A growing number of suspicious sea cable disruptions in the Baltic Sea are pushing NATO members to ramp up their defenses of critical maritime infrastructure, but this will prove challenging and could elevate tensions with Russia amid the Kremlin's apparent growing risk tolerance. Following the disruption of an electricity cable and several fiber optic internet cables connecting Finland and Estonia on Dec. 25, NATO Secretary-General Mark Rutte announced in a Dec. 27 post on X that NATO will enhance its military presence in the Baltic Sea. The same day, Estonian officials deployed a naval patrol to monitor the remaining electricity cable between the two countries, urging other countries to follow suit. Following the incidents, Finnish authorities quickly began investigating a Russian oil tanker after details emerged that the vessel had dragged its anchor on the seabed, seizing and boarding the vessel Dec. 26 and tugging it to the port of Kilpilahti on Dec. 28. The suspected oil tanker, named the Eagle S, is a part of Russia's so-called shadow fleet, which consists of hundreds of aging vessels often linked to shell companies whose corporate linkages are difficult to trace and that enable the Kremlin to circumvent Western-imposed price caps on Russia oil transported by sea. While the severance of the Estlink-2 connector did not severely disrupt electricity flows between the two countries, electricity prices in the Baltic states have risen since the incident. If temperatures fall before the cable is repaired, which could take until July 2025, more significant strains on regional energy supplies are possible. The concurrent cable breaks occurred less than a month after another incident in the Baltic Sea that also resulted in the severance of two fiber optic cables within 24 hours between Nov. 17-18. European authorities now believe that the earlier incident was the result of a Chinese commercial vessel, the Yi Peng bulk carrier, purposely dragging its anchor for more than 100 miles to deliberately disrupt the internet cables, potentially after Russian intelligence officials bribed the ship's captain. 

• On Dec. 25, the Eagle S was spotted in the vicinity of the damaged Estlink-2 electricity connector when it purportedly slowed significantly, according to publicly available automatic identification system signals. In addition to the electricity cable, three fiber optic internet cables connecting the two countries were damaged, as was an internet cable between Finland and Germany.
• Upon boarding the Eagle S, European investigators discovered a significant amount of equipment, such as transmitting and receiving devices capable of recording radio frequencies, not typically found aboard cargo vessels, according to reporting by U.K.-based shipping publication Lloyd's List published Dec. 27.
• Between Nov. 17-18, two sea cables, the C-Lion1 subsea cable connecting Finland and Germany and the nearby BCS East-West Interlink cable linking Lithuania to the Swedish island of Gotland, were severed. Around the time of the cable breaks, the Yi Peng 3's transponder, which charts and transmits maritime vessel movements, was reportedly off. 

The cable disruptions are the latest in a growing number of similar incidents in the Baltic Sea since the outbreak of the Russian-Ukrainian war and increasingly frequent detections of Russian surveillance around European maritime infrastructure. Since Russia's invasion of Ukraine in February 2022, the Baltic Sea has increasingly become a hotbed for suspicious damage to critical energy and internet infrastructure. The Nord Stream pipeline explosions in September 2022, which ruptured three out of four lines providing gas between Russia and Germany, garnered significant attention given the brazenness of the sabotage. While subsequent investigations indicate that Ukraine was responsible, it nevertheless highlighted the vulnerability of Europe's offshore energy and telecommunications infrastructure to potential Russian sabotage efforts. In October 2023, the Balticconnector subsea gas pipeline and two nearby fiber optic internet cables in the Baltic Sea were damaged nearly simultaneously in another incident attributed to a Chinese vessel dragging its anchor, also possibly at the behest of Russia. The scattered incidents have occurred against the backdrop of growing reports of Russian vessels spotted near critical infrastructure sites in the Baltic Sea — including around offshore wind farms, pipelines and underwater sea cables — and accusations that Russia's shadow fleet is also being used to collect signals intelligence. 

• A joint investigation published Sept. 24 by Dutch outlet Pointer and eight other European media companies analyzed 72 Russian research vessels undertaking voyages since the outbreak of the Russian-Ukrainian war within the exclusive economic zones of Denmark, Estonia, Finland, the Netherlands, Norway and the United Kingdom. In 54 of these excursions, researchers observed suspicious movements like sailing slowly for hours, moving in a zig-zag pattern or stopping completely; these typically occurred near gas pipelines, data cables, wind farms and military infrastructure.
• U.S. officials have detected increased Russian military activity around key undersea cables, and believe Russia has increasingly emphasized building a dedicated military unit to survey communications infrastructure for potential sabotage, CNN reported Sept. 6. The unit, called the "General Staff Main Directorate for Deep Sea Research," comprises surface ships, submarines and naval drones. 
• In April 2023, a joint investigation by broadcasters from Denmark, Finland, Norway and Sweden revealed that a fleet of Russian vessels disguised as fishing trawlers and research vessels was equipped with underwater surveillance equipment and was mapping key sites in the North Sea for possible sabotage including underwater sea cables, wind farms and pipelines. 

