The Foundation for Defense of Democracies (FDD) said NATO’s ability to rapidly move forces and military equipment across Europe depends not only on roads, railways, ports and airfields, but also on the cybersecurity of civilian digital systems supporting military mobility. In a Sept. 28 analysis, FDD said declining European investment in defense-related infrastructure has left transportation networks ill-suited to heavier military forces, with narrow roads, limited rail capacity and incompatible rail gauges delaying reinforcement. Fragmented cybersecurity governance among NATO, the European Union and national authorities also leaves civilian transportation operators without consistent security standards or oversight.
“The alliance’s ability to move forces — including U.S. forces based or arriving in Europe — increasingly depends on civilian digital networks that NATO neither owns nor directly regulates,” Jiwon Ma, a senior policy analyst at FDD’s Center on Cyber and Technology Innovation, wrote a CSC 2.0 report titled ‘Strengthening NATO Through Military Mobility and Critical Infrastructure Cybersecurity.’ “Fragmented cybersecurity governance across NATO, the European Union, and national authorities leaves the civilian transportation operators on which alliance forces depend without consistent security standards or oversight. The result is a growing disconnect between NATO’s operational requirements and the resilience of the infrastructure supporting them.”
Adversaries have already demonstrated a willingness to digitally target logistics and transportation systems to disrupt movement without crossing the threshold of armed conflict. Foreign ownership further compounds these risks. Chinese state-linked firms hold stakes in more than 30 European port terminals, including facilities designated to receive U.S. military forces and equipment. Risk from these terminals falls directly on American forces, not only European ones. In a crisis, Beijing could exploit these dependencies to delay or restrict NATO access. Such investments also create potential digital avenues for intelligence collection and operational disruption.
“Because allies retain sovereign responsibility for national infrastructure, this report finds that no single actor is responsible for keeping reinforcement corridors operational when under attack. NATO identifies the infrastructure and mobility capabilities its forces require and can coordinate national efforts but lacks the authority to impose binding standards on civilian operators,” Ma evaluated. “By contrast, the European Union can impose binding standards on civilian operators, but member states retain control over defense priorities and infrastructure investment. As a result, NATO forces cannot move as rapidly as they may need, and investment for upgrades lags behind NATO’s reinforcement requirements. If NATO fails to align spending with reinforcement requirements, its ability to deter and defend will remain at risk. The alliance should thus pair its defense- and security-related spending commitment with a process that directs investment toward projects that enhance the physical and cyber resilience of assets integral to military mobility.”
At the June 2025 NATO summit in The Hague, leaders committed to spending 5% of gross domestic product (GDP) on defense by 2035, including up to 1.5% of GDP on defense-related investments, such as critical infrastructure, industrial base protection, and cybersecurity-related investments. However, while NATO requirements inform European Union infrastructure planning, such expenditures do not ensure that national spending will be directed toward those priority corridors or address urgent bottlenecks.
Ma assessed that this “is because NATO’s ability to reinforce allies and sustain operations relies on a complex network of civilian transportation infrastructure, digital systems, regulatory processes, and commercial operators that enable personnel, equipment, and supplies to move to and across Europe at speed. The military mobility challenge in Europe can thus be understood across four interconnected dimensions: physical infrastructure constraints, regulatory and investment shortfalls, technology modernization and cybersecurity gaps, and Chinese influence over Europe’s critical infrastructure.”
The FDD reported that Europe’s military mobility vulnerabilities are compounded by the growing strategic footprint of Chinese state-linked entities across critical transportation and logistics infrastructure, energy infrastructure, and communications networks. Chinese laws requiring citizens and companies to cooperate with state intelligence agencies and Beijing’s support for Russia’s war in Ukraine raise concerns that this footprint provides potential intelligence access or coercive leverage against NATO. Chinese firms, many of them state-linked or state-owned, maintain direct or indirect stakes in at least 14 out of the 29 European ports located near NATO naval facilities or supporting NATO logistics operations.
Moreover, a 2023 European Parliament study found that three Chinese conglomerates — COSCO Shipping Corporation, China Merchants Group, and Hutchison Port Holdings — own or operate terminals in roughly half of the EU ports considered critical to NATO operations, including nearly 30 terminals across Europe and as many as 20 terminals within the 15 largest EU ports.
