NATO After Madrid: Preparing for an Age of Confrontation and Disruption

NATO’s Madrid Summit in June 2022 was potentially transformative. Allied leaders were united in their view that Russia poses the most significant and direct threat to their security and to peace and stability in the Euro-Atlantic area. They agreed to a fundamental shift in NATO’s deterrence and defense posture, with strengthened forward defenses, enhanced battlegroups in the eastern part of the Alliance, and an increase in the number of high readiness forces to well over 300,000. They recommitted to the fight against terrorism, and addressed NATO’s response to threats and challenges from the Middle East, North Africa and Sahel. They underscored the importance of greater resilience as the first line of effective deterrence and defense, crisis prevention and cooperative security. They agreed to invest more in defense, to increase common funding, and to advance a NATO Innovation Fund and Defense Innovation Accelerator to help the Alliance sharpen its technological edge. They endorsed a new action plan to strengthen cyber cooperation. They committed to long-term support for Ukraine through a strengthened Comprehensive Assistance Package. And they invited Finland and Sweden to join the Alliance. 

Leaders also unveiled a new NATO Strategic Concept, the Alliance’s long-term guideline document, which describes a “contested and unpredictable” world in which Alliance interests and values are challenged by “pervasive instability, rising strategic competition and advancing authoritarianism.” In that context, and for the first time in a Strategic Concept, allies state that China’s “ambitions and coercive policies challenge our interests, security and values.”[1] To underscore their concerns -- and in another first – allies welcomed the leaders of Australia, Japan, New Zealand, and the Republic of Korea to the Madrid summit. They agreed to initiate a roadmap for expanded cooperation, ensuring closer political consultation and joint work on such issues as cyber and hybrid threats, maritime security, counterterrorism, and the impact of climate change on security. 

These are impressive steps. If the Summit is to be considered truly transformative, however, Alliance members must now translate words into deeds.[2]

Moving From Deterrence by Reinforcement to Deterrence by Denial 

At Madrid, allies underscored NATO’s primary task of collective defence. On the ground, currently, the Alliance depends on tripwire forces deployed in eastern allied states, plus places ultimate reliance on reinforcement by ready forces now deployed to the rear, including in the United States. Essentially, this means giving up ground upon attack and then reoccupying it after reinforcements are sent forward. The horrific devastation unleashed on Ukraine’s citizens and the destruction of Ukrainian cities make it clear that deterrence by reinforcement is neither credible nor desirable. On the eve of the Madrid summit, Estonian Prime Minister Kaja Kallas said that in the event of a Russian invasion, her country would be “wiped from the map” under existing NATO plans.[3]

Prompted by these concerns, allies at Madrid essentially agreed that NATO must move away from tripwire defense and provisions for reinforcement to forward defense and deterrence by denial – the operational implication when Allied leaders say they will ‘defend every inch’ of NATO territory.[4] Allies resolved to strengthen NATO’s force posture, including with ambitious plans to be able to mobilize as many as 300,000 troops within 30 days. This change will require more U.S. and European troops deployed to NATO’s eastern flanks, new infrastructure by host nations to receive those troops, a new command structure, and a revised concept for military operations. Putting all of this together will take time, at minimum another year, even as Russia’s war in Ukraine continues and confrontation with Russia persists.

Moreover, in line with what NATO calls its “360 degree” approach to defense, the Alliance must be able to dissuade and deter threats to its members, from whatever source and across all domains, while being prepared to defend all parts of NATO territory and to protect the critical functions of Allied societies. That means not only countering challenges from Russia, but also addressing pressures emanating from NATO’s south and southeast, and to guard against malevolent disruption to the critical functions of allied societies. The Alliance needs to bridge gaps in its ability to better integrate its political, military and technological capacities across all five operational domains: land, sea, air, cyberspace and outer space. NATO has been good at addressing each domain on its own. Being good at multi-domain operations is exponentially harder. 

The Alliance must also fill critical capability gaps to deal with Russia’s anti-access/area denial (A2/AD) capabilities. This includes counter A2/AD capabilities such as suppression of adversarial air defenses, availability of long-range precision strike conventional missiles, improved Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance (C4ISR), and additional electromagnetic warfare assets.

New Allies, New North

One of the many consequences of Vladimir Putin’s further invasion of Ukraine in February 2022 is the complete transformation of Northern Europe’s security landscape. Denmark has pledged to boost its defense spending to reach NATO’s 2 percent goal, and in early June 2022 Danish voters abandoned their country’s long-standing opt-out from the EU's Common Security and Defense Policy, now enabling Denmark to take part in joint EU military operations and to cooperate on development and acquisition of military capabilities within the EU framework. Even more stunning is the decision by Finland and Sweden to cast aside their long-time traditions of military non-alignment and join NATO, which will strengthen Allied deterrence and defense across the Arctic, Nordic and Baltic regions.

