THE ISENBERG INSTITUTE OF STRATEGIC SATIRE
SATIRE & POLICY FICTION
Three Days in July — A Fiction of NATO and the Mercenary Question
Fiction Desk, August 2028
SATIRE & POLICY FICTION — This is a work of AI generated fiction. The North Atlantic Council, its member states, and the general shape of NATO’s institutional processes are real. The specific ministers, officials, incidents, companies, and negotiations depicted here are invented for narrative purposes and do not represent actual NATO deliberations, positions, or officials. Not for operational use, citation as fact, or redistribution as news.
Table of Contents
Session One: Monday, 30 July 2028
Interlude: Tuesday, 31 July 2028
Session Two: Wednesday, 1 August 2028
Session One: Monday, 30 July 2028
The rain over Brussels that Monday was the fine, patient kind that doesn’t bother announcing itself, and by the time the ministers’ cars had circled through the security cordon at the Boulevard Léopold III entrance, the windows of the North Atlantic Council chamber were streaked with it, blurring the flags outside into thirty-two smears of color. Inside, the air had been set to a deliberately unremarkable eighteen degrees — someone on the rotating presidency’s staff had read that a cold room keeps tempers civil, and no one had argued with the theory.
There was one line on the agenda board, which was itself the story reporters would lead with that evening: The Growth and Regulation of the Private Military and Security Industry. Thirty-two foreign ministers, and for once nearly all of them had come themselves rather than sending a deputy, because everyone in the building understood that this was not a housekeeping item.
Secretary General Ingrid Solberg opened without preamble. She had a single slide prepared, and she let it sit on the screen a moment before she spoke: a number, four hundred and thirty billion dollars, the estimated annual revenue of the global private military and security industry, roughly triple what it had been ten years before.
SECRETARY GENERAL SOLBERG: We are not here to relitigate whether member states use these firms. Every government in this room does, in some form — logistics, base protection, training missions, maritime security. That ship sailed decades ago, and no one is proposing to turn it back. We are here because the ship has since taken on weapons systems that used to belong only to states, and because the customers boarding it are no longer only states either.
Estonia went first, which was itself a small piece of stagecraft — Tallinn wanted the cyber dimension established before anyone could narrow the conversation down to boots and convoys. Foreign Minister Marta Kuusk did not raise her voice.
KUUSK: Three months ago, a private contractor under services agreement to a Gulf state’s ministry of interior conducted network intrusion operations against a Baltic energy provider. Not a state armed force — a company, hired by another company, using a toolkit our own signals-intelligence service would be glad to own. There was no state actor we could formally attribute it to, and no treaty this fell under. There was a contract and an invoice, and by the time our CERT finished its forensics the operators had rotated onto a different account in a different jurisdiction. We keep drawing red lines around states. The industry stopped waiting for that regulation years ago.
Germany’s Dr. Léna Hartmann followed, and what she brought was not intelligence but law.
HARTMANN: My ministry’s counsel informs me that if a German-registered firm — and we now have several, regrettably — conducts offensive operations using lethal autonomous systems, the Federal government may itself carry exposure under the Rome Statute. We are not discussing logistics contracts anymore. We are discussing the privatization of killing, and I am told plainly that the German public will not accept an alliance seen to bless it. We want firm limits: no offensive cyber weapons, no lethal autonomy without a human in the loop, full stop, for any firm operating with Allied-origin technology.
Poland and the Baltic delegations pressed the same nerve from a different angle. A convoy of civilian trucks near the Belarusian border had been intercepted two weeks earlier — not by Russian regulars, but by a private firm working, as best as anyone could determine, for a corporate client with an interest in disrupting a rival’s supply chain. The contractors had been wearing Allied-pattern night-vision equipment and carrying encrypted radios traceable to a NATO-member manufacturer.
POLISH MINISTER: If firms like this can operate on our eastern flank without a flag we can point to, then someone can destabilize this alliance’s border without ever giving us grounds to invoke Article Five. That is not a hypothetical. That is a design feature.
France pushed the argument further still, toward the vanishing line between defense and offense. Foreign Minister Étienne Dubois reminded the room of an incident the previous year in which an autonomous perimeter system, leased by a private security firm to a mining consortium in the Sahel, had misclassified a civilian vehicle during a software fault and caused casualties that made news well beyond the region.
