By: Noah Azzouzi
‘Russia is waging a shadow war against the West.’ This warning, repeated by Kaja Kallas, as well as other European officials and intelligence analysts, reflects growing alarm over the Kremlin’s hybrid operations across Europe. This ‘war’ is unusual in that there is no formal escalation, no clear declaration, and no generally recognised battlefield. The Kremlin’s strategy is not to invade, but to paralyse, by fragmenting European unity, reshaping the information space, and weaponising uncertainty long before the continent can organise an effective deterrent. This strategy is bearing fruits as incidents, from sabotage of undersea pipelines and disinformation to digital incursions and electoral interference, are met with suspicion and speculation, but rarely with coordinated, decisive response. The result? Strategic hesitation, which Moscow exploits with increasing sophistication. And it’s not just Moscow. Beijing, Pyongyang, and Tehran too are increasingly resorting to ambiguous operations while denying involvement.
With the integration of technology into national security strategies, covert action has transformed significantly. Unlike traditional covert operations, covert cyber-enabled operations now allow states to pursue political objectives remotely, instantaneously, at scale, and under the radar. At the heart of these actions is the concept of plausible deniability; the ability to carry out such actions without being held accountable. In the digital age, however, this concept is under pressure as it becomes increasingly difficult to convincingly deny involvement. So, the question is whether plausible deniability still defines covert action in the cyberspace, or whether we have entered a new era where ambiguity and controlled disclosure matter more than secrecy. Understanding this shift is crucial to understanding how democracies must respond to such uses of modern power.
Covert Action, Secrecy and Deniability
Used to quietly shape political, economic, or military conditions abroad without leaving clear fingerprints, covert operations allow states to manipulate political environments, control narratives and destabilise adversaries under a cloak of ambiguity, especially when intervention is too costly, politically risky, or likely to provoke escalation. Sitting between diplomacy and military intervention, they cover a wide range of activities, including disinformation campaigns, election interference, insurgency support, and targeted assassinations, all directly serving states’ foreign policy goals.
Historically, the success of covert operations hinged on secrecy and non-attribution, the intentional concealment of involvement, which allowed states to deny responsibility and shield themselves from political fallout, international backlash, or legal consequences. Over time, this imperative for secrecy and deniability was formalised in the doctrine of ‘plausible deniability’, following its official articulation by the U.S. National Security Council in 1948. For decades, success was simplistically binary: hidden meant successful, exposed meant failure. Yet, history tells a different story. Many covert actions eventually came to light, revealing that exposure is often inevitable, including UK’s experience in Yemen and Indonesia in the 1960s or the failure of the Albanian operation (BGFIEND/Operation Valuable, 1949-1954). Faced with this reality, secrecy was gradually seen as just one piece of the puzzle. The real measure of success lies in achieving strategic objectives and operational feasibility, as well as maintaining political legitimacy, even when secrecy is impossible to sustain. A clear case in point is the Stuxnet cyberattack on Iran’s nuclear program. Although the attack was quickly attributed to the U.S. and Israel, it nonetheless resulted in a significant impairment of Iranian capabilities, proving that effectiveness outweighs discretion.
The Rise of Implausible Deniability in the Digital Age
Traditionally, plausible deniability was a strategic asset with several functions. First, it helped reduce the risk of immediate retaliation and escalation. If no state could be clearly blamed, the pressure to respond was weakened. Second, the mere possibility of involvement created deterrence and signalled strength without inviting full confrontation. Third, it provided a legal buffer to avoid accusations of violating international law or norms. Finally, when conducted in support of allies and partners, concealing the role of the principal helped protect those involved from political consequences, legal scrutiny, or reputational damage. Together, these advantages made deniability a powerful foreign policy tool. A classic example is the CIA’s interventions in Iran in 1953 and Guatemala in 1954. In both cases, Washington orchestrated regime change through local actors, psychological operations and disinformation campaigns, while officially maintaining distance and denying any involvement. However, plausible deniability is losing its edge in the digital. In fact, attribution is now increasingly rapid, not in spite of secrecy, but because of it. In contrast to traditional cover actions, cyber operations are larger in scale, increasing the likelihood of attribution, particularly due to the expansion of involved actors, investigative journalism, OSINT, leaks, and international real-time intelligence-sharing. In cases such as the NotPetya malware campaign (2017), the DNC Hack (2016), and Operation Ghostwriter (2017-2021), which all began as covert cyber operations, official denials were issued, but faced diminishing credibility as they were quickly linked to state actors due to expanding investigative capabilities. Attribution is thus no longer a remote possibility; it’s often just a matter of time.
