Early identification of threats as the means of fighting against hybrid warfare (with a focus on the south Caucasus)

Early identification of the most recent hybrid threats (incident at Keshikchidag, the escalation in the border between Armenia and Azerbaijan, in July 2020, etc.) in the South Caucasus, enabled the nations to sidestep the repercussions of the provocation, most probably initiated by the external actors. This is the primary reason why the authors developed this paper. The importance of early identification in fighting against hybrid threats has been highlighted in the paper. The authors elaborated on the examples occured in the South Caucasus countries, as well as beyond the region. The challenges of identifying hybrid threats ahve been specified. The scenarios have been presented regarding the hybrid aggressors and hybrid threats in the South Caucasus region.


Introduction
As disinformation and hybrid campaigns are often unpredictable and deliberately confusing, it is important to detect them as early as possible. Early indicators should be established to enable more agile responses to hybrid threats, especially in the early phase of the conflict cycle (Thiele, 2015). Governments, but also the police, media, the private sector and civil society groups, need to improve detection and analytical capabilities, basing their findings on comprehensive monitoring and data gathering. This means investing in both the tools needed to detect the hostile narratives that are gaining momentum and, in the experts, needed to make sense of this information. It undeniably requires more resources and investment ("Hybrid and transnational threats", 2018). The main question in this paper is "how to identify hybrid threat before it is too late?" At a low intensity, it might even be difficult for the victim to know that they are under attack. A key task is to determine what * Corresponding author: War College of the Armed Forces, Republic of Azerbaijan, e-mail: xayal1333@gmail.com, ORCID: 0000-0001-8975-6530 combination of unexplained incidents -"things going wrong" -would indicate a coordinated assault. An additional complication is that hybrid threats could develop from the convergence of a number of already existing social, technical or economic problems which is then exploited by an adversary -without it having been necessarily planned, masterminded or coordinated (Giles, 2019). Various authors (Luke Coffey, Axel Hagelstam, Jarno Limnéll, Chris Kremidas-Courtney, etc.) have addressed an issue of identifying hybrid threats. However, an early identification of hybrid threats as a means of fighting against hybrid warfare has not been systematically studied, especially with regard to the South Caucasus region. The objective of the paper is to highlight the importance of the early identification of hybrid threats with a focus on the South Caucasus region. The research methods primarily used in the book are comparative analysis and synthesis.

Early identification of hybrid threats and its challenges
The actions to prevent hybrid threats go from identifying risks, vulnerabilities and knowledge and situation awareness (launching a hybrid risk study to identify the main vulnerabilities that may affect national structures and networks, carry out a study on hybrid risks in neighboring countries, create a fusion cell capable of receiving and analyzing classified and open source information on hybrid threats, setting up a Center for Excellence for "Countering the Hybrid Threats") are complemented by actions aimed at developing and increasing individual and collective resilience (improving the protection and resilience of critical infrastructure in relevant sectors, increasing the resilience of space infrastructures, improving awareness and resilience within existing training mechanisms and coordination) (Cîrdei & Ispas, 2017). According to Giles (2019), key indicators would probably comprise a mixture of traditional and novel ones. Traditional warning signs would include the arrival in the country, or in a specific region, of meaningful numbers of a specific type of foreign visitors; or civil demonstrations turning into a staged confrontation; or a sudden or escalating pattern of sabotage. New indicators would be connected with foreign emphasis on the importance of information warfare and conflict, exploiting new technological possibilities to the maximum in pursuing old principles of subversion and information warfare. Christopher Bowers has identified three characteristics of hybrid actors on the operational level: maturity, capability, and complex terrain. Maturity describes the degree of organization and cohesion; depth of leadership; responsiveness to internal leadership and external forces (state sponsor); support of a population; evidence of long-term goals and the ability to collectively pursue achievement of those goals. Capability refers to the capacity of a hybrid adversary to be able to field, employ, and sustain some elements of a modern military. It is not enough to use a weapon once or twice; a hybrid adversary must be able to train personnel in the effective, combined, coordinated use of multiple weapons systems and have a means by which the logistics necessary to sustain those systems are assured. Finally, complex terrain is critical in enabling a hybrid adversary to effectively confront a modern military opponent (Chuka & Born, 2014, 16).
Tactics and strategies regarding hybrid warfare used in different situations are based on the analysis of the situation and available capabilities. According to Chambers (2016), the contemporary characteristics of hybrid threats are a generalization and should be applied to individual situations differently in order to help understand the situation on the ground and develop an appropriate response.
