At the June summit of the North Atlantic Treaty Organization, maintenance of support to Ukraine, the applications for NATO membership by Finland and Sweden, and the rollout of the new Strategic Concept will appropriately be front and center. But, if NATO is to maintain its long-term capacity for deterrence and defense, it will be equally important to take actions to implement four key operational priorities, each derived from initial lessons underscored by the Russia-Ukraine war. Specifically, effective deterrence and defense requires: upgraded force capabilities immediately focused on readiness and sustainability, and supported by the requisite funding; additional forward force deployments, including a substantial European component; enhanced cybersecurity resilience based on zero-trust architectures for critical infrastructures necessary for defense mission assurance; and long-term limitations on trade with Russia to limit its capacity to modernize its armed forces.
Force capabilities: Readiness and sustainment
As a starting point, it is important to recognize that almost all NATO nations, other than the United States, have—in the words of a recent European Union (EU) analysis—had “years of defence underspending, which has led to an accumulation of gaps and shortfalls in the collective military” capabilities.1
Most importantly in the context of the current environment, the “capacity to operate full-spectrum and at high intensity was neglected.”2 That neglect, and the concomitant need to focus on reestablishing the capacity for high-intensity battle, is well recognized by NATO military leaders. For example, France’s “Strategic Vision of the Chief of Defense Staff” specifically sets forth the requirement to be able to “respond…in a high-intensity conflict.”3 Yet, as a recent RAND report stated:
France’s capacity to sustain a high-end, conventional conflict nonetheless is limited. The French military might be able to accomplish all its assigned missions at once, but it lacks depth, meaning that such demanding operations would quickly exhaust both its human and material resources.”
Stephanie Pezard, Michael Shurkin, and David A. Ochmanek, “A Strong Ally Stretched Thin An Overview of France’s Defense Capabilities from a Burdensharing Perspective,” RAND, 2021, ix, https://www.rand.org/pubs/research_reports/RRA231-1.html.
What is true for France is similarly true for other European militaries, including—perhaps most importantly—Germany, which has suffered from years of underspending and strategic neglect. In addition, while operating at a different scale in terms of resources and reach, the US military itself is insufficiently prepared, in particular, in terms of its munitions and supply inventories for a sustained, high-intensity conflict. However, these deficiencies are entirely remediable if appropriate measures are taken.
The initial requirement for success in high-intensity conflict is, of course, simply to have sufficient weapons and support available. The EU analysis includes the need to “[r]eplenish stockpiles” among the “most urgent capability gaps.”4 Taking lessons from the Russia-Ukraine war, those stockpiles should include anti-armor capabilities and man-portable and medium-range air defenses, each of which adds to the maneuver capability and lethality of ground units. Additionally, unmanned aerial vehicles for both sensing and attack and long-range fires have proved to be key battlefield weapons, and air defenses for rear areas are also critical. Finally, inventories of precision-guided munitions for air forces need to be substantially increased. All of the foregoing should be undertaken in the context of a potential conflict that, as the Russia-Ukraine war has demonstrated, can extend for multiple months—and perhaps even years. So, inventories and replenishment capacities need to be established with such a timeframe in mind.
NATO should utilize the defense planning process to set the necessary targets. There should be no doubt, however, that achieving the requisite level of capability will require significant defense-budget increases, as the gap has been very substantial. As the EU analysis states:
Had all Member States spent 2% of their GDP on defence with 20% dedicated to investment, since 2006 until 2020, this would have resulted in an additional approximately EUR 1,100 billion for defence, of which around EUR 270 billion on investment.”
“Joint Communication to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions on the Defence Investment Gaps Analysis and Way Forward,” 7.
As that analysis makes clear, just meeting NATO’s 2-percent defense-spending goal will not be sufficient to resolve the substantial readiness and sustainment deficiencies in any reasonable timeframe. To be sure, the 2-percent goal is important, but NATO needs to establish an additional readiness/sustainment initiative over a shorter period—perhaps three or four years—that would substantially increase the readiness of national forces.
