Introduction
Hostile state activity refers to the intentional and aggressive actions undertaken by states aimed at undermining the sovereignty, stability, or influence of other nations. These actions often manifested in the form of hybrid threats that combine both kinetic and non-kinetic tactics, such as sabotage, influence campaigns, cyber-attacks, coercive diplomacy, and economic dependencies.Footnote 1 In recent years, such tactics have become increasingly prominent in global geopolitics, as they offer states low-cost, high impact means of pursuing strategic objectives without triggering open conflict.Footnote 2
Russia is widely recognised as a leading practitioner of sophisticated hybrid tactics against its perceived adversaries.Footnote 3 These activities are not confined to post-Soviet states such as Estonia, Georgia, or Ukraine but also extend to countries beyond its immediate neighbourhood. In this context, the UK holds a particularly adversarial position in Russian strategic thinking. According to Chatham House analysts, Russia perceives the UK as a key proponent of an anti-Russian sentiment in the West, a central security actor within NATO, and a vocal opponent of Russia’s regional and international ambitions. However, Russia also sees the UK as a weaker actor, largely dependent on United States (US) support, which incentivises Russia against the UK, anticipating a less resolute response.Footnote 4 Consequently, Russia has been employing a range of hostile state activities targeting the UK. These include hard and soft power tactics that incorporate persistent conventional provocations, cyber-attacks, and notably, state-sponsored chemical poisoning on British territory, coupled with allegations in attempts to influence critical democratic processes, such as the EU referendum.Footnote 5 As a result, Russia has become ‘the most acute direct threat to the UK’ compared to China and Iran.Footnote 6
In the existing literature, hostile state activity is increasingly recognised as a salient instrument of influence in international relations.Footnote 7 One influential approach to understanding institutional responses draws on historical institutionalism (HI), particularly the concepts of critical junctures and path dependency.Footnote 8 From this perspective, conflicts are seen as moving pictures rather than as snapshots drawing attention to the influence of the timing and sequence of events on conflict dynamics.Footnote 9 Institutions generally tend to follow entrenched trajectories despite political actors being willing to pursue transformation and facing external shocks.Footnote 10 However, the legacies of past decisions and existing policy pathways may constrain room for manoeuvre for political actorsFootnote 11 and often ‘lock-in’ effects that constrain future reform, meaning that institutional inertia can hinder timely adaptation to new or escalating dangers.Footnote 12
This rigidity poses particular challenges for democratic states, which are often more exposed than authoritarian regimes due to their open societies and less centralised control over public and private institutions.Footnote 13 Security and defence sectors frequently raise concerns about this new generation of hostile state activities,Footnote 14 leading major democracies to incorporate it into their security strategies.Footnote 15 In this regard, institutions play a critical role in shaping how states perceive, interpret, and respond to these evolving threats, which increasingly challenge traditional security architectures.Footnote 16
Developing an understanding of how institutions adapt to ambiguous challenges is deemed of significant importance across the literature, primarily because it offers crucial insights into policy trajectories, the effectiveness of strategic responses, and the potential for future institutional evolution. To gain a deep understanding of such ambiguous challenges requires a historical lens, examining when decisions are made, what triggered the decision process, how they are implemented, and how they contribute to enduring patterns of behaviour.Footnote 17 Understanding how external shocks alter inter-institutional relations provides a novel perspective for policymakers, allowing for a more nuanced approach to engagement, as seen in the UK’s efforts to re-engage with EU security policy after Russia’s invasion of Ukraine.Footnote 18 Within this context, Russian hostile activities beyond its immediate neighbourhood in the UK context have been scrutinised in relation to key events such as the 2014 Ukrainian crisis, the 2016 British referendum, and the US presidential election of the same year,Footnote 19 as well as their influence on political and military discourse in the UK.Footnote 20 However, current scholarship does not sufficiently explain the conditions under which Russian hostile activities shape policy discourse or lead to institutional change in affected states.Footnote 21
This article seeks to address this gap by focusing on the UK, a country geographically distant from Russia but increasingly targeted by its hostile campaigns. It investigates whether Russian activities have triggered any institutional change trajectories within the UK, and if so, what those changes were and under what conditions they occurred. Although Russia’s military campaigns abroad have broad geopolitical implications, this article focuses specifically on hostile activities directed at or conducted within the UK and the institutional responses they have triggered. To explore these, the article applies the framework of HI to trace the policy trajectory of successive UK governments and identify key turning points that prompted adjustments in response to Russian-originated threats.
The central argument of this article is that the UK’s institutional adaptation to Russian hybrid threats has been characterised by strong path dependency, with responses remaining reactive, fragmented, and shaped by a continued emphasis on counterterrorism rather than state-based threats. Initial provocations, including the Litvinenko poisoning, failed to punctuate the institutional equilibrium, as economic interests and diplomatic pragmatism absorbed the early shocks. It was only when mounting public pressure and advocacy from epistemic security communities converged with escalating Russian provocations that a tipping point was reached, enabling a shift towards more coordinated and enduring institutional reforms. The critical juncture, therefore, was produced not by external shock alone but rather by the interaction of accumulated pressures, domestic agency, and shifting public legitimacy.
The structure of the article unfolds as follows: the first section introduces the theoretical framework of HI, laying the foundation for the analysis. The following section outlines the empirical methodology employed in the paper, including key data collection and analysis procedures. Based on quantitative analysis, subsequent sections examine two critical junctures, the Litvinenko poisoning and the Skripal attack, separated by a period of accumulating pressures that failed to punctuate the institutional equilibrium.
