Russia's Increasingly Aggressive Sabotage Threatens Europe's Offshore Energy Network

(Photo by Ole Berg-Rusten / NTB / AFP)

The Hywind Tampen floating offshore wind farm, situated between energy company Equinor's oil and gas fields Snorre and Gullfaks in the Norwegian North Sea off the coast of Bergen.

Although Russia is growing more likely to target Europe's offshore energy infrastructure, Moscow will likely seek to avoid excessive economic or societal disruptions that would significantly heighten escalatory risks. In recent weeks, European governments and media have warned of increasingly aggressive and dangerous actions from Russia in its now months-long sabotage, espionage and destabilization campaign across the Continent. On Oct. 14, Thomas Haldewang, head of Germany's domestic intelligence service, warned the German parliament about "aggressive behavior" by the Russian intelligence services, noting a rise in both the quantity and sophistication of espionage and sabotage operations by Russian actors in Germany and stressing that Moscow is willing to "put human lives at risk" as part of these activities. Striking a similar tone, Ken McCallum, head of the United Kingdom's domestic security and counter-intelligence agency MI5, noted on Oct. 8 that Russia's military intelligence agency GRU is conducting sabotage operations in the United Kingdom and other European countries with "increasing recklessness," while Vice-Admiral Nils Andreas Stensones, the head of the Norwegian Intelligence Service, on Sept. 10 told Reuters that "the risk level has changed," with more serious acts of sabotage now increasingly likely. Norway — like other northern European countries bordering the Baltic and the North Seas — is a particularly attractive target for increasingly bold sabotage operations, given the country's extensive network of offshore energy infrastructure. This was highlighted during a closed-door meeting in late August between the security services from several northern European countries and Norwegian government officials and energy companies' executives to share intelligence and coordinate responses to potential Russian threats.

A joint investigation by broadcasters in Sweden, Denmark, Norway and Finland revealed in April 2023 that Russian civilian and military ships have been actively mapping offshore infrastructure, including wind farms, gas pipelines and communication cables in waters around the four Nordic countries since 2022.
On Oct. 16, Russian Foreign Ministry spokesperson Maria Zakharova said Moscow would retaliate against Norway over the country's decision to cut Russian diplomatic staff in Oslo, arguing Russia "will take this latest unfriendly step into account when drawing up our future line towards Norway. We promise that our response will definitely be sensitive, we promise that, for the Norwegian side."

Recent incidents suggest Russia's risk tolerance regarding its ongoing sabotage campaign in Europe is increasing amid rising tensions with the West over Ukraine, making aggressive attacks that could cause casualties or significant disruptions more likely. Since late 2023, Russia has ramped up its sabotage campaign across Europe, increasingly relying on local proxies both for plausible deniability and due to a lack of operatives on the ground since the mass expulsions of Russian spies in the wake of the Russia-Ukraine war. These efforts include physical sabotage, arson, vandalism, harassment, intimidation and other actions designed to sow chaos and ignite social tensions on the Continent in a bid to weaken European support for Ukraine while carefully avoiding crossing a threshold that would trigger a direct confrontation with NATO. But in the past few months, Russia appears to have escalated both the scope of its targets and the severity of its actions, showing an increased willingness to inflict greater damage and take on higher risks in these operations, as highlighted by recent plots to sabotage NATO and U.S. military bases or assassinate high-profile civilian targets across Europe. This comes amid growing tensions between Russia and the West, particularly as Moscow accuses NATO countries of enabling Ukrainian attacks on Russian soil by backing Ukraine's invasion of Russia's Kursk region and loosening restrictions on Ukraine's use of long-range weapons to strike targets deeper inside Russian territory. And, as recent incidents suggest, the Kremlin's increasing risk tolerance raises the likelihood of Russian-sponsored attacks that could cause casualties and/or significantly disrupt critical services in Europe, including against energy infrastructure.

