Effective Counter Unconventional Warfare

The 2019 ARIS study Fostering Effective Counter Unconventional Warfare/Occupation set out to answer a question that the war in Ukraine, the 2014 annexation of Crimea, and the cyber assault on Estonia in 2007 had already made urgent: how can a state on Russia’s strategic periphery prepare to resist aggression that arrives below the threshold of conventional war? The study’s authors, working at the Johns Hopkins University Applied Physics Laboratory for US Army Special Operations Command, drew on three decades of post-Cold War Russian operations and a longer arc of Soviet occupation to build a counter-unconventional warfare framework. Their findings reframe deterrence as a civilian and societal problem, not just a military one.

This article distills the study’s core arguments and pulls forward the thirteen findings that close it. For practitioners and informed readers tracking hybrid threats in 2026, the document remains one of the clearest unclassified statements of what counter-UW preparation actually requires. The full ARIS PDF is linked at the end of this piece and lives on the ARIS resource page.

What the study set out to do

The authors framed the study as two related problems rather than one. The first is resisting unconventional warfare itself, the kind of campaign that combined non-kinetic and kinetic operations to coerce Kyiv, foster proxies in the Donbas, and seize Crimea. The second is preparing for outright military occupation, the older problem that Eastern Europe lived through from 1939 to 1991. The two scenarios call for different responses, but they share a pre-conflict preparation phase, and that phase is where the study concentrates.

The methodology is deliberately historical and deliberately abstracted. Latvia’s guerrilla resistance against Soviet occupation provides one analytical anchor. Poland’s Solidarity movement provides the other. The two cases are chosen because they represent the two principal modes of resistance against the Soviet system: armed insurgency in the forests, and nonviolent populist mobilization in the cities. To translate those lessons into actionable preparation guidance without fixating on any single real country, the authors construct a fictional Baltic state, the Republic of Northaria, and run the full counter-UW framework against it. That move converts the historical findings into a practitioner workbook rather than a comparative history.

The Russian regime: modality, not master plan

Before turning to resistance, the authors map what they are resisting. The framing matters, and the study is unusually candid about it. Russian foreign policy under Putin, the authors argue, is best understood as reactive rather than expansionist. Sergey Markedonov of Russian State University, cited at length in the introduction, describes a Kremlin that responds to crises rather than executing a long-running master plan; scholars at the Johns Hopkins Applied Physics Laboratory describe the same posture as a “modality” rather than a strategy. Three categories of event trigger Kremlin reactions: provocation from the West, spontaneous local uprisings, and domestic pressure inside Russia. The First Chechen War traces to the Muslim invasion of Dagestan. The 2008 Georgia intervention traces to Tbilisi’s attempt to restore sovereignty over South Ossetia. The 2014 Ukraine crisis traces to Yanukovych’s volte-face on EU integration. Each was reactive in origin, even where the response was disproportionate.

What stays stable across those reactions is a set of four enduring objectives. Stability within the Russian Federation. Protection of the Putin regime. Russia’s prestige and respect abroad. And the prevention of further NATO and EU expansion into what Moscow considers its strategic periphery. Those four priorities are the constants. The instruments change with the crisis.

The authors are equally candid about how power is organized inside Russia. National power rests on three tightly interwoven pillars: government bureaucracy, big business (state-owned or run by Putin-aligned oligarchs), and the intelligence services. A fourth informal pillar, organized crime, runs through all three. The siloviki, Putin’s closest associates drawn largely from KGB and FSB backgrounds, dominate the structure. Super-wealthy oligarchs run major corporations, serve as government ministers, and maintain connections to criminal networks simultaneously. The system is not a state with corruption around the edges; corruption is the architecture. That fact has direct operational consequences for any country trying to prepare against it, because every Russian instrument of foreign pressure draws on all four pillars at once.

The non-military toolkit

Most of the Russian playbook operates below the threshold of war. The study catalogues the non-military instruments in detail. For broader context on how these tools fit together, see the TRH pillar guide on hybrid warfare.