There are some quintessential examples in the history about early identification of hybrid threats. Capitalizing on a migration card Russia attempted to exploit the Russian-speaking community in Germany, alleging through Russian mass media that Russian girl, Lisa was raped by Muslim migrants in order to provoke a wave of discontent and thus weaken the position of Chancellor Angela Merkel (Bajarūnas & Keršanskas, 2019). The case dominated German headlines for two weeks in January 2016. In the end, German police established that the story was fake -she had been with a friend that night (Treverton, et. al., 2018). In February 2017, a draft report was sent to the speaker of the Lithuanian parliament claiming that German soldiers, who are leading NATO's new battle group there, had raped a teenager (Sahin, 2017). The rationale behind this report was to undermine the credibility of NATO's decision after Warsaw summit to increase its presence in Baltic countries and Poland. However, the rumor was quickly revealed as fake news and did not trigger further reactions (Sahin, 2017). This example brings the early identification of any threat to the fore.
Each time we face a new security challenge, a defense or security contractor is waiting in the wings to sell us a solution. In the case of hybrid threats, there is no one-size-fits-all solution nor new system we can just buy to mitigate them. Instead, everything we've learned from previous examples tells us that we must adapt our legal frameworks and working culture and improve the connective tissue between ministries and organizations to enable our own governments and organizations to better protect our societies (Kremidas-Courtney, 2019). The activities in hybrid warfare are typically designed to stay within the grey zone that may be outside of a target's detection capabilities and underneath the target's estimated threshold of major escalation. The activities are also calibrated in a way that they do not allow a justified military response under international law, unless the hybrid threat actor considers such escalation to be beneficial for attaining its goals (Eronen & Cederberg, n.d.). Joseph Votel an et al. defined grey-zone conflicts as a segment of the conflict continuum "characterized by intense political, economic, information, and military competition more fervent in nature than normal steady-state diplomacy, yet short of conventional war" (Chambers, 2016).
In order to come up with the conclusive findings regarding the identification of hybrid threats in the South Caucasus, it is important to understand the geopolitics and state of affairs in the region.
Nilsson considers various modes of influence an external actor may use in order to change (or sometimes preserve) the status quo, that can be identified as security threats (Tarkhan-Mouravi, 2016): − support/disrupt the sustainability of the existing regime through assistance/sanctions and sabotage; support one of the sides during regime change, or influence the procedure of such change; − induce and promote gradual change of a regime, through (promise of) support or integration based on conditionality, or threaten withdrawal of such support, or using incentivebased pressures or rewards (bribes) to influence elite regime preferences; − impose regime change by force, including regime change on a part of the territory (supporting conflict, annexation), and clandestine operations; − apply various tools of propaganda, fake new, cyber-trolling, also hacking and other forms of cyber warfare.

The South Caucasus and early identification of hybrid threats. Retrospective analysis
South Caucasus is one of the regions located in the proximity of three major and ambitious Eurasian states: Turkey, Russia, and Iran (Iskandarov, 2019). Turkey is an actor, which more or less balance the Russia-Iran tandem. Russia is the most influential actor in the South Caucasus, claiming the region to be a part of its so-called "near abroad". The elements of hybrid warfare were initially observed in the countries, which were striving hard to get out of Russian sphere of influence, namely in the cases of Azerbaijan and Georgia. The key point in Russia's striving for the control over the "near abroad" was to incorporate the South Caucasian states into the Russia-dominated CIS. It needed little effort with Armenia, but it was rather difficult with Azerbaijan and Georgia; however, neither Armenia was a reliable Russian ally at the beginning of 1990s as it used to be later. When the initial Armenian attempts to set up good relations with Turkey collapsed, the only Armenian choice was to rely on Russia as its most important ally. The Russian troops stayed in Armenia and allegedly were also involved in the Karabakh war (Kopeček, 2010).
