’s interests. Crucially, Russian hybrid tactics are designed to operate below the threshold of an overt armed attack, thus avoiding triggering NATO’s Article 5 collective defense response. This ambiguity and incremental escalation are a hallmark of Russia’s approach, posing significant challenges for Western governments constrained by legal norms and a desire to avoid open war.

Historical Context: Latvia, Russia, and Hybrid Tactics

Latvia’s Past with Russia: Latvia’s vulnerability to Russian hybrid warfare cannot be divorced from its historical experience. The country was occupied and annexed by the Soviet Union during World War II, regaining independence only in 1991. Five decades of Soviet rule left a legacy in the form of a large Russian-speaking population in Latvia, concentrated in urban centers like Riga and in the eastern Latgale region near the Russian borderfpri.orgrusi.org. Approximately a quarter of Latvia’s residents today are ethnic Russians (the highest proportion in the Baltics), and a significant number are native Russian speakers . This demographic reality has been a focal point of Russian rhetoric about “protecting compatriots abroad” – a narrative Moscow used to help justify interventions in Georgia (2008) and Ukraine (2014) and could potentially invoke in Latvia.

NATO Membership and Security Guarantees: In 2004, Latvia joined NATO, firmly anchoring itself in the Western security architecture. This marked a strategic loss for Moscow’s influence and theoretically puts Latvia under NATO’s protective umbrella against direct military aggression. Indeed, NATO’s Article 5 states that an attack on one ally is an attack on all, creating a strong deterrent against overt invasion. However, Russia has adapted by turning to hybrid tactics that stay below the Article 5 threshold. The 2007 cyber-attacks on Estonia (following a dispute over a Soviet-era monument) provided an early example of Russian-linked hybrid operations in the Baltics, foreshadowing what would later unfold more dramatically in Ukraine. After Russia’s annexation of Crimea in 2014 and its orchestration of a separatist war in Eastern Ukraine, Western observers realized that the Kremlin’s playbook involves a blend of covert military force (“little green men”), information warfare, and cyber disruption instead of straightforward tank invasions. These lessons loomed large for Latvia and its neighbors. By the time Russia launched a full-scale conventional war against Ukraine in 2022, the Baltic states had spent years warning that hybrid aggression was a real and present danger to European security.

Recent Precedents: Russia’s use of hybrid warfare in Georgia and Ukraine offers clues to what Latvia might face. In Georgia (2008), Moscow combined conventional military offense with cyber attacks on Georgian networks and a propaganda campaign to undermine the government. In Ukraine (2014–2022), the Kremlin perfected the hybrid model: it infiltrated unmarked special forces and mercenaries, fueled separatist militias, unleashed intense propaganda about “Nazi” threats, and carried out massive cyber strikes on infrastructure – all while denying direct involvement. Latvia has already experienced smaller-scale incursions of this nature: for instance, in 2019 Latvian authorities arrested individuals on charges of spying and subversion linked to Russian security services, and pro-Russian protests erupted in 2022 over the removal of Soviet-era monuments in Riga – incidents widely seen as inflamed by Russian disinformation networks. These examples underscore that Russia’s hybrid tactics against Latvia are not just theoretical, but an ongoing reality.

Geopolitical Motivations for Destabilizing Latvia

Russia’s strategic calculus for targeting Latvia (and the Baltics more broadly) is driven by several interlocking motivations:

• Undermining NATO and Western Unity: Perhaps the greatest motive is to test and weaken the NATO alliance. If Moscow can destabilize Latvia – whether through internal unrest or probing incidents – without eliciting an effective NATO response, it would discredit the Alliance’s collective defense credibility. Russian strategists view NATO as the main obstacle to their regional influence; a successful hybrid campaign that exposes divisions or hesitation within NATO would be a major victory for the Kremlin’s long-term goal of fracturing Western security guarantees. In essence, using Latvia as a pressure point could undermine the post-Cold War security order built on NATO’s deterrence.
• “Protecting” Russian Minorities: The presence of a large Russian-speaking minority provides a convenient pretext for interference. The Kremlin claims a right to defend ethnic Russians and Russian speakers abroad – a theme used in Crimea and Donbas – and could stir grievances among Latvia’s Russian community as a justification for intervention. Moscow might calculate that agitating for the “rights” of Russians in Latvia (for instance, over language or citizenship laws) could justify covert action or at least create political pressure on Riga. By mobilizing this minority through propaganda or political fronts, Russia can generate internal tensions that it might later exploit.
• Historical and Ideological Drivers: From an imperial nostalgia perspective, some in Moscow see the Baltic states as part of Russia’s traditional sphere of influence. Putin has famously lamented the USSR’s collapse, and while re-incorporating the Baltics is far-fetched under NATO’s watch, keeping them unstable or neutral aligns with the idea of a Russian “buffer zone.” Historically, Russia dominated the Baltics for centuries (from Tsarist conquests in the 18th century through Soviet occupation in the 20th), and hardliners in Moscow may harbor the notion that these territories belong in Russia’s orbit . Destabilization short of outright conquest may thus serve a revanchist narrative without triggering a full NATO war.
• Geostrategic and Economic Interests: Latvia and its Baltic neighbors occupy critical geostrategic space on NATO’s northeastern flank. They border important Russian enclaves or allies (Kaliningrad and Belarus) and sit along the Baltic Sea – a key avenue for military positioning and trade. By fomenting instability in Latvia, Russia could disrupt NATO’s use of the Baltics as a staging ground and potentially secure more favorable access to the Baltic Sea. Economically, while direct Russian trade with Latvia has diminished (especially after EU integration and Russia’s own port development), Moscow may still seek leverage via energy supplies or transit routes. Indeed, Russian officials have threatened “asymmetrical measures” targeting the Baltic states’ economy and transit if political relations continue to deteriorate . In short, hybrid attacks on critical economic infrastructure or supply lines in Latvia could serve Moscow’s interest in reminding these states of their economic interdependence (or vulnerability) with Russia.
• Distracting and Dividing the West: Finally, aggressive moves against a small NATO state could be intended to divert Western attention or resources. For example, if the West is heavily focused on supporting Ukraine, Russia might use hybrid harassment in Latvia to create a second axis of tension, hoping to overstretch NATO or force difficult choices. Even the threat of trouble in the Baltics can fuel anxiety in European capitals. By keeping Latvia under pressure, the Kremlin may aim for a broader psychological effect – instilling fear of escalation and thereby weakening Western resolve on other fronts.

