Conflict and Defense

An Underwater Offensive

Een Onderwater Offensief - Shaping Europe

The vulnerability of Baltic Sea infrastructure.

Over the last few months, the Baltic Sea has become the stage of a series of incidents involving undersea cables that connect several European Union (EU) Member States in the region. This sea, with an average depth of about 52 meters, hosts a complex network of telecommunication lines, electricity cables and gas pipelines on its seabed. In November and December of 2024, several of these cables, such as those between Germany and Finland, were damaged or even cut, thereby causing disruptions. While accidental damage to these undersea cables cannot be entirely excluded, investigations into these incidents present strong clues that the damage may have been the result of deliberate acts.

Consequently, Member States have called for more security of European undersea infrastructure. However, protecting this infrastructure proves difficult and is costly due to its depth and size. Therefore, it remains highly vulnerable to sabotage by actors aiming to disrupt Europe’s communication and energy infrastructure. In response to the latest incidents, Finland has seized a suspected vessel, and the North Atlantic Treaty Organization (NATO) has announced plans to strengthen its military presence in the Baltic Sea.

Who is responsible for sabotaging undersea infrastructure in the Baltic Sea? What could be the reasoning behind it? And, what can the EU do to protect this crucial infrastructure?

A series of mysterious, but consequential incidents

The seabed surrounding Europe hosts a complex and extensive web of telecommunication links, energy cables, and gas pipelines. Undersea telecom cables carry about 99 per cent of the world’s data, ensuring seamless digital communication. This makes them indispensable in today’s globalised and interconnected world. Similarly, undersea energy cables are crucial to Europe’s supply of green energy sources, as they enable the transfer of electricity from offshore wind farms to land-based stations. In other words, these cables on the seabed are crucial to the continuous flow of energy resources and digital connections between European countries.

The cutting of undersea cables is often referred to as a form of hybrid warfare. This is the use of conventional and unconventional means by a state or non-state actor below the threshold of detection and attribution, which can create instability in the targeted countries. Newly NATO Secretary-General Mark Rutte said: “NATO allies will continue to stand together to face these threats through a range of measures, including greater intelligence sharing and better protection of critical infrastructure”.

Due to the vulnerability of undersea infrastructure, it comes as no surprise that, according to NATO, this type of infrastructure has emerged as an attractive target for hybrid attacks, especially by state actors. These actors pose the largest threats due to their capabilities and strategic incentives for intentional sabotage and spying. Since Russia’s invasion of Ukraine in 2022, the geopolitical landscape has significantly changed. Specifically, the undersea infrastructure of the Baltic Sea has faced growing threats of sabotage, highlighted by the explosion of the Nord Stream 2, a gas pipeline connecting Germany and Russia. While Russia’s involvement in this specific instance was later debunked, investigations into the new incidents that occurred at the end of 2024 do point to Russia and, allegedly, also to China.

The first incident in the recent series occurred on November 17 and 18, 2024. It was reported that two undersea telecommunications cables were cut. One was a cable between Finland and Germany, the other between Sweden and Lithuania. Finnish cybersecurity organisation Cinia suggested that these cuts may have been caused by an “external force”, either deliberately or unintentionally. The exact details remain unclear, but the Swedish police have launched an investigation into the suspected sabotage. The focus of the investigation is a Chinese-flagged bulk carrier, the Yi Peng 3, which was present at the location of the cables when the disruptions occurred. In reaction to the investigation, China said it was willing to assist, while Russia denied any involvement in the incident. According to security sources, the bulk carrier was responsible after it was revealed it had dragged its anchor on the seabed.

The incident in November is similar to one that occurred two years ago. In October 2023, a Chinese vessel, the NewNew Polar Bear, owned by Hainan Xin Xin Yang Shipping Co, allegedly damaged two cables and a gas pipeline in the Baltic Sea. Back then, China made similar promises to assist in the investigation; however, the ship was not stopped, and more than a year later, European investigators have yet to present conclusions.

