The Real Target Is Us
Terrorism's classic gambit is exploiting democracies into damaging themselves. Moscow has adopted it. Here's how it works.
Terrorism and Russian-style hybrid warfare work in similar ways: both strategies seek to weaponize attention and response at scale.
The real objective of each attack is not only physical damage and human impact, but also wider changes in how Western societies feel, think, talk, and legislate about security.
The real target is how we react.
Terrorism as communication
Terrorism and hybrid warfare have been understood as separate threats representing differing methodologies: one the domain of suicide bombers and clandestine cells, the other of deniable troops, cyberattacks, and gray‑zone coercion. Yet current scholarship and the lived experience of Europe’s rolling crises make clear that the Kremlin has converged on a strategy common to both: the weaponization of attention and response. Modern terrorism research treats attacks as messages directed at several audiences at once: governments, target communities, potential supporters, and foreign observers.
Russia’s operations follow the same logic, but from behind a veil of deniability: attacks they refuse to claim are crafted to maximize fear, deepen polarization, and push democratic governments into overreach, while coordinated sabotage, cyberattacks, and information campaigns sow confusion, fracture unity, and leave leaders oscillating between paralysis and escalation.
Russia, as a hybrid actor, relies on relatively limited acts of kinetic violence that are messaged and amplified by Russian information operations and those of Russian allies to induce opponent states and societies into adopting stances and beliefs that serve Russia’s long‑term goals.
European lessons in hybrid pressure
Recent European experience has given this convergence real-world texture in the eyes of the public. Intelligence services across the continent have recently begun to reveal a pattern of suspected Russian operations that sits in the “gray zone”: reconnaissance of critical infrastructure, low‑level sabotage, and psychological pressure dialed down just below the threshold of formal armed attack.
Reporting in the Financial Times describes Dutch, Danish, Polish, Czech, and Swedish authorities confronting a “campaign of intimidation” that includes drone flights over airports and energy facilities, unexplained fires in transport hubs, cyberattacks on government systems, jamming of aviation navigation, and even explosives smuggled into Poland disguised as canned corn.
A European Broadcasting Union investigation details how “disposable agents,” recruited via encrypted messaging apps and social networks, have been used to carry out arson and vandalism against warehouses, logistics centers, and other nodes in the continent’s economic infrastructure.
In my personal estimation, these recent reports represent a “drop in the bucket” relative to the incidents that have not yet been publicly attributed to the Kremlin.
Individually, these incidents look like sabotage, vandalism, or technical failure; in aggregate, European officials describe them as a pressure campaign designed to intimidate and exhaust, with each incident forcing very public, resource‑intensive responses: tightened security at ports and rail hubs, new patrols around energy infrastructure, emergency briefings, urgent political statements, and constant reassurance of citizens.
NATO and EU analyses of hybrid threats describe an explicit goal of influencing target populations and policy‑makers through a mix of kinetic acts and subversive measures. The center of gravity is not an armored tank division, but a target society’s perception of reality and risk. In this context, “small” acts of sabotage, cyberattacks, GPS jamming, unexplained fires, and the like can have outsized strategic effects if they trigger disproportionate reactions: panic in markets, sweeping new security policies, alliance disputes, or a generalized sense that the state is no longer in control.
European governments are reacting not only with quiet defensive measures but with a new strategy of rapid attribution and public communication, attempting to connect scattered incidents to a single Russian campaign so that citizens see the larger design rather than random misfortunes. Naming the “bad guy” is increasingly revealing itself as a highly viable public relations strategy as governments release timelines, forensic details, and intelligence assessments to wrest back narrative control from an adversary that has long relied on ambiguity.
High Representative of the European Union for Foreign Affairs and Security Policy, Vice-President of the European Commission, and former prime minister of Estonia Kaja Kallas has described this pattern as state‑sponsored terrorism, arguing that it targets civilian life and confidence rather than only military assets.
“Russia’s hybrid actions in Europe are increasingly brazen. Russia is committing state sponsored terrorism. There are many ways we can respond, including additional sanctions and tackling online recruitment of saboteurs.”
–Kaja Kallas, speaking at a press conference of the European Union’s Foreign Affairs Council on November 20, 2025
Her statement came in response to a November 17 railway explosion near Warsaw that Polish Prime Minister Donald Tusk called “probably the most serious” act of sabotage since Russia’s illegal aggression against and invasion of Ukraine.
Tusk was undoubtedly referring to Russia when he claimed, “For two years now our country has had to contend with sabotage carried out on behalf of foreign services.”
Russian spies in Mexico
Additional recent reporting from North America suggests the same toolkit is being extended near the U.S. homeland.
