For years, NATO has sidestepped a critical question: when does a non-military attack trigger its collective defense clause? The alliance's Article 5, which states that an armed attack on one member is an attack on all, was designed for a conventional Soviet assault. But today's threats are far more ambiguous, ranging from drone incursions to cyber warfare and disinformation campaigns.
Harlan Ullman, a senior adviser at the Atlantic Council and principal author of the shock-and-awe doctrine, argues that NATO's failure to define what constitutes an attack under Article 5 is a fatal flaw. He notes that the only invocation of Article 5 came after the 9/11 attacks, when NATO backed the U.S. in Afghanistan. That precedent, he says, is ill-suited for the hybrid tactics employed by Russia.
Russian President Vladimir Putin has weaponized what Lenin called "active measures"—operations designed to sow chaos and division without crossing the threshold of a conventional war. These include drone incursions, cyber attacks, and propaganda campaigns. Ullman points to the Kremlin's use of "useful idiots" like former President Donald Trump, who has strained U.S.-NATO ties by demanding Europe take on more defense costs.
Ullman's frustration is personal: from 2003 to 2016, he served on an advisory board for NATO's Supreme Allied Commanders in Europe. Despite repeated warnings, he says, NATO has not created a dedicated center to counter active measures. The alliance has established 30 Centers of Excellence covering cyber, counterintelligence, and strategic communications, but none focuses on this specific threat.
Russia's use of drones is a prime example. Sixteen NATO members have reported Russian drones entering their airspace, with Romania citing 26 violations and shooting down four drones in August. A Russian drone attack near Leipzig/Halle Airport in Germany failed to explode but underscored the vulnerability. NATO has yet to adopt a collective response to these incursions.
Cyber attacks are another battlefield. Russian troll factories, such as the Internet Research Agency founded by Yevgeny Prigozhin, have spread disinformation across NATO states. Yet NATO has left individual members to counter these campaigns, with no unified strategy.
Ullman proposes several steps. First, NATO should declare that any Russian drone entering member airspace or waters will be destroyed, expanding air policing to enforce this. Second, NATO should use its exercises and deployments as influence operations to expose Russian tactics. Third, under the Supreme Allied Commander Europe, NATO should create a "dirty tricks" organization—similar to Churchill's World War II special operations—to actively counter Russian hybrid warfare.
The challenge lies in the sensitive nature of cyber capabilities, which are often classified and shared among allies like the Five Eyes coalition but not across all 32 NATO members. Nevertheless, Ullman insists that NATO must act before the next hybrid attack tests the alliance's resolve. As he puts it, "Perhaps this time round, someone may listen."
