Hybrid threats deliberately blur the lines between war and peace, as well as between friend and foe, by employing atypical instruments in unconventional combinations. This creates a state of strategically-calculated ambiguity, in which the threatened target can no longer clearly assess its security environment. The Heidelberg Hybrid Threat Indicator quantifies this ambiguity, translating it into a warning system for hybrid threats and their evolution over time. It examines the three dimensions of ambiguity: complexity, deniability, and the bonding capacity.
Complexity arises from the multitude and diversity of the hybrid threat campaign. This means that not only the number of instruments used is relevant, but also the interaction patterns in which they are combined across domains. The more unusual these interaction patterns are, the higher the complexity. When threats are more complex, aggressors can better obscure their true intentions.
Through deniability, hybrid aggressors aim to obscure either an action itself or their involvement in an action. For example, they might use covert espionage operations or so-called proxy groups. This makes it more difficult for a targeted state to respond to or to hold the actors behind the hybrid threat campaign accountable.
Hybrid aggressors strategically make other states dependent on them. This built-up bonding capacity becomes a lever of power that can be instrumentalised against a target at the right moment, i. e. when “exploitative intentions” are revealed. The key factor is the vulnerability of a targeted state. This depends on how reliant the targeted state is on imports and how many alternative partners are available to it.
Phases of Hybrid Threats
Hybrid threat campaigns can be divided into different phases. They range from priming through destabilisation to coercion (Hybrid CoE 2021). Dependent on how ambiguous a campaign is, the HTI can determine the exact phase a specific hybrid threat campaign is in. This provides important insights into the potential danger of an individual campaign and the potential further developments of the relevant threat.
Priming
In the priming phase, hybrid aggressors aim to create fertile ground for their hybrid campaign while being as inconspicuous as possible. On one hand, they rely on plausible deniability through using instruments such as covert espionage operations or cyberattacks, which grant actors a level of protection from measures meant to hold them accountable. On the other hand, they also use traditional foreign policy instruments to build bonding capacity with other states, with the intent of creating dependency. The mixing of these different interaction patterns further increases complexity of campaigns. This phase is therefore characterised by increasing ambiguity.
Destabilisation
In the destabilisation phase, hybrid aggressors begin to influence the targeted state. Even though malicious actions become more noticeable, the aggressors still aim to obscure their involvement to some extent. This significantly limits their range of applicable instruments and complicates interaction patterns. In this phase, the ability to fall back on plausible deniability remains high, while the complexity of a campaign decreases. As the targeted state begins to respond and starts to reduce its dependencies, the level of bonding capacity also decreases. This phase is therefore characterised by a significant reduction in ambiguity.
Coercion
In the coercion phase, a hybrid aggressor openly uses threats against the targeted state in order to impose its will. The intentions and responsibility behind the hybrid campaign become (increasingly) clear. Whether the applied instruments are still plausibly deniable is no longer relevant to the aggressor. As a result, their range of utilisable instruments expands, i.e. sabotage, allowing for unconventional interaction patterns once again. Complexity thus increases significantly in this phase. The level of bonding capacity decreases drastically in light of open aggression. In this phase, ambiguity should stabilise at a medium level.
How to quantify Hybrid Threats
The HTI measures ambiguity along three categories: complexity, deniability, and bonding capacity. Rather than measuring hybrid threats themselves, it captures the likelihood of hybrid threats based on their level and composition of ambiguity. Currently, it can determine a measure for complexity and bonding capacity by combining different datasets and the use of the latest methods of empirical social research, including artificial intelligence and sequential network analysis. An indicator for deniability is still under development.
Data Basis
The basis for the complexity index is formed by the instruments used in a hybrid campaign. Our project is guided by the model of the European Center of Excellence for Countering Hybrid Threats (Hybrid CoE), which identifies a total of 33 applicable instruments. The corresponding data thus comprises event datasets from Traversals Analytics and Intelligence GmbH; the European Repository of Cyber Incidents (EuRepoC); and the POLitical Event Classification, Attributes, and Types (POLECAT) database.
Indicator for Bonding Capacity
To determine bonding capacity, we have additionally established another dataset that enables the calculation of energy dependence and dependence on foreign direct investment. To achieve this, the dataset calculates energy balance (according to Eurostat) against total energy available. The data comes from Eurostat and provides a monthly framework through which we can analyse energy dependence, as well as providing an annual resolution for dependence on foreign direct investment. The resulting bonding capacity index can range from 0 (=no bonding capacity) to 1 (=maximum bonding capacity).
Indicator for Complexity
The complexity of a hybrid campaign increases when instruments are used in atypical combinations or interaction patterns. To measure how atypical they are, the HTI uses sequential network analysis. Based on observations from all NATO member states and Ukraine, it creates a reference graph for typical instrument combinations. The complexity measure then indicates how much a specific instrument combination deviates from these typical combinations at any given time. It can range from 0 (=no complexity) to 2 (=maximum complexity).
Indicator for Ambiguity
Currently, the measure of ambiguity consists of complexity and interdependence. Complexity obscures the malicious intentions of the attacker and increases the potential attack surface of a hybrid campaign. Interdependence, in turn, increases the damage it causes.
Ambiguity functions like a wave: if it is particularly wide, it affects a larger area (i.e., it is more complex and the harder for a targeted state to identify the impact vector). If it is particularly high, it causes greater damage (bonding capacity). The wider and higher the wave, the more uncertain the state is as it approaches.
Illustrations: flaticon.com/de/autoren/freepik