On January 2nd 2026, 45,000 households in southwestern Berlin woke up to find themselves without power or heating in the middle of winter. Overnight, assailants set fire to a cable bridge near a power plant, disrupting parts of the Berlin power supply network for weeks. Even after power was eventually restored, the subsequent fallout from the city government’s lacklustre response has led to calls for the mayor, who had been caught playing tennis during the power outage, to resign. Though the perpetrators of this attack initially claimed to represent the ‘Volcano Group’, a far-left domestic terrorist organization in Germany with nebulous goals and motivations, known Volcano Group affiliates subsequently condemned the attacks and denied the organization’s involvement.
The hazy details surrounding this latest act of sabotage reflects the current state of domestic security in much of Europe. Across the continent, incidents similar to this have become more common since 2022, due to a drastic rise in incidents of suspected Russian sabotage.
This odious intersection of sabotage, theorized to be part of Russia’s “hybrid warfare” efforts, and homegrown terrorism has resulted in an internal security environment across Europe where disruptions to critical infrastructure and various aspects of daily life have become expected, if not mundane. In the past four years, suspected Russian agents have targeted undersea telecommunications and internet cables in the Baltic Sea; railway networks in Germany, Poland, and France; and Ukrainian businesses in the UK. Though Russia has leveraged its existing network of “illegals” in Europe, or Russian sleeper agents posing as citizens of other countries, Russia is increasingly relying on the recruitment of third-country nationals through online channels like Telegram on a gig work basis, distributing payment in cryptocurrency.
The Effects of the Culture of Disruption
The maintenance of this culture of disruption is one of the goals of Russian grey-zone operations. When acts of sabotage and major disruption of critical infrastructure provoke no response from NATO, they undermine critical underpinnings of the North Atlantic Treaty’s Article 5, that an armed attack on one member state will be treated as an armed attack on all. Sabotage and similar actions do not meet the standards for an armed attack, yet constitute part of a sustained hostile campaign against NATO. The result is that acts of sabotage against infrastructure are now indistinguishable from accidents and genuine mechanical or human failures. Sabotage investigations demand time and resources from NATO countries’ police and domestic intelligence agencies, and when every disruptive incident requires a sabotage investigation, Russia could eventually overwhelm NATO’s existing domestic security apparatuses.
These tactics may be new to Europe, but they find precedent elsewhere. For years, China has been steadily exerting pressure on Taiwan by violating its airspace and territorial waters with increasing regularity. These actions gradually escalate tensions and intentionally blur the lines between routine operations and genuine escalation in preparation for full-scale conflict, thereby obfuscating China’s intentions at any given time. China is also under suspicion for participating in sabotage in the Baltic Sea, where Chinese merchant vessels have been observed dragging their anchors along the sea floor near undersea cable installations.
Russian sabotage in Europe seems to be motivated by a similar logic, that of normalizing disruptive behaviour such that they are indistinguishable from genuine pre-conflict escalation. These operations also serve to intimidate Russian dissidents in Europe and dissuade further defection.
In other words, they are by nature acts of terrorism, and NATO’s mandate to act against acts of terrorism is clear. The only time NATO has ever invoked Article 5 was in response to the 9/11 attacks, an act of terrorism against the United States.
Yet, no NATO member has called for the invocation of Article 5 in response to suspected Russian sabotage, and rightly so. By refraining from resorting to Article 5, NATO continues to demonstrate that it is not the escalatory party in Russia’s ongoing aggression against Europe. However, there is a cogent argument for NATO to lay down a red line and a counterstrategy against further sabotage.
NATO’s Possible Responses
Unlike with Russian incursions against European airspace, where NATO air defences can simply shoot down Russian drones or aircraft when ordered to do so, there is no singular, clear option for effective countervailing action in response to Russian sabotage.
One option could be the expulsion of Russian diplomats in response to suspected sabotage incidents. This is already the norm when NATO countries uncover Russian espionage cases, and such expulsions directly disrupt existing Russian espionage networks in Europe. Poland has already done so in response to a major attack in December 2025, which saw Russian-backed agents blow up a railway line.
A potentially riskier option might be providing Ukraine with materiel and intelligence for targeted strikes inside Russia, sending a signal that NATO will respond to aggression in kind. Ukraine has already employed sabotage against Russian infrastructure, complementing its use of drones inside Russian territory. This, however, does nothing to address the domestic disruption caused by Russian sabotage in Europe and simply represents a tit-for-tat response.
In the long term, enhanced civil defence capacity will remain key to creating conditions of preparedness for and resilience to disruptive incidents. To that end, NATO could take a more active role in coordinating civil defence efforts between member states, currently a largely discrete responsibility. NATO is already empowered to do so under Article 3 of the North Atlantic Treaty and could set guidelines and targets for civil defence spending as it does for military spending. Berlin’s laggard response to the arson attacks demonstrates how a relatively small-scale action can trigger a days-long crisis for local governments. A larger attack, or a coordinated series of attacks across several NATO countries, would necessitate a coordinated collective civil defence response, which currently does not exist within the NATO framework. To pre-empt this potentiality, NATO could consider establishing a civil defence crisis response centre, and member states can establish formal channels of communication between civil defence authorities.
Above all, it is imperative for NATO to show that continued aggression in the form of sabotage and terrorism crosses a firm red line, which will be met with a swift, coordinated response. Russian aggression in the form of these incidents is a fact. It is therefore incumbent upon NATO to respond to and deter this aggression, in fulfillment of a vital part of its mission.
Image credit: French soldiers on a Vigipirate patrol at the Gare de Strasbourg (2013) by Claude Truong-Ngoc via Wikimedia Commons. Licensed under CC BY-SA 3.0.
Disclaimer: Any views or opinions expressed in articles are solely those of the authors and do not necessarily represent the views of the NATO Association of Canada.