The large increases in Germany’s investment budget provide a model for a budgetary approach that should be undertaken by other countries. Germany has promised to reach 2 percent annually, including by spending one hundred billion euros over a four-year period on investment.5 Other countries should follow the German approach and establish special investment-funding streams focused on readiness and sustainability that would be designed to resolve the shortfalls in a three-to-four-year period. Along with the funding increases, and as an additional part of a NATO readiness/sustainment effort, the Supreme Allied Commander for Europe (SACEUR) should be given the task (and authority) to review and report on the readiness of the forces that will be called upon in the event of a contingency. A focused effort on readiness and sustainability, generated through the defense-planning process and overseen by the SACEUR, will significantly enhance NATO’s deterrent and defense posture.
Forward force deployment including a substantial European component
Russia’s willingness to use force, as demonstrated by its attack on Ukraine, along with the intended expansion of the Alliance to include Finland and Sweden, and the need for the United States to have the capability to act simultaneously in two main theaters—the Indo-Pacific as well as Europe—all combine to warrant a revision by NATO of its existing force-deployment posture. Broadly speaking, more needs to be forward on a regular basis, mobility capabilities need to be enhanced, Europe and Canada need to take on more significant roles, and nuclear deterrence needs to be refurbished.
NATO’s ongoing response to Russia’s invasion of Ukraine has already led to a significantly greater presence in the east. The United States now has approximately one hundred thousand forces in the European theater, and four new enhanced Forward Presence (eFP) battalions led by European nations have been stood up in Bulgaria, Hungary, Romania, and Slovakia. However, the current NATO forward forces are not postured to meet a Russian attack against the Alliance arising outside the context of Ukraine. While Russia’s capacity for attack is obviously affected by the ongoing war in Ukraine, the Russian leadership’s actions have been significantly driven by emotional considerations, and that emotion-driven calculus is potentially quite dangerous.
Accordingly, two types of conflicts require planning. First, it is possible that, rather than a full-scale attack, Russia might undertake what some have described as a “land grab” against one or more of the Baltic states—something akin to either its initial attack into Ukraine that sought to succeed by a quick strike that would take Kyiv, or its ongoing actions that appear designed to take control of the portion of Ukraine that includes the Donbas and the area along the Sea of Azov through Crimea. Second, especially as it reconstitutes its forces after the Ukraine conflict, Russia could undertake a more significant full-scale effort that the Russian leadership determined necessary based on its geopolitical calculus—for example, escalating in response to NATO actions undertaken to defeat a “land grab.”
A revised force posture for effective deterrence should have the capacity to meet each of these contingency types. The summit should require NATO military authorities to generate the necessary planning and requirements. In undertaking such planning, it should be recognized that the United States, even with its Indo-Pacific requirements, is able to provide substantial capabilities for a conflict in the European theater. However, to maximize NATO’s defense posture, European nations should provide a substantial portion of the required forces.
First, France, Germany, and the United Kingdom should plan to take important roles. Simply by way of example, the United Kingdom currently maintains an armor, a mechanized, and a fires brigade, and each of those should be included in the planning. Similar requirements should be established for France and Germany, which (as noted above) will require significant readiness and sustainability enhancements.
Second, European military structures include a number of existing multinational formations, such as the Joint Expeditionary Force led by the United Kingdom (and including Norway, Finland, Denmark, Iceland, and the Baltic states) and the German-Netherlands Corps. Decisions need to be made as to whether and how such formations should be included in an effective defense.
Third, European air forces are substantial, and would also play an important role in any conflict. The addition of more than one hundred fighter aircraft from Finland and Sweden will add to NATO capabilities, as will the ongoing acquisition of F-35 fighters by Denmark, Finland, the Netherlands, Norway, Poland, and the United Kingdom.
Each of these European capabilities should be factored into developing a full-scale theater defense, though specifics will differ among regions.
In the northeast, the land-grab scenario can best be deterred by additional forward forces in each of the Baltic states and Poland. The existing eFP battalions do not have the warfighting capabilities that would be required in the event of such an attack.
However, an effective approach to deterrence and defense could be accomplished by upgrading the level of presence in each of the Baltics and Poland, and accompanying that with enhanced mobility capabilities built around prepositioned materiel.
