Sharing the Burden of Hybrid Threats: Lessons from the Economics of Alliances

ABSTRACT

This article discusses the effects of the changing (hybrid) conflict environment on the burden sharing debate. We discuss the actions taken by both the alliance as the member states in repelling these threats, arguing that this mainly produces security outputs that are private or impure public. As the burden sharing literature currently lacks notions of hybrid threats, we believe the current modelling to be ill-suited to provide reliable assessments of member states’ burden sharing behaviour. We address this void by adjusting the Joint Product Model, extending a country’s security activities to a more inclusive ‘whole of government (WoG) approach’. We depart from this WoG model to stress the challenges associated with comparing the contributions of member states in countering these threats. This leads us to dispute the use of aggregate military expenditures as a main variable to measure a country’s degree of free riding. More and other types of (non-military) variables and proxy-indexes should be taken into account. The same remark goes for estimating the benefit-burden concordance within this framework of permanent non-linear state competition.

KEYWORDS:

• Burden sharing
• hybrid threats
• state competition
• NATO

Acknowledgments

The useful comments and constructive suggestions by two anonymous referees are gratefully acknowledged. The usual disclaimer applies.

Disclosure Statement

No potential conflict of interest was reported by the author(s).

Notes

1. We specifically refer to NATO in this article, as it is one of the most successful military alliances in history. In addition, NATO has been studied extensively within the domain of burden sharing, which allows us to integrate our insights within this framework. Our key ideas and analytical model are however applicable to other (security) alliances. Especially as the EU is seen as a key actor in responding to hybrid threats (See Section 2.2).

2. Following the 2014 summit in Wales, where alliance members ‘pledged’ to increase their defence expenditures towards 2% of their GDP and to spend at least 20% of their annual defence spending on major new equipment (NATO 2014).

3. As we will discuss later, some of these threats cannot be considered as ‘new’. We do argue that some ‘old’ threats have become more prominent as a result of technological developments.

4. We are increasingly interconnected in various areas: within the domain of communication (e.g. social media, cyber, mobile telecommunications), economics (increased interdependence in the domain of trade, energy, foreign direct investments, etc.) and the free movement of people. (Leonard et al. 2016).

5. We stress that the purpose of this article is not to explain why some allies contribute less. We mainly strive for a model and a deeper understanding within the defence-economic literature that better reflects reality.

6. One related, and justified, criticism is that the definition of e.g. ‘Hybrid Warfare’ is too ambiguous and that too many threats are being labeled as ‘hybrid’ (Caliskan and Liégeois 2020).

7. Referring to the use of operations conducted by special forces to advise and assist foreign resistance movements who are conducting a resistance warfare against their host nation or occupying force. (Kilcullen 2019).

8. E.g. Manipulating energy prices, economic aid, the use of economic sanctions, exploiting the dependency upon trade. See e.g. Blackwill and Harris (2016).

9. The examples mentioned in this article can be found in the most recent US Worldwide Threat Assessment (Coats, 2019), illustrating the need to devote attention to these types of threats. The EU recently published a conceptual model regarding the landscape of hybrid threats, containing a broad series of examples (Giannopoulus, Smith, and Theocharidou 2020).

10. E.g. The Russian use of ‘active measures’ during the Cold War. See Holland (2006).

11. Several definitions emphasise the ‘synchronised’ combining of these threats.

12. The gradual application of small effects, only minorly harming one’s opponent so it seems disproportionate for the defender to carry out their deterrent threats, is also referred to as ‘salami tactics’ (Levite and Shimshoni 2018; Perot 2019; Sweijs and Zilincik 2019.)

13. The 2015 cyber-attacks disrupted the Ukrainian power grid. The 2017 cyber-attacks were aimed against the energy and financial institutions (Banerja 2018). Sullivan and Kamensky (2017) conduct a thorough comparison and demonstrate that the tactics, techniques and procedures that were successfully deployed in Ukraine could be easily deployed against the US power grid or any other country in the world.