Historical institutionalism in the context of hostile state activities
The term ‘institution’ is commonly used with varying interpretations, and the existing scholarly discourse lacks a universally agreed-upon definition. Various authors approach institutions from distinct perspectives; some consider them formalised structures like parliamentary assemblies or national security agencies,Footnote 22 while others define institutions as assemblies of rules and processesFootnote 23 or even symbolic systems.Footnote 24 Although each of these definitions presents valid viewpoints, this study adopts the understanding of an institution as proposed by March and Olsen.Footnote 25 Following March and Olsen, an institution is characterised as a ‘collection of interrelated rules and routines that define appropriate action in terms of relations between roles and situations’.Footnote 26 Beyond mere rules, institutions also embody ideas about their purposes and about the identities and practices of their participants.Footnote 27 Ideas are crucial as they shape interests by ordering preferences.Footnote 28 They also serve as repertoires that legitimise interests, institutional arrangements, and political actions.Footnote 29 They specify not only the goals of policy and kind of instruments that can be used to attain them, but also the very nature of the problems they are meant to be addressing.Footnote 30 This is often referred to as the legitimation-based logic of institutional reproduction and change.Footnote 31 From this vantage point, the institution related to countering hostile state activities encompasses a framework of rules and practices that shape the routine of formulating security policies and practices. These rules and practices girdle a spectrum of elements including security laws, a comprehensive compendium of standard operating procedures, and regulatory mechanisms for government institutions.
To comprehend the notion of an institution, it becomes essential to elucidate the concepts of rules and routines. Rules are foundational directives that establish the framework for overarching actions within political institutions.Footnote 32 They serve as regulatory mechanisms, moulding the conduct of institution members, while providing external parties with insights into the institution’s purpose and functions.Footnote 33 Conversely, a routine can be characterised as a dedicated behavioural pattern within an institution, embodying a consistent approach to conducting tasks over time. It also denotes the systematic accomplishment of a specific task in a consistent manner.Footnote 34
In the context of foreign hostile activities, rules and practices establish systematic policy responses directed at foreign states and state-affiliated proxy actors, aiming to mitigate or halt their activities. These components structure a comprehensive policy framework for security institutions to implement. While security agencies are entrusted with addressing malign influence campaigns, they generally resort to established responses that have yielded positive outcomes in the past. Nonetheless, these responses may not invariably yield satisfactory results, thereby necessitating institutional adaptation.
In this study, ‘institutional change’ is operationalised along three interconnected dimensions: (i) legislative reforms, including new statues and amendments to existing law; (ii) organisational restructuring, such as the creation, reform, or empowerment of security and governance bodies; and (iii) shifts in policy orientation, including the reallocation of institutional priorities and resources towards countering state-based threats.Footnote 35 Parliamentary discourse serves as the primary evidential medium through which these changes are traced, functioning as a window onto institutional change rather than as data for discourse analysis per se.Footnote 36
In line with institutionalism theorists like BrunssonFootnote 37 and March and Olsen,Footnote 38 institutions naturally undergo change, as they follow paths that inherently involve such shifts. Change within an institution emerges when adjustments to its rules and practices become necessary to address emerging problems. The growing disparity between environmental conditions and an institution’s normative orientations compels political actors to handle crises or reform the institution to better address these challenges.Footnote 39
Problem-solving is intricately linked to prior experiences. As illustrated by the ‘garbage can’ approach, institutions resemble receptacles where members deposit problems and solutions over time. These embedded responses are utilised whenever solutions are required.Footnote 40 Political actors often rely on established templates when responding to problems.Footnote 41 Over time, however, these customary responses may prove inadequate, prompting adjustments to existing policies and responsibilities. Hence, pursuing different problem-solving strategies entails adjustments to rules and practices, constituting institutional change.
Similarly, just as institutional change occurs, the tactics employed by rival nations and changing environmental conditions correlate with shifts in hostile activities over time.Footnote 42 Consequently, security measures that were once effective may now fall short in addressing newly emerging hybrid threats. Public dissatisfaction with policies and media attention pressures governments to swiftly address ongoing policy failures. The inability to curb or eradicate hostile activities targeting democracy forces domestic political actors to initiate institutional changes.
Historical institutionalism, unlike sociological and rational-choice institutionalism, prioritises the examination of historical legacies, highlighting how past events and contexts shape institutional frameworks and influence political behaviour.Footnote 43 This theory posits that when an institution is established, it follows a particular path where political actors tend to persistently adhere to initial policy choices. As PiersonFootnote 44 contends, the cost of shifting to a new policy and new responsibilities outweighs the benefits of maintaining the existing one, leading to uncertainties as institutions navigate change.Footnote 45 Therefore, to reduce the adaptation cost of new policies, policymakers prefer continuity, a tendency labelled ‘path dependency’ by historical institutionalism scholars.Footnote 46 This path fosters political stability, characterised by Krasner as ‘a state of equilibrium’,Footnote 47 within which public institutions institutionalise members’ activities, creating a procedural framework shaped by rules and practices.
However, this adherence to the same path, an extension of initial policy choice, is not always feasible due to shifting environmental conditions. External crises stemming from the broader institutional environment disrupt the long-term stability of institutions. Such crises disturb equilibrium and impose substantial pressure on political actors to embrace institutional change and delegate responsibilities to institutional actors.Footnote 48 If this pressure is sufficient to shift equilibrium, inertia within the institution is disrupted, paving the way for a new policy path through institutional change. This new policy path then becomes the new equilibrium until disrupted by another crisis.
Another key explanation for institutional change within historical institutionalism is the idea of ‘critical junctures’, a concept akin to punctuated equilibrium.Footnote 49 Critical junctures propose that institutional inertia is upset not solely due to external crises punctuating political equilibrium stability, but also when the policy path reaches a critical juncture wherein environmental conditions and internal political dynamics converge to trigger institutional change.Footnote 50 During such junctures, the cost of institutional change and responsibility sharing is significantly lower than continuity, prompting political actors to revise the existing institutional framework.Footnote 51 The critical junctures concept not only pays attention to exogenous crises but also acknowledges the influence of domestic political actors in generating substantial institutional change. Not considering the role of individuals and internal dynamics that drive significant institutional change would render the historical institutionalism explanation inadequate and underscore the weakness of agency.Footnote 52 Thus, the critical juncture concept complements historical institutionalism by offering deeper insights into internal dynamics and the role of domestic political actors and agencies.Footnote 53
While punctuated equilibrium emphasises abrupt change in response to external shocks, institutional change can occur through gradual mechanisms within path-dependent trajectories. Mahoney and Thelen identify four modes of gradual change – layering, drift, conversion, and displacement – that can operate beneath the surface of apparent stability.Footnote 54 Additionally, Soifer argues that critical junctures vary in magnitude: some create only ‘permissive conditions’ for change without immediately triggering it.Footnote 55 This distinction is analytically significant for the present study, as it allows us to account for periods in which external provocations accumulate without producing immediate institutional reform, while recognising that such accumulation may lower the threshold for change when a decisive shock eventually arrives.