Azerbaijan lost the favour of Russia mostly during the tenure of the President Abulfez Elchibey between 1992-1993. In this time Russia probably helped to originate the Talysh and Lezgin separatism in Azerbaijan, which ceased after Elchibey's stepdown in June 1993 (Kopeček, 2010). Despite the war with Armenia, the involvement of frontline forces in the capital, the struggle for authority, and even the fratricidal massacre threatened independence of Azerbaijan. The Ganja uprising of June 4, 1993 was one of the events that posed such a threat. At that time, an armed clash took place in Ganja between the military forces led by the former corps commander of the Azerbaijani Army, pro-Russian colonel Suret Huseynov and government forces. The operation to disarm military unit 709, controlled by Huseynov, failed, killing 35 people on both sides. Government officials sent to Ganja were taken hostage by Huseynov's gang ("Müxalifətin 4 iyun savaşı", 2018). Huseynov and his armed men marched towards Baku, forcing Elchibey to step down. Then Heydar Aliyev was the only choice of the nation that could save the country. When he came to power Azerbaijan was teetering on the brink of civil war. Aliyev shared a power deal with Huseinov, the former becoming president and the latter prime minister with "extended competences". It seemed that Azerbaijan, ruled by the Aliyev-Huseynov doublet, was to become a loyal Russian ally as it joined the CIS in September 1993. After that, however, Heydar Aliyev refused the Moscow-led mediation in the Karabakh conflict, as well as the prevalently Russian peacekeeping forces, and set up the mediations in the frame of the CSCE Minsk Group (Kopeček, 2010). Moreover, despite the pressure coming from Russia and Iran, as well as the strong opposition of Surat Huseynov, President Heydar Aliyev managed the realization of the "Contract of the Century" in September 1994 with the participation of 11 major foreign oil companies (BP, Amoco, Unocal, LUKoil, Statoil, Exxon, TPAO, Pennzoil, McDermott; Ramco; Delta Nimir) representing six countries (UK, USA, Russia, Norway, Turkey and Saudi Arabia) and Western states gained an opportunity to participate in the oil and gas production of the Azerbaijani sector of the Caspian Sea (Mammadzada, Iskandarov, Gasanov, 2020). On October 4, 1994, another revolt was initiated by Surat Huseynov against President Heydar Aliyev. The president addressed the people with regard to the revolt. His exceptional prestige among the population soon led to the gathering of hundreds of thousands of people in front of the President's Office in support of the government. Thus, unlike the uprising of June 4, 1993, Heydar Aliyev prevented the revolt without firing a single shot. Surat Huseynov was removed from the post of Prime Minister on October 7. The most interesting point is about the arrest of Surat Huseynov. Huseynov was abducted shortly afterwards by unknown individuals. He soon appeared in Russia. However, shortly afterwards, Huseynov was arrested there and handed over to Baku ("Heydər Əliyev qiyamı belə yatırdı", 2015).
The most apparent Russian influence was evident in the politics of Georgia. The first Russian involvement in Georgia was probably the overthrow of the President Zviad Gamsakhurdia in 1992 by paramilitary forces led by Kitovani, Ioseliani and Sigua, equipped with the arms gained from the Russian military bases in Georgia (Kopeček, 2010). After his overthrow, Gamsakhurdia relocated to Chechnya where he was granted asylum by the Russian republic's leader, Dzhokhar Dudayev, who was pursuing his own independence bid from Moscow. In September 1993, Gamsakhurdia returned to Georgia to lead forces against the government, but former President Eduard Shevardnadze managed to suppress the revolt with the military assistance of Russia. According to official records, Gamsakhurdia died on New Year's Eve 1993 from a self-inflicted single gunshot wound to the head. A later examination reported two bullet holes to the head, fueling speculation that the Georgian leader had been murdered (Rimple, 2007). The Russian involvement was predominantly observed in the South Ossetian (in 1990s) and Abkhazian (in 1992) conflicts (Kopeček, 2010), which ended up with the secession of two separatist regions from Georgia.
Similarly, to Heydar Aliyev, Shevardnadze balanced between Russia and the West; nevertheless, unlike Aliyev he had to allow Russian military bases in the Georgian territory, as well as prevalently Russian peacekeeping forces in South Ossetia and Abkhazia. On the contrary Shevardnadze has been capable to join Western backed Baku-Tbilisi-Ceyhan pipeline project, to close one of the Russian military bases in Vaziani in the outskirts of Tbilisi, and even to host US military advisers in Pankisi gorge. Pankisi then became the place of indirect Russian-US clash in 2002, when Russian aircrafts bombed Pankisi, accusing Georgia of sheltering Chechen rebels (Kopeček, 2010).
Thus, the history proves that, an early identification of hybrid threat is of paramount importance. Unlike Abulfaz Elchibey and Zviad Gamsakhurdia, President Heydar Aliyev's discernment enabled him to identify the danger of Surat Huseynov and the power behind him and nip the threat in the bud.