There is support for such an enhanced presence, with the German chancellor recently quoted as saying, “We are ready to strengthen our engagement and to develop it towards a robust combat brigade.”6 This is a welcome development. And, as perhaps implied by the chancellor’s statement, each of the United Kingdom, Canada, and Germany, which head the eFP battalions, could maintain a heavy brigade in Estonia, Latvia, and Lithuania, respectively. The United States could maintain three heavy brigades, with a focus on Poland but regularly exercising with these and other forces in the Baltics.
However, if the object is to move from the cosmetic to an actual effective capability, the suggested six combat brigades will need to be only one part of a combined-arms effort. More specifically, a fully capable forward force would include at least one fires brigade, and preferably two brigades; short-range air-defense units to support each brigade; and prepositioned materiel for an additional 5–7 brigade combat teams, which could include armor, infantry, and vehicle formations. Air forces would have greater mobility, so would not necessarily need to be forward based, but should have the materiel and planned forward-basing arrangements (including air and missile defense) to support no less than thirty fighter squadrons, plus aircraft for command and control, and for intelligence, surveillance, and reconnaissance.7 The key point is that moving from a trip wire to an effective warfighting posture requires far more than just complementing existing eFP battalions with one additional brigade each.
In the north, while NATO has always planned for the defense of Norway, the addition of Finland and Sweden necessarily will require a revised and enhanced Baltic Sea and High North posture. Finland, Sweden, and Norway have long had significant interactions, including through exercises and such arrangements as Nordic Defence Cooperation (NORDEFCO), as well as with the United Kingdom-led Joint Expeditionary Force (JEF).8 As of this writing, it appears that neither Finland nor Sweden seeks permanent forces from other NATO nations (though, of course, exercises will continue, and presumably even expand). Given this background, it should not be overly complicated for NATO to establish a force-posture and command structure that includes Finland and Sweden. As an initial matter, the United Kingdom has the capability to put in place—and, at least initially—to lead such a new organization, as demonstrated by its recent deployment of the JEF headquarters to the Baltics.9
In the Black Sea area, France has undertaken to lead one of the new eFP battalions.10 That effort could be built upon, and France could undertake being a framework nation for Black Sea defense, including prepositioning materiel in the region to assure speedy reinforcement. While the Black Sea nations do not face as immediate a land threat as that which exists in the northeast, combatting Russian air and missile capabilities will be important, as will maintaining control of the littoral. Air and missile defenses, and antiship capabilities, will be required, and naval forces will need to defeat the Russian Black Sea fleet. Maintaining control over the straits between the Black and Mediterranean Seas will likewise be a key task, with Turkey taking the leading role, but that effort should be coordinated with France’s framework-nation role.
As noted above, Russia could undertake a full-scale attack. NATO will need to plan for capable forces sufficient to defeat a Russian force of approximately 150,000–200,000 (i.e., the size of the Russian force currently engaged in Ukraine). NATO obviously has more than enough forces to meet this requirement, and, as the war in Ukraine has shown, there would be warning time if Russia were to utilize such a sizeable force. Given time, NATO could more than match the number of any Russian force, but the effectiveness of such an approach would depend heavily on the ability of forces to move sufficiently promptly into warfighting positions. There is considerable uncertainty as to mobility capabilities within Europe, as well as the lift capabilities for US forces that do not already have plans to fall in on the existing prepositioned materiel sets currently maintained in Europe.11
NATO has shown the capability to move the current level of forces promptly in the context of Ukraine. However, if a full-scale contingency arose, the mobility issues would be more difficult because of the larger amount of forces that would need to be moved at the same time. According to media reports, the Baltics have “propos[ed] that a division-size contingent of about 20,000 troops be tasked with speeding to each of the countries if they are under threat.”12 Such a sixty-thousand-person force, added to those suggested above to be forward on a regular basis, could certainly provide useful defense, but there is no reason to plan for less than a force comparable to that generated by Russia. However, bringing a NATO force of 150,000–200,000 into place calls for prior enhancements to mobility and sustainment, including plans for host-nation support, as well as well-thought-out command and control.