Within the context of countering hostile activities, states facing such campaigns initiate relevant policies to safeguard their citizens and democratic institutions. Over time, the adopted rules and practices for countering such threats become routinised, forming a policy path for governments and national security agencies. While governments effectively combat hostile threats, a stable equilibrium prevails, and inertia is ingrained within security policy. However, sudden and ambiguous hostile actions that influence the perception of citizens have the potential to trigger government crises. These crises disrupt the existing security equilibrium and exert substantial pressure on governments to alter policy. To avert endangering citizens’ safety and mitigate electoral costs due to political inertia, governments confronted with destabilising security threats opt to revise their existing policy.
Security policy transformations are influenced by not only external crises arising from ambiguous attacks but also shifting environmental conditions that create new opportunities for institutional change. These evolving conditions enable political actors, such as security agencies, to initiate changes they previously lacked the capacity to enforce, thereby driving institutional shifts in countering hostile activities. Drawing on Haas’s concept of epistemic communities, networks of professionals with recognised expertise and authoritative policy-relevant knowledge,Footnote 56 we use the term ‘epistemic security communities’ to refer to actors such as the Intelligence and Security Committee (ISC), MI5 leadership, and security-focused policy institutes whose knowledge claims can shift policy debates and legitimise institutional reform during periods of structural uncertainty.
Critical junctures act as pivotal opportunities for security agencies to advocate for substantial changes to existing policy paths. However, institutional change does not always follow immediately. When hostile actions become increasingly frequent, intense, or prolonged, the accumulated pressure can eventually render the status quo untenable. In such cases, institutional change reflects a ‘conjunctural causation’; no single factor, whether external shock, public pressure, or epistemic advocacy, is sufficient on its own.Footnote 57 Rather, it is the convergence of these factors at a specific temporal moment that renders the status quo untenable and opens a window for reform.
Methodology
To understand the dynamics of institutional change in the UK associated with Russian hostile state activities, this article employs a mixed-method approach, combining both quantitative and qualitative techniques in a two-stage sequential analysis.Footnote 58 This design allows for a comprehensive exploration of both patterns of interaction and their contextual institutionalimplication.
In the first stage, we identified the critical junctures by analysing the longitudinal trajectory of UK–Russia bilateral relations event data methodology, which is particularly well suited for tracing the temporal evolution of interactions between states and for detecting abrupt shifts in their relationships.Footnote 59 Event data refers to systematically coded, time-stamped records of political interactions derived primarily from news sources. These data capture ‘who did what to whom, when, and sometimes where’, offering structured insights into state and non-state behaviour.Footnote 60 To ensure consistency and comparability, events are classified using standardised ontologies such as the Conflict and Mediation Event Observations (CAMEO) frameworkFootnote 61 or the more recent Political Language Ontology for Verifiable Event Records (PLOVER).Footnote 62 These ontologies define categories for political acts, including threats, negotiations, or cooperation, which are then translated into numeric scores using the Goldstein Conflict-Cooperation Scale, ranging from −10 (highly conflictual) to +10 (highly cooperative).Footnote 63 This scoring system enables the quantification of political dynamics and facilitates the identification of critical junctures, moments of heightened conflict or cooperation, that may signal turning points or institutional shifts in foreign policy, particularly in contexts like the UK’s evolving stance towards adversarial actors.
For this study, we utilised the Integrated Conflict Early Warning System (ICEWS) event dataset, a machine-coded, open-source corpus developed with support from the USA Defence Advanced Research Projects Agency (DARPA)Footnote 64 and its successor, the POLitical Event Classification, Attributes, and Types (POLECAT) dataset, which was last updated in June 2024.Footnote 65 Despite their distinct methodologies – ICEWS using the CAMEO ontology and Goldstein scale and POLECAT employing a new machine-learning coder based on PLOVER – the difference in approach does not impact their scalability, as both are designed to automate analysis of vast datasets, and their scalability is primarily determined by computational efficiency rather than the event coding framework itself.
We have chosen 2001 as the starting point because this year marks the consolidation of Vladimir Putin’s foreign policy vision and the onset of a new era in UK–Russia relations, notably shaped by post-9/11 security alignments and evolving geopolitical tensions.Footnote 66 This timeframe captures both the cooperative overtures of the early 2000s and the subsequent deterioration of bilateral relations, providing a coherent analytical window.
The extracted dyadic subset is then examined to track fluctuations in conflictual versus cooperative behaviour, enabling us to pinpoint key inflection points.Footnote 67 To visualise these points, we used the daily dyadic intensity scores provided in these datasets, which quantify the cooperative and conflictual tone of UK–Russia interactions on a continuous scale. These daily scores are aggregated into yearly averages, and then plotted using Python libraries (Pandas, Matplotlib, and NumPy). This visualisation gave us the empirical basis for identifying critical junctures in the bilateral relationships and serves as a foundation for the second stage of the analysis. Based on the fluctuating intensity shown in Figure 1, we identified two critical junctures, the Litvinenko poisoning (2006) and the Skripal attack (2018), bookending an intervening period of fluctuating but ultimately absorbed tensions.
United Kingdom and Russian Federation: Dyadic conflict–cooperation score (2001–24).
Figure 1 Long description
A line graph showing the UK-Russia relations annual dyadic conflict-cooperation score from 2001 to 2024. The x-axis represents the years from 2001 to 2024 and the y-axis represents the score ranging from negative 4 to positive 4. The graph highlights two significant events: the Litvinenko poisoning in 2006 and the Salisbury poisoning in 2018, marked by shaded areas. The line indicates fluctuations in cooperation (positive) and conflict (negative) over the years, with notable declines around the highlighted events.
The first period covers the years between 2001 and 2007 and captures an initial attempt at cooperation, visible in relatively stable positive intensity, but critically shows the emergence of deep divergences that culminated in events like the Litvinenko poisoning, making the closure of cooperative pathways.
