The alleged sabotage of undersea cables by Russian and Chinese ships in the Baltic Sea raised the possibility of a dangerous 2025 for NATO’s northern theatre. Allied leaders have pledged to increase surveillance and take stronger action against these vessels.

Mark Rutte, the alliance’s chief, said late in December that NATO would increase its military presence on the Baltic Sea, following the last suspected instance of sabotage. He condemned “any attack on critical infrastructure”.

Rutte’s commitment came after the most recent of three alleged sabotage operations in the Baltic Sea — the damaging of the Estlink 2 power cable and four internet cables on Christmas Day. The Estlink 2 cable — along with the Estlink 1 cable — transfers electricity from Finland to Estonia across the Gulf of Finland.

The Eagle S, a ship registered in the Cook Islands but reportedly owned by Russia’s “shadow fleet”, was quickly taken into custody by the Finnish authorities.

The Finnish authorities announced on Jan. 3 that repair work had started and that forensic samples were being taken as part of the investigation. The Finnish authorities said that eight sailors were still subject to a travel restriction as the investigation continued.

NATO claims that Moscow is using tankers to avoid international sanctions on its fossil fuels exports, prompted by the Kremlin invasion of Ukraine in 2022. The Atlantic Council described the “shadow fleet” of old vessels that often sail without Western insurance and are owned by opaque people, with frequently changing names and registrations.

Officials from the Allies say that some of these ailing vessels are also low-tech saboteur ships.

According to Windward, a maritime risk management company, there could be up to 1,400 ships in Russia’s shadow fleet. The energy cargo tracking firm Vortexa calculated in December 2023 that 1,649 ships had operated on what the Atlantic Council referred to as the “opaque markets” since January 20, 21. Among them, 1,089 vessels carried Russian crude oil.

The cat-and-mouse game at sea

The suspected sabotage in December prompted the Joint Expeditionary Force led by the UK — a defensive region that also includes Denmark, Estonia Finland, Iceland Latvia, Lithuania the Netherlands, Norway, and Sweden –to launch an advanced AI-assisted reaction system. This was to “track possible threats to underwater infrastructure and monitor Russian shadow fleet.”

The Finnish President Alexander Stubb announced that the meeting in Helsinki on January 14 will be centered around “measures needed to secure the underwater infrastructure” and “the strengthening of NATO’s position in the Baltic Sea, as well as responding to the threats posed by Russia’s shadow fleet.”

Allies will face a challenge when it comes to monitoring 145,560 sq. miles of ocean that are traversed daily by up to 4,000 ships.

Sidharth Kaushal, a senior research fellow for sea power at the British Royal United Services Institute, said that NATO tracking efforts were complicated by the “sizable size of the commercial shipping industry and the fact ownership structures can be quite opaque and complex.”

He explained that “a vessel can have multiple beneficial owners, and its owners might not be from the same state as where it is registered. So attributing a vessel’s activity to one state becomes difficult.”

Russian and Chinese vessels linked to Moscow or Beijing could also play a part, as could other ships that appear unrelated.

Kaushal stated that “the Russians have a wide range of commercial vessels from which to choose.” Oddly, they chose a vessel associated with their Shadow Fleet.

It is also shallow. The average depth of the Baltic Sea is 180 feet. This compares to 312 feet for the North Sea and 4,900 feet for the Mediterranean Sea.

The Baltic Sea is much deeper than the Atlantic Ocean, which has an average depth of 10,932 ft., or the Pacific Ocean with 13,000 ft.

Kaushal explained that “in the Atlantic for instance, you have to use a lot of specialized equipment in order to attack undersea infrastructure.” In the Baltic “many simple tools — like dragging an anchored — are perfectly viable means of attack.”

NATO’s Toolbox

It is more realistic to guard specific sites than to identify and monitor all possible saboteurs. Estonia, for instance, said that after damage was reported to Estlink 2, it sent naval vessels to guard Estlink 1.

Divers from the Special Forces also tested underwater sensors at Bold Machina 2024, a naval exercise held in Italy on November 11, which NATO says could be used one day to protect underwater infrastructure.

Kaushal explained that the solution to the problem was to concentrate on the infrastructures of critical importance, instead of trying to cover a large area such as the Baltic.

