By: Meghna Dasgupta

The recent talks of ceasefire between Ukraine and Russia are a pivotal moment in Eastern European geopolitics. While the cessation of active hostilities offers hope for stability, it simultaneously brings in a complex landscape of cybersecurity threats and hybrid warfare tactics, particularly along NATO’s eastern flank. As conventional military conflicts slow down, cyber operations and information warfare are expected to intensify the evolving landscape of Hybrid Warfare

Hybrid warfare combines conventional military strategies with unconventional tactics, including cyberattacks, disinformation campaigns, economic coercion, and political subversion. Russia’s approach to hybrid warfare is characterized by its ability to integrate cyber operations, espionage, and information warfare to achieve strategic objectives without engaging in direct military confrontation.

One notable example is the alleged Russian interference in Romania’s 2024 presidential election. The election results were annulled after intelligence revelations of foreign interference, highlighting the limitations of reactive measures in countering hybrid threats. This incident underscores the need for proactive, systemic resilience against information warfare tactics.

Cyber Threats in the Post-Ceasefire Era

The ceasefire does not signify a reduction in cyber threats; rather, it may signal a shift in tactics. Adversaries could intensify cyber operations to exploit vulnerabilities during this transitional period. Russian state-backed groups, such as APT29 (Cozy Bear) and APT44 (Sandworm), have historically targeted NATO member states’ critical infrastructure and governmental agencies.

APT29 has targeted political groups, think tanks, NGOs, technology firms, and government agencies. In a recent incident, APT29 hacked TeamViewer, a major remote access software provider, compromising data such as names, corporate contact information, and encrypted passwords. This breach raised serious concerns about espionage and data theft, as the hackers potentially aimed to access TeamViewer’s sensitive client systems.

Potential Cyber Warfare Escalations

• Targeting Critical Infrastructure: Cyberattacks on power grids, water supply systems, and transportation networks are likely to increase, aiming to destabilize NATO’s eastern members.
• Financial Sector Disruptions: Cyber espionage and ransomware attacks against financial institutions could disrupt banking and economic stability.
• Military Espionage and Disruptions: Cyberattacks against NATO’s command structures and troop deployments could hinder rapid responses to emerging threats.

Information Warfare and Disinformation Campaigns

Information warfare, particularly disinformation campaigns, remains a cornerstone of hybrid tactics. Russia’s strategy involves creating and maintaining a “positive informational background,” where the information space is continuously shaped so that specific narratives can be rapidly amplified when required. This approach allows for the sustained influence over others, which can be strategically used to destabilize societies and erode trust in democratic institutions.

The annulment of Romania’s election exemplifies this tactic. Russian narratives portraying Romania as a victim of the EU, NATO, and Western elites were seeded into online spaces long before the electoral cycle, creating an ecosystem of disinformation that could be mobilized at a critical moment.

Key Disinformation Strategies

• Deepfake Propaganda: AI-generated videos depicting NATO leaders in fabricated situations to undermine public trust.
• Manipulated Social Media Trends: Automated bot networks pushing false narratives to create division.
• State-Controlled Media Amplification: Russian state-backed outlets like RT and Sputnik continue spreading anti-NATO sentiment.

Sabotage and Covert Operations

Beyond cyber and information warfare, sabotage and covert operations have emerged as significant components of hybrid warfare. Russia has been implicated in various acts of sabotage across Europe, targeting critical infrastructure to destabilize NATO member states.

• Arson Attacks on Military Equipment Warehouses: Russian intelligence reportedly hired and trained agents to target warehouses in Europe storing military equipment for Ukraine.
• Targeting NATO Military Installations: In July 2024, U.S. military bases in Europe were placed on high alert after intelligence suggested Russian agents were preparing for attacks on U.S. bases and personnel on the continent.
• False Flag Operations: Russia has been accused of staging incidents to justify retaliatory measures or spread confusion.

These covert operations highlight the persistent threat posed by Russia despite the ceasefire.

