State Threats in the Context of a European War

The Russian army’s encirclement of Ukraine’s biggest cities has seen a huge Western retaliation against the Russian economy. Recent sanctions imposed by the UK, the US and the EU are the most severe to date, raising questions about possible Russian retribution. The fourth anniversary of the Salisbury poisonings will likely go under the radar given the rapid escalation on the ground in Ukraine, but it does serve as an important reminder of threats that fall below the threshold of armed conflict, yet nonetheless threaten the very fabric of our way of life.

Salisbury Poisonings and the Categorisations of a State Threat

In March 2018, Sergei Skripal and his daughter Yulia were poisoned with a military-grade nerve agent (a chemical weapon) of a type developed by Russia, commonly known as Novichok. A further four people were contaminated in the following weeks and months, killing one of them, Dawn Sturgess. UK security agencies attributed the attack to the GRU (Russian military intelligence) and established that it was approved above the GRU at a senior level of the Russian state. In response to the attack, the UK expelled 23 undeclared Russian intelligence officers. Assassinations like the one attempted in Salisbury in 2018 were cited by the Director General of MI5 as an example of the ‘most visceral concern’ of physical threats to life.

The UK government defines states threats as ‘as overt or covert action orchestrated by foreign governments which falls short of general armed conflict between states but nevertheless seeks to undermine or threaten the safety and interests of the UK’. These include assassinations and physical threats to things, such as damage or disruption to infrastructure. The National Cyber Security Centre has briefed frequently on state threat actors compromising the UK’s critical national infrastructure supply chain. Whereas physical threats to people may be comparatively infrequent, disruptive cyber attacks have the potential to impact a far wider percentage of the population. Espionage – the covert seeking of sensitive confidential information and intellectual property as seen in the Russian Foreign Intelligence Service’s SolarWinds attack last year – represents another tranche of state threat, while interference and disinformation make up the final main subset. Other threats to geostrategic interests, potentially including the exploitation of energy insecurity, will also be relevant.

State threats are diversifying and evolving in ways which present new challenges to the UK’s security, prosperity, social cohesion, resilience, democracy, values, institutions, and strategic advantage. They can involve direct action by foreign governments or intelligence agencies, or the co-opting of firms, groups or individuals to conduct harmful activity on their behalf. The Integrated Review noted states’ continued use of organised crime groups ‘as proxies in systemic competition’, while the Intelligence and Security Committee’s 2020 Russia Report emphasised Russia’s ability to employ organised crime groups to supplement its cyber skills.

The West’s Response to War in Ukraine and the Russian Retaliatory Toolkit

Fast-forwarding four years from the Salisbury poisonings, Russian aggression on foreign soil is taking a far different form. The Western response to the war on Ukraine has so far revolved around providing military assistance and imposing sanctions with the intention of isolating Russia economically, diplomatically and culturally. The considerable pressure being applied will amount to – in the eyes of the Russian state – economic warfare which is intended to threaten the stability of the current Russian regime and ultimately its existence.

Parts of the Russian response to this will be financial in nature, for example, banning Russians from transferring money abroad, while other parts will be geopolitical, for example, putting nuclear forces on high alert and threatening to pull out of the New START nuclear arms treaty. Crucially, however, there will also be scope for a response that poses immediate risks to UK institutions and citizens. Historically, state-sponsored cyber-activities are a preferred avenue for the Kremlin – Western financial institutions and energy infrastructure may be at most risk. This may be conducted directly or indirectly. A direct attack may look something like the May 2021 ransomware attack against Colonial Pipeline – a major fuel distributor in the US – albeit on a far larger and more damaging scale. An indirect attack could look more like the NotPetya attack in 2017, where attacks aimed at Ukrainian institutions leak out and infect other countries. There is some evidence this is already happening, with a new strain of malicious software that wiped data from hundreds of computers in Ukrainian institutions being spotted in Latvia and Lithuania too.

In either case, the Russian state would be likely to enlist the help of cyber criminals to direct disruptive attacks against high-impact targets. Some criminal groups have announced their intention to ‘use all possible resources to strike back at the critical infrastructures’ of any entity that organises a cyber attack ‘or any war activities against Russia’. Global banks have been preparing for these eventualities, with increased network monitoring and drilling for cyber attack scenarios, but it is likely that Russian state threat actors have carried out significant but as yet undetected breaches covertly over a number of years – supply chain penetrations do not meet the eye the same way as tanks on a satellite image.

As international pressure on Russia continues to build, we can expect disinformation campaigns to intensify to create confusion and uncertainty regarding the progress of the invasion and Russia’s plans for its conclusion. The disinformation effort is also likely to be geared towards sowing division within Western political institutions and undermining unity in their response.

Using oil and gas supply to exploit energy insecurity is another lever which the Russian state could lean on, sending inflation rates in Europe and the US spiralling further and generating more domestic unrest there. It is no surprise that Russian oil and gas exports are currently exempt from the barrage of Western sanctions.

Establishing Vigilance in the Face of State Threats

These eventualities will be occupying the minds of UK government officials, but there is an absence of a wider conceptual model for thinking about state threats and the corresponding joined-up thinking necessary to underpin an effective response. The state threat problem predates this war and will continue manifesting after it, not just from Russia but China, Iran and North Korea too.

This underlines the need to develop a more nuanced understanding of the threat: who are the main state threat actors? What are the main intersections between these states and criminal actors? How do the different aspects of state threats connect? From that foundation, we can begin developing a model for understanding the impact: how are state threats affecting the security, freedoms, and prosperity of the UK? How do different state threats rank against each other in terms of their severity? And what is the pace of change with respect to these threats?

The situation on the ground in Ukraine is currently all-consuming, but there is a growing array of state threats. The UK government must confront this in a coordinated and coherent manner to prevent the long-term erosion of UK national security.

The views expressed in this Commentary are the author’s, and do not represent those of RUSI or any other institution.

Have an idea for a Commentary you’d like to write for us? Send a short pitch to commentaries@rusi.org and we’ll get back to you if it fits into our research interests. Full guidelines for contributors can be found here.