Sweden and Finland are already very close partners to NATO. They are militarily advanced and technologically savvy. Despite Finland’s relatively small population, Helsinki can mobilize 280,000 troops in thirty days. Its air force is among Europe’s best. Sweden has re-emphasized territorial defense and bolstered its air, land and sea capabilities. Each country’s regional expertise on Russia and traditions of ‘total defense’ will also add to NATO's understanding of Northern European security challenges and ways in which Allied societies can build resilience against disruptive threats. The addition of Sweden and Finland will connect the entire High North outside of Russia in a NATO strategic space, raising the threshold of risk for Russia should it contemplate any further aggression. It will also facilitate NATO support to the Baltic states, which is currently constrained through the sliver of territory along the Polish–Lithuanian border known as the Suwalki Gap. Supply and support of the Baltic states by new NATO Baltic Sea allies will enhance those countries' ability to defend themselves. 

While NATO allies at Madrid invited Finland and Sweden to join the Alliance, NATO membership is not complete until all 30 NATO nations ratify their accession to the North Atlantic Treaty. This could leave both countries vulnerable to Russian pressure. Allies need to expedite the ratification process.

The Resilience Imperative

During previous wars hot and cold, allies knew where the front line was. During the Cold War, it was the Fulda Gap astride the Iron Curtain. After the 9/11 attacks, allies safeguarded their security at the Hindu Kush. Now, as Russia continues its assaults on Ukraine, Europe’s frontline rips across Ukrainian territory, and its foremost defender is Ukraine, a non-NATO country. 

But Putin’s war is a multi-front war. Russia’s assaults on Ukraine and other neighboring countries are multi-dimensional. They include weaponizing food, energy, refugees, cyber, information and other flows. The dangers such efforts pose have been amplified in recent years by a spate of disruptions to allied societies generated by state actors, non-state networks, even nature itself. The upshot: today’s front line is not just in Ukraine. It can be anywhere – Black Sea ports, Istanbul’s Grand Bazaar, Frankfurt’s airport, Oregon’s Bowman Dam, Italy’s food supply, Britain’s hospitals, France’s social media platforms. Today, the front line could be your computer. It could be your mobile phone. 

To ensure security in this age of persistent confrontation and ongoing disruption, allies need to improve their resilience: they need to sharpen their ability to anticipate, prevent, and, if necessary, protect against and bounce forward from disruptions to critical functions underpinning democratic societies. While allies have been attentive to this challenge, so far they have defined resilience rather narrowly and statically as pertaining particularly to critical infrastructures and continuity of government. Responses have not been integrated adequately into allied planning or operational activities beyond narrow country-by-country baseline metrics. 

Before the Madrid Summit, allies stood up a new Resilience Committee to better coordinate their efforts. At Madrid, leaders stepped up their game. They pledged to “pursue a more robust, integrated and coherent approach to building national and Alliance-wide resilience against military and non-military threats and challenges to our security, as a national responsibility and a collective commitment.”[5] This is an auspicious beginning. The test will be in its implementation. 

Of course, each NATO member state bears primary responsibility for ensuring the resilience of its own democratic society. Resilience begins at home. However, in an age of potentially catastrophic terrorism, networked threats and disruptive cyber-attacks, no nation is home alone. Few critical infrastructures that sustain the societal functions of an individual country are limited today to the national borders of that country. Strong efforts in one country may mean little if a neighboring ally is weak. Governments accustomed to protecting their territories must also be able to protect their connectedness — the vital arteries that are the lifeblood of open societies. Resilience will never be achieved on a country-by-country basis; allies dependent on mutual flows of people, power, goods and services must move from country-by-country baseline requirements to shared resilience, by establishing metrics together that can ensure their mutual security. This needs to include and go beyond critical infrastructures to encompass key industries, financial flows, strategic ports and transportation/reception nodes, supply chains, communications and information networks, and other elements of the connective tissue that binds allies’ critical societal functions. 

They must also be prepared to project resilience forward to non-NATO partners.[6] We see the importance of this today in Ukraine, which is being used by Russia as an experimental laboratory for hybrid threats and disruptive attacks on the country’s critical infrastructure, incapacitating electricity grids, subway systems and airports. Because Kyiv is largely unable to retaliate, Russia has also found Ukraine to be a useful testing ground for its cyberwarfare capabilities. 

In the current crisis, NATO has acted to help Kyiv become more resilient to such attacks. That is good, but allies should not think of such help as a “one-off” in the middle of a passing crisis, they should think of it as an ongoing, integral part of NATO’s mission going forward.

