Ever since Russia annexed Crimea from Ukraine and sponsored separatists in the Donbas, Eastern Europe has collectively wondered: “Where will the Kremlin strike next?”

The Baltics are one likely target.

Russia could begin a rapid attack under the guise of a snap exercise, combining troops from its western military district with those in its exclave of Kaliningrad. The resulting pincer movement could isolate the Latvian and Estonian capital cities in mere days.

However, such a bold assault would quickly trigger Article 5, NATO’s collective defense principle. It’s more likely that the attack would be opaque, muddled through the use of proxy forces, disinformation and cyber attacks.

What if a Russian motorcycle gang rolled up to an Estonian border outpost and started “causing a ruckus," proposed Stephen J. Flanagan, a senior political scientist at the Rand Corporation who co-authored a new study on deterring Russian aggression in the Baltics for the Pentagon.

The guards attempt to quell the group, “but as far as they’re concerned, it’s just a bunch of rowdy, drunken motorcycle guys,” Flanagan told Military Times. “But maybe they’re not.”

Maybe it’s the opening salvo of something more nefarious. The gangs are followed by cyber attacks on local infrastructure or riots by ethnic Russian populations who were spurred to action by disinformation online. Estonian officials move to ease the unrest, but every action is met with more propaganda that paints the government as incompetent, weak and attempting to harm Russophone peoples.

In no time, the Kremlin announces that it will provide support to Estonia’s ethnic Russians.

× Fear of missing out? Sign up for the Early Bird Brief - a daily roundup of military and defense news stories from around the globe. Thanks for signing up. By giving us your email, you are opting in to the Early Bird Brief.

Satellite images of Russian military operations during Vostok 2018 1 of 5 A collection of satellite images of Russian military maneuvers during Vostok 2018, a large-scale training exercise. Russia could initiate a short-warning attack following a large conventional force exercise or a snap exercise, both of which have become more frequent in recent years. (Satellite image ©2019 Maxar Technologies) 2 of 5 A collection of satellite images of Russian military maneuvers during Vostok 2018, a large-scale training exercise. Russia could initiate a short-warning attack following a large conventional force exercise or a snap exercise, both of which have become more frequent in recent years. (Satellite image ©2019 Maxar Technologies) 3 of 5 A collection of satellite images of Russian military maneuvers during Vostok 2018, a large-scale training exercise. Russia could initiate a short-warning attack following a large conventional force exercise or a snap exercise, both of which have become more frequent in recent years. (Satellite image ©2019 Maxar Technologies) 4 of 5 A collection of satellite images of Russian military maneuvers during Vostok 2018, a large-scale training exercise. Russia could initiate a short-warning attack following a large conventional force exercise or a snap exercise, both of which have become more frequent in recent years. (Satellite image ©2019 Maxar Technologies) 5 of 5 A collection of satellite images of Russian military maneuvers during Vostok 2018, a large-scale training exercise. Russia could initiate a short-warning attack following a large conventional force exercise or a snap exercise, both of which have become more frequent in recent years. (Satellite image ©2019 Maxar Technologies)

A Russian force of more than 20 battalions attempts to capture the Latvian and Estonian capitals in an effort designed to collapse NATO cohesion. A smaller Russian force is launched from Belarus and Kaliningrad to support an attack on Lithuania and close the Suwalki Gap, blocking NATO reinforcements from Poland.

As Moscow’s forces descend on the Baltic states, Latvian, Lithuanian and Estonian officials mobilize conventional forces, but they understand the Russians can’t be held off permanently. The fight will need to transition to a resistance movement eventually.

“Baltic Special Operations and National Guard and Defence League units, in support of conventional forces, aim to delay the Russian advance by destroying key transportation infrastructure such as bridges, and attacking Russian forces at chokepoints; they also serve as JTACs for U.S. and NATO air strikes,” the Rand study’s authors wrote. “Behind the advancing Russian troops, lightly armed local forces ambush Russian reinforcements and logistics troops and report Russian force movements to Baltic and NATO command centers.”

Estonian and American JTACs conduct a show of force with an A-10 Warthog in Salina, Kan., Dec. 13, 2017. (Staff Sgt. Tyler Woodward/Air Force)

The study, which was supported by the Pentagon and conducted within the federally funded Rand National Defense Research Institute, devised a multitude of scenarios under which Russia could interfere in the Baltic states — ranging from attacks below the threshold of armed conflict to flagrantly annexing land of neighboring states.