DUBOIS: That system carried components of Alliance origin. When it fails, the political cost lands on all of us, whether or not any of our governments signed the contract. You cannot sell a targeting system as ‘defensive’ and be surprised when the client uses it offensively. The line was never as bright as the export licenses pretended.
When it was her turn, U.S. Secretary of State Liesel Vance did not open by disputing any of it, which surprised a few people at the table who had expected the usual posture.
VANCE: No one in this room disputes there’s a problem. We disagree about what kind of problem it is, and therefore what kind of instrument fixes it. American firms hold a commanding share of this market because our contractor base is the most capable in the world, and because we sustain deployments at a scale no other member does. A licensing regime built and enforced out of this building would fall hardest on the industry’s most capable and most accountable firms — ours — while doing very little about the firms actually selling toolkits to sub-state buyers, because those firms were never going to observe an Alliance rule to begin with. Restrict our companies and you don’t shrink the market. You hand the fastest-growing part of it to Beijing’s state-aligned contractors and Moscow’s hybrid formations, who answer to no oversight body at all.
KUUSK: With respect — the firm that hit our grid was chartered in Delaware.
VANCE: The parent holding company is chartered in Delaware. The operating entity that held the contract is registered in Ras al-Khaimah. That is exactly the structure I’m describing. A regime keyed to Alliance jurisdictions catches the flag. It does not catch the ship.
BELGIAN MINISTER: Then perhaps we discuss the flag and the ship, rather than deciding in advance that regulation is pointless because someone, somewhere, will evade it. Every sanctions regime is evaded by someone. We do not on that basis decline to have sanctions.
It went on like that past the lunch hour and into the afternoon. The Canadians floated something modeled loosely on the old Montreux Document process — a restatement of existing international humanitarian law obligations, non-binding, paired with a voluntary code of conduct and an oversight board that could suspend a firm’s eligibility for Alliance-adjacent contracts. The Italians wanted something with actual weight: a mandatory NATO PMSC registry, disclosure of end-use clients for any firm bidding on member-state work, and a “no re-export” clause that would follow a cyber or targeting package the way an arms-export control follows a rifle — restricting the service, not just the hardware it ran on.
No one at the table needed reminding that the Montreux Document had existed since 2008, that the Military Extraterritorial Jurisdiction Act had sat on the American statute books even longer, that half the governments in the room had their own domestic PMSC oversight laws already — and that none of it had stopped the morning’s incidents from happening. That was, everyone understood without saying so, the actual subject of the day: not whether rules existed, but why the rules that existed had turned out to be built for a different, smaller industry than the one now sitting across the table from them.
SECRETARY GENERAL SOLBERG: We will not solve in one afternoon what we allowed to grow for a decade. I am asking the Secretariat to prepare a fuller briefing for Wednesday. In the meantime, I’d encourage delegations to talk to one another. That is usually where the actual work gets done in this building.
Interlude: Tuesday, 31 July 2028
There was no formal session Tuesday, which did not mean there was no diplomacy. It meant the diplomacy moved out of the chamber and into the corridors, the delegation lounges, and — in the case of the conversation that mattered most — a window alcove by the coffee machines that looked out over a construction lot that had been a construction lot for as long as anyone could remember.
Vance found the Estonian minister there a little after ten, and the German state secretary a few minutes after that, and the three of them stood without quite forming a huddle, the way people do when they want a conversation to look accidental.
VANCE: You’re not getting a re-export regime. Not this year, and I’d guess not this decade. I’d rather tell you that now than let Rome burn an afternoon on it Wednesday.
GERMAN STATE SECRETARY: Then tell us what we do get. ‘Nothing, with a preamble about shared values’ is not something I can bring home to a parliament that just watched a Baltic grid operator get hit by a contractor.
Vance turned her coffee cup a quarter turn on its saucer, a habit her own staff had learned to read as thinking rather than performing thought.
VANCE: A registry. Not mandatory disclosure of end-use clients — that’s the piece that kills it for us. A registry of firms that hold or have held contracts with any Alliance government, cross-referenced against a shared incident channel, so that when your CERT finds a contractor’s fingerprints on an intrusion, there’s an actual line to every other member’s vetting process. No new enforcement body. No licensing authority. Just information, moving faster than it moves today.
