The Russian bear isn’t going to wear the same outfit the next time it decides to invade another neighbor. While Moscow used the pretext of defending ethnic Russians and peacekeepers in South Ossetia to overtly invade Georgia in 2008, President Putin learned lessons from how that conflict unfurled. In 2014, unmarked Russian troops masquerading as “Little Green Men” seized all of Crimea, with most Ukrainian police and military personnel responding to Russian incentives and joining Russian forces. While local anti-Russian groups formed in Crimea—one such group, called InformNapalm, identified Russian troops using open-source intelligence, while also uploading data and videos naming and shaming Russian forces—Russia still quickly annexed Crimea and created a “civil war” in the Donbas.

As there typically needs to be a casus belli (a justification for war), the next time Moscow attempts to expand its regional sphere of influence there will likely be a similar pretense for deploying Russian troops. But just as Russia’s approach in Ukraine took on a different form from what was seen in Georgia six years earlier, the Russian costume will definitely be different. A fictional scenario of Russia deploying “Little Blue Helmets” (i.e., fake UN peacekeepers) to a Baltic country (Estonia, Latvia, or Lithuania) illustrates one such new form that Russian revanchism could take. To be clear, this is not to suggest that such an outcome is among the most likely, or even that there is evidence that it sits in a playbook somewhere on a dusty Kremlin shelf. But given some states’ willingness to leverage the legitimate image of peacekeeping operations to pursue their unilateral strategic objectives, engaging with this particular hypothetical scenario offers a useful and plausible means of exploring what options are available to respond to another Russian military adventure abroad. In short, it is aimed at ensuring the United States and its European allies and partners are not caught as flatfooted as they were in 2014. The potential solutions that derive from that exploration are all based on recent Homeland Defense Institute (HDI) fieldwork and interviews in Ukraine and the Baltics.

A Dangerous Baltic Scenario: “Little Blue Helmets” Keeping the Russian Narrative

As best put by US Army Lieutenant Colonel Matt Cavanaugh, a successful land grab requires the predatory country to “be quick and ambiguous . . . because everyone’s on camera these days, so they’re going to figure out who you are. You just want to have a time cushion to seize your objective before the cavalry comes.”

Russia has been extensively waging various attacks against the civil society in the Baltics since Estonia, Latvia, and Lithuania joined NATO in 2004. This has included bankrolling pro-Russian NGOs in each Baltic country and creating the Baltic Media Alliance, based in London, as a way of serving Russian-speaking populations in the Baltics. Such activities undermine strategic and defense thinking in each Baltic country by creating a different infosphere for Russian-speaking citizens in each country, while causing schismogenesis, polarizing pro- and anti-Russian sides in civil society.

A future Russian invasion scenario—based on past behavior, current capabilities, and existing technologies—that could play out in a Baltic country might go like this:

Russian agents infiltrate towns in the eastern parts of a Baltic country that have the most Russian speakers and foment a fake crisis—for instance, creating a narrative of government forces attacking citizens for speaking Russian. This crisis event is merged with a massive Russian sociopolitical-information warfare campaign through social media with fake news and deepfakes, stoking anomie and protests against the supposedly repressive Baltic government. Simultaneously, Russian agents plan, supply, form, and communicate protests against local government officials and buildings, ensuring that large numbers of agitated Russian speakers show up to create a conflict between local authorities and the pro-Russian protesters. Pro-Russian media outlets start sharing “allegations” and “reports” of authorities attacking peaceful demonstrators, creating the narrative of unjust oppression of ethnic Russians in the Baltic country.

In response to this conjured crisis, President Vladimir Putin holds an immediate joint press conference with the president of Belarus, announcing the need to protect the Russian culture, language, and people. Putin declares the immediate deployment of what he says are UN peacekeepers for R2P reasons, staffed with Russian and Belarusian personnel wearing official-looking UN blue helmets. Within hours, the Little Blue Helmets rush over the border in blue armored personnel carriers and blue transport helicopters, each tagged with a hastily painted “UN” on it (and possibly the Cyrillic “MC,” as well). Meanwhile, Russian forces jam the entire electromagnetic spectrum throughout the Baltics, preventing Estonian, Latvian, Lithuanian, and deployed rotational NATO forces from coordinating a military response, let alone being able to utilize cellphones and use GPS accurately to identify Little Blue Helmet locations.