Russian government officials, including Foreign Minister Sergei Lavrov in September, repeatedly warned of significant retaliation against Western countries providing Ukraine with more long-range cruise missiles and allowing Kyiv to strike targets deep inside Russia.
On Oct. 16, the Guardian reported the United Kingdom's counterterrorism police were investigating potential Russian involvement in a suspected sabotage operation where Russian operatives may have planted an incendiary device on a plane bound for the United Kingdom that later caught fire at a DHL warehouse in Birmingham on July 22. A similar incident occurred in Germany at a DHL facility in Leipzig in July, and Germany's domestic intelligence agency hinted on Oct. 15 that Russia may have been involved. Although the two incidents had no major consequences, they could have caused fires aboard the planes had the parcels ignited mid-flight, potentially leading to deadly plane crashes.
Russia's potential interest in targeting Europe's energy infrastructure may increase further over the coming months, as Ukraine's gas transit agreement with Russian state gas giant Gazprom is set to expire at the end of the year and it is unlikely that complex ongoing negotiations will succeed in extending it or producing a new deal. If the deal expires, a further 15 billion cubic meters (bcm) of natural gas would be removed from the market, and Russia could take advantage of this tighter gas supply by sabotaging Europe's energy infrastructure to put pressure on European prices. This strategy could also work as "retaliation" against the Continent for allowing Ukraine to sever one of the last remaining gas trading routes between Europe and Russia. That Russia would also struggle to divert these flows, at least initially, would only add motivation for Moscow to retaliate.

Europe's offshore energy infrastructure makes an attractive target for sabotage given that certain attacks could have high disruptive potential, be difficult to conclusively attribute and still fall below the threshold of war, all of which maximize the potential impact while limiting the risk of escalation or retaliation. While there is no concrete evidence of Russia planning any attack against Europe's energy infrastructure in the short term, Moscow would both have the interest and the technical capabilities to do so. Potential targets for Russian sabotage operations in Europe include onshore and offshore energy assets such as pipelines, LNG terminals, storage facilities, refineries and power plants. Natural gas infrastructure represents a particularly attractive target given the very tight state of the market in Europe currently, which would amplify the economic effects of even an isolated incident. As seen in multiple incidents since Russia's 2022 invasion of Ukraine, offshore natural gas pipelines are the most vulnerable targets to sabotage due to their remote locations and limited physical security measures, which make attacks easier to carry out and attribution very challenging to ascertain. The Baltic Sea and the North Sea, crucial shipping routes crisscrossed by pipelines and communication cables, are also key flashpoints for potential sabotage, given how attacks in either location would potentially affect multiple countries' energy security and economic stability. Norway is an especially attractive target given its role as Europe's largest gas supplier since Russia's invasion and relatively vulnerable infrastructure. Potential targets for Russia's sabotage of infrastructure transporting Norwegian natural gas to mainland Europe include the Baltic Pipe, which links Norway to Poland via Denmark, or one of the major pipelines transporting gas from Norway to the United Kingdom and Western Europe, such as the Europipe II and Langeled pipelines. The Baltic Sea is the most accessible place for Russia to target energy infrastructure as it can access it directly through seaports in St. Petersburg and in the Kaliningrad enclave. Still, Russia would also have the equipment and knowhow to carry out more complex operations in the North Sea, including at depths of 200 meters on average in the areas where major pipelines converge.

With a nameplate capacity of up to 10 bcm, the Baltic Pipe represents a potentially highly attractive target as it is located in a shallower area of the Baltic Sea, which would facilitate an attack from a technical point of view. Moreover, the impact of sabotage on the pipeline would be relatively contained (with a capacity only 10% of Nord Stream — the 110 bcm pipeline linking Russia and Germany that was shut down after Russia's invasion of Ukraine and later damaged by suspected Ukrainian sabotage — the disruption caused severe supply shortages and price volatility), which would somewhat reduce the likelihood of an escalatory response from Europe. An attack would disproportionately affect Poland and the Baltic countries, which are significantly more supportive of Ukraine and hawkish on Russia than many of their Western European peers. Inflicting disproportionate costs on these countries would align with Russia's strategy to drive a wedge between Eastern and Western Europe, especially if the necessity to redistribute natural gas from the latter to the former in light of emergency solidarity mechanisms approved by the European Union in 2022 would increase the costs for consumers in countries where public support for Ukraine is already fragile.
In a more disruptive but less likely scenario, sabotage to the Europipe II and Langeled pipelines, each delivering 73.5 and 73.8 million cubic meters a day to Germany (and the Netherlands) and the United Kingdom, respectively, would be significantly more impactful, both in economic and political terms, as Norway currently provides about 40% of both countries' natural gas intake. This heightens the risk of escalation of a deliberate Russian attack on these pipelines, making such a scenario relatively less likely. Moreover, Norway's gas supply to Germany and the Netherlands is supplemented by the smaller EuroPipe I and NorPipe, meaning that a complete interruption of Norwegian gas deliveries to Western Europe would require striking three different pipelines, which would make the operation significantly more challenging. The depth and extreme remoteness of the pipelines would make an attack technically more complicated (though Russia would have the capability for such an operation) but also more challenging to defend against, especially given the very long extension of the EuroPipe II and Langeled pipelines, respectively stretching for 658 km and 523 km.

