On the Front Line of Russia's Hybrid Warfare in the Baltic Sea
Théo Prouvost witnesses first hand the response to increasing incidents of Russian aggression
On 26 January, an undersea fibre optic cable between Latvia and Sweden was damaged, likely as a result of external influence. This incident marked the third significant disruption to power and data cables in the Baltic Sea within two months. Those incidents, which have become increasingly frequent are raising alarms about Russian aggressiveness against NATO critical infrastructures.
Covered in a thin white fog, the Baltic Sea seems frozen. The horizon is disturbed only by the faint hum of the Jotvingis's engines. The flagship of the Lithuanian navy.
On board, the atmosphere is one of concentration. On the upper deck, officers scan the radar screens relentlessly. The crew of 50 sailors is focused on a slow mission: to detect and monitor any abnormal behaviour in these Baltic waters.
The ship's commanding officer, Captain Arunas, describes the hunt while observing the horizon, “It's simple, Russian ships or those of the shadow fleet hardly ever switch on their AIS (Automatic Identification System). It's up to us to find them.” Lieutenant Jackunas, the captain's second-in-command, adds behind, “We do a lot of surveillance. Information is our greatest weapon”.
On the command bridge, every inch is occupied by screens, charts and navigation instruments. Here, officers scrutinise the slightest signals and monitor the data collected in real time. According to Admiral Giedrius Premeneckas, Commander of the Lithuanian Navy, “Our main role and duty at sea is to gather information about what's going on. To get a complete picture of the Baltic Sea and share this information with NATO countries”.
This mission is far from routine: “Obviously, with the incidents occurring in the Baltic Sea, we are more mobilised because of the increased risk of hybrid attacks against critical submarine infrastructures,” explains Admiral Premeneckas. “We're in the middle of a hybrid war in the Baltic,” he pursued.
A shallow sea bordered by nine countries, the Baltic Sea is criss-crossed by electrical and communications cables. Before the start of the full-scale invasion in Ukraine, no sabotage had taken place.
By September 2024, the United States had warned of an increased risk of Russian “sabotage” targeting key infrastructure. Two US officials told CNN that “Russia was now more likely to conduct potential sabotage operations aimed at disabling critical elements of communications infrastructure”.
These fears were confirmed on 17 November 2024, when the Arelion cable linking Lithuania to the island of Gotland (Sweden) was severed. The following day, the C-Lion1 cable, linking the Finnish island of Santahamina to Rostock (Germany), suffered the same fate.
Although investigations are still underway, German and Finnish authorities were quick to point to probable sabotage. The German Foreign Minister, Annalena Baerbock, stressed that the almost simultaneous rupture of these cables could “not be a coincidence”, referring to the hybrid threat of Russian origin.
On 25 December 2024, a new incident hit the region. The Estlink 2 power cable, linking Finland to Estonia, suffered damage that reduced its capacity from 1,016 to 358 megawatts. Fingrid, the Finnish operator, estimates that repairs will take several months. At the same time, four undersea telecommunications cables were damaged.
The Finnish authorities suspected the oil tanker Eagle S, which was on the scene at the time, and boarded it. The vessel, registered in the Cook Islands and owned by a United Arab Emirates company, is operated by an Indian company (Peninsular Maritime), it is thought to be part of Russia's so-called “shadow fleet” used to circumvent international sanctions. This fleet transports around 1.7 million barrels of oil a day.
Margus Tsahkna, Estonia's Minister of Foreign Affairs, said: “Damage to sensitive underwater infrastructure has become so frequent that it's hard to believe it's an accident or simply bad seamanship. We need to understand that these systematic incidents must be seen as attacks on our vital structures.”
On 26 January, a new undersea cable was severed, prompting a response from the Division of Public Security Service under the Ministry of Interior. In a statement to Byline Times, officials noted that much of the information regarding the incident remains classified due to security concerns, leaving them unable to provide further details.
Later that day, the Minister confirmed the damage to the Ventspils-Gotland optical cable, marking the third significant disruption to power and data cables in the Baltic Sea within two months. The incidents, which have become increasingly frequent over the past two years, are raising alarms. In a tweet, the Minister questioned whether the cause—be it accidental or deliberate—matters, given that the cost remains the same. He also underscored the importance of strengthening security measures, calling the Baltic Sentry initiative a promising first step, but stressing the need for further legislative and political action.
