Foreign interference, or what the EU now calls FIMI (foreign information manipulation and interference), has a multifaceted toolkit. In addition to information manipulation, ASD has identified cyber operations, economic coercion, malign finance, and civil society subversion as tactical tools authoritarian actors use to undermine democracy. Since 2018, ASD’s Authoritarian Interference Tracker (AIT) has documented Russia’s and the People’s Republic of China’s (PRC) use of these tools in more than 40 countries across the transatlantic community. Yet FIMI operations have evolved since ASD first developed its methodology, and recent trends dictate that the AIT must evolve to include a new tool: kinetic operations.

Europe in particular has seen a growing number of cases involving state-directed orchestrated violence and physical disruptions—acts of sabotage and assassination attempts, among others—to intimidate individuals and destabilize democracies. To capture this reality, the AIT’s methodology has been expanded to include kinetic operations, defined as “the deliberate use of—or credible threat to use—physical violence and/or physically disruptive actions to undermine security, damage confidence in democratic governance, and/or destabilize democratic society.”

This growing use of kinetic operations challenges existing security protocols and raises urgent questions about how democracies should respond. Countering these tactics requires more intelligence-sharing between European democracies, stronger legal frameworks, and targeted sanctions to deter perpetrators while protecting democratic institutions.

Kinetic Operations in Practice

Kinetic operations represent a dangerous escalation in the playbook of authoritarian state-sponsored interference in democracies. A recent Wall Street Journal report on Russia’s new spy unit, the Department of Special Tasks (SSD), within the country’s military intelligence underscores this shift. In the recent past, Moscow’s kinetic operations mostly targeted political opponents and former intelligence operatives, as well as fomented instability in neighboring countries like Ukraine and Moldova.  However, since its full-scale invasion of Ukraine in 2022, Russia has broadened its scope to go after the supporters of Ukrainian resistance across Europe. The attempted assassination of Rheinmetall’s CEO in Germany in July 2024 illustrates this new phase of Russian aggression. That operation, aimed at a figure central to Europe’s defense industry, clearly demonstrates Russia’s expansion of what it views as acceptable targets of state violence.

Russia’s use of incendiary parcels that caught fire prior to being loaded on cargo planes in Germany, Poland, and the United Kingdom and the failed arson attack on a bus depot in Prague further highlights the Kremlin’s willingness to place civilians in harm’s way to sow chaos in democracies—and to exact retribution against adversarial countries that are supportive of Ukraine. These incidents, as well as a growing number of vandalism campaigns in major European cities, signal a stark shift from remote operations conducted primarily online to acts of physical aggression that foster a broader sense of fear and insecurity in democratic societies.

Beyond the cases publicly attributed to Russia, there is mounting evidence that those incidents are only the tip of the iceberg. The severing of undersea internet cables and other major acts of sabotage remain unattributed, but the Kremlin remains a likely culprit. These attacks on infrastructure point to a broader, more insidious campaign designed to gradually weaken Western resolve.

The PRC also deserves a mention, though its approach to kinetic operations has differed from Russia’s. PRC state actions still largely focus on the harassment of dissidents and diaspora communities beyond its borders. These measures are undoubtedly oppressive and designed to silence both perceived enemies of the state and organic civil society voices abroad, but the PRC has yet to mirror Russia’s reckless tactics to deliberately put random civilians in harm’s way.

Trend Analysis

Kinetic operations feed into the destabilization campaigns that authoritarian states have been waging on democracies for years. For example, Russian state-sponsored information manipulation campaigns, amplified by proxies it covertly finances, have long fanned the flames of fragmentation in democratic societies. Kinetic operations add another layer of turmoil by heightening real-world fear, a condition that authoritarian states can then exploit to wage further FIMI campaigns. In this climate of uncertainty, vulnerable individuals become more susceptible to radicalization and disillusioned groups are more easily recruited for destabilizing activities, potentially creating a vicious cycle of destabilization.

Recent Russian kinetic operations in Europe also highlight the Kremlin’s ability to adapt. Due to the mass expulsion of Russian diplomats in 2022, Russia’s embassies and consulates throughout the EU became short-staffed. Pre-2022 kinetic operations relied primarily on Russian intelligence officers to carry them out, and they often used serious weapons that the Russian state provided like radioactive materials and nerve gas. In contrast, after the 2022 expulsions and a reduction of the Russian intelligence presence in the EU, there emerged a clear trend of using proxies and hired operatives, including petty criminals who are not Russian nationals. These proxies are tasked to start fires, vandalize cars, and spray divisive symbols on city buildings. This shift, notably highlighted in the latest yearly threat assessment by Estonian intelligence, complicates attribution and allows the Kremlin to maintain operational flexibility while avoiding direct state accountability. Combined with the founding of the SSD, this innovation in recruitment and execution indicates that kinetic operations are likely to be an increasingly prominent tool Russia uses to conduct FIMI campaigns.

Conclusion

Kinetic operations represent a significant evolution in authoritarian interference, and the establishment of Russia’s SSD confirms that these operations are now a central element of Moscow’s hybrid warfare against democracies. When combined with other FIMI tools like cyber operations and information manipulation, these physical acts of aggression not only threaten critical infrastructure and public safety but also erode public trust and deepen societal divides.

To safeguard democratic institutions, Europe and its allies must adopt a robust, multi-layered response. This includes enhancing intelligence sharing, strengthening attribution capabilities, updating legal frameworks, and imposing targeted sanctions. Moreover, deepening public-private and international collaborations is essential to build resilient infrastructure defenses against state-sponsored kinetic operations and related hybrid threats. Only through such a comprehensive strategy can Europe hope to push back against actions that can at times be characterized as acts of state terrorism and preserve the integrity of open, democratic societies.

The views expressed in GMF publications and commentary are the views of the author alone.