Working with criminal elements abroad

Russian organized crime operates throughout the former Soviet Union, Western Europe, North America, Latin America, and the Caribbean. WikiLeaks cables released in 2010 accused Russian intelligence of arms trafficking and operational coordination with criminal networks in Spain. Interpol has documented the movement of Russian criminal organizations including Podolskaya, Tambovskaya, Mazukinskaya, and Izmailovskaya into Mexico. The model is simple. Agents provide money and intelligence support. Criminal networks perform tasks. Plausible deniability is preserved.

Funding extremist political parties

Unlike Cold War political meddling, contemporary Russian influence operations are not ideological. Moscow has supported both left-wing and right-wing populist parties across the EU. Jobbik in Hungary, Golden Dawn in Greece, the Northern League in Italy, and the Front National in France have all benefited from loans originating in Russian banks. Russia Today has run programming sympathetic to particular figures and causes in the United Kingdom. The intent is not to elect a specific Russian-aligned coalition; it is to degrade political coherence in target states and create disaffected factions for Moscow to exploit.

Economic coercion, propaganda, and espionage

Energy supply and sovereign debt remain the cleanest economic levers. The study uses the November 2013 Ukrainian-Russian Action Plan as its canonical example: a one-third gas price cut combined with a $15 billion bond purchase, deployed to keep Yanukovych in Moscow’s orbit. White, gray, and black propaganda runs across media, with civil agitation campaigns added when amplification is needed. The SVR (Foreign Intelligence), GRU (Military Intelligence), and FSB (internal security with foreign reach) run espionage operations across the periphery and beyond, gathering diplomatic leverage and seeding disinformation. The intelligence services are the connective tissue across the entire non-military toolkit.

Fifth columns and cyberwarfare

The study describes fifth columns as networks that agitate in support of Kremlin policy in peacetime and evolve into military proxies in wartime. Cyberwarfare follows a similar dual-use pattern. The April 2007 distributed denial-of-service campaign against Estonia, triggered by the relocation of a Soviet war memorial in Tallinn, set the template: three weeks of attacks against government, banking, parliamentary, and media systems, never legally attributed but widely understood as Kremlin-coordinated. In 2008 Russian cyber operations against Georgia rerouted news servers to Russian infrastructure to shape coverage of the war. From 2014 onward Ukraine became the proving ground for offensive cyber against critical infrastructure. The pattern is consistent: cyber operations are not an auxiliary effort, they are a primary instrument used in coordination with everything else.

The military toolkit and escalation dominance

The military instruments scale upward from highly deniable to undeniable. SPETSNAZ deployed in uniforms without insignia (the “Little Green Men” of Crimea) sit at the deniable end. Paramilitary proxies like the Night Wolves motorcycle club, Chechen militias, and Cossack volunteer units add deniable mass. Infiltration of military supplies under humanitarian-relief cover keeps proxies armed. Battalion tactical groups crossing the border with persistent Russian denial of their presence sit further up the escalation ladder. Full-scale invasion sits at the top as an implied threat.

The organizing concept that ties the military and non-military instruments together is escalation dominance. Russia seeks to demonstrate its ability to escalate faster and harder than any plausible target state could respond. The intended effect is deterrent: every step the target considers taking against Russian non-military pressure is shadowed by the implicit threat of Russian conventional escalation. NATO membership solves the escalation-dominance problem in theory, but the study notes that Putin’s regime continues to test the alliance precisely to prove that disunity and lack of resolve nullify the Article 5 guarantee in practice.

The study draws six post-Cold War cases to illustrate the pattern’s evolution.

Read across the column on the right, the table tells a single story. Each operation taught Moscow something the next operation refined. By the time Russian forces appeared in Crimea in early 2014, the playbook had matured into a coherent doctrine that combined proxy operations, plausible denial, information warfare, cyber operations, and political preparation of the target population. The TRH analysis of the 1991 events in Lithuania picks up the earliest entry on the table in greater detail.

Two modes of resistance: Forest Brothers and Solidarity

The historical heart of the study is the comparison between Latvian armed guerrilla resistance after 1944 and Polish nonviolent populist resistance from 1956 onward. Both movements lasted decades. Both faced the same adversary. Both drew on deep wells of national identity. They produced very different outcomes.