While maintaining a veneer of plausible deniability without crossing the threshold of military aggression, particularly disruptive sabotage operations targeting Europe's offshore energy infrastructure would have a significant economic and societal impact and carry significant escalatory risks, which means Russia is ultimately less likely to pursue such a strategy compared to more restrained attacks against smaller infrastructure. An attack on either the Baltic Pipe or the Europipe II and Langeled pipelines in the North Sea would have a significant impact on Europe's natural gas markets, likely resulting in severe price shocks, increased pressure on gas supplies and heightened economic instability. Protracted outages, particularly at the North Sea pipelines, would lead to emergency measures across the European Union as well as the United Kingdom, including potential gas rationing, disruptions to industrial production, important financial responses from governments to shield consumers and businesses at a time of already precarious fiscal situations across most European countries, and a scramble to find alternative sources of energy that would increase prices further and likely lead to tensions among EU member states concerning the emergency allocation of gas and electricity supply. Most importantly, despite challenges in conclusively attributing attacks, operations of this nature would require a level of sophistication that would ultimately reduce plausible deniability and likely lead to Russia being considered responsible, thus dramatically raising the risks of escalation. Although European governments would mostly likely seek to avoid a direct confrontation with Russia, significant disruptions or even civilian casualties (for instance, as a result of long-lasting power outages during the winter) could force them to trigger NATO's self-defense clause or compel them to respond by providing Ukraine greater military support and more leeway on its use on the battlefield, which would inevitably further increase tensions and potentially trigger a spiral of escalation that could eventually result in a direct NATO-Russia military confrontation. Against this backdrop, despite its seemingly reduced threshold for sponsoring more aggressive attacks in Europe, Russia still has strong incentives to avoid triggering such a scenario, which means deliberately highly disruptive attacks against Europe's energy infrastructure remain ultimately unlikely. On the other hand, Russia still has the option to target smaller or more isolated energy infrastructure that is not critical to any European country's energy security (such as a well, a secondary pipeline with some redundancy or power substations), causing only local supply interruption and power outages. This would allow Moscow to increase pressure on Europe for its support for Ukraine without excessively fuelling escalatory dynamics, as these attacks would have only limited and temporary impacts on Europe's energy prices.

Both in the Baltic and the North Seas, undersea infrastructure is difficult to defend due to the sheer size of the area and the technical challenges of monitoring deep-sea assets. Although NATO and European countries have enhanced their surveillance of these regions, the infrastructure remains vulnerable due to the remote locations and the difficulty of ensuring 24/7 protection.
While Russia's risk tolerance and aggressiveness are rising in its sabotage efforts in Europe, a highly disruptive attack against Europe's energy infrastructure would still likely result from a more significant change in Russia's calculus, either to voluntarily test NATO responses and appetite for escalation or to deliberately cause severe damage to the European economy, something yet to be observed.
Potential targets for smaller-scale sabotage against offshore infrastructure include subsea secondary electricity and fiber-optic cables in the Baltic, North Sea and Bering Sea, as well as secondary pipelines, such as those transporting oil products or linking floating LNG terminals to inland networks. Isolated offshore wind farms, secondary energy terminals, storage facilities and remote power substations with limited importance to national grids may also be at risk.
Moreover, in addition to physical attacks, cyberattacks targeting control systems and communication networks could also paralyze operations and compromise safety protocols in energy infrastructure, leading to potentially significant economic damage, even if temporary. For instance, Nordic utility Fortum revealed as recently as Oct. 10 that it faces cyberattacks "on a daily basis" and that it regularly observes suspicious activities from drones and individuals near its Finland and Sweden sites.