In addition, Chinese firms hold a foothold in Europe’s communications backbone. HMN Technologies, formerly Huawei Marine, and others have laid or serviced undersea fiber-optic cables near NATO naval facilities. These cables carry both civilian and military logistics traffic, so a compromise could disrupt command-and-control and sustainment operations in a crisis. In 2017, state-linked CITIC Telecom CPC acquired Dutch operator Linx Telecommunications, gaining control over key parts of Estonia’s internet infrastructure, including a 470-kilometer undersea link to Finland and Sweden. The deal exposed wider gaps in Europe’s screening of foreign investment in strategic digital assets.
Ma provided a couple of recommendations in the FDD report. She recognizes that Europe’s military mobility corridors lack a coordinating mechanism to assess whether a full reinforcement corridor can stay operational under attack, since infrastructure investment falls short and resilience efforts are not aligned with NATO’s operational requirements, EU regulation, and national enforcement. The central fix is aligning investment with NATO reinforcement plans, and the six recommendations move from foundational reforms to targeted measures.
NATO should require allies to show how spending within the 1.5 percent of GDP category for infrastructure, network defense, and resilience addresses deficiencies in regional defense and reinforcement plans. Annual national plans should include a military mobility annex explaining the operational problem each project solves and which forces or routes depend on it. NATO should maintain a prioritized deficiency list, ranked by operational need, and use its updated 2029 capability targets to check that national spending corrects those shortfalls rather than counting general infrastructure spending.
The NATO Integrated Cyber Defence Centre (NICC) should organize its work around the ports, railways, airports, energy networks, and technology providers that reinforcement plans depend on. Its assessments should explain operational consequences, including which movements are affected, what capacity remains, and whether forces must be rerouted. Allies should designate national liaisons and common protocols, building on existing NIS2 incident reporting rather than creating a parallel NATO mandate, so cyber reporting directly informs logistics and command decisions.
The revised EU FDI Screening Regulation, in force since July 16, 2026, with most provisions applying from January 17, 2028, covers transport infrastructure but does not explicitly require heightened screening for the four priority military mobility corridors. The report urges the European Commission to update its guidance so that investments giving operating stakes, management rights, or data access over rail nodes, ports, airports, and logistics platforms receive enhanced review. A corridor’s NATO or EU military mobility designation should trigger national security consultation, with particular scrutiny of state-linked actors like China.
Because NATO does not command most transport assets, movement relies on voluntary contributions and commercial capacity. The Movement Coordination Centre Europe improves visibility but cannot guarantee enough rolling stock when several allies mobilize at once. Unlike air transport, rail has no pooled-asset mechanism, even though moving a single light division can require up to 200 trains. Allies should adapt the European Air Transport Command model by jointly procuring or designating a minimum pool of dual-use heavy-lift wagons, in coordination with the MCCE.
Satellite interference has surged since 2022 across the Baltic, Black Sea, and Arctic, and Russia and Belarus are responsible. Galileo’s authentication service and the new EU secure satellite communications program help but do not prevent spoofing or jamming. Member states should pair authenticated services with alternative navigation, timing, and routing procedures for each transport mode, and test them in exercises that disrupt several connected nodes on one corridor, with each exercise ending in a corrective action plan and a retest deadline.
Finally, the report says cyber workforce shortages should be treated as a defense priority. The global gap was roughly 4.8 million in 2024, including about 424,000 in Europe. NATO and the EU should expand funded training, scholarships, apprenticeships, and cyber reserves; create accelerated pathways for military personnel and mid-career professionals; and improve interoperability through mutual recognition of certifications. Recruitment alone will not close the gap, as workload, burnout, limited career advancement, and insufficient professional development drive attrition, making sustained investment in career development as important as attracting new talent.
In conclusion, FDD’s Ma said that addressing Europe’s military mobility infrastructure gaps and regulatory barriers is a test of whether NATO can move and sustain forces during cyber disruption, contested logistics, and attacks on the civilian systems that underpin reinforcement operations.
“While the European Union and NATO have made progress through mobility initiatives, cyber resilience programs, expanded infrastructure planning, updated operational plans and command structures, and more robust exercises, responsibility remains divided among NATO planners, EU regulators, national authorities, and private operators, and no actor currently ensures that an entire transportation corridor can remain operational under attack,” she identified.
Ma also observed that ensuring these transportation corridors work will require NATO to anchor resilience spending and cyber awareness to its reinforcement plans, and the European Union and member states should secure critical infrastructure along priority corridors. Ultimately, military mobility should be judged not by the number of projects funded or exercises conducted but by whether allied forces can still reach the battlefield at the speed and scale NATO’s defense plans require.