NATO’s Strategic Response

In response to these escalating threats, NATO has undertaken several initiatives to enhance its cybersecurity posture and counter hybrid warfare tactics:

1. Establishment of the NATO Integrated Cyber Defence Centre (NICC)

During the 75th Anniversary NATO Summit in July 2024, NATO leaders announced the creation of the NICC at Supreme Headquarters Allied Powers Europe (SHAPE) in Mons, Belgium. This cybersecurity hub aims to inform NATO military commanders about potential threats and vulnerabilities in cyberspace that could affect NATO’s operations.

2. Enhanced Cyber Defense Collaboration

NATO has prioritized information sharing, joint cybersecurity exercises, and the development of rapid response teams to mitigate the impact of cyberattacks. These measures aim to strengthen the alliance’s collective defense against sophisticated cyber threats.

3. Counter-Information Threat Initiatives

In 2024, NATO updated its approach to address the increasing sophistication of information threats as a component of hybrid warfare. The alliance introduced data-driven tools like the enhanced Information Environment Assessment (IEA), designed to analyze large datasets in real time and enable proactive responses to hostile narratives.

4. Strengthening Societal Resilience

NATO emphasizes the importance of societal resilience in deterring hybrid threats. This involves addressing vulnerabilities, enhancing public awareness, and fostering a comprehensive understanding of hybrid warfare tactics among member states.

Challenges and Considerations

Despite these efforts, several challenges persist in countering hybrid warfare along NATO’s eastern flank:

• Attribution Difficulties: The inherent difficulty in attributing hybrid actions—particularly those conducted via proxies or sophisticated disinformation systems—significantly hinders NATO’s decision-making processes. This delay provides aggressors with a critical tactical advantage, leveraging speed and confusion to overwhelm the targeted state’s response capacity.
• Cyber Defense vs. Offensive Capabilities: While NATO focuses on defensive cybersecurity measures, adversaries continue developing advanced offensive cyber tools. There is an ongoing debate over whether NATO should adopt a more aggressive cyber deterrence strategy.
• Public Awareness and Response Coordination: Many Eastern European nations face challenges in effectively educating the public about hybrid threats, leaving them vulnerable to misinformation campaigns.

Conclusion

As NATO navigates the post-ceasefire era, the alliance must remain vigilant against evolving hybrid threats. Cyberattacks, disinformation campaigns, sabotage, and covert operations will likely intensify as adversaries seek to exploit vulnerabilities. While NATO has taken significant steps to enhance its cybersecurity and hybrid warfare countermeasures, continued adaptation and resilience-building are crucial.

The future of NATO’s eastern flank will depend on its ability to anticipate, counter, and neutralize hybrid threats in an increasingly complex geopolitical landscape. Strengthening cybersecurity infrastructure, bolstering information resilience, and enhancing collective defense mechanisms will be key to ensuring stability and security in the region.

By: Lt Col JS Sodhi (Retd), Editor, GSDN

The India Ocean has witnessed strong regional trade and collaboration across millennia, with sea-based trade across the countries of the region playing a central role in the growth of civilisations, global prosperity as well as the spread of science, arts and culture. The potential of the region has also drawn the attention of both states, as well as non-state actors, who seek to leverage these opportunities for their own gain. This has been a significant cause for concern for a number of the region’s countries, who have not yet developed adequate security capacities to safeguard their entitlements.

India has recognised this common security challenge to regional maritime security and committed to working with its partners in a collaborative, inclusive and proactive manner to address these concerns. For over a decade, the Vision of SAGAR, or Security And Growth for All in the Region, has guided diplomatic outreach in security, trade and cultural domains. On Mar 25, 2025 the Prime Minster of India Narendra Modi announced the expansion of this vision to MAHASAGAR – Mutual And Holistic Advancement for SAGAR while speaking to the global audience from Mauritius. It is under this restated vision, that the Indian Navy is set to flag off the first ever Indian Ocean Ship – SAGAR on its maiden IOR security mission.

