What changed between the plenary report and the adopted text

The European Parliament,

– having regard to the UN Charter and the fundamental principles of international law,

– having regard to Title V of the Treaty on European Union (TEU), in particular Chapter Two, Section Two thereof on provisions on the common security and defence policy,

– having regard to the Treaty on the Functioning of the European Union (TFEU),

– having regard to Articles 42(7) and 222 TEU,

– having regard to its previous resolutions on Ukraine, Russia and Belarus, in particular those adopted since Russia’s annexation of the Crimean Peninsula in February 2014 and Russia’s full-scale invasion of Ukraine in February 2022,

– having regard to the international legal framework for preventing and fighting terrorism, including UN Security Council Resolution 2341 on protection of critical infrastructure against terrorist acts, adopted on 13 February 2017,

– having regard to the joint white paper from the Commission and the High Representative of the Union for Foreign Affairs and Security Policy of 19 March 2025 entitled ‘Joint White Paper for European Defence Readiness 2030’ (JOIN(2025)0120),

– having regard to the joint communication from the Commission and the High Representative of the Union for Foreign Affairs and Security Policy of 26 March 2025 on the European Preparedness Union Strategy (JOIN(2025)0130)),

– having regard to the Commission communication of 1 April 2025 to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on ProtectEU: a European Internal Security Strategy (COM(2025)0148),

– having regard to the Declaration of the North Atlantic Council Summit in The Hague, adopted by the Heads of State and Government participating in the meeting of the North Atlantic Council on 25 June 2025,

A. whereas the intensity and scope of hybrid attacks against the EU have escalated significantly since the start of Russia’s war of aggression against Ukraine, with incidents repeatedly linked to authoritarian states, notably Russia, Belarus, China, Iran and North Korea;

B. whereas Russia constitutes the primary and most significant security threat to the EU and its Member States; whereas Russia has persistently violated the principle of territorial integrity and political independence set forth in Article 2(4) of the UN Charter; whereas hybrid attacks represent a threat to democracy in the EU and its Member States;

C. whereas the severity of these attacks has increased drastically and constitute a blatant violation of Member States’ sovereignty, the EU’s territorial integrity and international law; whereas hybrid warfare has become a structural feature of the current geopolitical environment;

D. whereas recent hybrid attacks can include unauthorised drone incursions, ‘smuggling balloons’, airspace violations, clandestine tunnels for infiltration and smuggling, sabotage of and espionage targeting critical security and defence infrastructure, the sabotage of undersea cables and energy infrastructure, GPS jamming and navigation spoofing, cyberattacks, arson and assassination plots, the instrumentalisation of migration and organised crime, elite capture, covert foreign investment, economic coercion, data exfiltration and other acts of political subversion and economic penetration, foreign information manipulation and interference (FIMI), and interference in political and electoral processes;

F. whereas the sovereignty and territorial integrity of all Member States are foundational principles of the EU; whereas hostile state actors, in particular Russia, target the EU’s territorial integrity on two fronts: through direct physical attacks against Member States and through influence operations aimed at undermining the unity of the EU, by engineering Member States’ withdrawal from the EU;

G. whereas hybrid threats increasingly affect the EU as a whole, including overseas countries and territories such as Greenland, but the EU’s external border regions and the EU’s maritime areas are particularly susceptible to attacks; whereas these attacks also target candidate countries and EU neighbours, notably Ukraine, Moldova, Armenia, Georgia and the Western Balkans; whereas the territorial integrity of the EU’s neighbourhood is key to ensure peace, stability and security in Europe and the wider world;

H. whereas interference in Greenland by non-EU countries, notably inflammatory narratives and the conduct of hybrid actions on Greenland’s territory, as well as the US Government’s formulation of explicit threats against Greenland’s sovereignty, have raised concerns regarding Greenland’s sovereignty and territorial integrity;

I. whereas Georgia is an example of successful Russian hybrid interference resulting in Kremlin-aligned Georgian Dream-led authorities replicating Russia’s playbook of hybrid operations against Georgia’s own civil society and democratic institutions;