A military-mobility review should be undertaken to resolve these issues. Prior analysis has described the need to enhance military mobility:
[T]wo recent studies, one co-chaired by a former NATO Supreme Allied Commander and the other by a former U.S. European Command land commander, concluded that NATO needed to significantly upgrade its capacity for military mobility. The importance of mobility to an effective reinforcement strategy is well-known, and the European Union has, in fact, established a military mobility initiative. Unfortunately, that initiative is significantly underfunded—with the EU only budgeting 1.69 billion euros over five years as compared to the 6.5 billion euros recommended by the European Commission…”
The summit should task SACEUR with reviewing mobility requirements for a significant force, as recommended above. To undertake the review, SACEUR should utilize NATO’s Joint Support and Enabling Command that is directly subordinate and that, as the SACEUR “logistic domain advisor,” maintains a “network of contacts integrating all relevant authorities, civilian, governmental, and non-governmental institutions of NATO and EU member states.”13 The review might include exercises along the lines of the so-called Jack Voltaic exercises in the United States, which engaged “civilian infrastructure [which] influences military deployment…[and] force projection.”14
Assuming that the conclusion of the review results in requirements for significant mobility enhancements, a military-mobility fund could be established under NATO auspices. Alternatively, as suggested in the recent European Union analysis, the European Investment Bank could utilize its lending authority to provide funding to nations to support mobility projects designated by NATO and the EU.15 What should not be done is to ignore the problem, nor to suggest that the existing EU military-mobility effort, however well intentioned, is sufficient given its limited funding and the absence of significant changes on the ground.
Finally, in addition to the conventional-force requirements described above, NATO will need to strengthen the credibility of its nuclear deterrent—most importantly, through the planned full-spectrum modernization of US nuclear forces, as well as those of France and the United Kingdom, and by modernizing the forces that are part of NATO’s nuclear-sharing arrangements and adjusting US/alliance nuclear posture accordingly. Modernization is important to maintain the effectiveness of the forces, and doing so will add to deterrence, including as an element of managing effectively the potential of simultaneous conflicts in Europe and the Indo-Pacific. Nuclear forces are an area in which the Russian military has undertaken a fifteen-year sustained modernization that has led to several new types of weapons. Along with the nuclear threats that Russia has made in the context of the Russia-Ukraine war, Russian nuclear modernization demonstrates a potential for nuclear use, which makes a strong nuclear deterrent by NATO all the more important.
Cybersecurity resilience for critical infrastructures
In the event of a conflict with Russia, a successful defense will depend heavily on resilient cybersecurity capabilities, in order to maintain the operation of key critical infrastructures necessary to defense mission assurance. Achieving that goal will require not only government efforts, but also the establishment of an effective coordination mechanism between governments and the private sector, as the latter will be significantly engaged in the cyber fight.
Russia’s substantial cyberwarfare against Ukraine underscores the importance of such effective cybersecurity. As NATO’s assistant secretary general for intelligence has described:
All available evidence indicates that Russia has employed a coordinated cyber-campaign intended to provide its forces with an early advantage during its war in Ukraine…[T]the magnitude of Moscow’s pre-kinetic destructive cyber-operations was unprecedented. On the day the invasion began, Russian cyber-units successfully deployed more destructive malware—including against conventional military targets such as civilian communications infrastructure and military command and control centers—than the rest of the world’s cyberpowers combined typically use in a given year…The cumulative effects of these attacks were striking. In the hours prior to invasion, Russia hit a range of important targets in Ukraine, rendering the computer systems of multiple government, military, and critical infrastructure sectors inoperable.”
NATO needs to anticipate that in any conflict with Russia, it would face the same types of cyberattacks. Maintenance of governmental functions and reasonably adequate operation of critical infrastructures, especially those necessary to defense mission assurance, would be critical. Through the defense-planning process, NATO should set as a goal a cybersecurity plan that utilizes the most effective cybersecurity approaches, namely a combination of zero-trust architectures, advanced threat hunting, and continuous vulnerability analysis.