The worst case scenarios are unlikely, Flanagan said.

“Our general assessment is we don’t believe, and many of the Baltic leaders don’t believe, that the Russians would make a land grab and sue for piece,” Flanagan added. “But they are opportunistic. If they think they can cause a crisis in NATO and make NATO look feckless or unable to respond quickly, that may be something they would risk.”

Fusing the alarms

The Ukrainian conflict spurred the Baltics into action, as Lithuania, Latvia and Estonia embraced the concepts of total defense and unconventional warfare, the Rand study found. A combination of active-duty, national guard and reserve-styled forces have been refined in the three Baltic countries over the past few years, each with different missions to resist Russian aggression and even occupation.

To solidify those gains, the U.S. and NATO should look at taking further steps to support the Baltic countries by providing more advanced equipment, refining resistance plans, developing fusion centers for intelligence collection and countering Russian information and cyber warfare, the study said.

If the conflict were to start with oddities like Russian motorcycle gangs, fusion cells could be key, according to Flanagan.

NATO already has a Comprehensive Crisis and Operations Management Center, or CCOMC, which monitors intelligence collection. Integrating that even more with the civil, police and military reporting structures of the Baltic states could build the full picture of an evolving threat before it’s too late.

“As we saw in the Ukraine crisis, sometimes the initial reports of Russian military moves came from social media before it perked up on intelligence,” Flanagan said. “One of the things that needs to be looked it is how to make sure those initial probes and attacks are lashed up so you can respond effectively.”

NATO’s CCOMC monitors intelligence information to identify emerging crises and develop response plans. The center does have liaison officers from the European Union, but increasing information exchanges with the EU Intelligence Analysis Centre and national civil authorities could strengthen early warning even more, according to the study.

At the 2016 Warsaw Summit, NATO leaders acknowledged that hybrid warfare threats, like those seen in Ukraine, could trigger collective defense obligations. However, hybrid warfare often taps into minority group grievances within a country, making it difficult to separate from traditional civil unrest.

No more ‘leaflets and loudspeakers’

Russia has caused chaos in the Baltics before. In 2007, the Estonian parliament decided to relocate a World War II memorial statue and the remains of some Soviet soldiers from the capital city of Tallinn to a military cemetery outside the city.

The move triggered rioting in the capital city and waves of cyber attacks against Estonian government and banking websites, as well as condemnation by Moscow.

The sophistication of Russian information warfare has only grown, the Rand study warns. However, a repeat of the Crimea or Donbas scenarios is seen by most Baltic officials and analysts as highly unlikely.

Russian propaganda in the Baltics is aimed at Russophone populations, much like it was in Ukraine’s eastern Donbas region. However, the ethnic Russians in the Baltics tend to be more loyal to their national governments than those in Ukraine were, Flanagan said.

“But I do think the Russians are opportunistic and I do think they will continue to prepare the ground,” he added.

Even if only a small minority were moved to action by Moscow’s propaganda, that might be enough to provide a pretext for Russian intervention, according to the Rand study.

Another example of what this could look like was captured in June, when a blog post made to look like a popular Lithuanian news outlet claimed U.S. Army Stryker vehicles killed a local child in a road collision. A doctored image was posted online showing unconcerned soldiers near a crushed bicycle and child’s corpse.

SOCOM needs to step up its propaganda game, Pentagon deputy says The Pentagon is pushing it’s special operations forces to move beyond the traditional leaflets-and-loudspeakers approach to information warfare, a senior Pentagon official said this week.

“This is a very typical example of the hostile information, and proves we are already being watched,” Lithuanian Defense Minister Raimundas Karoblis said of the fabricated event during a June 8 meeting with NATO officials. “We have no doubt that this was a deliberate and coordinated attempt aiming to raise general society’s condemnation to our allies, as well as discredit the exercises and our joint efforts on defense strengthening.”

The recent Rand report said the U.S. and other NATO allies could participate in this information war, as well, especially in the event of an active Russian incursion.

In the past, influencing operations have disseminated information through radio and television. But 21st-century messaging requires social media and innovative tactics, such as pushing persistent cellular service into denied areas, developing equipment that can analyze social media comments quickly and fielding automated translation technology.

