Formation of the Baltic Sea Hybrid Threat Task Force and Its Implications for European Security

Executive Summary

The Baltic states, Germany, and other littoral states have agreed to form a joint task force to counter hybrid threats, based on the assessment that Russia's gray-zone pressure has evolved into a structured, persistent threat. However, its organizational structure, budget, and command system are not yet finalized. Considering Germany's past practice of refraining from publicly attributing specific incidents to Russia, there is a 55% probability—the highest among the scenarios—that the task force will remain a consultative body focused on intelligence sharing. The likelihood of it becoming a permanent body funded by an increased EU budget is only 20%, constrained by the EU's unanimity requirement and the passive stance of some member states that are highly dependent on Russia. The South Korean government and companies should prioritize allocating resources to common action items across all scenarios rather than betting on a single outcome. These items include supplying drone detection and anti-air defense subsystems, providing maritime unmanned systems and satellite imagery analysis for monitoring the “shadow fleet,” and managing European logistics risks. This recommendation is based on the key judgment that the rapid response systems and individual procurement channels already established by the Baltic states will continue to operate regardless of the task force's final form.

I. Situational Analysis

Baltic Sea States to Form Hybrid Threat Task Force

1. Background and Developments

The Baltic Sea states share a geographical border with Russia and Belarus, a condition that has made them the first to be exposed to hybrid threats. In Estonia, an incident occurred where a drone crashed into the chimney of the Auvere power plant, located 2 km from the Russian border. Since this event, the Baltic states have been building up their rapid response systems [2].

The Latvian news outlet Delfi reported remarks by Vice Admiral Jan Christian Kaack, Inspector of the German Navy. He described the Russian Navy as "aggressive," noting that it conducts surveillance of bases and units, attempts threats and sabotage, and utilizes drones and a “shadow fleet” [9]. Admiral Kaack also pointed out that Russia has recently begun protecting its shadow fleet vessels with warships or armed security teams [9].

Speaking at the 'Coalition of the Willing' conference in Kyiv on August 24, Latvian Prime Minister Andris Kulbergs characterized Russia's tactics, such as disinformation and the weaponization of migrants, as a "war against the West" [4]. Around the same time, Latvian President Edgars Rinkēvičs stated at a press conference near the Belarusian border, "Russia's hybrid war has already begun" [11]. The language among Baltic leaders is solidifying, framing the threat not as a future possibility but as an ongoing reality.

In this context, on July 30, European Commissioners from the Baltic states, Poland, and Finland, including Valdis Dombrovskis, sent a letter to Commission President Ursula von der Leyen requesting increased security funding for the Baltic region [16]. This shows that the demand for European-level financial support is proceeding in parallel with individual national response efforts.

2. Current Situation

A meeting of Baltic Sea interior ministers was held at the Mürwik Naval School in Flensburg, Germany. According to the German media outlet Deutsche Welle (DW), German Interior Minister Alexander Dobrindt stated, "Foreign powers are trying to attack our security with hybrid means, destabilize our democracy, and weaken our economy" [1]. The meeting addressed security policy issues for the common future of the Baltic Sea region, resulting in an agreement to form a joint task force to counter hybrid threats [1].

This agreement aligns with the ongoing cooperation among the parliaments of the three Baltic states. On August 20 in Tallinn, the speakers of the Baltic parliaments issued a joint statement reaffirming their support for Ukraine and their position of not recognizing Russia's territorial annexations [13]. At a joint press conference in Riga, the prime ministers of Lithuania and Latvia emphasized the issue of eastern border security and called for EU-level support against Belarus's weaponization of illegal migrants [15].

Meanwhile, reactions within the Baltic states to the recent visit of a top U.S. intelligence official to Moscow have been restrained. The Ukrainian outlet Kyiv Independent reported that CIA Director John Ratcliffe had warned Russian officials in Moscow to refrain from escalating against NATO's border countries, particularly Estonia, Latvia, and Lithuania [17]. In response, on August 27, Estonia and Latvia stated that their own assessment of the threat from Russia "remains unchanged" [7]. This can be interpreted as a signal that they intend to maintain their existing state of alert rather than being reassured by U.S. mediation efforts.

