When a restaurant in Tallinn became a piece of evidence
On a cold morning in central Tallinn, smoke and soot told a story that CCTV soon embroidered into something darker than a kitchen mishap. The restaurant—opened to shelter Ukrainians displaced by war and affably named for a phrase shouted in Ukrainian streets—was still wet with rain and the smell of burnt oil when the owner stood on the pavement and watched his life flicker on a screen.
“You can see everything,” the owner said later, voice low. “The glass is broken. Someone throws something inside. The flames spread, and then the man who set it alight runs, burning.”
What looked at first like a local crime quickly revealed itself to be a node in a broader campaign. Two suspects were filmed at the scene—one setting the blaze while the other recorded the act. Within weeks, after co-ordinated inquiries that ran across Poland, Lithuania, Latvia, Estonia and Italy, the two were arrested. A court later connected at least one of them to payments from a foreign military intelligence service, reportedly via cryptocurrency.
The symbolism was ugly and plain: a place that had offered sanctuary for people fleeing war was targeted, and the act was not random. For Estonia’s investigators, this was the kind of incident that needed naming—cleanly and publicly—because ambiguity is often the primary weapon in modern grey-zone conflict.
Naming the nameless: Estonia’s approach to hybrid attacks
Across the Baltic states, law enforcement and intelligence units have learned to assume that not every vandalism or arson is what it seems. In Tallinn, the default posture is investigative skepticism: dig until you find the links, then publish the evidence.
“If we have the proof, we tell our people,” an Estonian security official told me. “Silence helps the aggressor. Clarity helps society.”
There is method in this bluntness. Hybrid operations—those that blend cyber sabotage, covert violence, disinformation and carefully crafted deniability—thrive on uncertainty. If the public cannot tell truth from plausible fiction, authorities lose a key line of defence: trust.
How hybrid campaigns unfold
Look at the pattern in recent years and the tactics read like a malicious playbook:
- Cyber intrusions that expose or manipulate information: hacked cameras at borders or port facilities that allow outsiders to monitor troop and logistics movements.
- Physical sabotage: cut undersea cables, slashed pipes, or damaged railways that erode confidence in critical infrastructure.
- Information operations: amplified rumours and selective leaks to polarise communities and strain democratic debate.
- Covert kinetic acts: arson, vandalism or targeted attacks that intimidate political actors and civic voices.
These are not theatrical set-pieces. They are small, sharp strikes designed to nibble at the edges of security: to make travel disruptive, business unpredictable, and civic life fractious. “The intent,” a Nordic cyber analyst said, “is to make societies slower, suspicious and less able to respond to real crises.”
From drones over airports to jamming GPS: the spike in strange events
Last autumn and winter, a blizzard of puzzling incidents swept northern Europe. Airports shut runways. Flights were cancelled after reports of drones near airfields. In one case, military personnel opened fire on an object above an airbase. Governments issued alerts; ministers called the episodes “serious.” Yet, in many instances, proof remained thin or unpublished—fueling controversy and scepticism.
It’s easy to scoff and call it collective panic. It’s also possible that the actors behind these events are deliberately conducting operations that are just credible enough to force reactions, but not so blatant as to leave obvious chains of custody.
Meanwhile in Finland, other symptoms of hybrid pressure played out in the shadow of phone and radar screens. Authorities logged a dramatic leap in GPS interference—roughly 2,800 incidents recorded in 2024, a stark rise from the low hundreds the year before. Undersea cables were found severed beneath the Gulf of Finland; a ship was detained after operators suspected it was involved. And the country, still digesting an episode in which more than a thousand people were pushed across a border and shepherded along roads by people traffickers, closed crossings and hardened its defences.
Stories from the quay: civilians living with the grey zone
Walk into a port-side tavern in Helsinki at dusk and you overhear preparedness talk that would have seemed alarmist a decade ago. An office worker with a glass of wine describes her role in a neighbourhood shelter plan should a conflict escalate. A man says, half-joking, that his elderly father has been given the task of demolishing a bridge if needed to slow an advance.
“You plan for the worst because you’ve seen the map of what could be done,” the woman told me. “It’s not about fear every day; it’s about being ready if everything changes in a night.”
That blend of stoic practicality and quiet anxiety is the social effect of living beside a state of sustained hostility short of open war. It pushes governments to invest in resilience and citizens to accept military planning as a civic duty. It also raises wider questions about normalisation: when does preparedness become a new permanent normal?
When courts, clouds, and cables meet: legal and strategic answers
One of the most important responses has been legal: the effort to turn suspicion into proof and proof into conviction. Estonia’s prosecutors and police, for example, made a point of following forensic breadcrumbs across borders to secure a courtroom result in the restaurant arson case—sending a clear signal that hybrid acts will be investigated like any other crime.
That’s coupled with growing international co-operation: joint cyber advisories from around 20 Western states have, for instance, publicly linked certain campaigns of CCTV hacking at border posts to state-sponsored actors. Norway traced deliberate manipulation of water-control infrastructure to pro‑Russian attackers; Poland described train-line explosions used for logistics to Ukraine as sabotage.
These are not isolated anecdotes. They are part of a pattern experts call “strategic attrition”—a slow campaign to undercut alliances, distract institutions and sap public confidence without crossing the thresholds that would prompt large-scale military responses.
What do we do now?
How should democracies answer a campaign that prefers fog to fire? Strengthening attribution capabilities matters—so does sharing that attribution publicly when the evidence is robust. So does shoring up the mundane backbone of modern life: cables, pipelines, satellite navigation and election systems.
But there is another dimension: culture. Societies with high civic trust and a habit of sceptical information consumption are less easy targets. So are communities that organise quickly and calmly in the face of disruption.
As you read this, ask yourself: would your town notice if the lights went out for a different reason? Would your local paper be able to separate rumour from sabotage? Would your neighbours mobilise or fragment?
In the shadow between war and peace, those answers matter.
Closing
The burnt restaurant in Tallinn was a small attack in the scale of bombings and battles elsewhere. Yet its story—filmed, investigated, adjudicated—matters because it shows how modern aggression often arrives not with drumfire but with a camera click, a hacked feed, a severed cable, or a vanishing GPS signal. Naming such acts is the first step to resisting them.
“We are not at war,” a retired Nordic general told me, “but this isn’t peace either. It’s a long contest for time, trust and truth.”
And in that contest, citizens, journalists, lawyers, engineers and judges are all combatants of a kind. Are we ready to play that role?