The Massachusetts Institute of Technology’s Lincoln Laboratory has described zero-trust (ZT) architectures:
The core principles behind ZT are: 1) universal authentication of all users, devices, and services; 2) access segmentation, allowing no single entity access to more than a small portion of the organization’s resources; 3) minimal trust authorization, keeping access to resources only to those entities that “need-to-know” and can be trusted; 4) encryption everywhere to protect information in flight and at rest, whether inside or outside the organization’s networks; and 5) continuous monitoring and adjustment to detect issues early and adjust access accordingly.”
But, as the foregoing should make clear, effectuating a zero-trust approach is not something that most entities can undertake on their own. Rather, as the National Security Telecommunications Advisory Committee, has stated:
Many enterprises will need to rely on outside providers to better assure their security, including cloud service, ‘which can provide multiple network security functions, including firewalls, intrusion prevention systems, secure web and email gateways, remote access tools, routing, and Wide Area Networking (WAN) connectivity.”
NATO has, thus far, chosen to describe its cybersecurity-resilience task largely as protection only of NATO networks. That, however, is too narrow an approach. NATO’s warfighting capabilities depend in significant part on key critical infrastructures, such as the electric grid, pipelines, air, rail, and ports. All of those infrastructures must be operational to support warfighting. Additionally, and somewhat obviously, so must governmental capabilities.
NATO does not have the authority to establish rules for cybersecurity for critical infrastructures, but it does have the ability to establish goals that fit the requirements of effective defense. Establishment of such goals by NATO should not be undertaken in a vacuum, but done in coordination with appropriate regulatory authority. Additionally, and quite importantly, the relevant private sector needs to be engaged in such an effort. This is particularly true since a great deal of the resilience effort will be borne by the infrastructures themselves, and by the private-sector firms ranging from Internet service providers to cloud companies to managed-service providers that provide all, or a significant portion of, the cybersecurity for those critical infrastructures. NATO’s involvement will require a change in approach, as critical infrastructures are already subject to multiple regimes, ranging from the recent European Union regulations for cybersecurity to differing national rules.16
To put it mildly, the engagement of NATO as proposed above would not be the simplest bureaucratic task in history—but it is critically important to bringing warfighting requirements into regulatory considerations. NATO will also be engaged through key member states in assuring the resilience of these critical infrastructures through “persistent engagement” and “hunt forward” operations designed to offset Russian cyberattacks, and those actions will have greater value when coordinated with activities being undertaken by the critical infrastructures and the firms supporting them.17As part of this effort, NATO should help organize multinational cyber efforts, whereby nations with more significant cyber capabilities would work closely with others that would benefit from such support.
NATO has recently brought together the cyber coordinators from the member nations and—as shown by that effort, as well as the recently established Ukraine Defense Contact Group—NATO has the capacity to organize new arrangements as required.18 Such an effort is called for in order to provide NATO and its member nations the degree of cybersecurity resilience that would be required in the event of a conflict with Russia.
Long-term limitations on Russia
While the recommendations above are designed to increase NATO’s defense capabilities, the best result would be for those never to be required to be utilized in a conflict. Now that the Russian leadership has proved aggressive intent beyond any doubt, limiting Russia’s capacity to modernize, or otherwise enhance, its military capabilities would reduce the likelihood of their use or their success if utilized. Accordingly, NATO, along with other relevant institutions, should help organize long-term limitations on trade with Russia that would achieve this effect.
As a result of the Russia-Ukraine war, NATO countries—along with the European Union, as well as other nations—have established significant export controls and sanctions on Russia, including on dual-use items relevant to military capabilities. Such controls should be continued on a long-term basis. NATO should work with all relevant parties to ensure that trade that would provide significant support to Russian military capabilities is prohibited.19
Conclusion
Russia’s unprovoked attack into Ukraine has demonstrated the importance for the NATO nations of establishing effective deterrence and defense. The NATO summit should require the focused efforts described above on readiness and sustainability, forward deployments, and cybersecurity resilience, combined with continued limitations on trade with Russia in order to achieve that goal.