ESTONIAN MINISTER: That’s a bulletin board. Not a policy.
VANCE: It’s a start, and it’s the version that survives a change of administration in Washington, which the Italian proposal is not. You want durable, you want something that doesn’t need me defending it for four years in front of a Senate committee that already thinks NATO asks Americans to subsidize everyone else’s security.
GERMAN STATE SECRETARY: You know this is not enough.
VANCE: I know it’s what’s achievable this week. I also know the Italians will take it, call it phase one, and come back in eighteen months wanting the re-export clause the moment there’s been one more incident bad enough to make refusing it politically costly. That’s not cynicism. That’s just how this building works.
What none of the three of them said aloud, though all three were thinking some version of it, was that the entire conversation was being conducted in the shadow of a briefing none of them had yet seen. Word had gone around the delegations by midafternoon that NATO’s Intelligence Fusion Centre had spent the weekend finishing a report on an incident far worse than a grid intrusion — something involving Moldova, a contractor, and seventy-two hours the previous spring that the Secretariat had until now kept out of any unclassified channel. Vance’s own staff had given her the one-paragraph summary that morning, walking beside her from the car, and she had read the Montreux Document again on the flight over the day before out of pure habit, the way a person reopens an old insurance policy during a storm. It had told her nothing she didn’t already know: a careful, thorough restatement of law that already existed, addressed to states who already knew it, and silent — entirely silent — on shell companies, cutout contracts, and an operating entity re-registered overnight in Ras al-Khaimah.
Session Two: Wednesday, 1 August 2028
Solberg did not open Wednesday’s session with numbers. She opened by yielding the floor to the Director of NATO’s Intelligence Fusion Centre, which told the room, before he said a word, that whatever came next would not be a policy paper.
The briefing described a facility in an unmarked industrial park outside Chișinău. A U.S.-based contractor, hired by a multinational agricultural conglomerate to protect its regional server farms, had detected what its own analysts believed was a Russian reconnaissance probe. Staffed in part by former signals-intelligence operators, the firm’s cyber unit had not reported the intrusion to Moldovan authorities, to NATO, or to Washington. It had retaliated on its own authority. The retaliation had cascaded into a power failure across a stretch of Transnistria, knocked a Russian signals node offline, and produced a spike in encrypted traffic out of the Kaliningrad military district that Alliance watch officers had read, for the better part of three days, as preparation for a limited response. It had taken seventy-two hours of back-channel contact to talk everyone back down.
The room was very quiet.
VANCE: That company was not acting under U.S. government direction.
KUUSK: Precisely the point, Madam Secretary. It had the capability. It had the will. It acted like a sovereign power, on a timeline no government in this room controlled, and it came within a diplomatic phone call of an incident that might have tested Article Five. Your light-touch framework cannot govern what you do not command.
CANADIAN MINISTER: If a contractor’s drone strikes an Allied convoy, or a contractor’s cyber unit takes down a member’s grid, do we invoke collective defense? Against whom? The operators? The board of directors? Article Five was written in 1949 for armies in uniform. It has no clause for a private cyber unit acting on its own initiative on behalf of a client neither this alliance nor any state in it ever vetted.
It was into that silence that Turkey’s Ismet Pasha made his proposal, which had clearly been drafted before he ever walked into the room.
PASHA: There is a third option beyond banning what we cannot ban and ignoring what we cannot ignore. We incorporate them. Call it the Athena Protocol, if you like a name. A firm wishing to operate in any Allied theater, or to bid on any Allied contract, submits to certification: a NATO liaison officer with veto over kinetic action, and an immutable ledger of every engagement, every casualty, every dollar, open to Allied audit. In exchange, they receive access to shared intelligence and Allied logistics. We do not merely ban the wolves. We put a collar on them, with a name on the collar.
It drew real interest — the French and British delegations both leaned into it as a serious middle path, and even Hartmann allowed that a certification-with-veto model addressed her constitutional concern better than a registry did. But it also drew the objection everyone had been waiting for.
