Ukraine's Lessons for the Future of Hybrid Warfare


Nov 28, 2022

Ukrainian Army soldiers launch a drone near Bakhmut, Ukraine, November 25, 2022, photo by Leah Millis/Reuters

Ukrainian Army soldiers launch a drone near Bakhmut, Ukraine, November 25, 2022

Photo by Leah Millis/Reuters

This commentary originally appeared on The National Interest on November 25, 2022.

A new decision-analysis approach is necessary to capture the use of disinformation in the context of hybrid warfare. The war in Ukraine features two different types of competing societies: open and closed. However, the critical characteristics of this competition cannot be captured using a single analysis framework. Instead, multiple tools must be integrated to help generate a robust policy response to modern hybrid threats.

Russian aggression in Ukraine entails a hybrid war, which is defined by NATO as “an interplay or fusion of conventional as well as unconventional instruments of power and tools of subversion…blended in a synchronized manner to exploit vulnerabilities of an antagonist and achieve synergistic effects.” To be sure, hybrid methods of warfare have been used in the past but “what is new about attacks seen in recent years is their speed, scale, and intensity, facilitated by rapid technological change and global interconnectivity.” Other terms, such as gray zone and information warfare, may be used in this context but, regardless, key characteristics must be modeled and integrated to inform effective policy.

At the onset of the war, Russia leveraged a suite of “active measures,” including espionage, cyberattacks, and internet-based disinformation. These measures were aimed at softening Ukraine's civil defenses and grooming its population for a takeover. Subsequent kinetic attacks were then supposed to take advantage of the ensuing chaos and foster a fait accompli scenario. The use of active measures rather than kinetic attacks, at a relatively high ratio of approximately four-to-one (PDF), was designed for an operation similar to the 2014 annexation of Crimea and the Russo-Georgian War of 2008 that involved the economical use of force and limited political fallout.

However, active measures appear to have failed in Ukraine. Russia was outplayed on the social media front, largely failed in its espionage efforts, and was relatively unsuccessful at using cyberattacks. Russia's pretexts for invading Ukraine were debunked and the invasion was postponed in January when it presumably would have had a greater impact on European energy markets. Russian propaganda and disinformation were also promptly debunked and even “pre-bunked” to the point where they were disregarded on arrival. By comparison, Ukraine managed to boost domestic morale with social media campaigns, exposed Russian war atrocities, rallied international support, and even helped crowdfund for defensive armaments.

The war has demonstrated the key features of hybrid warfare in a duel between open and closed societies. As the two sides used information and disinformation to compete on social media, Russia and Ukraine both employed a whole-of-society approach to war that goes beyond the conventional concept of mobilization. First operationalized by Russia, the less-open society, hybrid methods were intended to exploit the openness of Western liberal democracies. Of course, a perpetrator considers the risk of having the same vulnerabilities exploited if the victim retaliates in kind. Russia thus relied on the structure of a closed society to defend against its own poison. When attacked through hybrid aggression, a relatively open society like Ukraine will draw strength from its openness and mitigate vulnerabilities through technical means as they emerge.…

The remainder of this commentary is available at

Weilong (David) Kong is an assistant policy researcher at the nonprofit, nonpartisan RAND Corporation and a Ph.D. candidate at the Pardee RAND Graduate School. Tim Marler is a senior research engineer at RAND and a professor at the Pardee RAND Graduate School.