Following the incident in November 2024, a second incident occurred on December 25th, 2024, Christmas Day. An energy cable and three telecommunication cables between Finland and Estonia were damaged and cut. According to the Estonian Minister of Justice, Liisa Pakosta, it “can’t be by accident”. Not much later, it was reported that the police were again investigating the involvement of a foreign vessel. This time, the Hong Kong-flagged Xin Xin Tian 2 was supposedly in the vicinity of the cable around the time of the outage. However, as new details were revealed, suspicions shifted to another ship: the oil tanker Eagle S, which is known to be part of the Russian shadow fleet. This fleet consists of a growing number of ageing and poorly maintained vessels employed by Russia to circumvent the sanctions imposed by the West and, allegedly, conduct surveillance around critical infrastructure.

The cause of the outages: intentional or accidental?

In the incidents mentioned before, reports indicate that the vessels were near the specific cables when the outages and disruptions occurred. Regarding the incident of November 18-19, the Danish broadcasting service TV2 revealed that transponder data from the Chinese-flagged Yi Peng 3 indicated that the ship’s movement had slowed down directly above three Danish-Swedish cables, an act that experts deem unnecessary. Furthermore, research by TV2 with an underwater drone shows a long drag mark, along with a deep impression on the seabed, which may be the result of a dragging anchor. Moreover, the direction and place of the drag trail of the anchor match the course of the Yi Peng 3.

Since the incidents in November 2024, the Yi Peng 3 has anchored just outside Danish territorial waters. EU Member States that have fallen victim to the sabotage incidents in November swiftly dismissed the idea of an accident, with Germany’s Defense Minister Boris Pistorius asserting that “nobody believes” the cuts were “accidental”. As mentioned before, Swedish police are conducting an investigation and have since been on board the carrier at the invitation of China as ‘an observer’. However, a request by Sweden for prosecutors to board the ship has been denied. In light of the investigation, Sweden also said it wants to bring the ship to one of its harbours. However, as the ship has continued its course through international waters after the observation, this is now difficult.

Following the incident on Christmas Day, Finland has focused its investigation on the Cook Islands-flagged Eagle S. In a press conference, Finnish authorities announced that the damage to the cable was, again, likely due to the drag of an anchor. In response to the investigation surrounding the role of the  Eagle S, Finnish authorities decided to detain the vessel. According to shipping website Lloyd’s List, the Eagle S was loaded with equipment to monitor NATO ships and aircraft activities. Furthermore, after authorities boarded the ship, they asked the crew to lift the anchor, only to find out that there was no anchor attached to the anchor chain. On January 7, the Swedish Navy reported that they had located and retrieved a lost anchor from the seabed. According to Finnish broadcaster Yle, this anchor belongs to the Eagle S and was used to sever the power cables between Finland and Estonia.

Although these clues point in a certain direction, no official evidence has been presented that these vessels are responsible, as investigations by authorities are still ongoing. However, Finnish Member of Parliament and former Defence Forces Chief Jarmo Lindberg said that “it seems suspicious that enormous anchors could be dragged along an uneven seabed without the ship noticing”. When an anchor drags, the ship loses part of its speed and veers to one side.

Why are these disruptions happening?

Both the alleged Russian and Chinese involvement in the incidents should not come as a surprise. NATO officials believe that Russia is conducting a decadelong programme to map out European undersea infrastructure in an attempt to prepare the battlefield for a possible future conflict. According to a senior NATO official, “part of Russian war planning is knowing where the critical infrastructure of your enemy is”. Regarding China, its preparations for a potential (military) unification with Taiwan, its ever-closer ties with Russia, and its worsening relations with the West create new imperatives to carry out physical attacks on Europe’s cable systems, either to disrupt their operations or to intercept the data they transmit. European officials have stated that they believe the sabotages in November are connected to Russia’s invasion of Ukraine. The Kremlin, however, has dismissed these claims as “absurd” and “laughable”.

Furthermore, energy sources have been an important tool for Russia to destabilise and divide EU Member States. Of course, after the invasion of Ukraine, Russia threatened to cut off the gas supply, which led to a slight panic in Member States that were reliant on this supply and a significant increase in energy prices. However, as recent incidents in the Baltic Sea have proven, European energy infrastructure at sea is also at risk. 

