Sondland calls on NATO to flip Russia attribution doctrine, presume Kremlin responsible for hybrid attacks
Intelligence warnings of Russian hybrid attacks on NATO's Eastern Flank frame a doctrine proposal from former U.S. Ambassador Gordon Sondland: when a drone crosses into Eastern European territory, when a power cable is severed beneath the Baltic Sea, or when a weapons factory explodes, the West should treat Vladimir Putin as responsible and require Moscow to prove otherwise. Sondland calls the framework the Godfather Test.
Key takeaways
- Former U.S. Ambassador Gordon Sondland proposes a NATO doctrine, which he calls the Godfather Test, that would presume the Kremlin responsible for hybrid attacks unless Moscow proves otherwise.
- Sondland argues Russia designs operations—using anonymous hackers, commercial vessels, operatives, and criminal proxies—to ensure courtroom-grade proof rarely exists, giving the Kremlin an effective veto whenever the West demands certainty before acting.
- He proposes reversing the burden of proof so that when suspicious acts bear the hallmarks of Russian activity, NATO and EU members presume Moscow responsible while still applying intelligence, judgment, and allied coordination.
- Sondland argues against symmetrical retaliation, saying every act of Russian mischief should leave the Kremlin worse off through a response at a time of NATO's choosing in an area Putin values.
- He recommends that responses not be announced, so Putin knows a price was paid but not necessarily when, where, or how it was imposed.
Intelligence warnings of Russian hybrid attacks on NATO's Eastern Flank frame a doctrine proposal from former U.S. Ambassador Gordon Sondland: when a drone crosses into Eastern European territory, when a power cable is severed beneath the Baltic Sea, or when a weapons factory explodes, the West should treat Vladimir Putin as responsible and require Moscow to prove otherwise. Sondland calls the framework the Godfather Test.
The physical record he cites is already accumulating. Germany has blamed Russia after an explosive-laden drone was found near Ukrainian cargo planes at a major airport. A separate report warns that Russia is using its shadow fleet to probe NATO drone defenses. U.S. intelligence has warned that Russia could launch a limited attack on a NATO ally in an effort to fragment the organization. Poland has flagged Russian and Belarusian pressure pushing illegal migrants toward the alliance.
The attribution trap
Sondland's core argument is structural. Russia designs its operations to ensure courtroom-grade proof rarely exists: anonymous hackers, commercial vessels, intelligence operatives, fabricated local movements, and supposedly independent criminal organizations are the instruments, and plausible deniability is the output. Every incident is treated as a fresh mystery. Investigations open, months pass, public attention fades, allies disagree over evidence thresholds. Russia moves to the next operation before the last one is resolved.
His proposed fix reverses that dynamic. When suspicious acts bear the hallmarks of Russian activity, NATO and EU members would presume Moscow responsible unless persuasive evidence says otherwise. That removes what Sondland describes as the veto the Kremlin holds when the West demands certainty before acting. He is explicit that the presumption should be strong but not mindless: intelligence, judgment, and allied coordination still apply. He argues Putin forfeited the benefit of the doubt through the invasion of neighboring countries, cyberattacks, political interference, assassinations, sabotage, and energy coercion.
The response formula
On what follows a presumed attribution, Sondland argues against matching attacks symmetrically. If Russia damages a cable, NATO need not damage a Russian cable. A symmetrical response lets Putin calculate the price in advance and absorb it as a cost of doing business. The governing formula he proposes is simple: every act of Russian mischief leaves the Kremlin worse off than before, through a response at a time of NATO's choosing in an area Putin values. He names several options: disabling a Russian military capability, compromising an intelligence network, obstructing a revenue stream, exposing hidden assets, disrupting sanctions evasion, or increasing the effectiveness of Ukrainian operations.
The response, he argues, should not be announced. Putin should know a price was paid, he writes, but need not always know when, where, or how it was imposed. With intelligence warnings about the Eastern Flank active and Poland already on alert at the border, whether any government moves to operationalize that posture is the next development to watch.
Related reading
Filed by the newsroom of MarketPR on September 6, 2026. Source: foxnews.com. Indicative figures are not investment advice.