Is Hybrid War, War?
Vincent Roobaert ·
On 20 August, a Romanian F-16 destroyed an explosive-laden naval drone a few hundred meters from the Neptun Deep gas platform in the Black Sea, Europe's largest offshore gas project. It was the second such incident in a week; Romanian Army divers had already neutralized two drifting drones near the same site days earlier. The Romanian President blamed Russia directly. European Commission President Ursula von der Leyen called it part of "an escalating campaign of threats" and said plainly: "This is hybrid warfare."
I don't disagree with the facts. I disagree with the label and, increasingly, with how inconsistently it's being applied.
A growing pattern, not limited to the Black Sea
The incidents around Neptun Deep are not isolated.
In July 2024, incendiary devices disguised as ordinary parcels were shipped out of Vilnius through DHL and another carrier, bound for addresses in the United Kingdom and Poland. One package caught fire at DHL's Leipzig hub; another ignited in a UK warehouse. Lithuanian prosecutors have since charged five men, aged between 23 and 69, with terrorism offenses, alleging they were recruited by individuals linked to Russia's military intelligence service (GRU) as part of a wider network.
Two years later, in early August 2026, a drone carrying explosives was found near a Ukrainian military cargo aircraft at Leipzig airport, a hub that also handles NATO-related logistics. Surveillance footage reportedly shows the drone striking the aircraft's wing before failing to detonate. German investigators later matched DNA on that drone to a trace recovered from the 2024 Leipzig arson. Germany's interior ministry said the incident "may be an element of a hybrid attack".
The same month, Lithuania separately accused Belarus and Russia of a "deliberate escalation of hybrid warfare" after a wave of contraband-smuggling balloons repeatedly shut down Vilnius airport and floated the possibility of invoking NATO's Article 4, initiating consultation between NATO members.
Whatever the merits of that specific claim, it illustrates the problem: "hybrid warfare" is now the label attached both to a possible GRU-linked sabotage network moving explosives through a commercial parcel service and to cigarette smugglers drifting balloons over a border.
The term is being asked to do a great deal of work, for events of very different character and gravity.
Why the label matters
"Hybrid warfare" is not just a description. The use of these terms derives from a legal and political choice. States decide to consider that the event falls under the threshold of what is considered to be an armed attack. It therefore keeps the State’s response inside the toolbox of sanctions and diplomatic condemnation, rather than calling for a military response.
It deliberately avoids the vocabulary of "armed attack," because that vocabulary carries consequences: it is the trigger for Article 51 of the UN Charter, and potentially for Article 5 of the NATO Treaty.
That is precisely why I think the label deserves scrutiny rather than uncritical adoption. And it is worth being honest about what the label cannot do: it cannot change what actually happened.
What the law actually asks
Under the UN Charter's use-of-force framework, the test for an armed attack is one of ‘scale and effects’, not of the label a political leader chooses to attach.
A munition-carrying drone, launched with intent, entering a state's exclusive economic zone and requiring a kinetic response to neutralize, is not obviously a lesser act than a missile that misses. The fact that no one died is a matter of luck and Romanian air defense competence, not a matter of legal characterization.
The International Court of Justice's jurisprudence offers a useful analytical framework for this purpose. In Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States), the Court held that not every unlawful use of force rises to the level of an "armed attack" within the meaning of Article 51 of the UN Charter, drawing a distinction between "the most grave forms of the use of force" and "other less grave forms". This threshold was subsequently applied and refined in Oil Platforms (Islamic Republic of Iran v. United States), where the Court assessed whether the mining of a single vessel and an isolated missile strike were of sufficient gravity and effect to constitute an armed attack justifying forcible self-defense, rather than mere isolated incidents of lower intensity. The Court's inquiry in both cases focused entirely on the scale and effects of the conduct in question: its intensity, its target, and its consequences rather than on how the parties themselves chose to characterize it.
The label attached to an incident, whether "war," "special operation," or "hybrid aggression," is not conclusive. What matters is a fact-specific, cumulative assessment measured against the Article 51 threshold. Von der Leyen herself, in her own words to the European Parliament weeks earlier, argued that a pattern of incidents (Poland, Estonia, Denmark, Belgium, Germany, Romania and Lithuania) is not "random harassment" but "a deliberate and targeted grey zone campaign".
She is right about the pattern. Where I part ways is the conclusion. If the campaign is deliberate, coordinated, and repeated across multiple sovereign territories with the object of degrading the Union's resolve, the cumulative legal weight of that campaign should be assessed differently than each isolated incident taken alone. That is exactly the kind of question international law is built to ask and exactly the kind of question the use of the terms "hybrid warfare" is designed to avoid asking.
The attribution problem
None of this is to minimize the difficulty of attributing the actions to a State actor. However, this is a different legal question from the characterization of the acts themselves.
Qualifying conduct as an "armed attack" answers the question of what happened. Attribution answers the separate question of who is legally responsible for it. The ICJ's own attribution standard, set out in Nicaragua (para. 115) requires "effective control" over the operation in question, not mere sympathy, financing, or general support for an actor's aims. Political confidence that an incident "bears the hallmarks" of a given state's intelligence services, the language now routinely used about the Leipzig drone, the Vilnius parcels, and Neptun Deep alike, is not the same as satisfying that standard.
This is not an argument for inaction, or for pretending attribution doesn't matter. It is the opposite: attribution is precisely what should be done rigorously and stated plainly once it can be, rather than resorting to semantics ("hybrid," "grey-zone," "hallmarks of") that let a government sound assertive while making no legally binding claim at all. Von der Leyen's own call to "not shy away from attributing responsibility" was correct. The problem is that the practice across these incidents has not caught up with the words.
A thought experiment: the same drone, a school instead of the tarmac
Take the Leipzig drone. It struck an aircraft wing, failed to detonate, and bounced onto the tarmac.
Now change one fact and hold everything else constant: the same device, launched the same way, with the same intent, drifts slightly off course and comes down not on an airport but on a school, and this time it detonates, killing schoolchildren.
Same actor, presumably; same weapon; same decision to build it; arm it; and send it across a border. The only thing that changes is where gravity and wind took it.
Does that change the legal analysis? In one sense, no: the conduct and the means, i.e. launching an armed device into another state's territory, was identical the moment it left the ground, and the legality of that act cannot depend on a coin toss it has no control over. But the law's own test cuts the other way on the question that matters most in practice. Because the Nicaragua/Oil Platforms framework asks about "scale and effects," not just about the category of weapon used, a lethal strike on a school is far harder to wave off as a lesser use of force than a device that simply failed to go off.
So the honest answer is: the underlying breach of international law was already complete when the drone crossed the border. What changes with the school example is not whether a violation occurred, but how forcefully anyone is willing to say so, and how much political cover "hybrid warfare" can still provide once the cost is dead children rather than a damaged wing.
That should trouble us. If the label only becomes untenable after the outcome is catastrophic, then what we are really doing is waiting for a tragedy to do the legal reasoning that the facts, on their own, could already support.
The honest counterargument
The reason for all this caution is political and diplomatic and does have some merit. European leaders are not naive about escalation. Frederiksen has pushed for a harder line; Macron and Meloni have urged caution, wary of a tit-for-tat spiral with a nuclear power.
Keeping the "hybrid" framing preserves flexibility, avoids forcing a binary Article 5 decision that could fracture allied unity, and buys time for attribution to solidify or for a diplomatic solution to arise. That is a legitimate strategic calculation. It is not, however, a legal conclusion and the two should not be allowed to blur into each other.
Why this isn't academic
The characterization drives the response. "Hybrid warfare" invites sanctions and statements. "Armed attack" invites consultation obligations, evidentiary thresholds for attribution, and eventually, a collective response NATO members have spent four years trying not to have. Attribution standards matter too: political comfort with "presumed Russian responsibility" is not the same as the state-responsibility threshold international law actually requires.
There is also a cost the debate rarely names: the confusion itself.
When the same words are used for an explosive drone striking a military cargo plane's wing, a parcel-bomb network moving through a commercial courier, and a smuggler's balloon forcing an airport shut, the term stops doing any descriptive work at all. And when the vocabulary of "war" is deployed emphatically, incident after incident, without ever landing on an actor, a legal category, or a consequence, the public is left uncertain how seriously to take any of it. That confusion cuts against the very case European governments are trying to make for higher defence spending. Citizens asked to accept sharply larger budgets on the strength of being told "this is war" will reasonably ask, sooner or later: why no one has been named, why Article 5 has never been invoked, and why the answer is always more money rather than a clear legal reckoning.
Calling this "hybrid warfare" indefinitely, incident after incident, doesn't make Europe safer. It postpones the harder conversation about what states are actually willing to defend.
So, is it war?
So, is hybrid war, war? Under the law as it stands, not automatically. No single drone, no single parcel, no single balloon crosses the threshold of Article 51 on its own. But that is precisely the wrong unit of analysis. Nicaragua and Oil Platforms ask us to look at scale and effects, and the effects here are cumulative and continuous: naval drones off Romania, an explosive device on a military cargo aircraft's wing in Germany, an incendiary-parcel network run through a commercial courier, cut cables, airspace incursions, an airport shut down by balloons. Assessed incident by incident, each stays comfortably below the threshold that would force a hard decision. Assessed as what the pattern actually is: sustained, coordinated, and armed in intent even when it misses, it sits much closer to that threshold than the vocabulary of "hybrid warfare" allows anyone to admit.
That is the real function the term now performs. It is not a neutral description of an ambiguous reality; it is a linguistic device that keeps a reality which may already have crossed a legal line safely on the far side of it. Calling this "hybrid" rather than "armed attack" is not just imprecise, it is a choice with consequences: it is the difference between a diplomatic note and Article 5 consultations, between resilience funding and collective defence.
My argument is not that Europe should rush to invoke Article 5 over a drone that missed. It is that the gap between what is actually happening and the vocabulary used to describe it has grown wide enough that the vocabulary itself is now doing strategic work for the side that benefits from ambiguity. That gap is precisely what the public, and policymakers, should be told about honestly, rather than being handed words that resolve the discomfort of the question without resolving the question.
I think we're closer to that threshold than the current vocabulary admits.
First published on LinkedIn.