A startling undersea attack on Europe’s gas pipelines has officials deliberating how to better defend a vast array of local targets that are, effectively, not fully defensible.

For months, European governments have been scouring their military arsenals to help furnish a grueling ground war in Ukraine while making pledges to boost their own defenses. But this week, saboteurs — which many allege were Russian — reminded Europeans that the threat is also closer to home, in the nebulous world of “hybrid” attacks targeting everything from energy systems to internet cables to financial markets and water supplies.

Such assaults lie in the gray zone between war and peace — cloaked in a veneer of deniability and hitting targets that don’t always automatically trigger a military response.

That was the case with the recent explosions on the Nord Stream pipelines connecting Russia and Europe. Some of the infrastructure is jointly Russian- and European-owned, and the attacks occurred in the vague “exclusive economic zones” off the coasts of Denmark and Sweden.

The muddled responsibility makes it difficult to craft a specific reaction — for this incident or others. According to military specialists, possible options on the table are: heightened surveillance, more visible patrolling, ensuring systems have backups and better-coordinated responses. Norway, Denmark and Finland have all already taken a few of these steps.

The ability to swiftly update existing defense plans could dictate whether Europe is fully prepared for another, more serious, assault. And the stakes are only growing as the temperature drops, making basic functions like heat and electricity even more important.

“NATO has [a] quite elaborate policy on hybrid threats and critical infrastructure,” said Edgars Rinkēvičs, Latvia’s foreign minister.

“We now,” he added in a text message, “need to understand if it is up to date.”

A senior diplomat from an eastern NATO country echoed the point: “Since the invasion against Ukraine, all eyes were focused on the revived conventional war in the 21st century, neglecting somehow the importance of preparedness in the field of hybrid tactics.”

And, he added, this sabotage illustrates NATO’s need to keep “developing its defense on all dimensions and across all areas of responsibility.”

A deterrence game

While investigations into the leaks are ongoing, NATO’s northern members and partners have already begun tightening security.

Norway is deploying its military to protect oil and gas installations, while Finland’s border guard upped its monitoring of maritime traffic and infrastructure. Denmark also moved to boost protections around energy sites.

And although many governments have formally declined to point fingers, NATO sent a thinly veiled warning to the Kremlin on Thursday that it would respond to an attack on allies’ key infrastructure.

“All currently available information indicates that this is the result of deliberate, reckless, and irresponsible acts of sabotage,” NATO’s principal political decision-making body, the North Atlantic Council, said in a statement.

The group said it had committed “to prepare for, deter and defend against the coercive use of energy and other hybrid tactics by state and non-state actors.” And it sent a warning: “Any deliberate attack against Allies’ critical infrastructure would be met with a united and determined response.”

Nevertheless, the gas leaks present a thorny challenge for the alliance, which has pledged to protect every inch of allies’ territory.

Hybrid attacks are often designed to hit adversaries without necessarily triggering a full-scale conflict or revealing with certainty the perpetrators’ identity. Is a cyberattack on a privately run dam always the military’s responsibility? Can investigators ever convince the public that Russia was behind a rural explosion?

“The Russian military and the Kremlin love those debates — was it them, was it not them — and this kind of plausible deniability," said Rod Thornton, a senior lecturer at King's College London. “They want to encourage debate or disagreement within NATO about how to react.”

And when NATO isn’t technically at war with Russia, it becomes even more quixotic.

“It's complicated stuff for NATO to handle because it is not peacetime, but it's not war in the sense that it necessarily triggers Article Five,” said Kristian Søby Kristensen, a senior researcher at the University of Copenhagen’s Center for Military Studies, referencing NATO’s founding principle that an attack on one member is an attack on all members.

Experts point out that the location of the leaks complicates possible responses — pulling in multiple countries and companies with subsidiaries in even more countries.

“This is precisely an act of sabotage that creates uncertainty,” Kristensen said.

“It’s difficult to figure out what this actually is,” he said. “Is it a standalone? Is it just the first instance of a longer campaign? Who are the ones responsible for responding? What should the response be? Who has responsibility for cleaning up?”

At the same time, NATO’s ability to completely block Russia from attacking infrastructure is limited.

“You cannot put guards on every kilometer of undersea cable,” said Charly Salonius-Pasternak, the leading researcher at the Finnish Institute of International Affairs.

“So the question becomes,” he added, “can you deter this?”

The same is true of nearly any critical infrastructure. The energy grid is disparate and often rural. The financial system is spread across a network of private companies.

One approach, according to Salonius-Pasternak, is to make sure key infrastructure “is so robust, that while it would be inconvenient, it doesn't matter” if one piece is sabotaged.

Allies can also choose to be more visible and “increase presence, either in the air or the sea,” he said, in order to “show national populations as well as Russia that we're doing something.”

Another option, Salonius-Pasternak added, is “very aggressive patrolling” — which could involve aerial surveillance, sensors and boarding ships. This approach “takes a massive amount of resources,” but the high cost also makes it a “much more credible” signal.

And while the public’s attention may be focused on Russia’s invasion of Ukraine and rising prices, risks to undersea infrastructure have been on policymakers’ minds for some time.

Early this year, British chief of defense staff Admiral Sir Tony Radakin warned about an increase in Russia’s underwater activity, telling The Times that “Russia has grown the capability to put at threat those undersea cables and potentially exploit those undersea cables.”

Now, some experts say Russia’s battleground losses could fuel more use of hybrid tactics against Western adversaries.

Back in Brussels

In Brussels, officials acknowledge that there is a need to improve how assets are secured.

“We need to strengthen protection of critical infrastructure as quickly as possible,” said a second senior diplomat from an eastern NATO country. “It will be ensured,” the diplomat said, adding: “There are many objects of concern.”

The University of Copenhagen’s Kristensen said a response could involve more NATO planning for future crisis management procedures, paying more attention to the gray zone and critical infrastructure, and focusing NATO allies’ military assets “on conducting surveillance and ensuring your situational awareness.”

Hanno Pevkur, Estonia’s minister of defense, has urged allies to learn from the experience of war.

“What we can see from the Russian war against Ukraine is that critical infrastructure of all kinds is a valuable target for the aggressor — from roads to bridges, to hospitals, to supply lines of all kinds,” the minister said in a text message.

“That is why,” he said, “every country of NATO has to keep a close eye on the learning moments from this war, so all critical infrastructure that needs protection is definitely under our heightened attention.”

Inevitably, boosting such defenses is always a work in progress.

“We have done some work,” said the first senior diplomat. “We are not starting from scratch.”