IOR Sagar, will be a multi-national mission, with over forty personnel from ten IOR countries joining as team members on an Indian Naval warship, on a month-long mission to promote regional maritime security. This ship will sail to multiple counties in the South Western Indian Ocean, undertaking a wide range of security missions, independently as well as together with maritime forces from other nations.

IOS Sagar is a significant new initiative of the Indian Navy, with several important characteristics. The ship itself is an Indian Naval platform, which is being dedicated exclusively for regional security initiatives for the duration of the mission. This is a significant allocation of capabilities, which underscores the Navy’s intent to be a credible and reliable contributor to regional maritime security. While the majority of the crew will be personnel from the IN, the forty crew members from nine other partner nations–Comoros, Kenya, Madagascar, Maldives, Mauritius, Mozambique, Seychelles, Sri Lanka and South Africa – will form an integral part of the crew, and join in all aspects of the ship’s functioning.

This multi-national nature of the crew is what makes IOS Sagar truly unique. It is a truly IOR led effort, at addressing security concerns which affect all nations in the region. The ship, by virtue of its multinational team, will be able to make more effective contributions in its endeavours, as there will be a better understanding of issues, from diverse perspectives, including from representatives of some affected states. Even more significant is the enhanced mutual trust and understanding which will be realized by the teams who live and work together onboard. The Indian Navy has already signalled its deep trust in its partners by conceptualizing the idea of IOS Sagar, and the outcomes of this mission could guide all future efforts towards collective maritime security. Collaborative efforts, based on mutual trust and cooperation, would undoubtedly help countries across the region harness their vast potential and sustain their plans for growth and development.

The region’s security in the present day is characterized by growing tensions and competition. Established and emerging powers are locked in a contest for geo-strategic and geo-economic advantage, which does not always augur well for the smaller, less developed economies in the region. Chinese efforts to acquire a military foothold through economic coercion across coastal states in African continent is a case in point. As an extra regional force, PLA Navy seeks to expand its footprint in the IOR, claiming to usher in peace and prosperity. However, such efforts by China are only self-serving and aims to prospers itself at the cost of smaller nation.

In such an atmosphere, there is a felt need to establish adequate regional security capabilities, which are not dependent on extra-regional powers, who may not share the concerns and risks of the countries in the region. Moreover, as nationalism and protectionism gain ground in some regions, it is becoming increasingly clear that regional solutions are essential to ensure regional security.

IOS Sagar is a novel concept, which seeks to overcome regional limitations by sharing of resources, pooling of capabilities and working in unison. This ship is a powerful model for naval diplomacy, where, the commitment of the Indian Navy to work in complete sync with its partners, towards achieving positive security outcomes for everyone on the region, is underscored and spotlighted. Moreover, it epitomizes India’s view of how it aspires to lead the region – in collaboration with its partners, with equal respect for all and positive collective outcomes. The IOS Sagar is a significant new effort, which could well be a watershed moment for regional security efforts in the Indian Ocean.

By: Munira Qaiser, Research Analyst, GSDN

The East and South China Seas are central to global trade and security, and their geopolitical significance has led to ongoing territorial disputes among multiple nations, including China, the Philippines, Vietnam, and Malaysia, as well as broader regional and global powers such as the United States. These disputes often manifest through grey zone tactics—strategic actions that are intentionally ambiguous, not overtly aggressive, but intended to alter the status quo in favour of the actor employing them. Grey zone tactics include economic pressure, cyberattacks, disinformation campaigns, maritime militia operations, and other forms of irregular warfare. These tactics are particularly difficult to counter as they operate below the threshold of conventional warfare, making traditional military or diplomatic responses less effective.