Latvia’s Forest Brothers fought a sustained partisan war against Soviet reoccupation through the late 1940s and into the mid-1950s. They had genuine popular sympathy, knowledge of the terrain, and a tradition of independence reaching back to 1918. They also had no realistic path to victory. Soviet intelligence services penetrated the partisan networks at every level, manufactured false resistance organizations to lure fighters into ambushes, and used mass deportation to break the rural communities that sustained the guerrillas. By 1956 the armed resistance was effectively dead. National independence eventually came through other means, four decades later.

Poland’s path ran through the cities and the workplaces. The trajectory began with the 1956 Poznan protests and the broader October crisis that brought Władysław Gomułka to power on a wave of de-Stalinization. The 1970 shipyard strikes in Gdansk, the 1976 protests at Radom, and the formation of the Workers’ Defense Committee (KOR) in September 1976 created the organizational substrate. KOR provided legal aid, medical aid, and family support to workers persecuted by the regime; it also produced an underground press that linked the intelligentsia to the workers for the first time in the post-war period. Karol Wojtyła’s election as Pope John Paul II in October 1978 gave the movement a moral architecture and a mass audience that no security service could fully suppress. The 1980 Gdańsk strikes under Lech Wałęsa produced Solidarność as an independent trade union with ten million members at its peak. Martial law in December 1981 drove the movement underground, but the substrate held. By the late 1980s Solidarity had pulled the regime to the Round Table negotiations, and by 1989 communism in Poland was finished. The contrast with Latvia is the study’s central historical lesson, and it sits inside finding number four below.

For a deeper treatment of the mechanics behind populist mobilization that made Solidarity possible, see TRH on resistance mobilization and the comparative literature on nonviolent resistance. The single most important quantitative work in this field, Erica Chenoweth and Maria Stephan’s Why Civil Resistance Works, found that between 1900 and 2006 campaigns of nonviolent resistance were more than twice as effective as their violent counterparts in achieving their stated objectives. The ARIS finding is consistent with that broader empirical record.

The Gladio caution

Chapter 6 of the ARIS study addresses a problem that surface readings of counter-UW literature often skip past. During the early Cold War, NATO sponsored stay-behind networks in at least fourteen Western European countries, including neutral states such as Sweden, Switzerland, Finland, and Austria. The networks were designed for a specific contingency: in the event of Soviet conventional invasion, dormant cells would activate for sabotage, intelligence collection, and guerrilla operations against the occupier. American and British intelligence services were involved in their formation. The networks were kept secret from legislatures and from the public.

The cautionary lesson is what happened when the original mission lost relevance. As the prospect of Soviet invasion receded behind nuclear deterrence, some stay-behind networks reoriented from wartime preparation to peacetime political action. The most serious allegations attached to Italy’s “Operation Gladio,” which surfaced into public view in 1990 and gave its name to the entire stay-behind effort. Italian magistrates and a parliamentary investigation alleged links between Gladio operatives and a right-wing “strategy of tension” intended to attribute terror attacks to leftist groups. Similar allegations surfaced in Germany, France, and Belgium. The factual record remains contested, but the political damage was real. In November 1990 the European Parliament condemned the existence of stay-behind networks and called for their disbandment.

The study draws a careful conclusion. Pre-conflict resistance preparation is necessary. Pre-conflict resistance networks can drift, particularly when the threat environment changes and the original mission fades. The safeguard is redundant oversight by vetted officials across executive, legislative, and judicial branches. The historical record is clear that secrecy without oversight is unstable over time. This caution sits behind several of the closing findings.

The thirteen findings

The study closes with thirteen findings drawn from the historical record. The first ten focus on what a target state needs to do. The last three focus on the political and institutional architecture surrounding any resistance preparation. Each is reproduced here in condensed form. Read together, they form a counter-UW preparation framework for any state on the strategic periphery of an aggressive great power.

