Hybrid threats in focus for NATO exercise at Luleå University of Technology

How can we strengthen the resilience of renewable energy systems against hybrid threats? This was the focus of the NATO exercise Nordic Pine 25, which took place on 23–25 September, hosted by Luleå University of Technology. Hybrid threats can include for example military aggression, disinformation campaigns and cyber-attacks.

Drone attacks, wind turbines suddenly ceasing to function, and network infiltration were some of the scenarios that participants faced in the NATO exercise Nordic Pine 25. Over three days, about 150 people from around 20 nations practised society's resilience to various types of hybrid threats to renewable energy supply systems. The exercise was organised by NATO Science and Technology Organization (STO), and took place simultaneously in several locations, in Luleå, Munich, Espoo and online, with Luleå as the main site.

The first day focused on threats that could happen now or in the near future, while on day two, scenarios involving an escalated conflict were practised. On day three, participants looked to the future – how can we prepare for hybrid threats that could occur in ten years' time? Hybrid threats are a combination of military and non-military means that can occur in both war and peace.

Actually happening

“Many of the threats we had as a scenario during practice in recent years are things that are actually happening here and now. We are seeing drone incidents at airports, disinformation campaigns and cyber-attacks. If the energy supply fails, it affects the whole society. That is why it is important for NATO that we can meet these threats together and that civil society works together,” says Anton Lif, Project Manager at Saab and Exercise Director for Nordic Pine 25.

During Nordic Pine, participants attended lectures by experts and took part in practical exercises. Groups were presented with a fictional scenario involving an incident and asked to discuss how it should be handled. Researchers in Cyber security from Luleå University of Technology participated in the exercise. In addition, Karl Andersson, Professor of Cyber security, gave a lecture on Campus Total Defence, of which Luleå University of Technology is one of the initiators.

Scenarios to prepare for

One of the participating researchers was John Lindström, Professor of Cyber security. On day two, his group practised a scenario in which offshore wind farms had been hacked through a software update. In addition, something had happened that prevented the service boats from leaving the quay.

“The best thing about the exercise is meeting people from other sectors, seeing things from different perspectives and learning from each other. I conduct research and teach OT security in the manufacturing and process industries, which includes these types of scenarios. I often hold training courses and exercises, and it is very interesting to see it as a participant. These types of threats are already happening, and we need to be prepared,” says John Lindström.