War by proxy is the foggiest war of all

What do rocket strikes by Shiite militias in Iraq, ransomware attacks on targets in the U.S., and Russia's use of mercenaries on battlefields in the Middle East have in common? They are part of a trend in which America's rivals are using nonstate actors and quasi-deniable means to put pressure on its interests.

Washington is frequently finding itself on the business end of a classic strategy — proxy warfare — for which it has yet to devise an effective answer.

Proxy warfare has been around forever. During the age of sail, contending powers commissioned privateers to deplete their enemies' coffers. The British East India Company, while technically a private enterprise, brought large swaths of territory and global trade into London's imperial grasp. During the Cold War, Washington and Moscow enlisted mercenaries, insurgents, activists and other nonstate groups in a fierce rivalry that they both hoped to keep within bounds so as to avoid a major superpower conflict.

Today, the U.S. has worked with nonstate actors to roll back the Islamic State and maintain a geopolitical toehold in Syria. More often, however, America is the target of this approach.

Iran has made a practice of arming and inciting Shiite militias to conduct rocket and drone attacks against U.S. bases and personnel in Iraq, as part of a larger strategy of proxy warfare throughout the Middle East. Vladimir Putin's Russian government employs the mercenaries of the Wagner Group and other organizations to protect Moscow's interests and expand its influence in Syria and Libya.

Russian criminal organizations have allegedly carried out cyberattacks against America's critical infrastructure, most notably through the ransomware attack that shut down Colonial Pipeline earlier this year. The Kremlin's connection to these elements is murky, but it seems unlikely that Putin would tolerate the attacks if he didn't believe they were advantageous to the Russian state.

The allure of proxy attacks is that they offer impact with (relative) impunity. Iran can use Iraqi militias to weaken the U.S. position in Iraq, or gain leverage in nuclear negotiations, without having to openly attack a superpower. Russian criminal groups can foment disorder within the U.S. without fully revealing the Kremlin's hand. And the harder attribution is, the harder it has traditionally been for Washington to justify a sharp, punishing response.

So far, Washington has found it hard to formulate winning countermeasures. Proportional retaliation against the proxies themselves — pinprick airstrikes against Iranian-backed militias; arrests or financial reprisals against Russian criminal groups — doesn't appear to unduly trouble their government sponsors. This is largely because it allows Tehran and Moscow to maintain the myth of deniability and deflect the costs onto more expendable actors. The obvious alternative for Washington is to hit back harder — and be willing to go after the sponsor as well as the proxy.

In 2018, the Department of Defense destroyed a contingent of 200 Russian mercenaries that got too close for comfort in Syria. In early 2020, President Donald Trump ordered the killing of Qassem Soleimani, the commander of Iran's Quds Force, after his Iraqi proxies' attacks on Americans crossed the line.

Similarly, President Joe Biden has reportedly warned Putin that he will retaliate against Russian state interests — perhaps through cyberattacks, perhaps through economic sanctions or other means — if large-scale cyberattacks continue.

The logic is sound. Proxy attacks won't stop until U.S. rivals start to fear that they will suffer more from the American response than they gain from the initial probe. Showing that the U.S. will respond asymmetrically — that it reserves the right to strike back across multiple domains — can inject greater uncertainty into these countries' calculus. And as analyst Michael Knights argues, if Washington can resist publicly crowing about its operations, it can avoid making its enemies feel as though they have no choice but to continue the cycle.

Even so, retaliating against a sponsor doesn't always do the trick. Trump may have shocked the Iranian government by killing Soleimani, but the militia attacks resumed not long thereafter. The root of the problem is that it is hard for a distracted superpower to win contests of coercion and resolve against committed rivals — and the U.S. is the very definition of a distracted superpower vis-à-vis Russia and Iran right now, because it is so visibly trying to focus on China.