According to The New York Times, the United States gave Mexico a list of more than twenty Russian intelligence officers operating under diplomatic cover, but Mexico declined to expel them. U.S. and European officials say this reflects a shift in Russian intelligence priorities after the invasion of Ukraine: moving senior officers to Mexico to run operations against the United States from close range while avoiding some of the scrutiny they now face in Europe.
This feels both familiar and new. During the Cold War, Soviet intelligence used Mexico as a staging ground and listening post for operations against the U.S., taking advantage of geographic proximity and a political environment wary of American demands. While Mexico has long been a base of interest for Russian and Soviet intelligence, the mix of tools available now is wider.
The scale of Russian intelligence presence in Mexico has been a matter of public record since at least March 2022, when General Glen VanHerck, then head of U.S. Northern Command, testified before the Senate that “the largest portion of G.R.U. members in the world is in Mexico right now.” These officers, VanHerck noted, “keep an eye very closely on their opportunities to have influence on U.S. opportunities and access.”
A network in Mexico can support classic espionage, cyberattacks against U.S. systems, financial and political interference, and potentially small‑scale acts of disruption that blend into existing problems such as cartel violence, criminal hacking, or infrastructure accidents. In hybrid terms, those create options for pressure and signaling that are deliberately hard to pin down, which again shifts the burden of interpretation and calibrated response onto the most uniquely reckless Washington in modern history and a public that already shows significant signs of cognitive fatigue.
The problem is structural
Hybrid, or “non-linear”, warfare operates inside the same psychological and political space, but with a state’s resources and reach. Russian doctrine and practice, in particular, treat information as a central domain of conflict rather than a supporting arm. Moscow emphasizes shaping adversaries’ political environments and decision‑making before and during kinetic operations while using tools to blur visible boundaries between war and peace.
Analysts of Russian campaigns in Ukraine and Syria have described a blend of deniable troops, local proxies, cyber operations, and targeted strikes, all paired with messaging that clouds attribution and divides foreign publics. Ambiguous incidents are accompanied by multiple competing narratives. The idea is not to persuade everyone of a single story, but to paralyze our decision‑making and fracture consensus—and it often works.
Hybrid tactics aim for effects that are large compared to the size of the physical act: confusion in capitals, quarrels inside alliances, and pressure for either risky escalation or dangerous restraint. Russia has identified a fairly wide band of activity in which low-cost operations can generate significant economic and political disruption yet still stay short of the threshold at which a conventional military response can be seen as justified, wise, or politically safe.
By staying below clear legal thresholds for “armed attack” while still creating anxiety and economic disruption, Russian planners seek to trap democratic governments in a zone where every response appears either hopelessly weak or unfairly escalatory.
What terrorism achieves mainly through bombs and shootings, Moscow now adapts through sabotage, cyber operations, and disinformation campaigns intended to be interpreted by victims as amorphous, disconnected incidents that appear spontaneous, mysterious, organic, or accidental in origin. This intentional information gap provides fertile narrative space for the attacker to seed with their own stories about what happened.
For democratic governments, any overt retaliation must satisfy domestic legal standards, alliance politics, and escalation management with what is ultimately a nuclear‑armed adversary. Moscow’s ongoing and thus far fruitful bet has been that this complexity will paralyze our decision‑makers and produce fragmented, uncoordinated responses.
Their logic mirrors terrorism’s focus on exploiting the gap between modest inputs and outsized social and political outputs. Hybrid attacks aim to inhabit the space between policing and war: too serious to ignore but too ambiguous for clear deterrence. If response is weak, citizens might lose faith in their institutions; if response is overly strong or misdirected, it risks undesirable escalation or self‑inflicted harm.
The adversary’s main advantage lies in the asymmetry between how little it must do and how much the defender must consider before responding.
The media transmission belt
Cross-national empirical research has shown that while casualty counts do increase coverage, other factors, such as perpetrator identity, target symbolism, and attack novelty, can drive news coverage and public concern independent of body count. Small attacks with the “right” characteristics often generate more attention than deadlier ones that lack them. Academic work on “media-oriented terrorism” documents how groups choose symbolic targets, crowded public spaces, and visually striking methods precisely because those features ensure prominent coverage and intense debate. Research also suggests the relationship is bidirectional: media coverage of attacks correlates with subsequent increases in terrorist activity, creating a feedback loop that both sides exploit.
Attacks are crafted to send messages to multiple audiences (governments, target populations, potential recruits, and international observers) and to do so primarily through how they are seen. They are engineered to be filmed, replayed, and discursively mined; only then can they achieve their full political effect. These are operational decisions driven by a strategic expectation: the real leverage lies in the reaction.
