Authors:
Vitālijs Rakstiņš, Researcher at Rīga Stradiņš University, Expert in Societal Resilience
Sandra Zilberta, Chair of the Board, Think Tank “Health Systems Resilience” (VASN)

 

The recent drone strike by Ukraine’s Security Forces on Russian strategic bomber airbases stands out as one of Ukraine’s most impressive operational victories. At the same time, this meticulously coordinated operation by Ukrainian security services highlights vulnerabilities that both we and our allies must realistically prepare for in the near future. It is reasonable to expect that similar swarms of AI-enabled unmanned aerial vehicles may be deployed in hybrid warfare scenarios targeting assets in NATO or EU member states.

Modern security threats require not only technological solutions but also a transformation in the culture of cooperation. To strengthen national security and resilience, active and equal involvement from both the private sector and civil society is essential. We propose to develop the concepts of the Public–Private Preparedness Cooperation and Civic Engagement as integral elements of the national security architecture.

It is clear that state and municipal resources alone are insufficient to manage a prolonged crisis. Therefore, it is essential to mobilize the knowledge, infrastructure, and operational capabilities found within society and the private sector. However, this cooperation must be reciprocal — it cannot rely solely on obligations imposed unilaterally by the state.

 

The Illusion of Absolute Protection

 

Uncontrolled proliferation of disruptive technologies and the brutal war initiated by Russia in Ukraine have demonstrated that no critical asset can be perpetually protected against all threats all time. In the short term, multilayered protection is possible — for example, through external support, as seen in the recent NATO Enhanced Forward Presence air defence exercises that protected the Riga Hydroelectric Power Plant. Yet it is not feasible to ensure permanent protection for every piece of critical infrastructure.

This is why the Nordic countries have embraced the concept of Total Defence, which goes beyond kinetic and cyber protection of assets and focuses on ensuring continuity of critical functions.

This concept assumes that any infrastructure asset can be damaged, become inaccessible, or even be destroyed entirely. Historically, the European Union’s critical infrastructure protection policy has focused on physical security threats, such as terrorism. Over time, cyber threats were also integrated into the framework. Today, the EU Directive on the Resilience of Critical Entities requires member states to focus not only on protecting physical infrastructure but also on ensuring the continuity of critical functions.

Continuity of operations means that governments, businesses, and non-governmental organizations must be able to continue delivering essential services to the population — even in the midst of armed conflict, cyberattacks, or natural disasters.

 

How Prepared Are We to Protect Ourselves?

 

To ensure continuity of operations during crises, each organization must first identify its critical functions — that is, the activities and services whose disruption would directly impair the ability of the state or society to function. Not all operations carry the same level of importance during Hour X, so it is essential to determine which functions must be maintained first and foremost.

Once these critical functions have been identified, organizations must develop a practical business continuity plan to ensure their delivery under any circumstances. This includes:

  • identifying essential personnel required to carry out these functions;
  • establishing alternative work locations in case primary premises become inaccessible;
  • ensuring access to backup electricity and communication systems;
  • reviewing and strengthening supply chain resilience;
  • and developing a contingency plan (“Plan B”) for each vital process.

Such a level of preparedness allows organizations to continue operating even when crises unfold unpredictably.

However, in today’s interconnected world, where business models often rely on subcontractors, operate with minimal reserves (just-in-time logistics), and depend on vulnerable supply chains, planning becomes increasingly complex — especially for states bordering aggressive regimes like Russia. This is further complicated by the need to vet partners for security risks.

 

Protecting Critical Infrastructure in a New Threat Environment

 

Modern critical infrastructure — such as power grids, water supply systems, and data centers — cannot be defended without additional protective measures. These are essential for reducing exposure to threats and ensuring that these assets remain functional during crises.

In many countries, including Latvia, restrictions are in place: unmanned aerial vehicles (UAVs) are prohibited from flying over such infrastructure; filming and photography are banned; and protective buffer zones with restricted access have been established. These safeguards are essential for reducing the physical vulnerability of critical infrastructure.