NATO ships are still limited in their ability to prevent damage. Kaushal explained that “international freedom of navigation” limits what navies are able to do in international waters or within their exclusive economic zones.

According to the United Nations Convention on the Law of the Sea, freedom of navigation can be challenged when a ship’s transit “prejudices the peace, order or security” of the coastal states.

Historical agreements, such as the 1884 Convention for the Protection of Submarine Telegraph Cables, may also give allies the latitude they need to take action against suspect vessels.

However, preventing civilian ships from passing could have negative consequences in other areas. NATO’s more muscular police presence in the Baltic could encourage Chinese naval activity to be more assertive in the South China Sea or more Iranian interdictions of Iranian ships in the Persian Gulf.

Kaushal: “I don’t think nations, especially Western nations, have shied from that.”

At least local leaders of allies appear to be demanding action. The alleged December attack is just the latest in a series of suspected sabotage attacks in the Baltic.

Two submarine cables – the BCS East-West Interlink linking Lithuania to Sweden, and the C-Lion1 fiber-optic cable that connects Germany to Finland – were damaged by the Baltic Sea in November.

Authorities suspect the Chinese cargo ship Yi Peng 3 caused the damage. German, Swedish, and Finnish officials boarded a ship near the Danish coast in order to inspect it and interview the crew. Later, the Yi Peng 3 set sail to Egypt.

In October 2023, the Hong Kong-flagged Newnew Polar Bear ship damaged the Baltic Connector pipeline connecting Estonia and Finland by dragging its anchor. The EE-S1 cable, which was nearby, was also damaged.

Investigators found a damaged anchor of a ship on the seabed near the damaged cables. Gouge marks were visible on either side of the cables to indicate its trajectory. The National Bureau of Investigation in Finland said that the New Polar Bear lacked one of its anchors.

In August, China’s government acknowledged that the ship damaged underwater infrastructure “by mistake,” citing a “strong storm.”

2025 in the Baltic Theater

Before ships started damaging cables in the Baltic, the strategic lake — called by some leaders the “NATO Lake” after Sweden and Finland joined the alliance — was the site of covert operations that were tied to Russia’s conflict with Ukraine.

In September 2022, the Nord Stream 1 & 2 pipelines that transport natural gas from Russia into Germany were bombed. This was the first noteworthy incident of alleged sabotage on the Baltic Sea after Russia invaded Ukraine in February 2022.

Pipelines were long criticized by North America and Europe, who were skeptical about Berlin’s business relations with Moscow. This included leaders from Ukraine and the Baltic region. They saw pipelines as part of the Russian hybrid war.

Investigators have yet to determine who is responsible for the apparent sabotage of the pipelines. A series of unconfirmed media reports have accused Russia, the U.S., and Ukraine. All denied any involvement.

The Baltic is therefore already an important theatre in the larger showdown between Russia & the West.

Russia can benefit from this. Moscow could force NATO to spend significant resources and time to protect undersea infrastructure with a few tankers. The relative ease of access to the Baltic and the energy requirements of the region could amplify the impact of sabotage.

Kashaul pointed out that the gas grid is not well integrated into the rest of Europe’s grid. In most of Europe, this might be considered a minor inconvenience, but limited sabotage – particularly of gas pipelines – can have some pretty disproportional effects in the Baltic Sea.

Gas shortages in Europe are a major concern for European countries, given their economic and polling effects. The continent’s response has been undermined by energy insecurity. Moscow has sought to exploit this weakness.

But the Baltic Sea’s undersea adventures are not a free-for-all for Russia.

Kashaul stated that Moscow’s shadow operators “have so far enjoyed the freedom of navigation, and the ability to transport Russian oil above the price cap rates in NATO-controlled waters.”

Ghost ships could face more concrete retaliation if NATO nations can prove that vessels violating sanctions are involved in sabotage.

This could also lead to an escalation. Bloomberg, citing a Danish intelligence report, said that Russia could attach military escorts on tankers transiting through the Baltics.

Kashaul noted that such a development was “quite plausible”, though he did note that the intensity of convoy operations could be greater than Russia’s small Baltic Fleet.

He added that a more militarized approach could also unnerve the non-Russian crew members of the vessels.

Kashaul added, “Whether the crews on these ships are willing to take the risks, even if Russians offer escorts or convoys is another factor.”