Official assessments at the EU level maintain a cautious tone. The Croatian newspaper Jutarnji list, citing an anonymous senior EU official, reported that European intelligence agencies have not confirmed any signs of a Russian military attack on a NATO member state [14]. The Turkish outlet Daily Sabah published a similar report [18]. This suggests that the possibility of a military invasion and the persistent nature of gray-zone pressure are being treated as separate issues.

3. Key Actors and Positions

German Ministry of the Interior (Minister Dobrindt)As the host of the meeting, Germany led the discussions on the task force. Germany defines Baltic Sea security as an issue directly linked to the security of its own northeastern coast [1]. However, previous EAI analysis has pointed out Germany's cautious approach to attribution. It has a track record of refraining from publicly linking incidents to Russia due to concerns about diplomatic repercussions [2][8]. The extent of the task force's authority to conduct specific investigations and make public statements may conflict with this German cautiousness.

The Three Baltic States (Estonia, Latvia, Lithuania)These are the states with the most acute threat perception. Due to their geographical vulnerability of sharing a border, they already operate rapid response systems [2]. The Latvian government's rhetoric is the strongest, describing Russia's hybrid activities as a "war against the West" [4][11]. They also maintain an independent judgment framework, not lowering their threat assessment even after the CIA director's visit to Moscow [7], indicating they are not swayed by external signals of mediation.

German Navy (Vice Admiral Kaack)Assesses the threat from Russia's shadow fleet and sabotage activities in the Baltic Sea as being at a persistently "high" level [9]. This provides a basis for expanding the discussion of hybrid threats from a focus on land-based infrastructure to the maritime domain.

European CommissionHas received the request for increased security funding from the Baltic states, Poland, and Finland [16]. At the same time, it maintains a cautious assessment that there are no signs of an imminent military attack [14][18]. A discrepancy exists between the call for greater financial support and the official threat level assessment.

RussiaDoes not appear as a direct actor making statements on this issue. However, it is consistently identified in the narratives of Baltic and German actors as the perpetrator of gray-zone provocations [1][9][11].

4. Key Issues

The first issue is the scope of the task force's actual authority. The key challenge will be how to reconcile Germany's cautious practice of attribution with the Baltic states' practice of rapid attribution and response within a single consultative body [2][8].

The second issue is financial allocation. It remains unclear whether the request for increased EU security funding by the Baltic states, Poland, and Finland [16] will be linked to the operating budget for this task force.

The third issue is the dualistic framing of the threat assessment. The gap between the European Commission's assessment of "no signs of military attack" [14][18] and the on-the-ground perception in the Baltic states of being in a "state of war" [4][11] complicates the very definition of the threat that the task force is meant to address.

II. In-depth Issue Analysis

Formation of the Baltic Sea Hybrid Threat Task Force: An In-depth Analysis

1. Analysis of Root Causes

The fundamental reason for this task force agreement lies in the changing nature of Russia's pressure strategy against Europe. On the Ukrainian front, Russia is stuck in a war of attrition and lacks the capacity to escalate against NATO with conventional forces. This military constraint has paradoxically incentivized an expansion of gray-zone operations [8], as activities below the threshold for invoking NATO's Article 5 can bypass the collective defense clause.

The Baltic Sea is the frontline of this strategy. Vice Admiral Jan Christian Kaack, Inspector of the German Navy, has pointed out that the Russian Navy conducts surveillance of bases and units and attempts threats and sabotage, while also employing drones and a 'shadow fleet' [9]. He explained that Russia has recently advanced to the stage of protecting its shadow fleet vessels with warships or armed security teams [9]. This signifies an evolution from simple reconnaissance to a persistent pressure infrastructure equipped with a physical protection system.

Latvian Prime Minister Andris Kulbergs described this trend as a "war against the West" [4]. President Edgars Rinkēvičs also declared, "Russia's hybrid war has already begun" [11]. The shift in the language of Baltic leaders from cautionary future tense to present progressive descriptions is rooted in the assessment that these threats are not sporadic incidents but structured operations.

