Unplugged

As a result, NATO launched the Baltic Sentry mission to protect the sea and its underwater infrastructure last month. The alliance believes the recent incidents are Russian hybrid operations used by Moscow to test NATO’s “red lines” without risking a breach of the defence alliance’s Article 5, which states that an attack on any NATO member is an attack on them all.

There have been at least 10 cases of damage to underwater cables in the Baltic Sea since October 2023. The most recent took place on 19 February, when a Finnish-German telecom cable C-Lion1 suffered damage in the Swedish economic zone, prompting Finnish and Swedish authorities to launch investigations into the incident the following day.

The first documented incident of this kind took place in October 2023, when two telecommunication cables were severed and the Balticconnector gas pipeline, which runs between Finland and Estonia, had to be temporarily taken out of operation while a leak was repaired.

Commenting on the Balticconnector incident, the then president of Finland, Sauli Niinistö, said that the damage could have been caused by “external activity”, but with each new incident, the statements have become less vague.

In November, German Defence Minister Boris Pistorius mooted sabotage, calling the cable damage “a clear sign”. In December, Estonian Foreign Minister Margus Tsahkna said that the incidents had become so frequent that it was “difficult to believe this is accidental or merely poor seamanship”. 

While all clearly implying Kremlin involvement in the incidents, regional politicians stopped short of making direct accusations, in each case stressing instead the need for a thorough investigation.

Weather, mistakes, incompetence

There has, as yet, been no consensus in the West on whether Moscow has played a hand in the events.

The Washington Post suggested in mid-January that the cables had most likely been damaged due to human error by inexperienced crews, not sabotage, based on intelligence sources from several countries.

It cited the ship the Eagle S, sailing under the flag of the Cook Islands, which, experts believe, is part of Russia’s shadow fleet used to export oil and bypass sanctions. The Eagle S left the port of Ust-Luga, in Russia’s northwest, on 6 January, and was detained and then impounded by the Finnish authorities as part of their investigation into the damage to the Estlink 2 power cable.

In Helsinki, there were suspicions that the crew had deliberately dropped the anchor to the seabed and then dragged it dozens of kilometres to damage the cables. But secret service representatives The Post spoke to suggested the incident was caused by incompetence. Herman Ljungberg, a lawyer who represents the owner of the Eagle S tanker, said the same thing.

In August 2024, the Hong Kong-based South China Morning Post reported that Beijing had passed its own investigation into the Balticconnector gas pipeline incident to Estonia and Finland, which found that the Chinese ship NewNew Polar Bear was to blame, but that the damage caused had been an accident. 

Supporters of this version of events have data on their side — according to statistics from the International Cable Protection Committee (ICPC), there are 150–200 cases of damage to underwater cables recorded annually in the world, and the main reasons are “accidental human activity, such as fishing and anchoring, alongside natural hazards, abrasion and equipment failure”.

Sources that spoke to The Post drew no final conclusions, which didn’t stop Russian officials from demanding an apology from anyone who had blamed Moscow. The Kremlin considered the article an admission that any attempt to blame Moscow for the incidents were “absurd” and “ridiculous”.

The Soviet sabotage handbook

However, in the Baltic region itself, experts reacted to the Post article with scepticism. Speaking to Novaya Europe, Marek Kohv, an expert from Estonia’s International Centre for Defence and Security, said hybrid attacks were often “disguised as accidents”. 

“This is well known from the Soviet sabotage handbook. If official bodies interpret such events as accidents, the goal has been achieved,” Kohv added, noting that while he considered the ICPC statistics “useful”, there are still serious questions concerning the frequency of such incidents in the Baltic Sea. 

There were no incidents of this kind from the 1990s until 2023, and yet cables have suffered “regular damage” in the past year and a half, Kohv added. While he admits they could be “random incidents” he stresses that this did not exclude the possibility that this was “a Russian tactic to carry out hybrid attacks on the critical infrastructure” of the Baltic states.

Arjen Warnaar, the head of Standing NATO Maritime Group 1, the force responsible for the protection of underwater infrastructure, pointed out it would be impossible for a crew not to have noticed an anchor dragging along the seabed for “a couple of hundred miles”. He added that too many ships “acting strangely” — repeatedly and unpredictably changing course, or slowing down in areas where cables are laid, and then accelerating sharply — had either left from or sailed to Russian ports.

Northern patrol

NATO will now monitor the movement of ships in the Baltic Sea much more closely than before. Secretary General Mark Rutte announced on 14 January the launch of the Baltic Sentry mission to patrol the Baltic Sea and respond rapidly to any emerging threats. The mission will involve frigates, maritime patrol aircraft, naval drones, submarines and satellites, though as a military mission, the specific details have not been disclosed. 

As it is impossible to escort every ship, the alliance is relying heavily on AI to help identify anomalies. Captain Niels Markussen, a Danish naval captain involved in the mission, told CNN that reaction times to suspicious events had now been reduced to “within a half an hour or an hour”. For the sake of comparison, in one incident last year, a ship dragged its anchor along the seabed for 17 hours before it was noticed.