The second period reveals a fluctuating pattern between 2007 and 2018. Despite potential brief recoveries, it shows recurrent and increasingly severe drops in intensity, leading to deep antagonism. Crucially, however, the interaction scores during much of this period remained largely positive (Figure 1), indicating that despite growing hostility, the existing institutional equilibrium absorbed these shocks. This persistence of positive scores is analytically significant: it highlights the strength of path dependency in preventing institutional adaptation even amid escalating provocations.
The third period, spanning 2018-2024, shows intensity plummeting to its lowest points, signifying that the established antagonistic path had become so deeply embedded that it inevitably led to the complete breakdown of relations with the Skripal poisoning and full-scale invasion of Ukraine in 2022.Footnote 68
The second stage of the analysis builds on a qualitative content analysis to investigate the institutional changes in the UK in response to Russian hostile activities. The data collection began with a systematic search of written answers and parliamentary debates from the UK Parliament’s official records. Specifically, the Hansard database was queried using the keyword ‘Russia’ in combination with additional terms linked to institutional transformation and event-based triggers, such as ‘National Security Act’, ‘Litvinenko’, and ‘Skripal’. These keywords were selected based on existing literature highlighting the multifaced nature of Russian hybrid threats and the typical institutional domains they target.Footnote 69
Hansard was selected as the primary qualitative source for three reasons. First, as the official verbatim record of UK parliamentary proceedings, it provides direct evidence of legislative outputs, the passage of bills and statutory instruments, that constitute the most observable dimension of institutional change. Second, parliamentary debates capture the deliberative process through which security threats are framed and institutional responses are legitimised, particularly through Select Committee reports. Third, Hansard allows systematic tracing of how specific events were discursively linked to calls for institutional reform.Footnote 70 In total, fifty-nine parliamentary records were retrieved through keyword searches, of which fifteen were identified as relevant to institutional responses to Russian hostile activities and subjected to thematic analysis.
The retrieved results, comprising both hyperlinked documents and textual data, were examined manually. Each record was reviewed in full to identify and summarise key parliamentary debates that may indicate whether specific institutional changes were framed as counter-measures to Russian hostile actions. Where relevant debates were identified, direct quotations and precise references from Hansard records were extracted. These excerpts were then thematically organised to trace the relationship between parliamentary discourse and institutional adaptation. The resulting dataset was triangulated with secondary academic and policy sources to contextualise the findings and assess whether identified institutional changes were plausibly linked to countering Russian hostile activities.
2001–2007: Post–Cold War de-prioritisation rupture
Although the post-9/11 security landscape brought new global priorities for the UK, particularly around terrorism, the threat posed by Russia was far from new. It dates back to the Cold War, when the Soviet Union prioritised espionage over diplomacy by deploying intelligence officers under diplomatic cover.Footnote 71 In response, the UK routinely expelled suspected agents, most notably 105 in 1971, establishing expulsions as a standard counter-measure.Footnote 72
From the end of the Cold War, marked by the collapse of the Soviet Union, Russia was no longer seen as an immediate strategic threat. This was due to its diminishing global influence and the internal challenges it faced, including economic instability and political restructuring.Footnote 73 As a result, the human and financial resources once dedicated to countering Soviet threats were significantly reducedFootnote 74 with an understanding that ‘it is dying business’.Footnote 75 Resources and institutional priorities were redirected towards emerging domestic threats, particularly groups associated with the Irish Republican Army (IRA). However, the Good Friday Agreement in 1998 brought about a ‘ceasefire’, stabilising the political situation in Northern Ireland.Footnote 76
Following this shift, the primary focus of the UK’s security institutions moved towards international terrorism, especially in the wake of the 9/11 attacks. The 2005 London bombings further reinforced the securitisation of home-grown terrorism. In response, nearly all UK security institutions reallocated their operational priorities and budgets towards counterterrorism. For example, the London Metropolitan Police dedicated 75 per cent of their resources to counterterrorism investigations following the attacks.Footnote 77 Similarly, MI5, Britain’s domestic intelligence service, assigned only 20 per cent of its efforts to hostile state activities, with the majority concentrated on terrorism.Footnote 78 From a historical institutionalism perspective, these shifts represent path-dependent changes in institutional priorities, replacing hostile state activities with countering terrorism, laying the groundwork for subsequent resource allocation and threat perceptions.
Simultaneously, Russia under Vladimir Putin was also undergoing a distinct transformation. When Putin took power in 1999, he inherited a weakened post-Soviet state facing political and economic turmoil.Footnote 79 Despite these weaknesses, Russia retained significant assets: a large military, a nuclear arsenal, a robust intelligence community, and permanent membership in the United Nations Security Council. However, it also faced considerable structural constraints, including a shrinking population, economic dependency on natural resources, weak alliances, and fragile democratic institutions. Putin, with his Committee for State Security (KGB) background, sought not democratic reform but rather to restore Russia’s status as a ‘great power’ by leveraging existing strengths.Footnote 80 This strategy further contributed to the West’s downplaying of the Russian threat; as the ISC’s 2020 Russia Report later acknowledged, the UK intelligence community had progressively deprioritised Russia as a strategic threat following the end of the Cold War.Footnote 81 The reallocation of resources towards counterterrorism further entrenched this institutional trajectory.Footnote 82
This diminished threat perception was reinforced in the post-9/11 era. Putin swiftly condemned the terrorist attacks and positioned Russia as a partner in the global war on terror.Footnote 83 By aligning the international terrorism agenda with Russia’s own conflicts in Chechnya and the North Caucasus, Putin embedded Russia into the Western security discourse.Footnote 84 He advocated multilateral cooperation, portraying himself as a pragmatic commemorator with the West, despite residual tensions from the Cold War.Footnote 85 A symbolic culmination of this rapprochement was Putin’s 2003 state visit to the UK, the first by a Russian head of state since Tsar Nicholas I in 1843.Footnote 86 These developments signalled an institutional consensus in the UK that deprioritised Russia as a threat, reinforcing existing security pathways oriented around terrorism rather than state-based conflict.