Artificial Intelligence (AI) offers significant promise in countering these grey zone strategies. With advancements in AI, nations can leverage machine learning, autonomous systems, predictive analytics, and enhanced surveillance technologies to detect, analyse, and respond to grey zone tactics in real time. AI-driven systems can provide better situational awareness, faster response times, and more accurate predictions of potential threats. AI’s ability to process large amounts of data, recognize patterns, and generate insights could prove crucial in identifying subtle or covert actions that might otherwise go unnoticed. Furthermore, AI could improve decision-making processes by supporting human operators with data-driven recommendations or automated actions.

This article delves into the ways AI can be applied to counter grey zone tactics, with a particular focus on the East and South China Seas. It examines the role of AI in enhancing surveillance, improving response strategies, and fostering international cooperation to address these challenges. The article also addresses the ethical implications, the potential risks of escalating conflicts, and the limitations of AI in complex geopolitical environments. Ultimately, the integration of AI into counter-grey zone strategies could significantly reshape the security dynamics of the region, contributing to more effective deterrence and conflict management.

Introduction

The East and South China Seas represent one of the most strategically important regions in the world today. These seas are not only rich in resources but are also vital maritime trade routes that facilitate a significant portion of global commerce. However, these areas are also embroiled in complex territorial disputes, most notably over islands, reefs, and maritime zones. The claims and counterclaims by various nations have led to an environment where traditional diplomatic and military strategies have proven to be less effective. In recent years, countries have increasingly turned to grey zone tactics to pursue their objectives, which are designed to avoid direct confrontation but still achieve strategic gains.

Grey zone tactics are a series of actions that are deliberately ambiguous and fall below the threshold of full-scale military conflict. In the context of the East and South China Sea, grey zone activities include the use of paramilitary forces disguised as civilian entities, cyberattacks on critical infrastructure, and disinformation campaigns to sway public opinion and international support. These tactics are particularly difficult to counter because they operate in the space between diplomacy and military action, making it hard for affected nations to respond without escalating the situation to open conflict.

AI offers significant potential to address these challenges. With its ability to process vast amounts of information in real-time, AI can be used to enhance the monitoring of activities in the region, improving early warning systems for potential threats. AI-driven surveillance technologies, such as drones and satellite systems, can track suspicious movements and identify grey zone activities before they escalate into larger crises. Additionally, AI can assist in analysing patterns of behaviour, allowing for more accurate predictions of future tactics and helping nations to develop proactive measures rather than reactive responses. Furthermore, AI tools can facilitate the sharing of intelligence and the coordination of responses among regional and global stakeholders, promoting collective security and stability in the region.

However, the deployment of AI in countering grey zone tactics also raises a number of concerns, including the risk of over-reliance on technology, the potential for AI-driven escalation, and ethical issues surrounding the use of autonomous systems in military contexts. These considerations must be carefully weighed as AI technologies are integrated into the region’s security strategies. This article will explore these challenges, alongside the technological potential of AI, to provide a comprehensive view of how AI can play a role in shaping the future of security in the East and South China Sea.

Overview of Grey Zone Tactics

Grey zone tactics refer to a set of strategies that fall between traditional warfare and peaceful diplomacy, often used by states or non-state actors to achieve their goals without provoking open conflict. These tactics are typically non-kinetic, subtle, and difficult to detect or attribute, which makes them challenging to counter. Rather than engaging in direct military action, grey zone tactics involve activities designed to influence, intimidate, or alter the status quo in a region, all while avoiding a full-scale confrontation. They are particularly effective in regions where tensions already exist, and they often operate below the threshold of armed conflict.

In the context of the East and South China Seas, grey zone tactics have been notably employed by China to assert its territorial claims and expand its influence. The South China Sea is a highly contested area, with overlapping territorial claims from China, Vietnam, the Philippines, Malaysia, and Brunei. China’s use of grey zone tactics has included the deployment of maritime militias disguised as civilian fishing boats, which often operate in disputed waters alongside Chinese coast guard vessels and military assets. These actions are designed to establish Chinese control over the area while avoiding outright military aggression. Additionally, China has been involved in the construction of artificial islands and the militarization of these disputed territories. These tactics are ambiguous and subtle, often difficult for other nations to respond to effectively.