Current Security Posture in Latvia and the Baltic Region

NATO’s Forward Presence: In response to Russian aggression in Ukraine since 2014, NATO has significantly bolstered its military posture in the Baltic region. Latvia today hosts a NATO multinational battlegroup as part of the Alliance’s Enhanced Forward Presence (eFP). This battlegroup, led by Canada and including soldiers from around nine allied nations, has been expanded to roughly 1,700 troops and is planned to grow to a brigade-sized unit (around 3,000–5,000 troops) by 2026. These forces serve as a “tripwire” deterrent – any attack on them would immediately involve multiple NATO countries. Following NATO’s 2023 summit, Canada committed to double its troop contribution in Latvia and pre-position critical weapon systems, aiming to make the Latvia battlegroup the first in the Baltics upgraded to a full combat-ready brigade. Likewise, Germany has pledged a brigade for Lithuania, and the UK has a battlegroup in Estonia with additional forces on standby, illustrating NATO’s heightened readiness on its eastern flank.

Regional Military Developments: The Baltic states themselves have been boosting their defense budgets and capabilities. Latvia has surged its defense spending from only ~1% of GDP in 2014 to 3.65% of GDP in 2023, with plans to reach 5% – one of the highest levels in NATO. These funds are being used to acquire advanced systems (e.g. HIMARS rocket artillery, modern anti-air and coastal missiles) and to rebuild manpower through a new conscription service. Riga has reintroduced eleven-month mandatory military service in 2023, aiming to add thousands of trained personnel annually and grow its total wartime force (active and reserve) to over 30,000 in coming years . The other Baltics have followed suit: Estonia and Lithuania exceed NATO’s 2% spending benchmark and are investing in missiles, drones, and infrastructure to delay and complicate any invasion. Additionally, Finland and Sweden’s accession to NATO in 2023–2024 has transformed the strategic landscape. With these Nordic states in the Alliance, the Baltic Sea is increasingly encircled by NATO members, improving collective surveillance and reinforcement routes for the Baltics. Finland’s long border with Russia and robust territorial defense, in particular, provide added depth to the region’s security. However, despite these improvements, Baltic officials remain wary of gaps – such as the Suwalki Gap, a narrow corridor between Poland and Lithuania near Kaliningrad, which NATO would need to secure in any conflict scenario.

US Commitment and Allied Cohesion: One uncertainty in the current posture is the question of sustained US commitment. European confidence was shaken in recent years by US political debates over NATO support. Though the US has rotationally deployed units to the Baltics and Poland (including brigades and jet fighter detachments) and maintains the core of NATO’s conventional deterrent, leaders in Riga recognize that “critical US enablers and rapid reinforcements cannot be taken for granted” in perpetuit y. This drives Latvia’s emphasis on self-help and European defense cooperation. Indeed, the Baltics have become adept at leveraging multinational frameworks: apart from NATO, Latvia works with the EU’s security initiatives and regional groups like the Joint Expeditionary Force (led by the UK) and Nordic defense cooperation to ensure backup in crises. The bottom line is that Latvia’s security today rests on a layered posture – a small but growing national defense, a reinforced NATO presence on the ground, continuous Baltic Air Policing sorties (which intercepted over 300 Russian aircraft in Baltic airspace in 2023alone), and a broader Alliance guarantee. This posture is robust, yet calibrated defensively, since NATO’s aim is deterrence, not provocation. Russia, for its part, remains militarily constrained by its ongoing war in Ukraine, but it continues to conduct intimidating military exercises and air incursions around the Baltics, probing for any cracks in NATO’s shield.

