The New Frontiers of Resilience Illicit Trade, Criminal Infrastructure and the Wider Hybrid Threat

This policy report analyses this intersection of threats, where criminal infrastructure – its pathways, logistics, finance, technology, enablers, access and operational know-how – meets the intent of malign states. Infrastructure is often built for profit. However, once it exists, it can be infiltrated, co-opted, redirected or exploited for strategic goals, particularly by hostile and non-democratic regimes.

This is the crucial distinction the report makes. Not all crime is a hybrid threat. Not all criminal networks are a state proxy. The question is when criminal infrastructure gains strategic-level importance, when hostile regimes use it for their political, military, strategic and economic purposes, and whether we have a system to identify that moment.

Therefore, the report proposes a simple analytical sequence to track the problem at hand: starting with an individual incident, tracing the network of actors and connections behind it, and then assessing whether it forms part of a wider pattern.

While an incident refers to what happened, the net-work shows how it became possible and repeatable. The wider pattern points to whether the capability matters beyond crime. Accordingly, the focus shifts from commodities to capabilities and from cases to supporting infrastructure, or, as we refer to it throughout the report, the criminal infrastructure.

The Baltic experience is a particularly strong test case demonstrating both the use of criminal networks by hostile neighbours and the adaptability of criminal infrastructure. Once the Baltic states had tightened control over their land borders, smuggling routes shifted, first to low-altitude airspace and then to tunnels and high-altitude meteorological balloons. Criminal mobility and knowledge ofborder environ-ments have been leveraged for intelligence purposes,

while sanctions-evasion networks have brought together companies, professional intermediaries, digital finance and cross-border logistics. Although the methods vary, the underlying pattern is consistent: networks adapt, infrastructurepersists and capabil-ities developed for one purpose can be repurposed for another.

Our allies and partners increasingly understand the reality faced by the Baltic states and are responding by strengthening our shared ability to confront the full spectrum of threats posed by hostile regimes and the networks they operate. Our geography and threat perception may differ, yet we share a common task and interest – to defend one billion people and preserve our countries and societies from all types of hostile interference, stemming from both hostile states and criminal networks.

The United States (US) and the Baltic countries of Estonia, Latvia and Lithuania face different border pressures, malign actors and geopolitical circumstances, yet they share the same ultimate goal: providing security for their people. However, this report does not assume the threats and challenges we face are the same. The relevant comparison is not between borders or commodities, but between networks. On both sides of the Atlantic, authorities confront transnational infrastructures that move goods and money across jurisdictions, use legitimate and illicit business structures, adapt technologies and routes, and exploit gaps between institutions.

Our different experiences are also complementary. The Baltic states are on NATO’s border with Russia and Belarus,where criminal ecosystems overlap with sanctions circumvention, hostile intelligence activity and persistent hybridpressure. The US, in turn, has considerable experience in tracing and disrupting complex transnational criminal ecosystems through financial intelligence, sanctions, export controls, as-set recovery and robust enforcement capabilities.

The central conclusion of this report is not that ‘a mere crime’ should be relabeled as a hybrid threat. It is that criminalinfrastructure should be seen increasingly as a security issue. If the same routes, finance, companies, technologies, facilitators or access are repeatedly used for illicit trade, sanctions circumvention, intelligence activity or sabotage, the analytical threshold should be different. A law enforcement problem may also be a national security concern. This has immediate relevance for existing policy instruments. The solution is not another institutional framework. A large number of relevant tools already exist within border security, customs, law enforcement, financial intelligence, counterintelligence, sanctions enforcement, defense and resilience agencies and departments. It is the relationships between them, and what they seek, that must evolve.

Currently, approaches to this issue remain too incident-driven and institutionally stovepiped. A ship-ment is seized, a courier isarrested and a suspicious transaction is blocked or a company sanctioned. Each may be an operational success in and of itself. Butnone necessarily tells us whether the underlying network has been degraded. A seizure interrupts an incident, but network disruption removes capability. Therefore, the report calls for adapting exist-ing mechanisms around various principles: build a shared picture of networks rather than separate national case files; systematically connect criminal and financial investigations with counterintelligence and national security analysis; track how networks adapt following enforcement pressure; establish clearer indicators for when criminal infrastructure requires national security scrutiny; and aim to measure success by capabilities dismantled, assets recovered and net-works degraded, not just by the number of seizures and arrests.

It would also provide a workable agenda for Baltic–US cooperation in this regard. An important founda-tion already exists. Over three decades of National Guard partnerships, Proliferation Security Initiative cooperation, and the US-backed Nuclear Security Centre of Excellence in Lithuania have already shown how intelligence, border security, law enforcement, defense, specialized detection and international cooperation can be networked around a shared threat. The challenge is to extend that logic to a security landscape where the enabling infrastructure itself becomes increasingly important.

The wider point is resilience. NATO and its Allies have understandably focused on strengthening critical infrastructure that the defense of countries and their societies relies upon. The next logical step is to view resilience from the other side as well: what pre-existing infrastructure can an adversary exploit against us? Criminal networks can offer routes, finance, technology, access, local knowledge and expendable manpower that a hostile actor would otherwise have to develop from scratch. Protecting our infrastructure will remain important, but finding and degrading our enemies’ infrastructure is also becoming a resilience issue.