After raiding an objective, Lithuania special operations forces are exfiltrated on U.S. Army UH-60 Blackhawk helicopters during Exercise Flaming Sword in Panevėžsy, Lt., May 19, 2016. (Army)

“We need to move beyond our 20th century approach to messaging and start looking at influence as an integral aspect of modern irregular warfare,” Andrew Knaggs, the Pentagon’s deputy assistant secretary of defense for special operations and combating terrorism, said at a defense industry symposium in February.

Each armed service has elements that work to influence local populations, including Army psychological operations and civil affairs units and Marine military information support operations, or MISO. But it is U.S. Special Operations Command that fields a unique, trans-regional MISO capability.

The Joint MISO WebOps Center is operating today, and acts in close coordination with the State Department’s Global Engagement Center to deliver messages that counter propaganda from both state and non-state actors.

“The WebOps Center supports the combatant commands with improved messaging and assessment capabilities, shared situational awareness of adversary influence activities, and coordinated internet-based MISO globally,” Army Gen. Richard D. Clarke, SOCOM commander, told the Senate on April 9. “We remain on track to achieve Full Operating Capability by the end of FY 2025.”

That sort of messaging provides an alternative for Russophone peoples who would otherwise primarily consume Russian language media and news.

Were a Baltic nation to be overrun by Russian aggressors, psychological operations would remain critical, but U.S. and NATO forces would become even more so. The preparation for such a scenario has already been rejuvenated under the European Deterrence Initiative — a multi-billion dollar defense welfare program started in 2014 as a response to Russia’s annexation of Crimea.

Tangible support: MANPADS, ATVs and JTACs

U.S. Army Green Berets have been training Baltic special operations and national guard forces in unconventional warfare, while U.S. Air Force Special Tactics troops have been conducting close-air support training with their Baltic counterparts and practicing unique skill-sets, like landing fighter aircraft on abandoned highways.

The Pentagon has also been making infrastructure improvements to installations such as airfields, training centers and ranges in Eastern Europe that will improve NATO readiness and staging operations in the case of conflict.

These are just some of the preparations necessary to hold off a Russian onslaught in the event of a combined pincer maneuver from Kaliningrad and Russia’s Western border. That assault, while unlikely, could hypothetically follow mounting regional tensions and a Russian snap exercise along the Baltic states’ borders, according to the Rand study.

Ideally, civilian cells would organize, motivated by communications channels that allow government officials to broadcast messages encouraging a total defense and whole-of-society approach to holding off the Russians.

Much of the U.S. military’s training and support has already focused on building out Baltic partners capable such an undertaking.

“We are arguing that that should be both continued and expanded," Flanagan said.

U.S. Air Force Special Tactics troops train with A-10 Thunderbolts in the urban setting of Rakvere, Estonia, during a 2017 training trip. (AFSOC)

Providing secure tactical radios and satellite phones, digital cameras and rugged laptops, all-terrain vehicles, small arms, demolitions, anti-tank guided missiles and man-portable air defense systems helps to build out that capability, the Rand study says. Those supplies could then be cached inside decentralized stockpiles to sustain resistance cells in case of war.

Higher-end equipment like MANPADS and ATGMs would be allocated to Baltic special operations forces who would be responsible for ambushing tanks, raiding enemy headquarters and rescuing captives. Lower-end units would be used to ambush convoys, raid less defended outposts and conduct sabotage.

“In Lithuania, for example, they have something called the Rifleman’s Union, which is really a group of hunters who are also ready to support national defense in a time of conflict," Flanagan said. "Those folks are trained in lethal weapons and are available to support what we call a lower-end violent action squad.”

Civilians would contribute under this model of total defense as well by collecting intelligence, providing supplies and sheltering casualties. Even non-violent actions such as producing information operations materials and performing civil disobedience would be critical, the Rand study said.

Further developing resistance and paramilitary units has “the potential to delay and disrupt Russian military aggression against the Baltic states, and to make occupation of a Baltic state very costly to the invading forces, thereby enhancing deterrence,” the authors wrote. “These techniques and forces could also support a NATO liberation campaign.”

Eventually, NATO forces would conduct a counterattack. All the while, the resistance campaign would have made occupation of the Baltics untenable.