Civil Resilience and Institutions: Beyond pure military measures, Latvia has taken steps to harden itself against hybrid threats. It hosts NATO’s Strategic Communications Centre of Excellence in Riga, a hub dedicated to countering disinformation and propaganda. The government has implemented a Comprehensive Defense Strategy (adopted in 2018) that integrates civilian sectors into national preparedness. For example, Latvian municipalities and even volunteer groups (like hunting clubs) have been involved in defense drills and logistics planning to support the military in case of crisis. This whole-of-society approach aims to build resilience so that even if Russia conducts cyber attacks, sabotage, or tries to stir unrest, Latvian society will be better able to absorb shocks and carry on. The existence of a sizable ethnic Russian community remains a concern for societal cohesion, but Latvia has gradually tightened its citizenship and language laws and invested in integration and media literacy programs to reduce the appeal of malign Russian influence. Still, this arena – the contest for hearts and minds – remains an open battleground that hybrid tactics can exploit.

Possible Russian Hybrid Warfare Tactics Against Latvia

Russian hybrid operations could manifest in a range of hostile activities short of open invasion. Based on Russia’s past behavior and current trends, the following tactics are the most likely tools in a hybrid campaign targeting Latvia:

• Disinformation and Propaganda: Massive information warfare campaigns are a cornerstone of Russia’s hybrid approach. The Kremlin will use state media, proxy news sites, and social media (including newer platforms like Telegram and TikTok) to spread false narratives that undermine Latvia’s government and its Western partnerships. Likely propaganda themes include questioning NATO’s commitment to defend the Baltics, painting Latvia’s leaders as anti-Russian or fascist (to stoke ethnic tensions), and sowing doubts about the benefits of EU membership. Moscow’s information operations often target specific groups – such as the Russian-speaking minority, nostalgic older citizens, or disenfranchised youth – tailoring messages to exploit grievances. Advanced techniques like deepfakes and AI-generated content have also been employed to lend credibility to false stories. The objective is to confuse and divide the public, erode trust in institutions, and create an atmosphere of fear or apathy. For instance, investigators have found Kremlin-backed disinformation in Latvia aimed at discrediting NATO troops and portraying Western aid to Ukraine as dragging Latvia into conflict. Over time, such influence operations can weaken Latvia’s resilience from within, possibly inciting protests or influencing election sentiments in line with Moscow’s interests.
• Cyber Attacks on Critical Infrastructure: Russia has demonstrated a capacity to conduct aggressive cyber attacks against Baltic targets, often via state-linked hacker groups (associated with GRU or FSB intelligence). In a hybrid offensive, we can expect waves of cyber intrusions aiming to disrupt Latvian government services, energy grids, communications networks, and financial systems. Denial-of-service attacks, malware infections, and data breaches could all be in play. Notably, during the 2023 NATO summit in neighboring Lithuania, Russian hackers launched DDoS attacks and planted fake bomb threats to cause chaos. Latvia’s power utilities and banks have also faced persistent probing; in 2022, a major DDoS attack hit Lithuania’s energy company Ignitis, the “biggest cyber attack in a decade,” which was attributed to Russian actors and served as a warning to the whole Baltic region. In a crisis, a synchronized cyber assault could knock out Latvian government websites, deface news outlets with propaganda, and sabotage industrial controllers (for example, causing blackouts or train system failures). Beyond immediate disruption, cyber attacks enable espionage and data theft – stealing officials’ communications or critical security data – which can then be leaked to embarrass or blackmail the Latvian leadership. Combined with other hybrid measures, cyber offensives would test Latvia’s emergency response and could delay or complicate NATO’s ability to coordinate during a security incident.
• Political Influence and Subversion: Russia will likely continue covert efforts to manipulate Latvia’s political landscape. This includes funding pro-Kremlin politicians or parties, cultivating local influencers, and using front organizations or NGOs to lobby for “neutrality” in the Russia-West standoff. In Latvia, the Harmony party (historically backed by many Russian speakers) and various fringe groups have been subjects of concern for potential Russian influence. Moscow’s operatives may attempt to infiltrate government institutions or recruit insiders to sabotage policy-making. For example, in past years, Latvian security services have expelled a number of individuals – including a Russian embassy staffer – for espionage and subversive activities. Russia’s disinformation channels also amplify polarizing domestic issues (such as language laws or WWII historical memory) to inflame political debates. The goal is to create a more Moscow-friendly political environment or at least paralyze decision-making. Election interference is one possible flashpoint: while outright hacking of voting systems is less likely, Russia relies on information ops to sway voters. Cases in neighboring countries illustrate this – in Lithuania, a Kremlin-linked businessman’s funding of a presidential candidate led to an impeachment scandal in 2004. Latvia could similarly see scandals manufactured via leaks or fake documents targeting pro-Western politicians. In a severe scenario, Russia might even support the formation of a separatist or autonomy movement in Latgale (the “Latgale People’s Republic” notion that briefly appeared online in 2015) to challenge Riga’s authority. While Latvian society today shows little appetite for separatism, the mere perception of an internal insurgency – stoked by propaganda and perhaps a few armed agitators – could destabilize the country.