Another key aspect of grey zone tactics is their ability to create gradual but significant changes to the status quo without crossing the line into open conflict. For example, cyberattacks or disinformation campaigns can be used to weaken an opponent’s confidence, disrupt decision-making, or manipulate public opinion, all without resorting to physical violence. Similarly, economic coercion, such as using trade or investment to influence other countries’ decisions, can be seen as a form of grey zone activity. These tactics are difficult to counter because they do not always appear as overtly aggressive or illegal, making it hard for countries to justify a strong, forceful response.

Current Countermeasures and Limitations

Countries in the East and South China Seas, particularly those that are directly impacted by China’s grey zone tactics, have tried various strategies to counter these actions, but many of these countermeasures have proven to be inadequate or insufficient in dealing with the complexity and subtlety of grey zone operations. Traditional methods, such as military, diplomatic, and economic responses, have often fallen short of addressing the full range of tactics involved.

One of the primary countermeasures has been the increased military presence in the region. The United States, along with other countries like Japan and Australia, conducts Freedom of Navigation Operations (FONOPs) to challenge China’s territorial claims and maintain open access to international waters. These naval operations are meant to demonstrate international opposition to China’s actions. However, while they make a statement, they are often reactive and do not directly address the grey zone tactics, which are not typically military in nature. In addition, the risk of escalation in such a sensitive region makes military responses a difficult and potentially dangerous option.

Diplomatic efforts have also been attempted, particularly through multilateral forums like the Association of Southeast Asian Nations (ASEAN) and the United Nations. These efforts have included calls for international arbitration, such as the 2016 ruling by the Permanent Court of Arbitration, which rejected China’s claims in the South China Sea. Despite this, China has continued its actions, demonstrating the limits of international legal and diplomatic solutions. While these forums provide a platform for discussion, they often lack the ability to enforce decisions, and regional powers may be reluctant to confront China due to economic dependencies and the fear of further antagonizing a powerful neighbour.

Economic measures have been another tool used to counter grey zone tactics. Countries have employed sanctions or trade restrictions in response to China’s actions. However, China’s growing economic power makes it less susceptible to these measures. In some cases, economic sanctions may even backfire, as China has the means to bypass or mitigate these pressures. Additionally, economic coercion itself is a form of grey zone tactic, making it difficult for countries to respond effectively without escalating the situation further.

Cybersecurity and information warfare have become more important in countering grey zone tactics, particularly as China has been accused of launching cyberattacks and spreading disinformation. Countries have increased their efforts to strengthen cybersecurity and combat misinformation, but these responses are often insufficient. Cyberattacks are notoriously difficult to trace and attribute to specific actors, making it hard to mount an effective response. Disinformation campaigns, particularly those that target public opinion, can be equally challenging to combat, as they are designed to sow confusion and undermine trust in institutions, making it difficult to know when or how to respond.

Finally, regional cooperation among countries like Japan, the Philippines, and Vietnam has been limited. While these countries have made efforts to collaborate in areas like maritime security, there are still divisions over priorities and national interests. Some countries are hesitant to take strong actions against China, due to economic ties or concerns about retaliation. As a result, there is no comprehensive regional strategy to counter grey zone tactics, and countries are often left to respond individually, which weakens the overall effectiveness of these efforts.