14. ‘Solwarwinds’ constitutes a malware campaign, conducted in 2020. It gained access to numerous public and private institutions all over the world (FireEye 2020). The US government attributed the attacks to Russia (Sanger, Barnes, and Perlroth 2021). ‘Hafnium’ was identified in March 2021 as a state-sponsored (Chinese) threat actor aimed at exfiltrating information from a broad series of industry sectors (infectious disease researchers, defence contractors, policy think tanks, NGO’s). (Burt 2021).

15. This strategic vision recognises that non-Western adversaries are weaponising a wide series of instruments of statecraft, used below the threshold of retaliation and aimed at undermining the cohesion, resilience and the UK’s strategic position in key regions of the world. This results in a blurring between ‘peace’ and ‘war’, ‘public’ and ‘private’, ‘foreign’ and ‘domestic’ (UK Ministry of Defence 2020).

16. See the 2008 Russian 10-year military reform (De Haas 2011).

17. Most recent reports of Russian nuclear forces show a continuing broad modernization of Russian nuclear weapons to replace Soviet-era weapons (Kirstensen and Korda 2020).

18. See Balcaen, Bois, and Buts (Balcaen, et al., 2021a) for a game-theoretic model and discussion.

19. Recent strategic documents of NATO strongly emphasise the challenges associated with these threats (NATO 2020b, 2021).

20. E.g. the large-scale consequences stemming from an attack on critical infrastructure such as water, energy or communication services. (NATO 2020a).

21. Critical infrastructure, communication technology and even military transport are e.g. increasingly operated by the civilian sector (NATO 2020a).

22. Alliance members approved the article during the 2016 summit in Warshaw.

23. The Cyber Centre in Tallin (established in 2008) contains experts of the 29 NATO member nations and is recognised as a military organisation. (Cooperative Cyber Defence Centre of Excellence 2021).

24. The centre consists of over 1000 experts in the field of hybrid threats and promotes a WoG and a WoS approach. It provides a forum for strategic discussions, joint training and knowledge sharing by assuming a coordinating role between NATO and the EU (Hybrid Centre of Excellence 2021).

25. In case of strategic nuclear deterrence, the provider of these nuclear weapons cannot refrain from executing its retaliatory threat when one of the members is attacked. The credibility of NATO article 5 (in which the alliance members pledge to view an attack on one of the alliance members as an attack on the alliance) was reinforced by stationing US troops in Europe which implied that an attack on European soil would also harm US interests (Kim and Sandler 2019).

26. The doctrine assigns a greater role to conventional forces to respond in a proportional way, keeping a nuclear attack as a measure of last resort. This ‘motivated’ alliance members to increase their conventional means, since an ally with inferior conventional forces could be perceived as an ‘attractive’ target. (Murdoch and Sandler 1984; Sandler and Hartley 2001). Consequently, free-riding tendencies are reduced.

27. Increasing the US defence burdens following the ‘Strategic Defence Initiative’ (Hartley and Sandler 1999; Khanna and Sandler 1996). This lead to an increase in exploitation of the large allies by the small.

28. E.g. disinformation narratives will differ depending upon the targeted ally.Cyber opponents will similarly use different tactics when they decide to attack a specific ally.

29. As stated by NATO (2020b, p.45): ‘Hybrid Threats are frequently targeted at the “weakest link” or allied nations with a specific vulnerability.’

30. e.g. the Internet Research Agency in Russia, which was very active during the 2016 US elections (Mazarr et al. 2019).

31. This notion refers to the use of threats, or a combination of threats, in one domain (e.g. air strikes) to counter the activities in other domains (e.g. cyber-attacks) to avoid changes in the status quo. More information can be obtained from: Mallory (2018), Sweijs and Zilincik (2019) and Mazarr et al. (2019).