Ukraine is not a lone example. All across Europe’s southern and eastern peripheries disruptive challenges to weak democracies can ripple back into NATO territory. These examples underscore NATO’s interest in projecting resilience capacities forward to vulnerable democratic partners. Allies should share societal resilience approaches and operational procedures with partners to improve democratic resilience to corruption, psychological and information warfare, interference with elections or democratic institutions, and disruptions to cyber, financial and energy networks and other critical infrastructures. 

Resilience is a job for NATO, but it need not be a job for NATO alone. Enhanced NATO-EU cooperation offers a means to leverage the combined resources of both organizations in common cause. Most NATO member states are also EU member states. Much of the resilience challenge has to do with civilian institutions and privately-owned infrastructures, many of which are integrated into EU structures and processes. Fortunately, NATO and the EU already work closely on resilience issues related to critical infrastructure protection, and allied leaders at Madrid underscored the importance of this cooperation. They must now extend that cooperation to issues of shared and forward resilience.

Securing the Eastern Neighborhood

Eight years after illegally annexing Ukraine’s Crimean Peninsula and launching a proxy war in eastern Ukraine, Russia unleashed a full-scale conventional invasion of Ukraine in February 2022. Russia’s renewed invasion was not just an attack on Ukraine; it was an assault on the entire European security order that has evolved since the end of the Cold War. If Putin succeeds in subjugating Ukraine, Russia’s other neighbors – including the Baltic states – could be next. 

NATO and EU countries have offered considerable support to Ukraine, while being careful not to slip inadvertently into direct military clashes with Russian forces that could unleash a much broader war. The question now is how to sustain and enhance support for Ukraine and other NATO partners facing Russian aggression. 

There is no consensus within NATO to admit Ukraine as a member of the Alliance. Most NATO allies are not even prepared to take the preliminary, procedural step of granting Ukraine a Membership Action Plan (MAP). In NATO’s June 2022 Strategic Concept, the Alliance reiterated that a “strong, independent Ukraine is vital for the stability of the Euro-Atlantic area” and that the “security of countries aspiring to become members of the Alliance is intertwined with our own.” Alliance leaders committed to helping NATO aspirants Ukraine, Georgia, and Bosnia and Herzegovina build their capabilities and resilience, yet did not state more specifically what they are prepared to do in this regard. 

Given the stakes, allies must now infuse the Strategic Concept’s generalities with specific meaning. They should make it a strategic objective to do everything possible, short of extending an Article 5 guarantee, to help Ukraine, Georgia, and Moldova defend themselves and resist Russian destabilization. This means devising and implementing a package of measures tailored to each country’s particular situation. This “Secure Neighborhood Initiative” (SNI)[7] would encompass not only military equipment and training, but measures to increase these countries’ resilience against cyber-attacks, financial disruption, disinformation, economic warfare and political subversion. For Ukraine, the country currently under attack, the Ukraine-NATO Commission could provide for ad-hoc consultations whenever Ukraine or allies believe the territorial integrity, political independence or security of any of the parties is threatened. These countries should gain more access to the Alliance’s Centers of Excellence (CoE). A new NATO Trust Fund should be created that is dedicated to capability development and focused on defensive weapons acquisitions. 

Rather than adhering to the standard formula that NATO partnerships are demand-driven and funded largely by voluntary national contributions, under the SNI, NATO would proactively make it a formal NATO responsibility, backed by common funding, to help train Ukrainian and Georgian armed forces and to facilitate their acquisition of modern defensive weapons that would raise the cost to Russia for any new aggression – such as anti-armor capabilities, counter-artillery systems, air and missile defense, anti-ship missiles and combat drones. This would be of far greater benefit to Ukraine and Georgia than a MAP, which is largely symbolic, or the distant prospect of NATO membership. 

Addressing the China Challenge

At Madrid, allied leaders essentially declared the Indo-Pacific and European theaters to be increasingly linked. They underscored that NATO’s ability to address traditional and unconventional threats in Europe is becoming intertwined with related challenges to Alliance security interests posed by China. And while they said they were “open to constructive engagement” with Beijing, they pledged to work more closely together to address the “systemic challenges” posed by China to Euro-Atlantic security, including through enhanced shared awareness, resilience and preparedness, as well as standing against China’s “coercive tactics and efforts to divide the Alliance.”

In this regard, the Alliance should explore deeper coordination under Article 2 of the North Atlantic Treaty, which commits allies to promote ‘conditions of stability and well-being’ and to ‘encourage economic collaboration’. Article 2 offers a frame through which allies could work to enhance investment screening of foreign investment in security-related infrastructures, companies and technologies, as well as other steps to protect individual Allied nations from security-related dependencies on China. Article 2 also offers a framework for enhanced cooperation with the European Union on these issues, including common or complementary principles of action with regard to economic-security contingencies.