At the same time, restrictions have also been introduced concerning personnel working at critical infrastructure facilities. For example, nationals of hostile countries, including the Russian Federation, may be barred from occupying sensitive positions. In addition, the use of software and IT systems developed in non-NATO countries is limited due to cybersecurity concerns.

These measures are not directed at specific individuals or companies but are part of a broader national security strategy to protect systems essential to daily life and the economy.

 

Can Organizations Defend Themselves?

 

A key open question remains: can organizations independently protect their assets against a range of emerging threats?

Problems arise when multiple critical sites are simultaneously at risk. Private security providers may face staff shortages; equipment rental companies may lack power generators; and internet service providers may be unable to withstand high-intensity cyberattacks due to bandwidth or resilience constraints.

In certain cases, such as under elevated terrorist threat levels, national armed forces or internal security services can reinforce physical security. But what happens when these public-sector resources are already committed elsewhere?

Several initiatives have been launched to enhance infrastructure protection through internal capacity-building. One such approach involves forming Home Guard (Zemessardze) units composed of critical infrastructure personnel who could provide physical (kinetic) protection during emergencies. However, this solution is only viable for a limited number of sites, and not all employees are willing to take on such commitments.

 

Expanding Security Mandates and Strengthening Public–Private Preparedness Collaboration

 

An alternative approach under consideration involves granting broader authority to internal security services of critical infrastructure sites — for example, authorizing them to use force against unmanned aerial vehicles (UAVs) or suspicious vehicles. However, such powers can only be exercised in close coordination with national authorities.

 

Public–Private Preparedness Cooperation

 

It is increasingly evident that critical infrastructure protection in the 21st century cannot be ensured without the active involvement of the private sector. However, this also requires a paradigm shift in how public institutions and businesses cooperate.

Effective cooperation demands improved information sharing with security services, active involvement of businesses in national crisis and defence planning, and legal frameworks that allow procurement of specialized defence technologies and dual-use equipment. In the absence of such structured collaboration, the risk of miscommunication grows — for instance, the possibility of defensive action being taken against a friendly UAV or a threat being wrongly assessed.

A clear, timely and coordinated preparedness partnership between public authorities and businesses is therefore one of the cornerstones of secure and resilient national infrastructure.

Latvia already has several effective platforms for long-term cooperation between civil society, local governments, and state institutions. It is now time to develop an equally purposeful and structured national public–private preparedness framework, focused on ensuring continuity and functional resilience in times of national emergency.

This logic is also reflected in the United Kingdom’s Strategic Defence Review 2025, which explicitly recognizes that protecting critical infrastructure requires additional capacity from non-governmental organizations. The strategy calls for a “new contract” with the private sector — one that establishes shared responsibility for safeguarding the country’s essential functions.

 

Public Awareness and Communication During Crises

 

In any national crisis, access to timely, reliable information becomes one of the most important resilience factors. Every citizen has a responsibility to stay informed about how the situation is evolving and how to respond appropriately.

In Latvia, public notification of an emergency or Hour X will be issued through civil defence sirens, public service media (LSM), the 112.lv app, and — starting autumn — via a cell broadcast alert system.

Estonia has piloted a broader array of crisis communication tools. During an exercise on 14 May, citizens were notified via sirens, two mobile apps, SMS, news tickers on TV, and digital banners on websites and platforms. From 10 to 20 May, the Estonian Air Force, in cooperation with the Women’s Voluntary Defence Organization (Naiskodukaitse), also tested a mobile app–based air threat reporting function called Ole Valmis! (“Be Ready!”). Users were encouraged to photograph aircraft — such as helicopters — seen while outdoors using the app’s “aerial object recognition” feature. These images helped authorities build a crowdsourced aerial threat monitoring network, improving early warning capacity in the event of missile or drone threats.

However, it must be acknowledged that state-run alert and communication systems may become unavailable during a large-scale crisis. Therefore, municipalities should proactively plan and test alternative community-level communication measures, including deploying trained personnel to deliver messages in person, leveraging resilient community networks built during preparedness exercises, and using local police resources.

Collaboration with regional media outlets is essential, alongside a clear, tested crisis response roadmap for media communication during Hour X — that is, in the event of military or hybrid threats to national security.

