Oskari Penttinen
No one can constantly monitor everything that happens on the open seas—even narrow bodies of water have too many vessels and too much open space. Since Finland and Sweden joined the North Atlantic Treaty Organization (NATO) in April 2023 and April 2024 respectively, the Baltic Sea has witnessed three unprecedented instances of submarine cable and pipeline disruption, fleets of old cargo ships without transponders, and numerous environmental close calls. Although none of these acts have been officially blamed on Russia, the region’s collective understanding is that these incidents are likely intentional or accepted byproducts of responses to Western sanctions. Disruptions which were previously mere nuisances are now causing real damage. Act by act, these transgressions of mutually established good practices allow Russia to get away with intimidation without any concrete pushback. Russian military thinking treats inaction as an invitation to exploit the opportunity further. Only a firm response will halt the disturbances.
Reckless behaviour at sea
The submarine cable disruption on December 25, 2024, is only the latest in a chain of concerning incidents. At around noon that day, Eagle S, an oil tanker from the Russian port of Ust-Luga, is alleged to have dragged its anchor repeatedly over the Estlink 2 electricity cable. While such accidents occur occasionally as a byproduct of busy shipping in relatively shallow waters, the most recent incident is already the third such disruption since October 2023. This rate is abnormally high. In the first suspicious incident on October 10, 2023, the cargo vessel Newnew Polar Bear’s anchor reportedly collided with the Balticconnector pipeline, and in the second one on November 18, 2024, the bulk carrier Yi Peng 3 allegedly disrupted the C-Lion1 fibre optic cable.
Even if these incidents were unintentional, the Russian “shadow fleet,” a collection of old cargo and oil vessels carrying sanctioned Russian exports, such as fossil fuels, endangers mundane trade in the Baltic Sea. An EU report from November 2024 details how these vessels do not maintain adequate insurance and avoid inspections and screenings to minimise potential losses in case they are sanctioned and need to be scrapped. The “shadow fleet” is meant to obfuscate the destination of Russian oil exports, but sailing without transponders endangers nearby ships with collision. In the narrow Danish Straits and busy shipping lanes between Finland and Estonia, growing numbers of “ghost vessels” significantly increase the risk of accidents.
Furthermore, many coastal states fear that poorly maintained vessels might cause an expensive and environmentally devastating oil spill, or even worse, an explosive accident similar to the one seen in Beirut in 2020. In May 2023, the oil tanker Canis Power nearly beached in the Danish Straits. In September 2024 M/S Ruby was denied docking in Lithuania and other Baltic ports as officials feared that routine maintenance procedures could ignite its fertiliser load. Both vessels are affiliated with the Russian “shadow fleet,” and without up-to-date insurance, the bill for an environmental clean-up would fall on the victim country.
Active and agile pressure
The Baltic Sea incidents are often associated with sabotage and sub-threshold methods—intentional brinkmanship in which each act is, in theory, optimised for specific coercion just short of escalation towards war. Each “method” (the specific approach chosen) should be conducted through a suitable “form” (organisational structure) for a goal-oriented disruptive effect. All intended effects should also be meaningful, even if a violent and technologically advanced war should follow directly after it. Effectively, Russian military thinking tries to always be one step ahead of the current character of war so that Russia can obtain and retain a constant disruptive advantage. Hence, the terms “hybrid” or “sub-threshold warfare” are not used in Russian military literature, but they are instead referred to as “special operations” or “active means”, the term historically used by the KGB: in other words, an element of conventional war, not a grey-zone pre-war phase. This distinction is significant for understanding how, for Russia, the absence of kinetic war does not overturn the need to prepare the battleground for a possible confrontation in the future. Credible deterrence needs a guaranteed capability for strategic infrastructure disruption, to paraphrase the influential Russian military thinkers S. G. Chekinov and S. A Bogdanov. At the same time, warfare is constantly developing in complex ways, so the whole process only needs to be “good enough” rather than perfect. Constant pressure will make up for the suboptimal outcomes and partially achieved objectives.
In practice, these theoretical considerations translate to an agile piecemeal approach for constantly testing an adversary’s capabilities. Methods are intended to achieve material benefits quickly, preferably by undermining a foe through coercion as it is cheaper than conquering them for oneself, while also maintaining a façade of deniability. Damaging an electrical cable does not improve Russia’s economic standing, but it costs practically nothing, can be framed as an accident, and if it fails to achieve the intended effect, it is easy to scrap from future plans. At the same time, the states affected by the disruption are committed to investigating the incident and repairing the damage. The cable damaged in the December 25 incident will likely resume operations in the summer of 2025 at the earliest, while the loss of a single shipment of crude oil will not noticeably affect Russia. Furthermore, the damaged cable communicates Russia’s deterrence while also testing how responsive Finnish, Estonian, and NATO naval assets really are. Sub-threshold methods intend to discover opportunities for wider strategic exploitation.
A Constant learning process
However, even though Russian military thinking places significant emphasis on making gains wherever possible, it is important not to equate this with Russian omnipotence. Instead, Russia seems to actively learn about new opportunities and adapt them on a piecemeal basis. New methods are discovered, not necessarily planned. This adaptability illuminates how the sub-threshold activities in the Baltic Sea can also be studied as a chain of tests on NATO. While official publications and communications refrain from the term “NATO lake,” a region where the organisation’s power projection cannot be rivalled, Russia seems to perceive it as such, and is interested in testing how firm that commitment to local control actually is. Provocative and risky behaviour, such as Global Navigation Satellite System (GNSS) jamming and damaging infrastructure, gives Russia a feeling of how much the rules can be bent before someone sounds the alarm. Each successful act incentivises Russia to test an incrementally riskier one, creating a cycle of positive “match-fixing” in which the Russian leadership keeps overestimating the effectiveness of riskier acts based on the streak of perceived successes in the past.