Additional steps allies might consider include bolstering protection of defense-critical infrastructures and defense-related supply chains. This could include updating NATO’s secure telecommunications requirements for 5G, and incorporating secure 5G spending and other cyber and infrastructure protections into NATO’s spending goals.^[8] They should consider an Alliance-wide review of defense supply chain dependencies on China, and establish a NATO-EU Dialogue to address threats to critical infrastructure, investment screening, export controls (including of dual-use technology), telecommunications, and supply chains. Standards should be set for NATO members and partners regarding external investment in critical infrastructure, particularly if that infrastructure plays a role in NATO missions. And they should improve cooperation between NATO and international development finance corporations to highlight alternative investment options for critical infrastructure, especially among newer members and partners.

Participation at Madrid by the leaders of Australia, Japan, New Zealand, and the Republic of Korea was an encouraging sign, as was their agreement to chart a roadmap for expanded cooperation. As they flesh out those details, consideration should be given to inviting Japan, the Republic of Korea and New Zealand to join Australia as NATO Enhanced Opportunities Partners. Varying levels of enhanced military cooperation could be considered, from information sharing and joint exercises to joint operational planning or joint command centers. NATO should consider setting up NATO liaison office in these countries’ capital, as well as establishing Centers of Excellence in the Indo-Pacific. Much like current CoEs in Helsinki and Bucharest, these centers would not be formal NATO entities but be open to participation by a host of actors, including NATO. Private sector actors could also participate. Priority issues are a) addressing security challenges arising from economic interdependencies and technological advances; and b) security challenges related to competition in the global commons. Finally, NATO and its partners should explore an ad-hoc, issue-by-issue dialogue with India, which has not indicated interest in a deeper partnership with NATO yet shares overlapping concerns regarding Chinese actions and intentions.

From Strategic Autonomy to Strategic Responsibility

While Russian President Vladimir Putin’s war of aggression against Ukraine has reinvigorated the Atlantic alliance, it has also deepened Europe’s strategic dependence on the United States. As NATO continues its most urgent task — helping Ukraine beat back Russia’s assault — it must address this important longer-term challenge of rebalancing trans-Atlantic defense. Doing so means squaring a triangle of issues: ensuring Europe’s capacity to defend itself against Russia and manage a range of additional crises, many along its southern periphery; addressing European aspirations for greater strategic autonomy; and maintaining confidence that the United States can adequately uphold its commitments in both the North Atlantic and the Indo-Pacific.

Europe’s long-standing aspiration to develop more effective ways to act militarily is now intersecting with the long-standing U.S. aspiration that Europeans shoulder more of the common burden. Stated simply, in the past Europe has wanted autonomy without providing adequate defense resources, while the United States has wanted greater European defense contributions without diminishing NATO and U.S. political influence. Now, it is time to unite these two debates and find a new balance for both.^[9]

Over the next decade, the transatlantic partners must rebalance their relationship so that Europe assumes greater strategic responsibility, with two military goals in mind. 

First, European allies should build their conventional military capabilities to a level that would provide half of the forces and capabilities, including the strategic enablers, required for deterrence and collective defense against major-power aggression. Should a conflict simultaneously break out with China in Asia and Russia in Europe, the United States may not be able to deploy adequate reinforcements to Europe. European allies need to be able to pick up the slack.

Second, Europe should become the first responder to most crises along its southern periphery. European allies should develop capabilities to conduct crisis management operations without today’s heavy reliance on U.S. enablers such as strategic lift, refueling, and C4ISR.[10]

To achieve these two strategic goals, NATO allies could agree within the NATO Defense Planning Process to a military level of ambition for European strategic responsibility. European allies and Canada could commit to investing sufficient resources to ensure that, by the end of the decade, they can meet 50 percent of NATO’s Minimum Capability Requirements.[11] Meeting this standard will take time, given Europe’s current lack of enablers, its relatively low readiness rates, and its fragmented military industrial complex. Building European strategic responsibility will be a process, not a one-time event. 

Enhancing Security in an Age of Persistent Confrontation and Ongoing Disruption

Europe and North America stand today at a historic inflection point, between a fading era of relative stability and a volatile, dangerous age of disruption that is global in nature and broad in scope. Challenges include, but go beyond, persistent confrontation with a revanchist Russia and competition with a militarily powerful and technologically advanced China. They extend to emerging technologies that are changing the nature of competition and conflict and digital transformations that are upending the foundations of diplomacy and defense. The scale and complexity of critical economic, environmental, technological, and human flows, as well as the dependency of many societies on such flows, have increased dramatically. These risks require Europe and North America to reaffirm their mutual bonds, retool NATO and their other institutions, and rebalance their partnership.