The North Atlantic Council stated in May 2024 that Russia is conducting hybrid activities against Allies. What that means concretely is arson, parcel devices, railway sabotage and interference in civil systems, handled by prosecutors rather than by militaries, at very different stages of proof.
Written for humanitarian and policy readers: it connects security conditions to civilian effects, and implies no operational coordination.
How to read the grades
- Confirmed Documented as having occurred, with sources.
- Plausible exposure A mechanism Vigil assesses as likely; not documented as having occurred.
- Unconfirmed scenario Named because it is worth watching. Not asserted.
A step can never be graded more firmly than the step it depends on: a consequence cannot be better established than its cause. That rule is enforced when this site is built, not applied by hand — a chain that broke it would fail the build rather than publish.
- Trigger
The North Atlantic Council states that Russia is conducting hybrid activities against Allies, May 2024
- Affected area or systemConfirmed
What is exposed is ordinary civilian life and the systems that carry it: shopping centres and warehouses, courier networks, railway signalling, electoral processes and the information environment. None is a military object, and none is defended by the forward formations this module otherwise describes.
Documented as having occurred, with sources.
- Access or service disruptionConfirmed
The Council stated in May 2024 that Russia is conducting hybrid activities against Allies, naming sabotage, acts of violence, cyber and electronic interference and disinformation, and identifying seven affected Allies. National cases sit at different rungs: an Estonian county court convicted seven people over a 2023–24 vandalism campaign and found a January 2024 Tallinn arson was tasked by Russian military intelligence; a Lithuanian court convicted the perpetrator of a May 2024 arson in Vilnius; a Polish prosecutor charged a November 2025 railway sabotage in absentia three days after it occurred; a courier-network parcel case went to trial in April 2026 without a verdict.
Documented as having occurred, with sources.
- Civilian conditionPlausible exposure
The civilian exposure has two parts. The first is direct: fires, devices in transit networks and interference with a railway are risks to people who have no part in the confrontation. The second is procedural — these acts are handled by police and prosecutors, on court timescales, in jurisdictions where suspects have often already left, so the state's answer to a civilian is a case file rather than a defence.
A mechanism Vigil assesses as likely; not documented as having occurred.
- Broader humanitarian significancePlausible exposure
This is the pressure the module's military layer does not address. A multinational brigade deters an armed attack; it does not prevent an arson, and the institutions that do — prosecutors, police, courts, electoral commissions — are national, civil and outside NATO's command. That division is why the Alliance's own answer in this domain has been resilience and attribution rather than force.
A mechanism Vigil assesses as likely; not documented as having occurred.
Civilian conditions affected
Named as plain labels rather than a controlled vocabulary, so this list cannot drift from the commodity names the module's economy section already uses.
What remains unknown
- No incident count is carried. There is no official deduplicated series of attributed sabotage on flank territory, and constructing one would be Vigil's arithmetic rather than a published fact.
- Casualty, injury or damage figures were not established from primary sources this pass and are not stated.
- For most cases the direct perpetrators are unidentified or have left the jurisdiction.
Readings the evidence also supports
- The rise in recorded cases may reflect increased activity, or increased detection, prosecution and publication by states that were previously handling such cases quietly. Both are consistent with the published record, and the module does not choose between them.
Listed because the record's own assessment is not the only one its sources permit — not as a hedge on the assessment above.
Whether prosecutions convert charges into verdicts
The module holds two court findings of tasking, one conviction and several unresolved charges. Each verdict moves a case up the ladder, and the ladder is the record.
Whether the Council issues a further collective statement
The May 2024 statement is the alliance's own framing. A second would indicate whether the pattern is assessed as continuing or intensifying.
Watch questions this chain bears on
Standing analytical questions whose evidence runs through this chain, each with its latest review. Derived from the Watch object, never restated here.
Open in Explore Interactive: select this record and follow what connects to it.
Assessed as of — 2026-09 Last reviewed — 2026-09-21