• Exploitation of Ethnic and Social Tensions: A key element of Russia’s playbook is to exploit societal vulnerabilities. In Latvia, ethnic Russians and Russian speakers (who make up roughly one-quarter to one-third of the population) are a prime targetfpri.org. Russian intelligence and propaganda efforts may seek to mobilize this community through grievances, such as claims of discrimination in language use or citizenship. Kremlin-backed media and local proxies (like the Russian Orthodox Church or cultural associations) can amplify feelings of marginalization. In a hybrid offensive, one could imagine orchestrated protests by Russian speakers in Riga or Daugavpils, perhaps sparked by an emotive issue (e.g., the removal of a Soviet monument or an alleged hate crime). These protests might start peacefully but could be escalated by provocateurs into clashes with authorities – footage of which would then be broadcast by Russian media to portray Latvia as unstable and oppressing its Russian minority. Beyond ethnic lines, Russia could also inflame other social divisions: for instance, disinformation could target Latvian public opinion on issues like refugee policy, COVID-19 measures, or economic inequality, aiming to pit various segments of society against each other. This “divide and conquer”approach weakens national unity. An example was seen in Lithuania in 2021–2022 when false rumors (with resemblance to earlier Russian campaigns) spread that state authorities were taking children from families, inciting public outrage. Latvia must anticipate similar malign narratives tailored to its society. Additionally, Russia has weaponized migration as a hybrid tool: along with its ally Belarus, it engineered a migrant influx into Baltic borders in 2021 to pressure these states. A sudden surge of asylum seekers at Latvia’s border (potentially facilitated by Belarusian authorities at Moscow’s behest) could again be used to strain Latvia’s resources and provoke a humanitarian crisis, all under the watchful eye of Russian propaganda cameras.
• Cyber and Electronic Warfare: (This item can be merged with the above “Cyber Attacks” for brevity, since already covered. – Possibly omit separate listing since it overlaps.)
• Covert Sabotage and Proxy Militias: Physical sabotage is an increasing risk, as evidenced by recent incidents in the Baltics. Russian military intelligence (GRU) has been linked to plots to bomb or burn critical facilities in neighboring states – for example, a GRU-orchestrated arson at an IKEA warehouse in Lithuania in 2024 was uncovered, with indications that similar attacks were planned in Latvia. Latvia could see its own share of mysterious “accidents” or vandalism targeting infrastructure such as power substations, railways, or military depots. Small teams of covert operatives or locally recruited agents can carry out these acts of sabotage intended to instill fear and disrupt daily life. In late 2023, Latvian authorities reported incidents of pro-Russian vandals attacking the Latvian Occupation Museum and defacing national monuments, likely inspired or guided by Russian handlers. Furthermore, there is concern about the use of proxy militias or “little green men.” While Latvia’s internal security is far tighter than Ukraine’s was in 2014, Russia could clandestinely insert paramilitary personnel or support extremist groups to foment violence. These could range from criminal gangs hired to create chaos up to, in a dire scenario, a Wagner-style mercenary group infiltrated to carry out a deniable armed provocation. Any sudden outbreak of armed “separatists” in Latgale, even if only dozens of individuals, would present Riga with a perilous challenge: a domestic insurgency with the shadow of Russian backing. NATO has warned that Russia’s hybrid warfare might include “sabotage, acts of violence by proxies, or other covert operations” that blur the line of attribution. Latvia’s border regions could also witness border provocations – for instance, Russian or Belarusian border guards staging an incident, or unknown armed persons crossing into Latvian territory briefly to test response. Frequent Russian airspace violations and military exercises near Latvian borders add to this coercive environment, forcing Latvia to stay on high alert.
• Economic Coercion and Energy Warfare: Russia can also employ non-kinetic but impactful measures like cutting off energy supplies, leveraging trade dependencies, or imposing transit blockades. Historically, Latvia and its neighbors were heavily reliant on Russian natural gas and oil transported via Baltic ports. In a hybrid conflict scenario, Russia could halt what remains of energy exports or use Belarus to ban the transit of goods to and from Latvia. Cyber attacks on Latvia’s financial sector or sabotage of rail connections would likewise have economic ripple effects. Moscow’s officials have explicitly mentioned using “economic and transit measures” against the Baltics as retaliation. Additionally, one cannot ignore undersea infrastructure: submarine or special operatives could attempt to sever Latvia’s internet cables or energy interconnectors on the Baltic seabed, causing outages. Such actions, as suspected in the 2022 Nord Stream pipeline explosions, demonstrate Russia’s willingness to damage critical infrastructure to send a strategic message.