Systematic jamming and maritime thuggery are now possible because earlier airspace sovereignty violations and “shadow fleet” operations went unchallenged. Good behaviour in the Baltic Sea will not end the sanctions related to the Ukraine war, so there are few material incentives for Russia to cease its reckless behaviour. Effectively, systematic reckless and dangerous behaviour—“strategic delinquency” as coined by Edward Howell—reinforces itself over time as a safe source of material rewards. Tens of “shadow fleet” vessels still loiter in international and Russian territorial waters following the December 25th submarine cable incident, all claiming to be waiting for refuelling, whereas Newnew Polar Bear fled the area quickly in October 2023, after allegedly colliding with the Balticconnector gas pipeline running between Estonia and Finland.
Russia’s delinquent lessons are not limited to its own experiences. The “Gerasimov Doctrine”, analysing the prevalence of non-military means in modern warfare, is a prime example of how Russia learns from others. The article has been at the centre of recent Russian defence innovations, and it is entirely based on observations of NATO and US democracy promotion during the 1990s and early 2000s. On the one hand, Gerasimov outlines how, in Russian eyes, global US support for democracy has been a delinquent act violating norms of non-intervention. On the other hand, Gerasimov suggests that Russia should learn to thrive amidst rife covert and information operations.
Similarities in Russia's and China's sub-threshold methods suggest that the two countries are learning from each other. Much like the Russian fleet in the Baltic, the Chinese fishing vessel “maritime militia” has repeatedly ganged up on foreign vessels in the South China Sea since 2016 to reinforce its contested territorial waters claim through intimidation. Firstly, both rely on large quantities of expendable vessels. Large fleets are more difficult to sanction and physically intercept by smaller regional coast guards and navies, suggested as a solution to the problem by Craig Kennedy. Hence, more vessels can pass by unscathed, allowing for more simultaneous operations. Secondly, both threaten local ecosystems. The Chinese fishing fleets have weaponised overfishing to apply pressure on faraway states such as Argentina. Similarly, vessels originating from Russia have threatened oil spills by conducting risky repairs near protected archipelagos or ports that they have been denied from. These parallels fit the Russian emphasis on learning, even if the exact nature of the two’s relationship is hazy.
Fearing escalation means reinforcing risky habits
Russian sub-threshold methods will not be stopped by complacency, for such behaviour will erode any threshold beyond recognition. Western non-confrontation reinforces strategic delinquency. Past incidents have pushed European premiers and ministers to declare their worries about sabotage and heightened tensions in the Baltic Sea, but very few concrete actions have been taken. This inaction is especially damning of the Germans, who have the by far the largest NATO navy in the region but have also voiced doubts about whether the Baltic seabed can be realistically protected. While these remarks are accurate, they also reflect the influence of pro-Russia populists, who see current NATO policies as dangerous, on the German government.
As evident in Russian military thinking, Russia recognises this societal discord in Germany—and many other European states that struggle with populism —and capitalises on it. Russian information operations are intentionally focused on the upcoming German election as a NATO-sceptic German government could give Russia even more leeway in the Baltic Sea. An ambivalent Germany could discredit NATO efforts in Northern Europe, illustrating how Russia combines pressure on the Baltic Sea’s poorly monitored weak spots with simultaneous pressure on societal weak spots elsewhere in Europe.
Multinational action has suffered from the same complacency issue. Recently, before the latest cable disruption, NATO even considered using unmanned surface vehicles (USVs) to police cables in the Baltic Sea. Moreover, NATO is currently experimenting with rerouting data through space to avoid sabotage. Nevertheless, not only will these ideas take a long time to implement, but they also do not resolve the threat in its entirety. Natural gas or electricity cannot be routed through space, and USVs and satellites are vulnerable to electronic warfare, a Russian speciality in the region. Therefore, in practice, there has been no effective multinational action thus far. Russia’s persistent activities have revealed that words will not deter its sub-threshold methods. Reluctance to act decisively gives Russia more room to discover NATO weaknesses. Being the first one to reinforce the threshold by threatening escalation is intimidating, but deferring the responsibility to someone else is dangerous.
A response is needed and plausible
Where there are no “tripwires,” firm boundaries that provoke action if crossed, Russia—and other revisionist states—remains capable of extracting returns from NATO with strategic delinquency. The Finnish response to the latest cable disruption is unprecedented: Eagle S was boarded by Finnish commandos and will be held in a Finnish port until the investigation is over. In addition, NATO followed up this decision by declaring that it would “enhance its military presence in the Baltic Sea”. Both responses are improvements over mere denunciations, but neither is enough to deter risky vessels from entering the Baltic Sea or engaging in covert sabotage.
Multinational efforts should instead focus on active monitoring, escorting, or inspecting suspicious vehicles. Dragging an anchor back and forth over a cable in clear weather would be even more difficult to defend if the ship is being monitored by the authorities. Active monitoring will be more resource-intensive and confrontational than persecuting vessels on a case-by-case basis after incidents, but Russian behaviour is unlikely to change if sub-threshold disruptions carry no repercussions. Cracking down more aggressively on the “shadow fleet” with improved multinational readiness in the region is a commensurate first step. Active measures are needed to keep the Baltic Sea open for trade but closed for thuggery.
Oskari Penttinen is a History and Politics undergraduate at Corpus Christi College Oxford. He focuses on change and continuity in military strategy, power projection, and conventional warfare, especially with regards to Russian and NATO capabilities.