 

Strengthening Health System Resilience Through Community-Based Preparedness and Vigilance

 

To enhance the resilience of the healthcare system, it is essential to systematically launch preparedness training and exercises among primary and secondary healthcare providers. This should be done in close collaboration with professional associations and employers. These professionals — including general practitioners, pharmacists, nurses, caregivers, dentists, and others — are likely to be the first point of contact for the public during crises, particularly for socially vulnerable groups.

Positive examples of such efforts include the Pharmacists’ Resilience Handbook and related training initiatives conducted in collaboration with the Latvian Pharmacists’ Association and the Pharmaceutical Care Association. New partnerships are also emerging with professional associations of general practitioners to scale up frontline readiness.

Such a multi-layered approach ensures that critical information and assistance reach the population even when central systems are temporarily down or disrupted.

 

What Can Every Citizen Do? Civic Engagement and Situational Awareness

 

The experiences of Ukraine and Israel clearly demonstrate how vital public engagement and alertness are during crises. Just as we report unattended bags at airports, civic vigilance in daily life can help identify suspicious behavior or hostile actors early — potentially preventing terrorist activity or acts of sabotage.

Every hostile group — be it terrorists or enemy saboteurs — depends on local auxiliary networks for entry, transport, supplies, or weapons. Therefore, local residents are often the first to notice unfamiliar individuals, unusual transactions, or irregular activity in their communities. By reporting such observations, they enable security services to identify and neutralize threats before they escalate into attacks.

In 2023, Latvia’s national security agencies published materials on how to identify suspicious activity near critical infrastructure, along with practical advice for recognizing possible saboteurs. Citizens are encouraged to report such incidents directly to the authorities.

In addition, several official platforms are available to support public vigilance: www.melnsuzbalta.lv – a government-run portal for reporting disinformation and propaganda, www.cert.lv – Latvia’s National Cybersecurity Incident Response Team for reporting IT security incidents. The National Armed Forces also encourage public reporting of military vehicle movement during training exercises as a way to test civil-military cooperation in situational awareness

 

A Case for a Unified National Reporting Platform

 

In real life, people often face uncertainty about where to report suspicious activity. For example, when someone sees an unidentified drone, a suspicious vehicle, or alarming messages in closed social media groups or gaming chats — it’s rarely clear which authority should be informed. As a result, many individuals default to calling 112 or the State Police, which can overburden critical emergency services.

Such a fragmented approach is ineffective. This is why the establishment of a centralized, nationwide reporting platform should be considered — a secure, easy-to-use system where residents can report any suspicious activity without having to decide which institution is responsible. A unified solution would support faster, more coordinated response, while also strengthening civic engagement in national security.

Currently, Latvia does not have a clearly defined mechanism for civic engagement and reporting during a military threat. In contrast, Ukraine’s experience demonstrates how essential such infrastructure can be. At the onset of Russia’s full-scale invasion, multiple reporting platforms and chatbots were launched to enable civilians to report enemy movements. These tools were later integrated into a national system called E-Vorog, which allows any Ukrainian citizen — after logging in via the DIIA e-services platform — to submit real-time reports directly to the Armed Forces.

This is not just about symbolic participation. In modern warfare, where enemy forces constantly move and attempt to remain concealed, nearly every successful Ukrainian strike has been supported by accurate, timely information from civilians. Ukraine’s case clearly illustrates the power of a secure, accessible, and nationally integrated reporting platform. Latvia would do well to consider a similar solution — not only as a crisis response tool, but as a practical channel for civic contribution to national resilience.

These and related topics — on building societal resilience, improving crisis preparedness, and enhancing response capacity at both state and individual levels — will be discussed in greater detail during the upcoming panel discussion “Public Health and Health Systems in Crisis – Impacts, Tactics, and Recovery”, to be held on June 13 at 10:00 at the University of Latvia’s House of Nature. The event will feature Latvian and international experts, including Jeffrey Schlegelmilch, one of the United States’ leading authorities on disaster preparedness and response.

Resilience literacy = Preparedness partnership + Civic engagement.