J. whereas sabotage activities by Russian intelligence are increasingly being carried out using intermediaries, vulnerable social groups, including underaged persons, proxies and ‘disposable agents’, thereby complicating attribution and response; whereas religious institutions, including the Russian Orthodox Church and networks linked to the Muslim Brotherhood, have been exploited to conduct interference operations in the EU, undermining democratic values, the rule of law and the EU’s ability to defend itself;

K. whereas these attacks aim not only to create chaos and destabilise the EU Member States, but also to undermine democratic integrity, manipulate decision-making processes, deepen political divisions, weaken social cohesion, sow fear and public distrust among EU citizens, and weaken defence readiness and the EU’s support for Ukraine, generating cascade effects across the EU;

L. whereas the invocation of NATO Article 5 following the 9/11 terrorist attacks demonstrates that collective defence can be triggered following attacks not only by the actions of a state actor but also by attacks involving non-state actors and complex networks operating across national borders; whereas this precedent highlights the evolving nature of security threats and the need to adapt collective response mechanisms accordingly, including with improved common standards and procedures for attribution;

N. whereas FIMI operations use sophisticated cognitive-psychological methods, including reflexive control, a technique rooted in Soviet military theory that introduces specific informational inputs to limit a target’s perceived choices and steer decisions toward the influencer’s strategic goals;

O. whereas Russia’s 2015 and 2021 national security strategies frame the promotion of so-called traditional values and the ‘Russian World’ as instruments of its broader hybrid warfare strategy and geopolitical influence; whereas Russia has strategically deployed historical, religious, cultural and values-based narratives as part of its hybrid warfare strategy to influence public discourse, and ecclesiastical dynamics, weaken social cohesion, and undermine democratic resilience and Transatlantic integration;

P. whereas the transversal nature of the cognitive domain requires cognitive indicators to be fully integrated into the common operational picture used by cyber, intelligence, law enforcement, military and critical infrastructure structures;

Q. whereas the success of modern military operations and the effectiveness of public institutions increasingly depend on the control of cyberspace and on the strategic use of digital resources and information systems;

R. whereas internal security remains a responsibility of the Member States, although the cross-border, interconnected and multi-dimensional nature of those hybrid attacks requires strengthened cooperation, systematic information sharing and coordinated action at EU level, supported by adequate funding and complemented by long-term strategies to strengthen societal resilience and protect institutional integrity;

S. whereas EU Justice and Home Affairs (JHA) agencies have a key role to play in cooperation with national authorities, in establishing and maintaining common situational awareness of risks related to such threats and in assisting front-line Member States in crisis situations; whereas the Commission has included the strengthening of the European Border and Coast Guard Agency (Frontex) in its flagship initiatives for the 2024-2029 legislative terms, as well as a revision of the mandates of European Union Agency for Law Enforcement Cooperation (Europol) and European Union Agency for Criminal Justice Cooperation (Eurojust); whereas other initiatives such as the ‘Eastern Flank Watch’ may contribute to strengthening the protection of the external borders and increasing resilience against hybrid threats;

T. whereas the emergence of advanced AI systems represents a structural disruption to existing cybersecurity architectures, invalidating threat models and defensive assumptions developed over previous decades; whereas hostile state and non-state actors are already exploiting AI capabilities to increase the speed, scale and precision of hybrid operations, including cyber intrusions, AI poisoning, disinformation campaigns and critical infrastructure targeting; whereas the EU’s collective cyber resilience frameworks must be adapted to address these new vulnerabilities;

U. whereas despite the significant efforts undertaken by Member States, and the development of tools and mechanisms to counter hybrid threats, the EU’s response to hybrid attacks continues to suffer from legislative gaps, the lack of a harmonised approach among Member States, differing levels of awareness, and the absence of a dedicated structure or entity to monitor such attacks; whereas as a consequence, despite the urgency, EU Member States have yet to develop a fully coordinated and coherent response to hybrid warfare both individually, at European level and, where relevant, with NATO;