This institutional framing is also reflected in the data presented in Figure 1. Between 2000 and approximately 2004–5, UK–Russia relations were relatively stable and even cooperative, with interaction intensity levels constantly above ‘2’. This stability did not trigger institutional change because it reinforced existing assumptions within UK security institutions that Russia no longer posed a strategic threat. The prevailing interpretation was that cooperative engagement with Russia was both viable and desirable, which sustained the post–Cold War path dependency and validated the reallocation of resources towards counterterrorism rather than hostile state activity.
The diminishing threat perception towards Russia immediately after the Cold War did not last long, with periods of minor tensions combined with efforts to maintain diplomatic relations. The colour revolutions in the vicinity of Russia, including the Rose Revolution in Georgia, (2003), the Orange Revolution in Ukraine (2004), and the Tulip Revolution in Kyrgyzstan (2005), were gradually perceived by Russia as meddling in the region by western powers, including the UK, with a view to diminishing Russian power and influence in and around former Soviet states.Footnote 87 Furthermore, rejection of extradition demands for dissidents of Putin – such as Boris Berezovsky and Aleksandr Litvinenko, who were granted asylum status – was seen as providing sanctuary to individuals who actively opposed and criticised the Russian government and perceived as indirect support of anti-regime activities.Footnote 88
As shown in Figure 1, a sharp decline in UK–Russia relations occurred in 2006–7, with interaction intensity bottoming out at nearly ‘−1’ – indicating a punctuated equilibrium of significant diplomatic and security tension. This dramatic downturn corresponds with the poisoning in late 2006 of Aleksandr Litvinenko, a former Russian Federal Security Service (FSB) officer who had publicly exposed corruption within the FSB and alleged political assassinations ordered by President Putin. His death marked a profound rupture in bilateral relations and served as a high-profile incident that crystallised growing mistrust between the two states.Footnote 89
An investigation by the Metropolitan Police and the Crown Prosecution Service concluded that there was enough evidence to charge Andrey Lugovoy with the murder of Litvinenko by deliberate poisoning. However, despite repeated efforts by the UK’s Foreign and Commonwealth Office and Home Office to extradite Lugovoy, Russia refused to hand him over.Footnote 90 In response to Russia’s non-cooperation, Foreign Secretary David Miliband announced a ‘package of measures’ against Russia.Footnote 91 However, these measures were limited to diplomatic actions such as expelling four Russian diplomats and did not lead to a broader reorientation of institutional priorities or structural change.Footnote 92 In fact, when asked in a parliamentary debate whether the UK government planned to impose new passport or immigration controls on visitors from Russia following the poisoning, the Home Secretary stated that ‘no changes are planned to immigration control’.Footnote 93
From a historical institutionalist perspective, this period illustrates how the post-9/11 reorientation towards counterterrorism created a new institutional path that effectively ‘locked in’ threat prioritisation away from state-based activities. The Litvinenko poisoning, while constituting a significant external shock, can be understood as a ‘failed critical juncture’.Footnote 94 The exogenous crisis was present, but the cost of institutional orientation was perceived as exceeding the benefits of continuity. The government’s response, limited diplomatic expulsions without structural reform, exemplifies the ‘garbage can’ logicFootnote 95 whereby pre-existing solutions are applied to novel problems, reinforcing rather than disrupting the prevailing equilibrium.
2007–2018: Accumulating pressures and the limits of institutional adaptation
Even though UK–Russia relations reached a critical low point in 2006–7 following the poisoning of Alexander Litvinenko, as shown in Figure 1, relations between the two countries recovered to positive territory in the following years. This was a period marked by cautious re-engagement, even as Russia’s actions, such as its 2008 invasion of Georgia, raised concerns in the West. The election of Barack Obama in 2008, who aimed to reset relations with Russia, contributed to an improved international climate that positively influenced UK–Russia ties.Footnote 96 In this context, Prime Minister David Cameron visited Moscow in 2011, and Present Putin returned the gesture during the 2012 London Olympics, where the two sides engaged in dialogue on the Syrian conflict and trade relations.Footnote 97 These interactions were followed by further meetings at the Foreign and Defence ministerial levels.Footnote 98
Despite these diplomatic gestures, the relationship remained structurally fragile. Tensions over unresolved issues, including extradition disputes for the Litvinenko poisoning, persisted. The growing instability in Syria further highlighted these divisions, while Russia’s dismissive tone, captured in a Russian spokesman’s reference to Britain as a ‘small island no one listens to’, signalled the deeper frictions between the two states.Footnote 99 As shown in Figure 1, relations entered a period of pronounced volatility, marked by temporary recoveries followed by renewed downturns, an indication of an unstable equilibrium, in which each improvement was quickly reversed. The persistence of positive interaction scores, coupled with the absence of institutional reform markers in Figure 2, is analytically significant. Rather than signalling reduced hostility, it reflects the strength of path dependency whereby diplomatic engagement continued as a routine practice even as underlying tensions deepened. Each provocation generated short-term declines but failed to push the system beyond the threshold required for strategic reorientation. This pattern illustrates ‘permissive conditions’.Footnote 100 The external environment was increasingly favourable to change, but the internal political costs of abandoning the existing path remained prohibitively high.
United Kingdom and Russian Federation: Dyadic conflict–cooperation score with institutional changes (2001–24).
Figure 2 Long description
A line graph showing the United Kingdom and Russian Federation dyadic conflict-cooperation score from 2001 to 2024. The x-axis is labeled 'Year' and the y-axis is labeled 'Average Dyadic Score (-10 to 10)'. The graph is divided into three phases: Phase 1 (2001-2005), Phase 2 (2006-2014) and Phase 3 (2015-2024). Key events are marked with labels: 'U.S. Invasion' in 2003, 'Litvinenko poisoning' in 2006, 'Salisbury poisoning' in 2018 and 'Counter-terrorism Act' in 2019. The graph shows fluctuations in scores, with notable declines during the marked events. The score generally trends downward in Phase 1, fluctuates in Phase 2 and shows some recovery in Phase 3. The graph includes annotations for 'Schröder's presidency' and 'National Security Council' in Phase 2 and 'Brexit' and 'Russian Act' in Phase 3.