Each of these tactics on its own might be disruptive but not decisive. The real danger lies in a coordinated hybrid campaign where multiple methods are used in concert – for example, a cyber attack knocking out power, followed by a wave of disinformation pinning blame on government incompetence, coinciding with street protests by agitated Russian-speaking residents, all while Russia stages a “snap military exercise” on the border. The cumulative pressure of such simultaneous threats could severely test Latvia’s security forces and governance. It is precisely this multidimensional pressure that defines hybrid warfare, enabling Russia to pursue its goals incrementally while complicating Western responses.

Escalation Scenarios, Red Lines, and Risk of Conflict

Russia’s hybrid aggression against Latvia could escalate through various scenarios, each with distinct risks and “red lines” that might trigger a broader conflict. Three plausible escalation scenarios are outlined below:

1. Steady-State Hybrid Pressure (“Boiling Frog”): In this scenario, Russia maintains a continuous but calibrated campaign of hybrid harassment that remains below the threshold of provoking a military confrontation. This would involve persistent disinformation attacks, periodic cyber intrusions, and isolated acts of sabotage or espionage – essentially a “death by a thousand cuts” approach. The goal is to erode Latvia’s security over time and strain its society without any single event being egregious enough to warrant a forceful response. NATO may not find a clear trigger to invoke Article 5 as each incident appears manageable or ambiguous in attribution. However, the cumulative effect is serious: public trust in government might erode due to constant cyber outages or propaganda-fueled protests, and over years Latvia could be destabilized politically. The risk here is gradual escalation by accumulation – Moscow might slowly increase the intensity of operations if it feels confident NATO will stay hands-off. The red lines in this slow-burn scenario are blurry. A potential NATO red line could be if Russian hybrid actions cause loss of life or significant damage to critical infrastructure (for example, a cyber attack that causes a major power blackout in the dead of winter). Short of that, NATO countries would likely respond with countermeasures such as sanctions, diplomatic protests, and assistance to Latvia (cyber teams, intelligence sharing), but not military force. This scenario is dangerous in that it normalizes low-level aggression and could embolden Russia to push further over time.

2. Acute Hybrid Crisis (“Hybrid Thunderbolt”): This scenario envisions a more sudden and severe hybrid attack that creates a crisis atmosphere in Latvia. For instance, Russian operatives might sabotage a major power plant or communications node causing a nationwide outage, while simultaneously a violent riot erupts in Riga – later found to be egged on by Russian disinformation – and at the same time Russia conducts menacing military maneuvers just across the border. Such a convergence of hybrid threats could rapidly overwhelm Latvia’s capacity. The government might invoke NATO’s Article 4 (consultations) to seek urgent support from Allies. Red lines become critical in this scenario: if there is clear evidence of Russian state involvement in, say, a terrorist-style bombing or fatal sabotage on Latvian soil, NATO would face enormous pressure to respond collectively. While Article 5 has never been invoked for hybrid attacks, NATO has signaled that a hybrid operation of sufficient scale and effect “could reach a level that might trigger Article 5”. For example, a crippling cyber attack on national infrastructure or use of proxy forces causing multiple deaths might be deemed an “armed attack” in the sense of the treaty. The 2024 NATO summit declaration explicitly warned Moscow that hybrid actions might prompt a collective defense response. Thus, in this acute crisis, one red line would be crossed if Latvia’s leaders or NATO intelligence conclusively attribute the event to Russia – removing ambiguity. Another red line is if the hybrid attack coincides with any overt Russian military incursion, no matter how small (even “unmarked” troops appearing in a border town would likely trigger Article 5 immediately). The risk of miscalculation is high: Russia could underestimate NATO’s resolve and cross a threshold that leads to a rapid military escalation. Conversely, NATO might struggle to agree on the threshold for response, leading to delayed action which Russia could exploit to consolidate gains (e.g., entrenching its proxies or extracting political concessions under duress). This scenario is essentially a pre-war crisis, one misstep away from open conflict, testing NATO unity and decision-making under ambiguity.

3. Open Conflict (Worst Case Article 5 Trigger): In the worst-case escalation, Russia’s hybrid campaign serves as a prelude or cover for a direct military attack on Latvia. This could unfold if Moscow, for example, manufactured an “insurgency” in Latgale and then announced it must “protect Russian citizens,” sending in special forces or regular units across the border. Such an overt breach of NATO territory – even if initially couched in denials or done by ostensibly irregular forces – would cross a bright red line. NATO’s treaty obligations would compel a collective military response, meaning a Russia-NATO war. Both sides have strong incentives to avoid this scenario: Russia knows a direct conflict with NATO could be ruinous, while NATO knows any confrontation with nuclear-armed Russia carries existential risks. Therefore, Moscow’s hybrid tactics are calibrated to avoid a clear-cut invasion. However, the fog of hybrid warfare could unintentionally lead to open conflict. For instance, if Russian “proxy” fighters engaged Latvian border guards in a firefight that killed NATO troops, or if a Russian missile (perhaps fired during an exercise or as a warning shot) accidentally struck Latvian territory, NATO might invoke Article 5 depending on the circumstances. There is also the peril of escalation from misunderstanding: a cyber attack that blackouts Riga could be misinterpreted by NATO as the prelude to a conventional strike, prompting NATO to mobilize forces, to which Russia might respond kinetically. The “red lines” in this scenario are essentially those that define war – any confirmed Russian military incursion, attack on Latvian/NATO forces, or significant destructive act attributed to Russia would oblige NATO to act. Once Article 5 is invoked, the situation moves beyond hybrid ambiguity into open deterrence and defense. At that point, the conflict could expand rapidly, with Russia possibly attempting a broader offensive in the Baltics or strikes elsewhere in Europe, and NATO executing defense plans that involve large-scale deployments to Latvia and strikes against Russian forces engaged in aggression. This doomsday scenario remains unlikely precisely because of the mutually assured escalation it entails. Yet it must be considered in planning, as misjudging NATO’s red lines or resolve is a constant danger – especially if Russia’s leadership believes NATO might back down rather than risk war. NATO has thus been very clear in messaging that any armed attack, however disguised, on Baltic soil will be met with force.