To adapt to the growing difficulty of maintaining plausible deniability in the digital age, some states now rely on implausible deniability. Instead of concealing involvement, they flood the information space with conflicting narratives, sowing enough confusion to delay retaliation or weaken unified response. Russia has mastered this approach, turning weak or contradictory denials into deliberate tools of ambiguity, rather than just as a defensive posture. For example, following the 2007 DDoS cyberattacks on Estonia, with forensic traces pointing toward the Kremlin’s involvement, Moscow neither confirmed nor denied responsibility, and issued ‘non-denial denials’ and ‘non-comments’. This playbook is now central to Russia’s hybrid operations across Europe, blurring the lines so much that it is difficult to justify a direct response, until the damage has been done. Similarly, Beijing issues blanket denials, which are sweeping refusals to acknowledge any wrongdoing, or blames rogue patriotic hackers when evidence piles up about cyber operations linked to Chinese actors. Unlike Moscow’s chaotic, performative ambiguity, China’s strategy tends to maintain a disciplined deniability, carefully distancing the state from the operation in order to avoid economic and diplomatic escalation.
A key enabler of implausible deniability in the digital age is the growing use of non-state proxies, be they hacking groups like Russia’s APT29 or Iran’s APT33 and APT34, or troll farms like Russia’s Internet Research Agency or China’s ‘50 Cent Army’. Operating in a gray zone, whether independently or with state approval, funding, or coordination, these actors offer governments a buffer against direct attribution. Yet, their involvement makes attribution likely, if not inevitable. As a result, states are no longer aiming for believable denial, but for delayed accountability by buying time, sowing doubt, and complicating retaliation. By outsourcing actions and keeping distance with such actors, states implausibly deflect accusations. In this way, implausible deniability relies not only on clever messaging, but also on deliberately created opacity in the chain of command that clouds accountability.
Out of the Fog: A Democratic Playbook for Winning the Grey Zone
In today’s strategic competition, below the threshold of armed conflict, secrecy, once essential to plausible deniability, is increasingly replaced by ambiguity, the cornerstone of implausible deniability. Unlike secrecy, ambiguity does not protect those involved from exposure, but from the consequences. And the implications are profound. Without irrefutable evidence, traditional attribution metrics cannot keep pace and response mechanisms are too slow. Waiting for the ‘smoking gun’ is no longer tenable. To adapt, democratic governments must rethink how they define and respond to covert threats. Successful attribution of deliberately muddled signals will depend not only on finding out the truth, but also on how to respond when truth is obscured.
Building Whole-of-Society Resilience
Framed as campaigns against the fabric of society, hybrid threats are deliberately designed to exploit vulnerabilities across society (infrastructure, media ecosystems, universities and supply chains), not just the government. As such, resilience cannot remain the sole responsibility of the state. It must extend to society as a whole. This is the logic behind Phase 0 of the total defence model: shaping the environment, deterring aggression, and preparing the population before a crisis erupts.
Figure 2 – Total defence objectives for phases 0/I and IIA, revisited from Flanagan et al. (2019, p. 15)
In this phase, the objective is not only to raise the cost of aggression, but to deny adversaries the openings they seek to exploit: public confusion, institutional fragmentation, social disunity. Finland’s total defense and Sweden’s civil preparedness frameworks exemplify this approach, systematically integrating civilians, private sector actors, and institutions into national security planning strategies well before conflict. So, within Phase 0, civil society plays the mission-critical role of building psychological resilience, defending the information space, and sustaining social cohesion. In this context, non-violent resistance, strategic communication, perception management, and trust-building are not peripheral activities, they are frontline tools of national defence. Importantly, this demands a shift in the intelligence culture. To strengthen early detection and societal resilience, democratic governments should institutionalize intelligence co-production within open-source ecosystems. Civil actors, including investigative journalists, academic researchers and cybersecurity companies, already play a leading role in exposing hybrid interference. Unlike autocracies, which rely on centralized, state-linked proxies, democracies can turn their decentralization and pluralism into strategic assets. When rapidly activated and structurally supported, this networked agility acts as a force multiplier, not a liability.
Conclusion
In today’s hyper-connected world, secrecy has become fragile and even short-lived. Denying involvement of cyber-enabled covert operations is no longer realistic. In fact, being caught is not a failure, it is often expected. But rather than abandoning covert action, disruptors have evolved their playbook, not by hiding better, but by changing what denial is meant to achieve. Instead of plausible denial, implausible denial is now the norm; a strategy not aimed at persuasion, but at sowing just enough doubt to keep opponents off balance, divide democratic societies from within, and plunge them into a fog of uncertainty.
To compete in the cyber-enabled gray zone, democracies need to rethink not only how they identify threats, but also how they respond to them. The point being not to eliminate ambiguity, since that’s impossible, but to undermine its strategic utility as a weapon. This means that covert operations in cyberspace must be more expensive to conduct, quicker to reveal and harder to justify. This effort begins with investments in societal resilience, civil preparedness and decentralized resilience networks, to dilute the value of ambiguity and impose friction on adversaries operating in the shadows. At the same time, democracies must also invest in the co-production of intelligence. Indeed, the role played by investigative journalists, cybersecurity researchers and academic institutions in identifying and exposing state-sponsored interference faster than centralized institutions are often able to do is crucial. By integrating civilian actors into national security planning, agile, distributed and anticipatory response mechanisms to hybrid threats can be put in place. Ultimately, a whole-of-society resilience strategy is not a defensive shell, but a forward-looking framework for regaining control of the gray zone. Only then, by turning openness and pluralism into operational assets, will democracies be able to protect themselves from manipulation and define the rules of engagement for the age of occult power.