The situation in the Baltic was also discussed at an EU Foreign Affairs Council meeting in Brussels on 27 January. The gathered EU foreign ministers all agreed that the Baltic Sea incidents were a part of Russian hybrid operations and that they needed to be countered much more actively.

German Foreign Minister Annalena Baerbock commented in July that the region had become “very much the focus of hybrid Russian warfare”, while Kaja Kallas, the High Representative for Foreign Affairs and Security Policy and Vice-President of the European Commission, talked last month of the need to raise awareness of the hybrid threats facing the European Union and discuss “how to better deter and respond to hybrid threats amid Russia’s intensified campaign”.

Array of hybrid threats

As well as sporadic cyberattacks on government services and private companies, Russian hybrid attacks have included jamming GPS signals in Baltic airspace and the manipulation of migrant traffic. 

Shortly after Finland joined NATO in 2023, the number of illegal immigrants attempting to cross the border from Russia began to increase dramatically. The authorities in Helsinki suspected this was the work of the Kremlin, and as a result closed its borders to Russia indefinitely. 

Norway, until recently the only member of the Schengen Zone bordering Russia that had not imposed significant travel restrictions on Russian citizens, installed an almost 200-kilometre-long border fence between the two countries to improve security. 

As the Baltic states planned to disconnect from the Soviet-era BRELL unified energy system they shared with neighbouring Belarus and Russia to join a similar European system earlier this month, an alarming warning in Russian appeared on social media telling residents of all three countries to prepare for power outages, stock up on food, water and cash, a classic example of one of Moscow’s disinformation campaigns, which are designed to destabilise Russia’s enemies by provoking fear and even panic among the population. 

Hybrid threats also include fairly open acts of sabotage. Two incidents in the Estonian capital Tallinn in the early hours of 8 December 2023, when the car windows of Estonian Interior Minister Lauri Läänemets and the editor-in-chief of Baltic news website Rus.Delfi Andrey Shumakov were smashed, were later deemed to by investigators to have been ordered by the Russian intelligence services.

Hybrid attacks also make economic sense. Cable problems entail considerable financial losses for business, considering that “1.3 million kilometres of cables guarantee an estimated $10 trillion worth of financial transactions every day”, according to NATO. It could negatively affect the image of the Baltic as a transport artery, incudrease insurance rates for shipping companies in the region and, therefore, raise the price of transporting goods, not to mention the significant costs of repairs. Experts estimated in December that repairing the Estlink 2 electric cable would take seven months and cost tens of millions of euros.

No casus belli

However, with the growing number of hybrid threats aimed at “blurring the lines between war and peace”, this is now a problem for all Western states, not just those with coastline on the Baltic Sea.

Keir Giles, a senior researcher at London-based independent policy institute Chatham House, said that “defensive reactive measures like this can only do so much to address the problem”, and that it would be far more effective to be proactive, and convey to any potential aggressor that sabotage will not be tolerated.

“But that may require more bold and proactive steps than the collective West is willing to take at the moment,” Giles admitted to Novaya Europe.

Nevertheless, a new strategy to counter hybrid threats is now on the agenda, NATO’s Deputy Assistant Secretary General for Innovation, Hybrid, and Cyber James Appathurai revealed in an interview with Sky News late last year. The new strategy is expected to be approved at the next NATO summit due to take place in June.

One issue strategists will have to grapple with is the criteria for Article 5 of the NATO Charter to be invoked. NATO has publicly agreed that “since 2016, hybrid actions against one or more allies could lead to a decision to invoke Article 5 of the North Atlantic Treaty”, but any such decision must be unanimous and would only apply in the event of a clear and unconditional threat.

Though it is going about it cautiously, the Kremlin is hoping to fulfil its “strategic objective of weakening Europe and its allies mainly through the use of non-military hybrid threat tools”, according to Hybrid CoE, a think tank linked to the EU and NATO. 

“Acknowledging NATO’s military power, Russia does not appear to be pursuing direct military conflict with the West,” Hybrid CoE continued, noting that while such activity could destabilise the EU or even undermine support for Ukraine, it would not be enough to trigger Article 5 on collective defence.

In recent months, the NATO leadership has described itself as being “in a little bit of a boiling frog situation”. According to Appathurai, the current number of hybrid attacks would have been considered “utterly unacceptable” five years ago, but is now seen as normal.

Giles says there may also be a problem in terminology: “Ten years after the phrase was first co-opted to describe Russian special operations in Europe, ‘hybrid threats’ as a term has long outlived whatever usefulness it once had. The adjectives applied to this form of warfare — ‘hybrid’, ‘grey zone’, ‘sub-threshold’ and so on — have served as an excuse to persist in the comfortable fiction that Russia is not waging war on Europe,” he told Novaya Europe, saying it was high time that illusion was abandoned.