Overall, the calibration of response to hybrid aggression is delicate. NATO countries have worked to develop a more graduated set of response options – diplomatic, economic, cyber countermeasures – to handle hybrid attacks without immediately resorting to military force. But as hybrid incidents intensify, the line between “peace” and “war” can blur quickly. This is exactly what Russia’s hybrid playbook is designed to exploit. The challenge for Latvia and NATO is to deter and respond to hybrid threats decisively enough to prevent escalation, yet prudently enough to avoid giving Russia a pretext to up the ante. The risk of open conflict remains if deterrence fails or if Moscow fatally miscalculates Western political will.

NATO’s Deterrence Posture and Response Options

Facing the spectrum of hybrid threats, NATO has adapted its strategy and tools to improve deterrence and defense for members like Latvia:

Enhanced Conventional Deterrence: NATO’s most visible response has been strengthening its conventional force presence in frontline states. The deployment of multinational battlegroups in the Baltics and Poland since 2017 serves as both a deterrent tripwire and a rapid response force for initial defense. These forces have been bolstered since 2022, with plans for some (like in Latvia) to expand to brigade size and for pre-positioning heavy equipment. NATO has also dramatically increased the frequency and scale of military exercises in Eastern Europe – for example, the annual Namejs exercise in Latvia or larger Allied drills like Defender Europe – to demonstrate readiness and to practice counter-hybrid scenarios such as fighting in cyber-degraded environments or managing civilian unrest during conflict. After Finland and Sweden joined NATO, new regional defense plans were drawn up to integrate the Nordics and Baltics, enabling better coordination of air defense, coastal defense, and reinforcement routes across the Baltic Sea region. Notably, NATO’s Baltic Air Policing mission has been augmented; Allies rotate modern fighter jets in Lithuania and Estonia (and now in Poland’s airbases as well) to police the skies. The steep increase to over 300 intercepts of Russian aircraft in 2023 underscores both the threat and NATO’s active vigilance . On the maritime front, NATO navies patrol the Baltic Sea and have stepped up monitoring of undersea infrastructure. Collectively, these measures aim to deter Russia from contemplating any military adventure, by making it clear that NATO forces are present, capable, and unified. They also provide a backbone of support that Latvia can rely on if hybrid attacks start to escalate, ensuring that Russia cannot achieve a quick fait accompli in any scenario.

Hybrid Threat Response Teams: In recent years, NATO has acknowledged that agility is needed to counter hybrid warfare. Since 2016, the Alliance has stated explicitly that hybrid actions could trigger Article 5, and it created Counter Hybrid Support Teams to assist allies under hybrid attack . These teams – composed of experts in cyber defense, energy security, civil preparedness, etc. – can be deployed to a member state to help identify and mitigate ongoing hybrid activities. For example, NATO sent a support team to Montenegro in 2019 to help it fend off sustained disinformation and coup attempts linked to Russia . A similar team was sent to Lithuania to bolster its resilience against cyber attacks . Latvia, if facing a hybrid onslaught, could rapidly invoke NATO assistance and receive such specialized help on the ground. Additionally, NATO’s Cooperative Cyber Defense Centre of Excellence (in Estonia) and the Strategic Communications COE (in Latvia) are nodes that develop best practices and can surge expertise during crises. NATO has also improved information-sharing and rapid consultation mechanisms. Allies have agreed on procedures to consult quickly (via Article 4 or emergency sessions) when ambiguous situations arise, so they can attribute attacks and coordinate responses. Importantly, NATO’s decision at the 2024 Vilnius summit (75th anniversary) reaffirmed that a significant hybrid attack will be met with a unified response, possibly including collective defense measures . This clear messaging is intended to shore up deterrence by convincing Moscow that hybrid tricks won’t avoid retaliation.

Integrated Multi-Domain Defense: Recognizing the multidimensional nature of hybrid war, NATO and the EU have been enhancing cooperation on non-military security. The EU, for instance, has frameworks for countering disinformation (e.g. the East StratCom task force) and protecting infrastructure. Latvia, as both an EU and NATO member, benefits from this synergy – for example, EU sanctions can be imposed on individuals or entities conducting cyber or disinformation attacks, complementing NATO’s military measures. NATO is working on strategies for protecting undersea cables, securing 5G communications, and coordinating responses to energy supply shocks as part of its resilience commitments. The idea is to deny Russia easy opportunities in the “gray zone.” For instance, after suspicious activities around Baltic Sea pipelines and cables in 2022-2023, NATO established a Critical Undersea Infrastructure Coordination Cell to monitor and respond to such threats. Intelligence sharing between Allies has also intensified; Baltic states now regularly share information on Russian espionage or influence operations so that NATO can act in concert, whether that means expelling Russian diplomats Alliance-wide or issuing joint warnings. At the political level, NATO has strengthened its rhetoric: any attack, even if unconventional, that causes strategic effects will prompt solidarity. In practice, NATO’s response options to hybrid aggression could include cyber counter-attacks (for example, NATO members might take down a Russian hacker group’s servers), deployment of additional troops or ships to signal resolve, and collective attribution (publicly calling out Russian culpability to eliminate ambiguity). One notable tool is economic punishment – while NATO as a military alliance doesn’t impose sanctions, its member states coordinate through the EU or G7 to sanction Russian officials and organizations involved in hybrid attacks. This was evident when multiple countries expelled scores of Russian “diplomats” (intelligence officers) en masse after Russian clandestine operations were exposed in Europe.