NATO's enhancement of its military presence in the Baltic Sea is the latest effort by the bloc to ramp up oversight of maritime infrastructure in European waters, though implementing the strategy will face significant technical challenges. Over the last year, NATO members have sought to increase awareness and response mechanisms to maritime threats, particularly in the Baltic and North seas, including through establishing specific units to explicitly surveil and protect sensitive underwater entities, as well as other diplomatic and economic measures like sanctions aimed at undercutting the movement of shadow fleet vessels. While NATO's ongoing efforts to shore up maritime defenses will likely mitigate some risks to key infrastructure, particularly those closer to shore, will challenge alliance efforts to prevent sabotage. The most obvious obstacle is the difficulty of comprehensively monitoring the Baltic Sea. Much critical infrastructure, such as sea cables and pipelines, extend hundreds of miles across the seabed. Moreover, while NATO members are increasing their investment in maritime vessels and autonomous drones to monitor critical infrastructure, many of these initiatives are still in their early stages and will take several years to complete. Further, the sea's central location between nine European countries makes it a key area for shipping activity, including for Russia, which relies heavily on its ports in and around St. Petersburg and Kaliningrad, contributing to significant maritime traffic that complicates consistent monitoring of various strategic assets. The Baltic Sea is also unique for being exceptionally shallow, with an average depth of just 55 meters (about 180 feet), meaning that underwater infrastructure is much more vulnerable to potential sabotage from attacks that can be construed as incidental, such as dragging an anchor on the sea floor. The North Sea — a larger, more open and deeper body of water with stronger currents, rougher weather conditions and lower visibility — by contrast presents a more difficult theater for potential Russian sabotage, especially given the heavier NATO military presence there vis-a-vis Russia's presence. But the North Sea also has a higher concentration of maritime infrastructure — like offshore oil and gas rigs, pipelines and wind farms — all high-value, difficult-to-defend assets that Russian forces have both the interest in, and technical ability to, target.

• Following the suspected sabotage incident of two sea cables in the Baltic Sea, 30 NATO vessels and 4,000 military personnel conducted a 12-day "Freezing Winds" naval exercise Nov. 18 in an effort to bolster preparedness to protect NATO maritime infrastructure. 
• On Dec. 16, the European Council adopted its 15th package of sanctions targeting Russia since its invasion of Ukraine, with a specific emphasis on Russian-linked shadow fleet vessels. The sanctions added 52 vessels to a list that bans them from receiving maritime transport services or entering ports owned by EU member states. On Dec. 26, the EU foreign policy chief said the bloc is preparing additional sanctions to target the fleet.
• Among other initiatives, the Swedish military is developing two new A26 attack submarines, the Blekinge and Skane, scheduled for launch in 2027 and 2028, respectively. This is the first time Sweden has developed new submarines in more than a decade. They are intended to patrol the eastern Baltic Sea, monitoring and responding to Russian maritime movements. 
• In January 2023, NATO teamed up with the European Union to create the EU-NATO Task Force on Resilience of Critical Infrastructure. The following February, NATO also created the Critical Undersea Infrastructure Coordination Cell to identify vulnerabilities and improve information sharing between public and private sector entities involved in critical infrastructure maintenance and operation. In July 2023 during the annual NATO summit in Vilnius, the alliance agreed to establish a Maritime Center for the Security of Critical Underwater Infrastructure within NATO's Maritime Command. In October 2023, NATO, in collaboration with Sweden, launched the Digital Ocean Initiative aimed at facilitating technology integration to strengthen seabed situational awareness and enhance deterrence and defense in the maritime domain. 

Russian hybrid warfare activities targeting European maritime infrastructure will likely continue as the war in Ukraine persists, posing a range of disruptive risks to energy and internet services in localized areas. Russian sabotage has increased significantly over 2024 as the Kremlin's risk tolerance has risen, ranging from attempted assassinations of European arms manufacturing executives to deploying incendiary devices on cargo planes, along with myriad other examples of suspected Russian arson, vandalism and other attacks on other European entities. In line with this trend, Russia will likely continue sponsoring attacks, including in the maritime space, where it can use its shadow fleet and other somewhat deniable vectors, perhaps including certain Chinese vessels, to conceal the source of any attacks. While the Kremlin will likely maintain its aggressive offensive strategy aimed at undermining Western cohesion and support for Ukraine, Russia will likely still avoid Europe's most essential infrastructure entities, like the key Europipe II and Langeled pipelines in the North Sea. Given that they underpin large swaths of several countries' energy supply, attacking them would be more likely to trigger a more substantial NATO response. Instead, Russia will likely prioritize less strategically important infrastructure for sabotage that nevertheless creates challenges for European countries such as severing internet or electricity cables, reducing — but do not entirely disrupting — access to critical services. While these activities will not result in catastrophic disruptions to businesses and daily life in affected countries, they are likely to cause short-term localized issues for communities most reliant on specific connectors, particularly island communities. Moreover, even less impactful disruptions may still lower the bar for escalating tensions between Russia and NATO, particularly as more frequent incidents heighten the potential for miscalculations and elevate the chances of sabotage that causes more damage than intended. 

• In October 2022, two subsea cables were damaged off the coast of Scotland, severely undermining internet connectivity with the Faroe and Shetland islands, leaving much of the island communities with limited access to internet and mobile services. The incident forced most businesses to rely on cash to continue operations, and citizens were unable to contact emergency services for several hours until internet traffic was rerouted to working cables.

Even carefully calibrated, let alone more aggressive, NATO efforts to thwart Russian sabotage may elevate tension with the Kremlin. In the context of already deep mistrust between the two sides, NATO's increased efforts to monitor and respond to potential Russian sabotage may elevate tensions with the alliance. Better maritime surveillance will bolster European officials' ability to directly attribute incidents to the Russian government, especially in the unlikely but still possible scenario NATO forces catch saboteurs in the act. Thus far, the West has generally relied upon "naming-and-shaming" tactics in the aftermath of Russian-linked incidents, but evidence that this strategy has failed to curb Russian sabotage activities may compel the West to respond more aggressively. In the case of maritime activity, Finland's seizure and investigation of the Eagle-S represent some of the most direct interventions that European officials have taken following a disruption to critical infrastructure. Should European officials make even tougher responses to future incidents, such as the arrest or detention of crew members of a suspected Russian-linked vessel, the risk of more direct confrontation would grow.