VANCE: That is not oversight. That is NATO co-signing every contract a firm writes, which means NATO co-owns every failure a firm produces. And it still only reaches the firms willing to be certified. The Ras al-Khaimah problem does not go away because Brussels builds a nicer registry for the firms already inclined to behave.
DUBOIS: Then what does go away, Madam Secretary? Because from where France sits, the honest answer offered by the United States today is: nothing. Not the drone strikes. Not the grid failures. Not the convoy in Poland. Only the paperwork changes.
Vance did not have a clean answer to that, and to her credit she did not manufacture one.
VANCE: I’m not going to stand here and tell this table that what we’re going to agree to today solves the problem. It doesn’t. The Montreux Document didn’t solve it in 2008, and it was written for a smaller, simpler industry than this one. The Military Extraterritorial Jurisdiction Act doesn’t reach half the jurisdictions these firms now incorporate in. Our own export-control law was built for hardware, and this industry sells outcomes, packaged as a service, with the hardware incidental. I am not going to pretend a NATO information-sharing mechanism closes those gaps. I am telling you it is the piece that is actually achievable this week, and that the alternative — spending another year fighting over a binding regime that half this table’s legislatures will not ratify — leaves us with exactly the same gaps, plus a year of nothing.
That, more than any argument about jurisdiction, was what finally moved the room — not agreement, but exhaustion married to a shared recognition that no existing instrument, national or international, had been built with this industry in mind, and that building a new one from scratch, this week, in this format, was not something thirty-two foreign ministries were going to manage before their flights home.
What emerged by early evening, and what the communiqué would call a NATO PMSC Information-Sharing Mechanism, was close to what Vance had sketched over coffee two days before: a voluntary registry of firms holding Alliance-member contracts, cross-referenced against a shared incident-reporting channel; a non-binding “Statement of Shared Understanding” reaffirming existing international humanitarian law and export-control obligations without creating new ones; and a Restricted Capabilities catalog — offensive cyber tools above an agreed threshold, and lethal autonomous systems without a human authorizing each engagement — that member states committed, without any enforcement mechanism attached, not to see transferred to private clients. An Article Five clarification, contested until nearly the last hour, stated that actions by a private contractor would not be treated as an attack by a member state for collective-defense purposes unless conducted under that state’s direct command and control.
Pasha’s Athena Protocol did not survive the day intact, but its liaison-and-audit language was folded, in diluted form, into the voluntary code of conduct the Canadians had proposed Monday. Italy and Estonia attached a joint statement to the communiqué expressing their intention to “continue pursuing more robust instruments in appropriate fora” — diplomatic language, everyone in the room understood, for we didn’t get what we wanted, and we are not finished asking.
Epilogue
Vance signed off on the final language a few minutes before six, standing in a side room with her deputy, who had spent three days looking like a man watching a slow-motion accident he had been specifically told not to prevent.
DEPUTY: Rome’s going to take the re-export idea to the EU instead. Brussels, the other Brussels. They don’t need NATO consensus to regulate a firm doing business inside EU jurisdiction.
VANCE: I know.
DEPUTY: And if the EU passes something with real teeth, our firms doing business with European governments answer to it regardless of what we agreed to here today.
VANCE: I know that too. That’s a fight for next year. This week’s fight was making sure it wasn’t a NATO fight, with NATO’s name and NATO’s machinery attached to it — because that’s the version Congress will actually let me lose control of. Let the other Brussels own the hard part. We’ll manage the American piece in Washington, the way we always do.
Outside, the flags had gone still in the evening air, thirty-two of them plus the compass rose, and the construction lot across the way was exactly as unfinished as it had been on Monday. Somewhere on a tablet in her deputy’s coat pocket, unread until the car, a routine notice was already waiting: a Gulf-registered subsidiary of a Texas-headquartered firm had that afternoon signed a contract to field an autonomous perimeter network for a private consortium operating in the South China Sea. The market, whatever the communiqué said, was not waiting for Brussels to catch up to it. It never had.
- § §
SATIRE & POLICY FICTION — This is a work of fiction. The North Atlantic Council, its member states, and the general shape of NATO’s institutional processes are real. The specific ministers, officials, incidents, companies, and negotiations depicted here are invented for narrative purposes and do not represent actual NATO deliberations, positions, or officials. Not for operational use, citation as fact, or redistribution as news.