That is a history of about three decades ago. A lot of things have changes in this period, including the tactics of hybrid warfare. It is necessary to keep in mind that the art of competitive politics, including warfare, is developing all the time and we often encounter new mutations or rehashes of previously wellknown doctrinal approaches (Eronen & Cederberg, n.d.). All military doctrines are an evolution of previous ones, and influenced by the technical, political, social and economic forces shaping the battlefield at every level. Today's Russian approach is broadly rooted in some distinctive characteristics of today's Russia and past practice, but more specifically is the product of a series of military-political debates and organizational developments that came to fruition following the 2008 Georgian War (Galeotti, 2018). The nations in the South Caucasus lose the sight of this fact and therefore have been suffering throughout the centuries. Hybrid threats need to be pre-empted by both "passive" elements, such as increased resilience against shock or surprise and more active ones including robust measures to prepare and protect the functions and structures that are most likely to be targeted by hybrid attacks. For these purposes, the importance of sufficient civil preparedness arrangements, a free press, an educated public and an effective legal framework cannot be overstated.
Hybrid actors have demonstrated their intent by applying tools of hybrid influencing to advance their political agenda. According to Eronen and Cederberg (n.d.), the high-end hybrid threats are the most dangerous and difficult to be deterred and countered. They typically have: − an outspoken revisionist or even revolutionary political agenda; − well-developed instruments of national power providing the means supporting the political agenda; − integrated hybrid tools into their doctrinal thinking; − access to a wide array of assets and capabilities, including tools enabling crossing the geographic distance.
All these typical features are being observed either overtly or covertly in all countries of the South Caucasus. Russia is the most active external actor in the region. Russia's interests have been fully maintained in Armenia (at least till Pashinyan's leadership), partially in Azerbaijan (through the representatives of the "fifth column"). Georgian society has substantially refused the Russian ideology and excluded the Russian involvement in their country. There are three scenarios regarding hybrid aggressors and hybrid threats in the South Caucasus: 1) external actors may directly involved in the internal affairs of the regional countries; 2) external actors may use their contacts, namely the representative of the "fifth column" in order to destabilize the regional countries; 3) external actors may exploit the regional countries against each other.
For the time being, the first scenario is not conceivable against a backdrop of international condemn. Till Pashinyan's leadership Armenia was not concerned with the second scenario. Today the second and third scenarios are more prevalent and most probably will be so in the foreseeable future, since they are more convenient for external actors.
The "police-citizen" confrontation that took place on June 7, 2020 in Baku is an example of the early identification of hybrid threat ("Yasamal hadisələri", 2020). It might be seen simple, but in fact is very serious. Thus, one of the residents of the building ignores the two-day strict quarantine regime against a backdrop of Covid-19 pandemic. Conflict arises when a police officer who is monitoring the situation approaches him and warns. The next day, police officers break into the apartments, use insulting expressions, and record their actions. It was a deliberate provocation against the police with purpose of undermining their reputation in the midst of pandemics. What is interesting here is that, the recorded video has been spread by the policemen themselves. This fact highlights the severity of the issue. Because it proves that, the confrontation between the policemen and citizens was in the interest of some actors, in this case the "fifth column". The early identification of the threat enabled the government to deter a large scale civilian-police confrontation, which would have ended up with civil war. On June 4, a group of Georgian citizens violated the state border on the territory of the Keshikchidag State Historical and Cultural Reserve on the Azerbaijani-Georgian state border. The Georgian Border Guard was officially informed about the provocation and a crisis between two nations was thwarted. It is apparently obvious that, neither Georgia, nor Azerbaijan would benefit from this accident. It was another hybrid threat in the interest of most probably external actors. According to academician Yagub Mahmudov (2019), the incident at Keshikchidag did not happen accidentally. This was a deliberate provocation aimed at worsening the friendly relations between Azerbaijan, Georgia and Turkey, which are the guarantor of peace and security in the South Caucasus. The academician believes that, this provocation was committed at the order of the power centers, which have military, political and economic interests in the South Caucasus and these centers staged a provocation, using pro-Armenian forces in Georgia.
The escalation in the border between Armenia and Azerbaijan, in July 2020 is another example of hybrid threat. Because this time the escalation did not occur in Nagorno-Karabakh, but in Tovuz -internationally recognized border between Armenia and Azerbaijan. The objective of this escalation was to embroil Azerbaijan in another argument, where CSTO is involved. However, the prudence of the government precluded Armenians or some other external actors from realizing their ambition.
We have to consider that, the threats of today are not preventable through national resources and modes, countering them is a matter of international cooperation. Thus, one of the main tools to increase hybrid resilience is to enhance the cooperation with the leading Western organizations like EU and NATO based first and foremost on mutual interest and participate in training and exercises led by them. Multinational and multifarious exercises would be particularly helpful for the nations in the South Caucasus to explore their strengths and weaknesses.
An example of a place that has done a great job at building resilience to Russia's hybrid warfare is Estonia. Even though the Russian minority makes up roughly one-quarter of the population, Moscow hasn't been able to cause the same problems using its hybrid tactics as it has in other places. It is clear why the Russian population in Estonia is not susceptible to Moscow's hybrid tactics of "little green men" and propaganda. Polling shows that a vast majority have a lot of trust in their governing institutions. For example, according to a public opinion survey conducted by the Estonian Ministry of Defense in early 2019, 66 percent of Estonians have confidence in the country's president and 56 percent in the prime minister. According to the same survey, 87 percent of Estonians said they have confidence in the police. Perhaps not surprisingly, The Heritage Foundation's 2018 Index of Economic Freedom ranked Estonia seventh in the world in terms of economic freedom. The trust in government and police, combined with Estonia's economic opportunities, deny Russia the ability to use hybrid tactics. Estonia has been able to win the hybrid war even before it starts (Coffey, 2019).
Let us compare Estonia's situation today to that of Ukraine's in 2013 and 2014. Due to a dismal economic situation, and years of political and economic corruption at the top of government, Russia was able to exploit the situation in Ukraine. As soon as the "little green men" appeared in Crimea, it was too late. One does not have to look too far from home to see how Russia has employed effective hybrid tactics. The 2016 Presidential election is a great example. Certain sectors of American society are ripe for Russia's meddling. Certain minority groups feel mistreated by the police. Some on the political right feel a massive distrust of the FBI. There also exists a strong cynicism of the federal government in some sectors of American society (Coffey, 2019).
One of the most concrete outcomes of the efforts to counter hybrid threats is to have a look at what it has experienced, what it has lost and achieved and what direction it should take next. The Hybrid Centre of Excellence in Estonia has developed a concept for its three Communities of Interest (COI). Three COIs with their networking, analysis, training and exercise activities have succeeded in promoting both situational awareness, resilience and response capabilities in participating countries. The COI on Hybrid Influencing is led by the United Kingdom, the sub-COI on Non-state Actors by Sweden, and the COI on Vulnerabilities and Resilience by Finland. In summer of 2018, they convened networks to share best practices on issues such as legal resilience, maritime and harbor safety, energy networks, drones and election interference (Hagelstam, 2018). Sweden and Finland are perfect examples for the South Caucasus countries.
Since Russian-Georgian conflict of 2008 hybrid threats have received a great deal of attention in the South Caucasus. The events took place prior to and during that conflict have encouraged the scholars, and policymakers to examine the vulnerability of particular nations in the region to hybrid threats and introduce different methods to counter them before it is too late. A small place like the South Caucasus riddled with frozen conflicts always attracts attention of researchers. At times, hybrid activities may appear to have ceased, such as in the case of so-called frozen conflicts or during perceived peace time, while that particular situation may in reality serve the greater goals of the threat actor, or serve as time used to prepare the ground for future operations (Eronen & Cederberg, n.d.).
Countering hybrid threats requires a strong collaborative involvement of different actors. Because of this, many Western countries have begun to emphasize the importance of whole of nation and whole of government principles in preparing for today's cyber and hybrid threats (Limnéll, 2019). Through strengthening public and private governance, and seeking deeper and broader cooperation among institutions, nations, civil society and the private sector, we can turn globalization and our greater interconnectedness from a vulnerability into an advantage (Kremidas-Courtney, 2019). This mostly means adopting the Finnish comprehensive security-model, although each state adds their own characteristics into the model. The Finnish model has nevertheless received increasing amounts of prestigious international attention (Limnéll, 2019).

Conclusions
The South Caucasus region is a place where the interests of ambitious actors clash. The neighboring countries' growing influence has become a considerable concern for the last three decades, because these countries have been increasingly engaged in unconventional operations with a claim to undermine Western hegemony. Western community in its turn applies its own tools to offset them in the region. In addition these unconventional strategies employed fall mostly outside the purview of international treaties, laws and norms. Therefore, their actions fall short of engagement in hybrid conflict, while meeting the criteria of grey-zone conflict. In addition, unlike various regions in Europe (for instance Scandinavian countries, Baltic states and etc.) the threats do not solely emanate from external actors, the countries in the region might be manipulated against each other through different means. That's why early identification of hybrid threats is of utmost importance in order prevent further repercussions not only for the region, but also for the Western community in broader context, since Europe has vital interests regarding the regional energy and transport projects.