Western Powers Need to Get More Creative Against Russia

The Czech Republic’s kerfuffle over diplomats demonstrates the need to think bigger—and smaller—when it comes to responding to cyberattacks.

By Elisabeth Braw, a fellow at the American Enterprise Institute.
Members of the Czech Embassy in Russia arrive at the airport.
Members of the Czech Embassy in Russia arrive at Vaclav Havel Airport in Prague, two days after the Czech Republic announced it would expel 18 Russian diplomats who are suspected of involvement in a 2014 explosion, on April 19. Michal Cizek/AFP/Getty Images

Margaret Thatcher was not a woman of half-measures. In September 1985, having decided that the Soviet Union had gone too far in spying on the United Kingdom, the British prime minister threw 31 Soviets deemed to be spies out. The Soviet Union quickly retaliated by expelling 25 Britons it considered spies.

This weekend, the Czech Republic mounted an even more daring operation, expelling no fewer than 18 Russians. (Not surprisingly, Moscow responded, expelling 20 Czechs.) The back-and-forth came as U.S. President Joe Biden announced a new cocktail of punishments for the Russian regime as well. Both the United States and the Czech Republic were responding to aggression short of war, and their actions demonstrate an urgent dilemma: how to retaliate against aggression that’s intolerable—but not war.

“We have certainly broken the heart of the Soviet Union’s unacceptable intelligence activities in London,” Thatcher said immediately after expelling the alleged spies. This weekend, Czech authorities, still investigating a mysterious explosion at a rural ammunitions depot that took place in 2014, announced it had identified the culprits: none other than officers from Russia’s GRU intelligence agency, Ruslan Boshirov (real name: Anatoly Chepiga) and Alexander Petrov (real name: Alexander Mishkin), who are also accused of trying to assassinate the Russian nationals Sergei and Yulia Skripal in Salisbury, England, in 2018. Czech Prime Minister Andrej Babis could have paraphrased Thatcher in announcing the expulsions, as Russia’s arms depot activities were certainly unacceptable.

But while Thatcher had simply responded to too much spying, the Czech government had to avenge an explosion that killed two locals. Sending home 18 diplomats-cum-suspected-intelligence-officers from a relatively small country such as the Czech Republic (population: 10.7 million) is a daring step. But it’s a logical one. “The Russian Embassy in Prague is one of the places with a high concentration of Russian intelligence staff,” Jan Padourek, a former deputy director of the Czech Office for Foreign Relations and Information intelligence agency, told me this week. “According to public information from the Czech intelligence services, intelligence staff could constitute up to 50 percent of the total number of the employees of the Russian Embassy [in Prague] and two consulates-general in Brno and Karlovy Vary, of which there are about 130 people.”

Thanks to that concentration, the Czech Republic happened to have a straightforward way of signaling to Russia that lethal explosions by Russian officers on its territory won’t be tolerated. “Russia’s intelligence capability in the Czech Republic has been affected, but it has certainly not been paralyzed yet,” Padourek said.

But Western countries without such obvious means at their disposal face an even more urgent dilemma: How do you avenge activities that aren’t war but are intolerable all the same? The United States has, of course, been facing this dilemma since 2016, when Russian tampering with U.S. elections became clear, and for many years prior. But, at least in 2016, the United States barely responded at all. One reason was that then-U.S. President Donald Trump wasn’t eager to punish Russia, but the other was that it was unclear how, exactly, a liberal democracy could even avenge such gray-zone aggressions as assassinations, election interference, and cyber-incursions?

To be sure, the United States could hack that country back, but it wouldn’t behoove a liberal democracy to avenge an assassination with an assassination on the other country’s soil. Governments killing people in another country in peacetime is, of course, illegal, even though that has not deterred the CIA and other outfits from trying. And there’s another challenge as well: When is gray-zone aggression serious enough that the targeted country has to respond, and when should it simply accept the aggression as the price to be paid for the convenience of a globalized world?

Last week, Biden declared that he would no longer accept the slow drip of Russian incursions, at least for this round. The 2020 SolarWinds cyber-intrusion into software that several government bureaucracies used combined with election interference in 2020 and especially 2016 is clearly not acceptable. It’s important to remember, though, that the Russian-attributed SolarWinds cyberattack was not an act of destruction but an intelligence-gathering operation, and that the United States and other Western countries engage in that kind of cyber-espionage too. As with the United Kingdom in 1985, the espionage had simply grown too big. The U.S. government had to do something without condemning the practice itself.

In his remarks, Biden noted that he had expelled 10 diplomats at Russia’s embassy in Washington and sanctioned six Russian companies—standard fare when one country tries to register its displeasure with another. But he also sanctioned Russian government debt, which means that U.S. banks won’t be able to buy Russian government bonds. That will hurt Russia more than the diplomat expulsions, which are so common that countries practically assume they will happen at some point. In a larger sense, though, Biden demonstrated that liberal democracies can innovate when it comes to avenging gray-zone aggression and that they can do so using strictly legal means.

The most innovative punishment to date, in fact, has come from Britain—not under Thatcher but under a successor, Theresa May. Within days after Chepiga’s and Mishkin’s alleged assassination attempt on the Skripals, the British government under May had linked the act to the Russian government and assembled an international coalition that collectively expelled 153 Russian diplomats; the United States, with 60, expelled the most, followed by the United Kingdom with 23. Russia retaliated by expelling 189 diplomats from those countries and others that expelled Russians in solidarity. That wasn’t even the creative part.

Indeed, it later emerged that the British had done much more. “We expelled the entire Russian intelligence network in the U.K.,” Mark Sedwill, national security advisor at the time of the attack, subsequently told the Times of London. “But we also took a series of other discreet measures.” Sedwill was unsurprisingly too discreet to name them, but he explained that “we will use different techniques. We need to play to our strengths and focus our attention on their vulnerabilities. We are not going to conduct illegal operations, but there are things we can do. There are some vulnerabilities that we can exploit too.” The vulnerabilities included “tackling some of the illicit money flows out of Russia, and covert measures as well.” The government hasn’t revealed what exactly those measures were.

Diplomat expulsions are not just predictable; countries also risk running out of diplomats to expel.

Considering the illicit financial activity endemic to authoritarian countries, tackling illicit money flows is a promising strategy when it comes to dealing with Russia, China, and whichever other authoritarian state may next try to harm Western countries. Diplomat expulsions are not just predictable; countries also risk running out of diplomats to expel—and their own embassies will empty out too. “The expulsion of 20 employees of the Czech Embassy in Moscow will completely cripple the activities of the Czech diplomatic mission in Russia,” Padourek said. “All diplomats from the political and economic sections of the embassy, including the deputy ambassador, were sent home. Only consular staff remained. Deported diplomats had to leave Moscow within 24 hours.”

Such a blow is difficult for a sovereign nation to accept. This week, the Czech Republic announced it will exclude Rosatom, the state-owned Russian energy giant, from bidding for a Czech nuclear power plant tender. This is likely to in turn trigger another counterblow by Moscow, if only for the sake of appearances. The gray zone is, in fact, as tricky a battlefield as the traditional one. The Czech Republic clearly doesn’t see the same volume of illicit money flows originating in Russia as the U.K. does. But it does have allies: Indeed, this week it asked European Union and NATO allies to expel Russian diplomats, too. But it could borrow a page from May and ask its allies for different kinds of help. On matters of aggression short of war, allies can help one another in new and unexpected ways.

Elisabeth Braw is a fellow at the American Enterprise Institute, where she focuses on defense against emerging national security challenges, such as hybrid and gray-zone threats. She is also a member of the U.K. National Preparedness Commission. Twitter: @elisabethbraw