In this context, the establishment of the National Security Council (NSC) in 2010 aimed to centralise national security decision-making, integrating defence, diplomacy, and development to strengthen the UK’s global position amid growing transnational threats.Footnote 101 Although the NSC was not formed in response to Russian hostile activities, its establishment was primarily driven by the need for centralised security coordination amid the Afghanistan campaign and prime ministerial oversight.Footnote 102 It inadvertently introduced an institutional layer.Footnote 103 This new coordinating structure did not replace the existing arrangement but provided the organisational foundation on which post-2018 reforms would later build.
Despite periodic attempts at rapprochement, the annexation of Crimea in 2014, Russia’s intervention in Syria, and its support for separatists in eastern Ukraine escalated tensions again. These actions were viewed in the UK as direct challenges to the liberal international order.Footnote 104 In response, the UK joined its allies in suspending Russia from the G8, coordinated sanctions with the United States and EU, and endorsed a stronger NATO posture in Eastern Europe.Footnote 105 The UK also began providing non-lethal military support to Ukraine.Footnote 106
At this time, the UK remained a central actor within the EU, playing a leading role in shaping the Union’s sanctions regime against Russia. From Moscow’s perspective, the UK was one of its most vocal and effective adversaries within the bloc.Footnote 107 Therefore, the UK became a particular target for Russian disinformation campaigns, especially during the 2016 Brexit referendum. Rather than promoting a specific position, Russian influence operations focused on amplifying existing political divides.Footnote 108 These campaigns adopted a ‘flooding the zone’ approach, disseminating a blend of accurate, misleading, and false information designed to erode trust and polarise public opinion.Footnote 109 Russia’s international media outlets, such as RT and Sputnik, served as platforms for these narratives, often providing visibility to far-right discourses and anti-EU sentiment.Footnote 110
Russia’s malign information strategy extended beyond Brexit. Following several terrorist attacks in 2017, including the Westminster Bridge incident, Russian-linked accounts spread competing narratives via Twitter, some explicitly anti-Muslim, other condemning Islamophobia. These dual messages aimed to exacerbate social tensions and heighten political discord.Footnote 111 A key tactic involved testing multiple narratives, what Ellehuus describes as ‘trial balloons’, to gauge audience reaction before amplifying the most effective messages.Footnote 112 Often, these were first deployed on fringe digital platforms before being introduced into more mainstream online spaces. The strategy aimed not only to confuse but also to shift perceptions, exploiting societal fault lines to open cognitive gaps and reshape public attitudes.Footnote 113
In sum, the 2007–18 period does not constitute a critical juncture in the conventional sense. Rather, it represents a phase of accumulating pressures in which the institutional equilibrium was repeatedly tested but not broken. The absence of structural reform is not a null finding; it constitutes evidence of the high threshold required for institutional adaptation to ambiguous hybrid threats. The NSC’s creation was an institutional layer, and the gradual drift of threat perceptions created permissive conditions that would lower the cost of change when the Skripal crisis provided the decisive shock.
2018–2024: Crisis-driven comprehensive reform
The attempted assassination of Sergei Skripal in Salisbury in 2018 marked a significant punctuation in the deterioration of UK–Russia relations, as shown in Figure 1. Skripal, a former Russian military intelligence officer who had acted as a double agent for British intelligence in the 1990s and early 2000s, had been convicted in Russia for treason before being released to the UK as part of a spy swap in 2010. Despite Russian denials and efforts to deflect responsibility,Footnote 114 the UK government responded with the expulsion of twenty-three Russian diplomats,Footnote 115 who had been identified as undeclared Russian intelligence officers,Footnote 116 as a routine response to Russian hostile activities. This was followed by immediate reciprocal actions from Russia, including the closure of the British consulate and British Council in RussiaFootnote 117 and underestimating the UK’s geopolitical relevance with the words saying, ‘The scope and place of Great Britain in Russian politics is not that big’.Footnote 118
These developments took place amid a sharp rise in public concern. A 2018 Pew Poll found that 67 per cent of Britons viewed Russia unfavourably, while 75 per cent expressed no confidence in Putin.Footnote 119 This shift in public sentiment coincided with and plausibly reinforced the conditions for reforms. As Home Secretary Javid emphasised, the government’s task was to ensure authorities had ‘powers to tackle the evolving threat to the UK from terrorism and from hostile state activity and powers to keep the public safe’,Footnote 120 explicitly linking public safety concerns to the legislative agenda. While definitive causation cannot be established from parliamentary sources alone, the temporal alignment between rising public hostility and the government’s subsequent reform trajectory suggests a mutually reinforcing dynamic. In this context, the Skripal incident not only fractured diplomatic relations further but also marked a turning point in the UK’s strategic institutional posture towards Russian aggression. Theresa May’s government signalled a strategic policy shift and announced new legislative proposals to counter hostile foreign activities, a move she directly linked to the attack ‘We are urgently developing proposals for new legislative powers to harden our defences against all forms of hostile state activity’.Footnote 121 This Parliamentary commitment provides direct evidence of how an external shock was translated into an institutional reform agenda.
The first key legislative outcome was the Counter-Terrorism and Border Security Act 2019, which came more than a decade after the Litvinenko poisoning, when the opposition asked whether the government had any additional border controls for people coming from Russia.Footnote 122 The Border Security Act expanded powers at ports and borders to include stopping and questioning individuals suspected of ‘hostile state activity’.Footnote 123 While the Act’s primary focus was on strengthening counterterrorism measures, its provisions clearly responded to the threat exemplified by the Skripal attack.Footnote 124
In addition to negative public perception, the ISC’s 2020 report on Russia played a key role in facilitating further institutional change, despite Prime Minister Boris Johnson’s attempts to block and delay its release due to UK government elections.Footnote 125 This report concluded that the UK’s Cold War–era legislative framework was no longer suited to counter new-generation hostile activities, particularly given the transformation of the information environment. The report also exposed serious ambiguities in responsibility for addressing the ‘Russian threat’, noting that tasks are fragmented across different institutions. The Department for Digital, Culture, Media and Sport (DCMS) was tasked with countering disinformation despite being one of the smallest Whitehall departments, while the Electoral Commission oversaw the democratic process. The ISC criticised this fragmented structure, finding it surprisingly difficult to identify which institution held overarching responsibility, and recommended comprehensive legislative reform.Footnote 126 Crucially, the Committee’s explicit conclusion was later invoked directly during parliamentary debates on the National Security Act (NSA) 2023. As one Committee member noted in the Lord’s debate: ‘The ISC first recommended reform of the outdated Official Secrets Act almost 20 years ago, in 2004… the ISC’s Russia report explicitly and simply stated that ‘the Official Secrets Act regime is not fit for purpose’'.Footnote 127 This chain from committee recommendation to parliamentary citation to enacted legislation constitutes evidence of institutional agency driving reform.
