The European Center of Excellence for Countering Hybrid Threats
https://www.hybridcoe.fi/publications/strategic-analysis-how-states-use-non-state-actors-a-modus-operandi-for-covert-state-subversion-and-malign-networks/
Magnus Normark, April 22, 2019 – report here
States with a strong and long-term interest in influencing, manipulating and creating events in other countries to promote their interests will probably utilize different non-state actors in a systematic manner.
Directing activity through non-state entities presents an opportunity to conduct activities of a harmful nature against other countries covertly. Acting covertly through a third entity might even contribute to the foreign state being able to reach its desired objectives without the targeted state being aware that it has been subjected to harmful activities. Acting in a covert mode provides for the ability to deny and refute any potential accusations of involvement in the events. Another feature pertinent to hybrid threat activities is the opportunity to deploy entities in the target country with certain skillsets suitable for specific activities.
Leverage building is often performed within legal boundaries, making it difficult for law enforcement and security services to identify such occurrences and, if they do, to allocate resources for proper investigations.
Our initial ability to understand whether or not these activities are related to covert state direction and support will be very limited. From several view-points, not least a political one, knowing who is instigating the harmful events will be of utmost importance when determining the response and how to deter such threats in the future.