Those events prompted a meeting between NATO countries bordering the Baltic Sea, NATO and the European Commission in Helsinki on 14 January. At the press conference, Estonian Prime Minister Kristen Michal said: “Since the beginning of June, we have inspected more than 300 tankers, and we have boarded seven of them”. These tankers, often in poor condition, are known as “Russia's shadow fleet”. They transport oil under foreign flags, providing revenue for Moscow. “This often includes ships flying what we call ‘cheap flag state’," said Admiral Premeneckas.
“Unusual shipping lanes, reduced speed” are clues that should alert sailors, stresses Admiral Premeneckas. “We have specific algorithms for identifying ships likely to represent hybrid threats” he stated, without going further into the details.
However, the Lithuanian Navy and the Jotvingis do not board the ships. “We track them using technical means, in particular via radar. We identify them visually from nearby vessels, ask questions if necessary, and then pass on all this information to the relevant authorities. We are in peacetime, at least theoretically, which means that the management of suspects is the responsibility of the border protection service,” explains Admiral Premeneckas.
Surveillance, a “Deterrent Force” for NATO
To ensure precise control, the Lithuanian navy also uses specially designed naval drones to inspect underwater infrastructures. These small, torpedo-like machines in bright orange can dive to depths of up to 120 metres, well beyond the shallow waters of the Baltic Sea. Once submerged, they scan a 500-meter-wide surveillance zone. If the images transmitted reveal anything suspicious, a team of divers is ready to go to the site for further investigation.
Byline Times was able to attend an undersea infrastructure surveillance manoeuvre in the Baltic Sea. From the Jotvingis, a small dinghy was launched with four specialists on board, to deploy a naval drone. The outside temperature was -6°. Equipped with sonar and cameras, the drone dived to a depth of 120 meters, scanning the seabed. The drone's operator, Gricevirus, monitors the transmitted information in real time, to detect any anomalies. “I can control the drone with a simple phone and the data is sent to analysts,” he said.
Marine officer Keptsuckas, the data analyst, was guarded about giving details: “I can't say whether we've detected any Russian activity, but we're operating in international waters,” he said with an embarrassed smile. “One thing is certain: Russian ships do gather information on critical infrastructures” he continued.
A Response Within the Framework of International Law
“The threat is very high; we are constantly monitoring suspicious Russian vessels,” concludes Lieutenant Jackunas, the captain's second-in-command. As tensions in the Baltic intensify, Lithuania's approach remains firmly bound by international law. “In the Black Sea, the Russian and Ukrainian navies shoot at each other. They have clear targets. We can't cross that threshold,” adds Captain Arunas first officer.
This restraint is not without its problems, however. “We've reached an 80% certainty in some cases, but without the remaining 20%, we cannot definitively point to Russia, and evoke Article 5”, explains Linas Kojala, Director General of the Center for Geopolitical and Security Studies in Vilnius.
He underlines the scale of hybrid warfare, and argues that sabotage would be a more appropriate term to describe recent events in the Baltic region. “The term hybrid warfare is used when there is no direct kinetic threat. Nothing that would immediately trigger a military conflict,” he explains.
However, the consequences of these actions are very real. “Today, we are faced with physical damage that entails economic costs, but also human costs, as some of these Russian hybrid maneuvers can injure or even kill,” Kojala warns.
Faced with these challenges, Linas Kojala’s analysis is that “For the Baltic States, the red line has already been crossed several times. Now it's a matter of finding a consensus with our partners.” Before adding, “These measures will be costly, but the longer we delay in taking action, the higher the price we will have to pay”.
On 22 January, Lithuania's Minister of National Defence, Dovilė Šakalienė, held talks with Germany's Federal Minister of Defence, Boris Pistorius. At the joint press conference, Boris Pistorius said: “Experts believe that Putin could be in a position to reconstitute his armed forces by 2029. Conditions will then be in place – I'm using a lot of subjunctives here – for a possible theoretical attack on NATO’s eastern front.”
These hybrid tactics, employed by Russia, are seen as a test of NATO’s ability to respond to evolving security threats and maintain cohesion in the face of provocations. Pistorius added: “This means that, if we want to guarantee our deterrent and defense capability in the Baltic sea in the long term, we have a task ahead of us, which will require financial resources and a lot of energy”.