In response to these critics, in March 2021 in the Government’s Integrated Review of Security, Defence, Development and Foreign Policy, Boris Johnson’s government announced its intention to introduce legislation to counter state threats to give security and intelligence agencies the necessary power to tackle hostile state activities.Footnote 128 This decision was followed by launching a consultation on Legislation to Counter State Threats in May 2021 and by issuing a response to the consultation that laid the groundwork for future legislation.Footnote 129
During this period, key epistemic security actors played a decisive role in shaping the reform agenda. MI5 Director-General Ken McCallum’s annual threat update explicitly highlighted the critical legal deficiencies, stressing that it was neither a criminal offence to act as an undeclared foreign intelligence agent nor illegal to hold influential positions in the UK while secretly being funded by a foreign state, and concluding that ‘to tackle modern interference, we need modern powers’.Footnote 130 The NSA later directly addressed each of the gaps McCallum identified, demonstrating the traction of epistemic advocacy within the policy process. This sequence, from expert-driven problem identification through Home Office consultation to enacted legislation, provides clear evidence of how security community agency interaction with external threats drove institutional change at a critical juncture by legitimising and steering reforms under conditions of structural uncertainty.
Russia’s full-scale invasion of Ukraine in February 2022 served as a critical accelerating point that finally forced the UK to confront its role in enabling Russian illicit finance. The government introduced the Economic Crime Act (ECA) (2022) to target oligarch wealth, addressing years of criticism about Britain’s ‘light and limited touch to regulation’, which had allowed London to become what critics called a ‘laundromat’ for dirty money, supported by a ‘growth industry of enablers’.Footnote 131 The legislation’s long delay, despite commitments since 2016 and bipartisan support, highlighted institutional failures, with opponents arguing it was hypocritical to oppose Russian aggression abroad while tolerating its corruption at home.Footnote 132 Persistent obstacles, including alleged conflicts of interest from Russian-linked political donations and repeated failures to implement promised reforms like the Overseas Entities Bill, had previously blocked progress.Footnote 133 The Act’s key provisions, including a public register of overseas property ownership and measures to deter oligarch lawsuits,Footnote 134 represented a belated but significant shift. The ECA exemplifies a conjunctural causation; sustained cross-party parliamentary pressureFootnote 135 had gradually eroded the legitimacy of inaction, but it was Russia’s full-scale invasion of Ukraine that supplied the immediate catalyst. Neither domestic pressure nor geopolitical shock was sufficient on its own; it was their convergence that ultimately overcame years of political inertia and institutional resistance.
Beyond financial measures, the UK further tightened electoral integrity rules to curb foreign influence through the Election Act 2022. The Act restricted third-party campaigning in the UK elections to UK-based groups and eligible overseas electors and introduced a restriction on ineligible foreign third-party campaigning above a £700 de minimis threshold.Footnote 136 This legislation aimed to enhance transparency in political funding by, for instance, requiring digital imprints on online campaign material. However, despite these changes, critics argue that existing electoral law was ‘riddled with loopholes’ that allowed foreign money to be channelled through lawful donors.Footnote 137 For instance, the Election Act 2022’s expansion of overseas British citizens’ voting rights made it difficult to check their identity or the origin of their donations.Footnote 138
In addition to these institutional changes, the NSA 2023 represented the most significant overhaul of the UK’s national security law in over a century, updating the over 100-year-old Official Secrets Acts introduced in 1911 to address modern challenges such as espionage, sabotage, and foreign interference.Footnote 139 This legislation came while the UK faces a growing, diversifying, and evolving threat from malign state activity, with state threat investigations by MI5 increased by nearly 50 per cent in a year and police investigations up fivefold since 2018.Footnote 140 A key, transformative component of the NSA 2023 is the establishment of the Foreign Influence Registration Scheme (FIRS), which aims to deter state threats and provide transparency on foreign power influence in the UK. Russia has been specified along with Iran on the enhanced tier of FIRS, reflecting its acute threat to UK security.Footnote 141
Recognising the increasing use of online platforms for disinformation and foreign interference, the UK enacted the Online Safety Act (OSA) 2023. This legislation aims to protect users from illegal content and activity, including state-sponsored disinformation campaigns, notably from Russia, intended to interfere with the UK’s democratic processes.Footnote 142 Previously, the responsibility for countering disinformation was fragmented across various government departments, which benefited adversaries.Footnote 143 Before the OSA, foreign interference was designated a priority offence under the NSA, thereby reinforcing the OSA’s capacity to address the impact of state-sponsored disinformation in the UK.Footnote 144 OSA imposes obligations on online platforms to protect users from illegal content and mandates platforms take proactive steps to identify, filter, moderate, and remove state-sponsored or state-linked disinformation interfering with UK political decision-making.Footnote 145 The Act also empowers Ofcom as the new independent online safety regulator, with robust powers to enforce these responsibilities, including substantial fines up to £18 million or 10 per cent of qualifying worldwide revenue.Footnote 146 However, the effectiveness of this institutional change faces inherent critics, who arguing that the Act is ‘too slow and too weak’ to keep pace with rapidly evolving technology and lacks sufficient power to challenge major tech companies, some of which are reportedly ditching rules and firing compliance officers while continuing to pump out disinformation. It may also be ‘watered down’ in trade negotiations with the UK, which remains a significant vulnerability.Footnote 147
The 2018–24 period represents a productive critical juncture. Unlike the Litvinenko case, the Skripal poisoning produced a cascade of reforms because three things converged: (i) accumulated prior provocations had eroded the legitimacy of inaction; (ii) epistemic security actors used the crisis to advocate for long-sought reforms, providing the process-tracing evidence documented above; and (iii) public opinion shifted decisively against Russia, raising the electoral cost of continued path dependency. The legislative programme demonstrates that institutional change in response to hybrid threats arrives not incrementally but in concentrated bursts once the threshold for disrupting equilibrium is crossed.
