European states today find themselves dealing with the so-called hybrid warfare (or War in the gray zone). These are not traditional invasions, but cyber attacks on government servers, sabotage of strategic assets (such as the Nord Stream gas pipelines or underwater data cables in the Baltic Sea), disinformation campaigns and unidentified drones flying over critical infrastructure. They are actions specifically designed to remain “below the threshold” of armed conflict, according to international law, and for this reason it is being talked about more and more in relation to Russia.
And here the geopolitical question arises: if a European state is hit by an attack of this type, who intervenes? The European Union or NATO? There is actually a complex security mechanism in which the two institutions overlap (the so-called overlapping). So let’s see how these mechanisms work and what happens in the event of an alarm.
Activation of alliances: the clauses compared
The security of the European Union is based on two fundamental legal pillars:
- NATO Article 5 (Collective Defence)
This article, a cornerstone of the North Atlantic Treaty, establishes that an armed attack against a NATO member is considered an attack against all members. The strength lies in ready-made military defense plans, available troops and armaments and synergies from a strategic point of view. However, in cases of hybrid wars, the situation changes slightly: in order for Article 5 to be activated, in fact, a clear attack is needed and in cases of anonymous cyberattacks, attributing responsibility to a sovereign State requires months of investigations. Consequently, NATO’s military response is neither immediate nor automatic for this type of event, although the NATO summit in Warsaw formally recognized cyberspace as the fifth domain of warfare (the other four are: land, air, sea, space).
- Article 42.7 of the EU Lisbon Treaty (Mutual Assistance Clause)
The European Union also has its “Article 5”: Article 42.7 of the Treaty on European Union (TEU) obliges member states to help, with all the means in their possession, a member country that is the victim of an armed aggression on its territory. Unlike NATO, the European Union does not have an integrated military command structure or pre-approved territorial defense plans.
Article 42.7 therefore has a highly political value: it has been activated only once in history from France on November 17, 2015, following the Bataclan terrorist attacks in Paris. The activation did not mobilize a European army, but formalized the exchange of intelligence between France and Belgium and logistical support for French counter-terrorism operations.
Division of roles between NATO and EU
To avoid wasting resources and conflicts of competence during a crisis, cooperation between the two organizations is regulated by the EU-NATO Joint Declarations (signed in 2016, 2018 and 2023). International diplomacy has therefore promoted a clear division of labor:
- NATO manages military defense and deterrence: guards the external borders, coordinates satellite military intelligence and plans any kinetic response against the aggressor;
- The EU manages civil resilience and infrastructure: restores the functioning of electricity and digital networks, guarantees the continuity of the single market, coordinates military mobility and protects the economic and energy fabric from financial shocks.
The EU relief machine: what is IPCR?
If an EU country suffered a massive hybrid attack (for example, the simultaneous sabotage of a power plant and digital healthcare systems), the first response would not be military, but political and civilian. There is a protocol that the European Union can activate called IPCR – Integrated Political Crisis Response (Integrated arrangements for the political response to crises), governed by EU Council Decision 2018/1993.
At the request of the affected country, the EU Presidency immediately convenes informal decision-making tables which bring together the European institutions, experts from the affected countries and representatives of BORN And UN.
More in detail, the IPCR deals with:
- Technical analyzes produced by the European Commission and the European External Action Service (EEAS) to map the extent of the damage in real time;
- Communication coordination to counter disinformation campaigns and manipulation of information by foreign actors;
- EU Civil Protection Mechanism through the dispatch of specialized civil protection teams on site (doctors, technicians, cybersecurity experts) and the possible use of the European Union Solidarity Fund for damage to critical infrastructures.
The new defenses: Von der Leyen’s Emergency Security Protocol
Precisely because sub-threshold attacks are increasingly frequent (such as interference on submarine cables or GPS systems), European institutions are developing and discussing new regulatory tools. Inside the new one European Security Strategythe European Commission led by Ursula Von der Leyen has proposed the introduction of an Emergency Security Protocol.
This tool serves to fill the regulatory gap that currently exists by establishing tougher rules on who does what in the first minutes of a hybrid attack. Just as Article 4 of NATO allows a member country to convene a consultation among allies in the event of a threat to its security, theEmergency Security Protocoll would allow an EU Member State to activate a coordinated response at European level. The protocol is part of a broader regulatory ecosystem, which includes the Cyber Solidarity Act European Union and the directive NIS 2 (Network and Information Security), which imposes security obligations on over 15 critical sectors (energy, transport, healthcare, banking). To support this architecture, the European Union has mobilized a budget dedicated to cybersecurity within the Digital Europe program, with strategic investments aimed at creating a “European Cyber Shield”. The aim is to speed up the exchange of information between national agencies and create a common cyber defense network.