32. At the 2016 Warsaw summit, allies stated that hybrid attacks could also trigger article 5 of the Washington Treaty, justifying a unified response.

33. Reasons for this are manifold: e.g. the difficulty of detecting and attributing the attacks to a specific actor with certainty or the absence of clear ‘red lines’ that would trigger a collective response, i.e. the thresholds discussed in Section 2 (Mallory 2018; Sweijs and Zilincik 2019).

34. This is measured based on Spearman and partial correlation tests (holding the variables GDP/Capita and/or exposed borders constant) between military expenditures (ME) and GDP.

35. Examining the concordance between burdens contributed and benefits received, where the burdens are measured by taking a country’s ME as a proportion of NATO’s ME.

36. The 2021 budget request for example foresees 28.9 billion USD for nuclear modernization and 20.3 billion USD for missile defence systems.

37. Key documents that shape the political guidance are the ‘Strategic Foresight Analysis’ and the ‘Framework for Future Alliance Operations’ (Becker and Bell 2020).

38. Becker and Bell (2020) specifically wonder whether the increased interest in hybrid conflict and the question of resilience should be included in the defence planning process.

39. Another possibility to expand the model is to further subdivide the private good cⁱ into security goods (σ.cⁱ) and private consumption goods (φ.cⁱ). The former term than represents, for example, the additional expenses a firm needs to make to increase its cybersecurity and its resilience. We however opted to keep the model mathematically as simple as possible.

40. We assume this utility function to be strictly quasi-concave. All goods are assumed normal with positive income elasticity.

41. This represents a simplification, given that the wide series of hybrid attacks require adapted responses. The model can be expanded by including multiple counter-hybrid outputs (h_n)at a different price (p_n).

42. The optimalisation solution of the original Joint Product Problem is less difficult (given that there is one variable less) and yields: $\alpha MR{S}_{xc}^i+\beta MR{S}_{Zc}^i$=p Where the first MRS represents the willingness to pay for the private ally-specific defence good and the second the marginal willingness to pay for deterrence (Sandler and Hartley 2001).

43. ‘Thinning’ is a concept associated with conventional threats. The larger the alliance, the more forces are spread along a border or a territory. This leads to partial rival (troops deployed cannot be used to protect one’s own territory) and partial excludable (an ally can choose to exclude one of the allies) benefits. (Sandler 1977).

44. NATO’s Science and Technology Organization recently released a study in which they analyse the extent to which the military works together with other national actors to contribute to a comprehensive approach Science and Organization 2020).

45. The US for example provides more granular data on the composition of their military investments, cfr. Table 1.

46. This approach is also waged in the ‘traditional’ burden sharing debate. See e.g. Mattelaer (2016) and Robinon (2020) for an interesting debate on other metrics (soft and hard power factors) to evaluate burden sharing. A broader debate on burden sharing can be conducted by examining the ‘3 C’s’: ‘Cash’ (share of GDP devoted to defense), ‘Capabilities’ (share of the budget invested in equipment) and ‘Contributions’(efforts in the field of operational deployments).

47. There is a specific EU Horizon 2020 program, studying critical infrastructure resilience: ‘The critical infrastructure protection topic 3: critical infrastructure resilience indicator – analysis and development of methods for assessing resilience’.

48. Solomon (2004) already noticed that asymmetric threats can occur inside one’s borders, following advances in telecommunications and armaments. He did however not put forward other variables that could be considered for analysis. His re-estimating of the Joint Product Model with another weighting scheme for the variables ‘GDP’, ‘Population’ and ‘Exposed Borders’ already indicated the questionable role of the ‘exposed border’ proxy.

49. Kollias (2008) encapsulated the international economic dimension by including FDI flows, FDI stock and international trade. He conducted this analysis within the framework of the EU Common Defence Policy.

50. Unfortunately, the Live Cyber Threat map and the Deteteque Live Threat Map only show the number of incidents currently taking place. They do not provide a database reflecting past incidents.