Case Studies on AI in Countering Grey Zone Tactics

1. AI in Tracking Maritime Movements in the South China Sea
   • Case Study: In recent years, AI has been used to track and monitor maritime activities in the South China Sea. Countries like the United States and regional powers have deployed satellite-based AI systems to monitor ships’ movements in disputed waters. These AI systems use pattern recognition to automatically detect unusual activities, such as the construction of artificial islands or military vessels moving into sensitive areas.
   • Example: The US Navy and other defences agencies use AI to analyse satellite imagery and track Chinese military and fishing ships, which are often used as tools in grey zone tactics. These AI systems help identify changes in ship behaviour, such as unreported military deployments or irregular fishing activities, and allow for quick responses to potential threats.
2. AI in Countering Cyber Attacks and Information Warfare
   • Case Study: Grey zone tactics often involve cyber-attacks and misinformation campaigns. AI has been successfully used to help detect and block cyber threats in real-time. For example, during regional tensions, AI systems have helped monitor and defend against cyber-attacks aimed at disrupting critical infrastructure, such as ports and military communication lines.
   • Example: The Pentagon has used AI-based tools to detect and counter misinformation campaigns aimed at influencing public opinion and destabilizing governments in the region. AI algorithms help analyse vast amounts of online data to spot fake news or coordinated disinformation efforts.
3. AI for Monitoring Fishing Activities (Illegal, Unreported, and Unregulated Fishing)
   • Case Study: In the South China Sea, illegal, unreported, and unregulated (IUU) fishing is often used as part of grey zone tactics to assert control over contested waters. AI has been used to monitor and track illegal fishing vessels by analysing data from satellites, drones, and automated vessel identification systems.
   • Example: The company Ocean Mind uses AI to track fishing activities in the region. By analysing satellite images and vessel tracking data, AI can identify suspicious activities like illegal fishing in disputed zones. This helps countries involved in the conflict to act against such tactics before they escalate.

Future outlook on AI in Countering Grey Zone Tactics

As AI technology improves, we will see more advanced AI systems capable of predicting grey zone tactics before they happen. AI could analyse historical data, military activities, and even social media patterns to forecast potential military actions or economic coercion. This would allow countries to prepare for or prevent these actions. In the future, AI might be able to predict when a country is likely to deploy a maritime militia or start a cyber-attack. This will help nations make faster, more informed decisions to counter such moves.The use of unmanned drones and autonomous vehicles will expand, with AI controlling these systems for surveillance in the disputed waters of the South and East China Seas. These autonomous systems will patrol the area, monitor activity, and gather intelligence without human intervention, providing real-time information for military and diplomatic decisions. Future naval patrols may use AI-powered drones to monitor the waters for any grey zone activities like maritime militia operations or unreported military exercises. These AI systems would provide constant surveillance without putting human lives at risk.With cyber warfare becoming more common in grey zone tactics, AI will play a bigger role in defending against cyber-attacks. AI could learn to detect cyber threats faster than humans, and even predict where future cyber-attacks might occur based on patterns in data. Countries will use AI systems to defend their military networks from potential cyberattacks or espionage that are often used in grey zone warfare. These systems will be able to react in real-time, identifying, and neutralizing threats without delay. As AI becomes an essential tool in countering grey zone tactics, countries will likely collaborate more on AI development and sharing intelligence. By working together, countries can pool resources, share data, and ensure AI systems are used ethically and responsibly in monitoring and responding to grey zone tactics. In the future, nations could set up joint AI systems to monitor contested areas like the South China Sea. These systems would share data in real-time, allowing multiple countries to respond more effectively to grey zone tactics and prevent conflict escalation.

Conclusion

In conclusion, AI has already proven to be a valuable tool in countering grey zone tactics in the East and South China Sea, whether it is tracking maritime movements, detecting cyber-attacks, or identifying illegal fishing activities. Looking ahead, AI will become even more sophisticated, helping countries predict and prevent grey zone tactics with even more accuracy. As AI is used more in military and security operations, there will be greater focus on ensuring that it is used ethically. Countries will need to establish international agreements on how AI should be used to avoid conflicts, protect civilian populations, and ensure that AI does not escalate situations unnecessarily. Future discussions and agreements could focus on ensuring AI does not make decisions that could lead to unintended military actions. Countries might agree on rules for AI in combat zones, especially concerning autonomous drones and military robots. However, as this technology grows, so too will the need for international cooperation and careful consideration of ethical issues surrounding its use.