Deterrence by Denial and Resilience: NATO’s new emphasis is not only on deterring by the threat of retaliation, but also on deterrence by denial – making societies like Latvia hardened enough that hybrid attacks fail to achieve their purpose. This includes helping Latvia and others to improve media literacy (so citizens recognize and reject propaganda), secure their elections, diversify energy sources (Latvia has cut off Russian gas imports and built connections to EU suppliers), and build strong cyber defenses. NATO and EU funds have supported Latvia in, for example, upgrading its cyber security operations center and conducting joint cyber exercises. Moreover, Latvia’s adoption of a comprehensive defense approach (involving civilians and local governments in crisis response) is held up as a model in NATO. By demonstrating societal resilience – such as the ability to keep services running during a cyber attack or to quickly quash riots and disinformation with effective public communication – Latvia can deter Russia by showing that hybrid tactics won’t easily achieve the desired chaos. In essence, NATO’s strategy is evolving toward a whole-of-alliance resilience: every Ally is encouraged to close legal loopholes and vulnerabilities that Russia could exploit. For example, several NATO states have tightened laws on foreign ownership of strategic assets after cases where Russian oligarchs tried to buy property near military bases (a tactic noted in Finland). In Latvia, laws have been passed to restrict the spread of hostile propaganda (certain Russian TV channels are banned) and to make treasonous activities easier to prosecute. All these measures increase the costs and reduce the gains of Russian hybrid warfare.

Finally, NATO’s nuclear deterrent and overall military superiority remain the ultimate backstop. While not directly relevant to hybrid skirmishes, they form the backdrop that any Russian planner must consider – if a hybrid conflict ever did spiral into open war, NATO’s overwhelming response (conventional and nuclear) would be in play. NATO makes this clear to avoid any misunderstanding: even hybrid aggression carries the risk of escalation to full conflict, which Russia cannot win. This reality is perhaps the strongest deterrent of all, and NATO’s task is to ensure that Russia does not find a seam in the alliance’s resolve at lower levels of conflict.

Strategic Recommendations for Latvia and NATO

To counter the possibility of Russian hybrid warfare in Latvia, a multi-pronged strategy is needed. Below are strategic recommendations for Latvia and its NATO partners to enhance preparedness and deterrence:

1. Strengthen Societal Resilience: Latvia should continue to harden its society against hybrid attacks. This means investing in public awareness and education to inoculate citizens against disinformation – for example, expanding media literacy programs and swiftly debunking false narratives through credible sources. Integration of the Russian-speaking minority is crucial: policies that encourage greater use of the Latvian language and civic participation, while addressing legitimate minority concerns, can reduce the resonance of Moscow’s propaganda. Regular civil defense drills and crisis response exercises involving local communities will help ensure that if critical services are disrupted (by cyber attack or sabotage), society can cope without panic. A unified, resilient society presents no easy openings for Kremlin subversion. As one analyst noted, developing resilience is a “never-ending process” that must occur at national, European, and trans-Atlantic levels to blunt hybrid threats.
2. Enhance Cyber Defense and Intelligence: Given the high likelihood of cyber warfare, Latvia (with NATO support) must constantly upgrade its cyber defenses. This includes modernizing IT infrastructure, using threat intelligence to preempt attacks, and possibly adopting an “active defense” posture in cyberspace to deter hackers. NATO’s Cyber Defense Centre and cyber rapid-response teams should be closely integrated with Latvia’s efforts. Intelligence sharing is equally vital – NATO and EU allies should provide Riga with early warning of hybrid plots, whether it’s imminent cyber intrusions or influence operations linked to Russia. Creating a dedicated Baltic intelligence fusion cell could help pool information on Russia’s activities across Estonia, Latvia, and Lithuania. Such coordination can expose Russian hybrid operations early, denying them the cloak of deniability. When plots are foiled (as with the GRU-led sabotage plans uncovered in 2024), publicizing these successes can strengthen deterrence by signaling to Moscow its agents are being watched and caught.
3. Bolster Conventional Deterrence and Rapid Reaction Forces: NATO should continue translating its commitments into tangible capabilities on the ground in Latvia. In practice, this means following through on plans to build the Canadian-led NATO battlegroup into a full brigade with necessary enablers (air defense, engineering, artillery support) by 2025–2026. Pre-positioning equipment and improving infrastructure (airfields, ports, fuel depots) in Latvia will ensure that NATO reinforcements can deploy quickly if a crisis emerges. At the national level, Latvia’s goal to reach 5% GDP defense spending and expand its forces should be matched with smart investments: anti-drone technologies, better surveillance of borders (including maritime domain awareness in the Baltic Sea), and territorial defense units trained to respond to hybrid incidents. Host Nation Support arrangements need to be robust so that if NATO allies send troops or cyber teams during a hybrid attack, they can plug into Latvian systems seamlessly. Regular joint exercises that simulate hybrid scenarios – e.g. a mix of cyber attacks, info warfare, and insurgent attacks – will improve interoperability. By achieving a posture of “deterrence by denial,” where Russia sees that any attempt at armed mischief would be immediately contained by ready forces, NATO and Latvia together can dissuade Moscow from even considering crossing the line.
4. Clarify Red Lines and Communicate Resolve: NATO and Latvia should leave no ambiguity in their communications to Russia regarding hybrid aggression. Diplomatically, NATO must reiterate at the highest levels (as it did in 2024) that serious hybrid attacks can trigger Article 5, and that the Alliance is prepared to act accordingly. This message should be conveyed publicly and through backchannels to Russian leadership to reduce the risk of miscalculation. For example, a scenario could be described: “If a cyber attack causes loss of life or disabling of critical infrastructure in a member state, we will consider it an armed attack.” While maintaining strategic ambiguity on exact response, being explicit about certain red lines (like interference in command-and-control networks or deployment of unmarked armed groups on allied soil) can enhance deterrence. Additionally, NATO’s Nuclear Planning Group or major powers like the U.S. and UK could privately remind Moscow that any attack on NATO territory, hybrid or otherwise, runs risks of uncontrolled escalation – reinforcing the point that Russia gains little and risks all in such gambits. In Latvia’s own strategic communications, authorities should consistently highlight unity: for instance, showcasing how any disturbance will be met by a combined response of police, military, and allied support. Effective “strategic communications” – an area where Latvia is already a leader via the Riga StratCom COE – can turn the tables on Russia’s info war by exposing its tactics and strengthening public resolve rather than sowing fear.
5. Improve Legal and Institutional Frameworks: Hybrid warfare often exploits legal grey zones. Latvia and NATO should review and update laws to better address hybrid threats. For Latvia, this could involve refining laws on emergency situations to allow faster mobilization against unconventional threats (for example, empowering the government to deploy the National Guard in a cyber crisis or to curtail the operations of entities spreading dangerous disinformation during a declared emergency). Security services might need expanded legal tools to surveil and detain individuals suspected of being proxy agents for a foreign power – always balancing civil liberties, but recognizing the unique threat. On the NATO side, Allies could develop a collective toolkit for hybrid response: for instance, a predetermined package of sanctions and political responses that can be quickly activated when a hybrid attack occurs, to avoid paralysis in the heat of the moment. The idea of a “hybrid Article 5 playbook” has been suggested by experts, which could enumerate steps NATO would take in gradation to ensure a unified front (ranging from joint statements and fact-finding missions up to readying rapid reaction units). Additionally, NATO and the EU should streamline their coordination – perhaps establish a joint task force on hybrid threats – so that military, economic, and informational responses align. A coordinated multilateral response will always be more effective than fragmented national ones.
6. Deepen Regional Cooperation: Latvia should continue working closely with Estonia, Lithuania, Poland, and the Nordic countries to build a united regional defense against hybrid tactics. The Nordic-Baltic region has been at the forefront of innovating responses – from Finland’s whole-of-society resilience (the concept of “kokonaisturvallisuus”) to Estonia’s cyber expertise. Sharing these best practices is invaluable. Practical steps include joint monitoring of hostile activities (like the Nordic-Baltic countries pooling surveillance of the Baltic Sea and airspace to detect incursions or GPS jamming) and coordinating strategic communications to counter disinformation swiftly across languages. The recently formed Joint Expeditionary Force (JEF), which includes Baltic and Nordic states plus the UK, could be leveraged for rapid deployments in a hybrid scenario – for example, the JEF could send a company of troops to help guard a critical site in Latvia if sabotage threats are imminent, or send psychological operations teams to help counter an influence campaign. By developing a kind of “neighborhood watch” in the Baltic Sea region, these countries can collectively plug gaps in each other’s defenses. Multilateral exercises like Baltic Host (focused on civil-military cooperation) and regular meetings of Baltic-Nordic security services should be expanded. In essence, Latvia is not alone – it stands with a cohort of nations that have long experience with Russian tactics, and together they can present a hardened front line.
7. Support and Leverage Ukraine’s Success: While not directly about Latvia’s defenses, it is strategically relevant that NATO and Latvia continue strong support for Ukraine. Russia’s capacity to threaten NATO in the Baltics is constrained when it is tied down and weakened in Ukraine. Every failure of Russia’s military in Ukraine diminishes the credibility of its intimidation elsewhere. Conversely, if Russia were allowed to succeed or recuperate, it might turn attention back to NATO’s eastern flank. Thus, helping Ukraine defeat Russian aggression is indirectly one of the best ways to secure Latvia. It sends Moscow a clear message: its revisionist ambitions will be met with unified resistance. Additionally, lessons learned from the war in Ukraine (on countering drones, dealing with propaganda, protecting critical infrastructure from missile strikes, etc.) should be studied by Latvian and NATO planners to update contingency plans for the Baltics. In short, “as goes Ukraine, so goes the security of the Baltics.” Keeping Russia on the defensive reduces the likelihood it will gamble on provocations against Latvia or its neighbors.

By implementing these recommendations, Latvia and NATO will enhance a holistic deterrence posture. The objective is to convince Russia that hybrid warfare will fail to achieve its political aims and could even backfire by fortifying Latvia’s resolve and triggering a strong NATO reaction. This comprehensive approach – blending military preparedness, societal resilience, legal/political measures, and international unity – offers the best chance to prevent the dark scenarios of hybrid conflict from materializing.