2. Structural Context

Political Structure: The Threat Perception Gap Between Frontline and Rear States

The three Baltic states, Poland, and Finland have tended to immediately attribute threats to Russia and activate rapid response systems. In contrast, Germany and other Western European countries have a history of maintaining a cautious stance on attribution to avoid diplomatic repercussions [2]. Germany's hosting of the meeting and Interior Minister Dobrindt's direct reference to "foreign powers" [1] can be read as a sign that this gap is narrowing. However, the explicit name "Russia" was absent from Dobrindt's statement, implying that the inertia of Western European caution has not been fully overcome.

Economic Structure: Internal EU Negotiations over Financial Allocation

On July 30, European Commissioners from the Baltic states, Poland, and Finland sent a letter to Commission President von der Leyen requesting an increase in security funding for the Baltic region [16]. The fact that the formation of the task force is proceeding in parallel with financial discussions shows that countering hybrid threats is moving beyond political declarations into a phase of tangible negotiations over budget allocation. EU budget allocation could conflict with the principle of equity among member states, and Western European members may have an incentive to be passive about expanding dedicated funding for the Baltic states.

Security Structure: The Structural Limitations of the Sanctions Mechanism

EU sanctions against Russia are bound by a unanimity requirement. The dependence of Hungary and Slovakia on Rosatom further constrains this requirement [2]. This structure causes decision-making to converge at the level of the most reluctant member state. Opting for a working-level consultative body like a task force can be seen as an approach to secure cooperation at a lower, more feasible level, bypassing higher-level political decisions like sanctions that require unanimity.

3. Historical Precedents and Comparative Cases

The Baltic Sea region has already accumulated considerable experience in countering hybrid threats. The drone crash incident at the Auvere power plant in Estonia served as a catalyst for establishing a rapid response system [2]. This experience likely provided a practical foundation for the formation of the current task force.

The drone incidents at Germany's Leipzig/Halle Airport also serve as a point of comparison. A drone carrying explosives was found near the cargo area, and a cargo plane collided with an unidentified flying object [8]. In that case as well, U.S. intelligence pointed to Russian government involvement, but the German government refrained from public attribution [8]. The fact that the recent Baltic Sea interior ministers' meeting was held on German soil and that a German minister explicitly mentioned "foreign powers" can be interpreted as evidence that Germany, having experienced incidents within its own borders, has moved closer to the Baltic states' threat perception.

Slovakia's remote-controlled traffic camera incident is another relevant precedent. It revealed a different layer of threat from physical drone infiltration, demonstrating that the supply chain for civilian infrastructure itself can become a vector for infiltration [2]. This suggests a probability that the scope of hybrid threats addressed by the task force will not be limited to drones and sabotage but will extend to the entire supply chain.

4. Key Variables Shaping Future Developments

The first variable is the level of U.S. engagement.There were reports that CIA Director John Ratcliffe warned Moscow to refrain from escalating against Estonia, Latvia, and Lithuania [17]. In response, Estonia and Latvia stated that their assessment of the Russian threat "remains unchanged" [7]. Whether the U.S. will continue to send deterrent signals to Russia or reduce its engagement amid the Trump administration's policy of recalibrating alliances [10][12] is a variable that will influence the intensity of the Baltic states' independent response.

The second variable is the European Commission's financial decision.Whether the request in the letter from the European Commissioners from the Baltic states, Poland, and Finland [16] will lead to an actual budget allocation will determine the task force's operational capacity. Without financial backing, the task force risks remaining a merely declarative consultative body.

The third variable is the change in Western European countries' practice of attribution.While Germany's hosting of the meeting is symbolic, the fact that Minister Dobrindt's statement did not explicitly name Russia [1] shows that a cautious attitude persists. Whether Germany and other Western European countries will adopt the Baltic model of rapid attribution and public statements will determine the task force's effective response speed.

The fourth variable is the tone of threat assessments from EU intelligence agencies.An anonymous senior EU official stated that European intelligence agencies have not detected signs of a Russian military attack against a NATO member state[14][18]. If this assessment continues to serve as the basis for separating vigilance against hybrid threats from judgments about the possibility of military escalation, the task force's mission is likely to be narrowly confined to responding to gray-zone activities rather than conventional deterrence.