Despite the various clues, it is important to point out that damage to undersea cables can also occur accidentally. Damage to undersea cables is extremely rare, occurring about 200 times a year worldwide. Protecting this infrastructure against foreign aggressors is a difficult operation. While the entire system needs to be protected, an enemy only needs to succeed in one place.

EU Member States have already taken steps to limit further risks to seabed infrastructure. For example, Sweden has rejected applications for thirteen offshore wind farms over security concerns. The Swedish government believes that building these projects off the coast would have unacceptable consequences for Sweden’s defence. NATO has also warned that the security in Europe and North America is at risk due to acts of hybrid warfare by adversaries, and vulnerabilities in wind farms, pipelines and power cable infrastructure.

How can Europe prepare for and protect against attacks on undersea infrastructure?

Following the latest incidents in the Baltic Sea, the question arises of what the EU can do to protect its critical infrastructure on the seabed. As these hybrid attacks on the undersea cables are obscure, sudden, and somewhat mysterious, it remains difficult to point fingers at possible perpetrators based on hard evidence. Russia’s alleged involvement in the Baltic Sea incidents is not an isolated case. The foreign ministers of Germany, France, Poland, Italy, Spain, and the United Kingdom stated that Moscow’s escalating hybrid activities against NATO and the EU countries are “unprecedented in their variety and scale, creating significant security risks”. Examples of these activities are weaponising migration, deploying disinformation campaigns to influence European electorates, and carrying out targeted killings to further its objectives. Therefore, these hybrid attacks are not just an EU matter, but also a matter of NATO.

Regarding the incidents in the Baltic Sea, Rutte stated on X that “NATO will enhance its military presence in the Baltic Sea.” While this is a crucial step, I strongly believe that Europe must also prioritise strengthening its monitoring capabilities to safeguard undersea infrastructure. Tracking and documenting the movements of ships, particularly near critical European seabed infrastructure, can provide clear evidence of any sabotage attempts. Publicly disclosing such evidence when sabotage occurs could play a crucial role in holding the responsible actors accountable.

To achieve this, more investment should be made into methods to improve maritime security. For example, the Dutch Organisation for Applied Scientific Research (TNO) has announced it has successfully tested a detection method for monitoring ‘dark’ ship traffic around the North Sea, using unused glass fibres as sensors to detect vibrations from ships. This could help send out warnings of unauthorised activity around maritime infrastructure. Another solution is posed by BAM, a German scientific and technical Federal institute, which is developing small sensors for offshore wind turbines, which will warn of potential dangers.

On December 11, 2024, the EU announced a new set of sanctions against Russia, specifically targeting its shadow fleet. The EU wants to better locate and identify ships that sail through European waters without valid papers. In addition, the Union wants to research the owners of vessels and to which company they belong. Following the latest incidents, the German and Estonian governments have expressed the need for cooperation at a European level, as they call for increased collaboration between European countries and NATO partners to address possible Russian sabotage in the Baltic Sea. After the incidents of late 2024, Dutch marine frigate Zr.Ms. Tromp was assigned to command a group of NATO ships in the North Sea, Baltic Sea and Atlantic Ocean. This force will act as a rapid reaction force at sea, responding when something occurs.

The investigations into the incidents of November and December 2024 indicate the potential involvement of foreign actors in sabotaging critical European undersea infrastructure. While some strong clues point to interference and sabotage by Russia and China, obtaining concrete proof remains a significant challenge. Therefore, I hope that the outcome of the ongoing investigations by the affected Member States will shed further light on the causes. In the meantime, the EU and NATO should do everything in their power to boost its security in the Baltic Sea, and for that matter, also in other seas surrounding Europe, like the North Sea. I think Rutte’s announcement to increase military presence in the Baltic Sea is an important step that is instrumental in helping to catch an actor in the act. Furthermore, more investment in methods that can warn of suspicious ship activity around cables could improve the protection of this infrastructure. By addressing these threats with urgency and foresight, Europe can protect its infrastructure and bolster its security resources against possible future provocations.

Vincent Lubach holds a Master’s degree in European Policy and a Bachelor’s in European Studies from the University of Amsterdam with a major in European Economics and a minor in International Relations.

Image: Shutterstock