1. Independence depends on great-power patrons. The historical record of Eastern Europe shows that subject nations could not defend their freedom on their own. Counter-UW planning has to assume external support is part of the equation.
2. Insurgents and sponsors must align ends, ways, and means. Resistance groups typically have diverse internal objectives that degrade the insurgency. Sponsors with their own agendas can pull a movement off mission. Strategic alignment between resistance leadership and sponsoring states is foundational.
3. Insurgent contact with sponsors must reach above the intelligence services. Intelligence operatives may have purposes that diverge from those of their political leadership. Resistance leaders need direct contact at the head-of-state level, not just with case officers.
4. Nonviolent resistance has the better track record. The Latvian armed guerrilla movements ultimately failed to bring about change. The populist uprisings, culminating in Solidarity, were the most effective force in overturning communist rule. This finding deserves to be read carefully: it is empirical, not ideological.
5. Russian intelligence aims at infiltration. Soviet and Russian services have a long record of penetrating resistance movements, often with great success. Counter-intelligence and compartmentation are not optional.
6. Communications redundancy is vital. States subject to Russian aggression should ensure redundant communications: continued exposure of Russian activity, internet access, links to government in exile, links to the diaspora, and lateral links among resistance groups.
7. The Russian-speaking diaspora is a center of gravity. Russian compatriots can act as a fifth column, or they can spearhead the resistance. They must be viewed not only as a threat but as a potential resource, especially if successfully integrated into civic life.
8. Whole-of-society mobilization is decisive. Resistance survives only when all elements of society and culture are organized in support of it.
9. Balance deterrence and preparation. Visible national plans for resistance contribute to deterrence, but they must not communicate weakness or isolation.
10. Plans for resistance must not morph into extremism. Counter-UW measures cannot be allowed to become xenophobia, repression of political opponents, or terror. Transparent representative governance, coupled with law and order, is the best foundation.
11. Visa policy is a defensive instrument. States should withhold or withdraw visas for Russian diplomats and other agents who abuse their privileges or interfere in national politics.
12. Avoid political polarization. Russia targets disaffected political factions for anti-government propaganda. Political compromise, however distasteful, contributes to national integration and security against Russian aggression. This is one of the harder findings to operationalize in democratic systems where polarization itself is an electoral instrument.
13. Honor the Gladio lesson with oversight. Preparations for resistance must take place with redundant oversight by vetted officials across executive, legislative, and judicial branches. Preplanned resistance networks should remain clandestine but legal, with safeguards against misuse during peacetime political competition.

The numerical sequence matters less than the architecture. Findings 1–3 address sponsor relationships. Findings 4–8 address the design of the resistance itself. Findings 9–10 address the political signaling of resistance preparation. Findings 11–13 address the institutional safeguards around it. A real preparation plan touches all four layers.

Northaria: the framework operationalized

The most distinctive contribution of the ARIS study is its decision to translate the historical findings into a fictional case. The Republic of Northaria, a Baltic state bordered by Latvia, Estonia, and the Russian Federation, runs as a worked example across the entire appendix. The country has the demographic, geographic, and historical profile of a generic Baltic state: a parliamentary democracy established in 1990, a unicameral legislature called the Majvendi, a population that experienced fifty years of Soviet rule, and an ethnic Russian minority concentrated near the eastern border. The choice of a fictional country is deliberate. By abstracting the example, the authors avoid making the study read as policy advice to any single real government and produce something closer to a practitioner workbook.

The Northaria appendix walks through how each finding translates into actual preparation. Communications redundancy becomes specific infrastructure: backup internet routing through Nordic partners, ham radio networks among civic associations, pre-positioned media partnerships with international outlets. Whole-of-society mobilization becomes Northaria’s adaptation of the Nordic total-defense model: civilian defense leagues, structured volunteer reserves modeled on the Latvian Zemessardze, school curricula that include civic resilience training. The diaspora-as-center-of-gravity finding becomes a deliberate program of language access, civic integration, and counter-propaganda targeted at the Russian-speaking population, replacing the older instinct to treat the minority population as a security problem. The political-polarization finding becomes a set of rules for political party financing transparency and a public-broadcaster mandate to surface foreign influence attempts.

Northaria is fictional, but the playbook is not. The Latvian, Estonian, Lithuanian, Polish, Swedish, and Finnish total-defense programs that have matured since 2019 read as live implementations of the same architecture. For an adjacent treatment of how small states have built genuine resilience, see what large states can learn from small-state total defense strategies.