Conclusion
Since Russia reasserted its global ambitions and expressed growing hostility towards Western influence, particularly in response to the colour revolutions and NATO’s eastward expansion, the UK became an increasingly prominent target. As a vocal critic of Russian influence in the EU, a key NATO member, and a sanctuary for Russian dissidents, the UK was positioned at the intersection of geopolitical confrontation. Despite the 2006 poisoning of Alexander Litvinenko marking a critical moment in bilateral tensions, it did not produce an immediate institutional shift in the UK’s approach to hostile state activities. Instead, the British state maintained its counterterrorism-centric institutional trajectory, demonstrating a strong path dependency. Political leadership opted to reset relations with Russia, prioritising diplomatic pragmatism and economic interests, particularly as significant flows of Russian capital entered London’s financial and property markets.
This institutional inertia persisted even in the face of mounting provocations, including Russia’s aggressive interventions in Ukraine and Syria, and its disinformation campaigns during the Brexit referendum. The 2018 Skripal poisoning in Salisbury revealed the inadequacy of traditional statecraft tools, such as diplomatic expulsions, to effectively deter or address the evolving nature of hybrid threats. The UK’s response up to that point resembled the characteristics of a ‘garbage can’ model of decision-making: disconnected, ad hoc, and driven by immediate crises rather than long-term strategic recalibration. However, growing public awareness and pressure from epistemic security communities, as evidenced by the ISC’s recommendations and McCallum’s public advocacy, plausibly reinforced the conditions for change, creating a convergence of pressures that rendered continued path dependency untenable. These legislative changes are shown in Figure 2.
From an HI perspective, the UK–Russia case illustrates that institutional change in response to hybrid threats can be significantly delayed, sometimes by decades. This delay is characterised not by linear incrementalism but rather by prolonged stasis punctuated by concentrated bursts of reform. The accumulation of sub-threshold provocations during 2007–18 created the preconditions for the productive critical juncture that followed. Hybrid activities such as disinformation, cyber intrusions, and political interference often fail to cross the immediate thresholds required to provoke institutional change. These threats function like a slow-moving illness: their effects are diffuse and ambiguous, remaining unnoticed until they metastasise into crises. By then, institutional responses may be too little or too late. As such, early detection by epistemic communities is vital. These actors must act as early warning systems for democratic institutions, interpreting weak signals and alerting policymakers before institutional stasis becomes a liability.
Public pressure also plays a critical role in breaking institutional inertia. When political elites deprioritise emerging security concerns or are distracted by other pressing agendas, public awareness and media attention can elevate the urgency required for change. In democracies, the mobilisation of public opinion and advocacy networks can serve as an essential corrective mechanism, ensuring institutions adapt to evolving hybrid threats in real time.
Finally, the UK must be vigilant against not only traditional adversaries like Russia, China or Iran but also potential threats from within alliances or trusted partnerships. The increasing sophistication of new hostile activities means future threats may originate from unexpected sources, making institutional agility essential. Rapid and anticipatory institutional change, therefore, becomes a strategic necessity, not only to respond to external pressure but to preserve the resilience of democratic governance itself.
A limitation of this study concerns the challenge of establishing definitive causal links between enabling factors and observed institutional changes. Although the process-tracing evidence demonstrates a traceable sequence, Hansard parliamentary records alone cannot fully isolate the precise causal weight of individual factors. Future research incorporating elite interviews could provide more fine-grained evidence of the decision-making process.
While this article has examined institutional changes in the UK through the lens of Russian hostile activities, future research should delve deeper into the nature of these reforms. Are they structural, procedural, or normative in character? How effective are they in confronting contemporary state-based threats? While the UK offers a rich empirical case, the pattern of delayed institutional adaptation observed here is unlikely to be unique. Similar dynamics can be seen in Germany’s belated diversification away from Russian energy dependence and in France’s gradually strengthened cyber-defence posture. Comparative studies could therefore assess whether accumulating pressures identified in this article operate across different democratic systems. Such research would not only illuminate variation in institutional resilience to hybrid threats but also help identify alternative pathways to timely and robust institutional transformation.
Acknowledgements
We would like to thank the anonymous reviewers for their constructive comments and Professor Andrew Mumford and the editorial team of the European Journal of International Security for their support throughout the review process.
Funding statement
This article was produced with the support of the Erasmus+ Programme of the European Union, under a Jean Monnet Module award, and the Taith Knowledge Exchange Programme, funded by the Welsh Government, both under the project Hybrid Warfare and Cybersecurity (HYBER). The European Commission’s support for the production of this publication does not constitute an endorsement of the contents, which reflect the views only of the authors, and the Commission cannot be held responsible for any use that may be made of the information contained therein. The views expressed do not necessarily reflect the position of the Welsh Government or Taith.
Competing interests
The authors declare no competing interests.
Ethical standards
This research relied exclusively on publicly available data and open-source materials. No human participants were involved and all data analysed were already in the public domain.
Ethem Ilbiz is Associate Professor of Global Politics and Cybersecurity Governance at the International Centre for Policing and Security (ICPS), University of South Wales. His research spans cybersecurity governance, EU–Türkiye relations, and application of computational methods to security policy.
Atakan Yılmaz is an assistant professor in the Department of Political Science and International Relations at Bahçeşehir University. His research focuses on international security and governance, with particular emphasis on cybersecurity, foreign policy analysis, and digital and emerging technologies in global politics.
Michael Edwards is a senior lecturer at the University of South Wales, leading the MSc International Security and Risk Management programme. He is a former national security practitioner and a PhD candidate with an interest in tech-enabled cognitive warfare and violent extremism. Ongoing research areas include nihilistic youth radicalisation, the intersection between extremism and individuals with a sexual interest in children, digital influence operations, and the use of virtual volunteers within security contexts.
Open access