The goal is not simply to kill, but to make a much larger public feel that it might be killed next.
Violence against a few becomes a lever for changing how authorities treat the many, polarizing societies and making moderation politically toxic. An “inexplicable” act of violence is designed as the opening act in a longer play about identity, security, and power, supporting the classic academic model of terrorist “provocation”: civilians are targeted in part to trigger harsh or clumsy state responses that can be framed as proof of repression or hypocrisy.
Television and social platforms provide the stage on which terrorism performs and the audience from which governments take cues and make justifications. Graphic images, looping footage, Breaking News chyrons, and push alerts magnify the psychological footprint of attacks far beyond their direct physical effects. Sensational coverage inflames our emotions, which help push politicians toward and justify maximalist responses, which in turn sustain a repetitive news cycle that keeps the attackers’ messages in view. Media acts as a transmission belt that turns isolated acts into national traumas.
Media exposure creates a feedback loop because vivid coverage of attacks tends to heighten fear and anger, and anger in particular is a strong predictor of public support for aggressive and wasteful policies that overshoot actual risk. The more shocking the imagery and the more vulnerable the victims (children at a birthday party, families in church), the more intense the public reaction, and the stronger the predictable demand for visible, large‑scale state action.
Research on the “mediatization” of policing shows that law enforcement now operates inside this same media logic. Decisions about cordons, tactical deployments, raids, and press conferences are not just operational but performative, being made with the advance knowledge that they will be instantly documented and broadcast.
In some circumstances, a muscular response can reassure anxious publics. But it can also produce counterproductive effects, including improperly diverting valuable law enforcement resources, the use of journalists as little more than police stenographers—and creating the exact spectacle terrorists seek: proof that individuals or small groups can force powerful states to divert vast resources, shut down cities, and change a society’s way of life.
Emergency laws, mass surveillance, sweeping raids, or foreign interventions can then be used in propaganda as evidence that authorities cannot be trusted, which helps extremists recruit and polarize societies. For hostile actors that thrive on the polarization of their enemies, each completed feedback loop constitutes a micro-success.
States that already want such measures, but lack majority support, may “piggyback” on successful attacks and the media feedback loop to push their own agendas.
At the rhetorical level, hybrid actors instrumentalize the language of counterterrorism. Russia routinely labels Ukrainian defenders, Syrian opposition forces, and various domestic critics as “terrorists,” using that designation to justify large‑scale bombardment, forced displacement, and political repression under the guise of legitimate security operations (See: “Special Military Operation”).
The category of terrorism becomes a weapon of discourse: by casting opponents as terrorists, states seek license for measures that would otherwise be politically or legally unacceptable. This is an inversion of the provocation strategy itself: not terrorists attempting to elicit overreaction, but governments framing their own overreaction as necessary and virtuous.
The central contest: reaction
Taken together, terrorism and Russian hybrid operations reveal a common theme: the most important effects occur in how societies react, not in the immediate physical damage. The initial act need not be grandiose or theatrical, though it often is; what matters more is the informational aftershock. The aim is to saturate the environment with noise, sharpen “us versus them” binaries, and make proportionate, rational, evidence‑based policy almost impossible.
European debates inside NATO and the EU now revolve around how to answer this challenge without either normalizing low‑level attacks or stumbling into open war. At the same time, Washington is running its own pressure tactics on Mexico, which appears set to further complicate any coherent response to Russian activity there, complete with:
Overt acts of political and economic bullying.
Amassing troops at the Southern border.
Labeling Mexico a “true threat” to California and Texas because of the Tijuana River sewage crisis.
Provoking a diplomatic incident over signage that appeared on a Mexican beach falsely indicating it was part of the United States—signs the Pentagon later said was placed in error. The correction received a fraction of the coverage of the initial incident.
Given the larger picture of Mr. Trump and Mr. Putin quietly walking in lockstep while continuing to act as opponents on the world stage, as well as the totality of devastating changes made this year to the U.S.’s counterintelligence apparatus and to our diplomatic relationships with established allies, it seems policymakers have little hope of appropriately confronting the wider security threat to North America.
Meanwhile, Russian services are actively building out capabilities in nearby states that will be used to further embed operatives into communities and manipulate the opinions of new and larger demographic segments using highly ambiguous, deniable, and often-violent tactics. A key challenge before us as citizens and media is how to stay informed without becoming an unwitting instrument of a hostile foreign power or mentally falling prey to their terror tactics.
When relatively small acts of violence, sabotage, and disinformation can deliver disproportionately harmful effects, resisting the impulse to panic may be the most strategic act of all.