Why this matters in 2026

The study was written in 2019. The intervening years have validated almost every part of its threat model. The 2022 invasion of Ukraine demonstrated what happens when the unconventional toolkit fails to produce political results and Moscow reaches for conventional force. Below that escalation, the rest of the playbook has continued unabated.

The cable-cutting incidents in the Baltic Sea between November 2024 and early 2025 have become the most visible recent example. The damage to the BCS East-West Interlink and the C-Lion1 cable in November 2024, followed by the rupture of the Estlink 2 power cable and four telecommunications cables on Christmas Day 2024 by the Russian shadow-fleet tanker Eagle S, prompted the formation of NATO’s Baltic Sentry mission in January 2025. The Henry M. Jackson School of International Studies has documented roughly ten cable cuts in the Baltic since the 2022 invasion, with seven occurring in a single two-month window between November 2024 and January 2025; their analysis is available in their Baltic Sea Undersea Cable Security report. The picture is not unambiguous: a January 2025 Washington Post analysis reported that US and European intelligence officials now consider most of the ruptures to be the result of maritime accidents rather than directed sabotage. The competing assessments are themselves part of the ARIS picture, which is the point: a mature hybrid posture produces ambiguity, and ambiguity is the instrument.

The sabotage campaign on land is less ambiguous. In October 2024 the Director General of the United Kingdom’s Security Service, Ken McCallum, used a rare public address to state that “the GRU in particular is on a sustained mission to generate mayhem on British and European streets”, citing arson and sabotage incidents conducted “with increasing recklessness.” German and Polish intelligence services have publicly attributed a series of 2024 incidents to GRU-directed networks, including the July 2024 incendiary devices at DHL logistics hubs in Leipzig and Birmingham that Polish prosecutors have described as a dry run for similar attacks on cargo flights bound for the United States and Canada. Poland’s Internal Security Agency (ABW) reported in late 2024 that sabotage activity attributed to Russian special services had intensified across EU and NATO members.

The political instruments have if anything broadened. Reporting from the Carnegie Endowment, the European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE) in Helsinki, and the German Marshall Fund’s Alliance for Securing Democracy has tracked election-period influence operations across France, Germany, Romania, Slovakia, and Moldova. The patterns of political-party financing, energy coercion, and information operations identified in the ARIS study are now standard tools in the Kremlin’s external policy toolkit and have been adopted in modified form by other states; TRH covers a parallel toolkit operated by Tehran in the piece on Iran’s global irregular warfare apparatus.

What has shifted since the study’s publication is the recipient list. The 2019 framing focused on Eastern Europe, but the counter-UW architecture now reads as preparation guidance for a much broader set of states. The Resistance Operating Concept, developed by US Special Operations Command Europe with Baltic and Nordic partners and edited by Otto C. Fiala, builds directly on the framework summarized here, and TRH’s standalone piece on the ROC traces its operational implications in detail.

The ARIS study’s most uncomfortable finding, for many readers, is finding four. The historical evidence is clear that armed resistance against a determined occupier is the longer and bloodier path, and often the losing one. Mass nonviolent mobilization, organized through trade unions, churches, civic associations, and student networks, has the better record. That conclusion does not displace the need for an armed component in genuine occupation scenarios, and the study does not claim it does. It does, however, reorder the priorities of pre-conflict preparation. Civic infrastructure, communications redundancy, diaspora engagement, and societal cohesion belong at the top of the planning list. The kinetic toolkit sits further down. The 2019 ARIS authors saw that ordering clearly. The seven years since publication have only strengthened the case for reading it that way.

Further reading

The full ARIS study, Case Studies in Insurgency and Revolutionary Warfare: Fostering Effective Counter Unconventional Warfare/Occupation (Robert Leonhard et al., USASOC, 2019), is available on the ARIS resource page alongside the rest of the case study collection.

The Resistance Hub Staff

Articles published under The Resistance Hub Staff byline reflect a collaborative process that combines open-source research, human analysis, and AI-assisted drafting. Structured prompts and defined editorial theses guide the use of AI, but all content is reviewed, edited, and finalized by human editors with subject-matter expertise in irregular warfare, resistance studies, and critical infrastructure security. Reader contributions are also published under this byline, and identified in the article.

Editorial Policy →