By the time world leaders get briefed on the crisis and the fake peacekeeping mission in the Baltics, Little Blue Helmets have occupied a new chunk of Baltic territory with trenches dug and fortifications established, each Russian position flying United Nations flags. To control information and narratives, Russian forces quickly field their own cellphone towers and networks (e.g., MTS, BeeLine, Megafon, and Tele2), ensuring information dominance within 22–45 miles of each Russian position, while sending propaganda text messages to any local resistance forces.

With a fait accompli established, world leaders decry Putin’s fake operation in the Baltics, finger wagging the violation of international laws and norms, and speak of possible sanctions while at the same time realizing Western European dependence on Russian natural gas pipelines to keep them warm this winter. Meanwhile, NATO commanders struggle with how to militarily respond as Russian air defenses elevate the risks associated with any airborne assault or air campaign, not to mention symbolic issues that might arise with NATO airstrikes against “UN peacekeepers”—regardless of whether these ambiguous Little Blue Helmets not being authorized by the United Nations Security Council.

Shaping and Preventing the Next Innovative Intervention?

When our HDI research team presented this Little Blue Helmets scenario to government and defense officials in Estonia, Latvia, and Lithuania, most responded with some form of, “The Russians can’t do that, it’s not legal.” While this is most certainly a rational response steeped in a belief in international norms and laws, many Ukrainian officials would have said and thought the same thing in 2013 about the prospects of Russia violating Ukraine’s sovereignty as enshrined in the 1994 Budapest Memorandum, which gave security assurances to Kyiv in exchange for giving up its nuclear weapon stockpile. The assumption of Ukrainian security and sovereignty was so ingrained in Ukrainian defense thinking that during our interviews with several government and military officials, they flatly told us that there was no plan or purposeful placement of forces near the Russian border before 2014.

Regardless, in 2021 (and beyond), the specter of the next costumed trick Putin might pull on a neighbor raises a broader issue of what the armed forces of each Baltic country could do, not to mention what NATO and its forces deployed there (each with their own rules of engagement) could do, if such a Little Blue Helmet crisis were to unfold in the Baltics.

While such a scenario might seem unlikely, Putin has been able to exploit the current US-led world order, specifically taking advantage of three US tendencies: “a default toward de-escalation rather than confronting aggression; a desire to compartmentalize issues rather than link them; and complacency about the U.S. role in the world, rather than a drive to compete proactively.” Simply put, US leaders must be willing to defend allies, partners, and friendly nations, in rhetoric and in practice.

A big step in that direction might include forward-deploying more rotational US forces with NATO units in each Baltic country as a way of signaling further US commitment in Eastern Europe, increasing interoperability between US and allied forces, and practicing how to respond to a possible scenario involving Russian aggression (whether with Little Blue Helmets or otherwise). Moreover, countries might take a cue from the Lithuanian military rules of engagement, which, as we learned during interviews there, are comparatively more relaxed during a crisis than rules common among other NATO militaries that are more strict and risk creating tactical paralysis in the face of a rapidly changing situation. This can serve as a stronger deterrent, as can having more auxiliary and volunteer forces (e.g., the Estonian Defence League and the Lithuanian Riflemen’s Union) capable of going underground and leading a resistance movement against any occupying forces. Finally, NATO leadership should consider how to wargame unconventional scenarios—such as one involving Little Blue Helmets—and figure out ways of integrating and coordinating resistance operations, including on-the-ground activists that could expose masquerading Russian forces, much like InformNapalam and Bellingcat did with Russian activities in Ukraine.

For the foreseeable future, Russia will remain a persistent power, and Western leaders must be willing to imagine the many possible characters of future Russian aggression, including the next Russian force will be dressed up in. Failing to do so—and underestimating Russian capabilities and intent—could easily mean the United States and NATO are caught flatfooted again the next time Putin conjures up an unexpected trick.

Jahara “FRANKY” Matisek (@JaharaMatisek) is a senior fellow for the Homeland Defense Institute (HDI) and recently led an HDI research team to Ukraine and the Baltics. He is an active duty US Air Force officer and senior pilot serving as associate professor in the Military and Strategic Studies Department at the US Air Force Academy, and is the director of fellows for the Irregular Warfare Initiative. His forthcoming book, Old and New Battlespaces, describes how adversaries use strategic schismogenesis and employ sociopolitical-information warfare to weaponize everything in society, as every citizen becomes a combatant.

The views expressed are those of the author and do not reflect the official position of the United States Military Academy, Department of the Army, or Department of Defense.

Image: Vehicles from a joint Russian-Belarusian peacekeeping unit are lined up for review before the start of an exercise at the Polivno training ground in Ulyanovsk, Russia (credit: