Lawfare Daily: Russia’s Shadow War in the Baltic Sea

[Intro]

Minna Ålander: One issue with this maritime infrastructure, especially when it's like undersea cables that have been laid on the, on the seabed, is that they were laid in the time when one didn't assume that there would be like this kind of physical threats to them. And, and they've been laid in a way that makes it fairly easy to damage them.

Anastasiia Lapatina: It's the Lawfare Podcast. I'm Anastasiia Lapatina, Ukraine Fellow at Lawfare, with Minna Ålander, an associate fellow at Chatham House Europe Program.

Minna Ålander: A likely result is that the authorities can never, like, conclude that, yes, there was a direct link to Russia. And they may also not be able to prove intent because unless it's basically a crew member confessing, like, yes, we did this on purpose, like, it's just very hard to prove something like that. So often the attribute remains sort of like technical.

Anastasiia Lapatina: Today, we're talking about the growing incidence of suspected sabotage in the Baltic Sea, Russia's role in them, and what Europe can do to protect its waters.

[Main podcast]

So I wanted to talk to you about the topic of Russian sabotage and Russian espionage in the Baltic Sea and in the Baltic region and specifically about the very suspicious subsea cable activities that have happened in the last two years.

And so in the past 18 months, there were four specific cases that kind of alarmed the authorities and made headlines. In 2023, there was a gas pipeline and a data cable between Estonia and Finland that was damaged. In 2024, there were two cases of communication cables between Sweden and Lithuania and Germany and Finland damaged as well.

There was also an Estonia and Finland power cable that again got damaged under uncertain circumstances. And then in 2025 in January—so very recently—there was a data cable between Latvia and Sweden that got damaged as well. And so all of those cases were kind of uncertain because nobody knows who's really behind them, but a lot of things are pointing at Russia.

Before we go into who the perpetrators might be and what this all means. I just wanted to ask, what have been the consequences of, of these damages and, you know, as far as an average civilian in, in these countries is concerned, what kind of impact can this have, and what were the consequences?

Minna Ålander: Yeah. So that was an excellent sort of rundown of like what has happened. It has indeed been quite a lot. The good news is though, that it hasn't really had any noticeable impact on civilian life in, in the countries affected. So mainly what it has caused has been reparation costs.

But thanks to the sufficient redundancy in this infrastructure, in the Baltic Sea, there haven't been any major sort of like blackouts or not even really like slower internet when it was like data cables or communication cables that that were damaged in this incident. So that shows how important it is to, to have a sufficient level of resilience in terms of redundance so that you don't have just one cable, but, I don't know five or so and that you're sort of you've thought about a backup plan.

Because of course like disruptions can happen also actually, just like purely accidentally. The question of intentionality here is of course, like a very hot potato, but that sort of like has been a very good, a very good sort of like proof of resilience in the countries.

However, for example, in the case in December 2024, when, when this ship called the Eagle S dragged its anchor over some, some, power cables between Finland and Estonia, that could have actually been much worse if the Finnish authorities hadn't stopped the ship and confiscated it so fast because there were like way more cables along the line that it would have dragged the anchor, and then the damage could have been much more significant.

And in that case, I would say that there was definitely an interesting element here in the sense that it was two power cables where electricity goes from Finland to Estonia. So, so it's like that way that the, that the energy is going and Estonia, along with, with Lithuania, and Latvia, just recently, like last week, cut themselves off completely from the, from the Russian energy grid.

So there was sort of like this, this question of is, is this somehow connected, like was, if Russia was behind it, was it trying to complicate matters or like punish the Baltic States, like Estonia, for this, or, or just like do harm to, to maybe postpone the, the decoupling from the Russian energy.

So it could have been worse for sure, but so far that the actual damage to civilian life, or like there haven't been many complications in that sense. It has been very limited.

Anastasiia Lapatina: You kind of leaned into my next question here, which was how big is the potential for something more serious and impactful. Like how, how much of this critical infrastructure is there and how resilient are these countries, as you've mentioned, for future attacks like this? If, if an actor, an adversary really wanted to escalate this and bring it up a notch, could they really do real serious damage to civilian life here? Is it possible?

Minna Ålander: Well, I would say that it sort of like depends on what is, what is the intention here. And of course, like, we do not have any sort of like proof that could be presented in a court of law that this definitely was Russia behind it. But if we just like assume that that is the case, like of course, one, one aim here could be apart from just like waging this so called hybrid war—so this, this kind of gray zone aggression that deliberately stays below the threshold of an armed conflict to make it sort of harder to, to do something about it and definitely sort of like excludes any military means as a response.

So, so there is like sort of value in doing this now while we're still in peacetime, according to international law. I mean, like we are obviously in a very, in very muddy waters here in terms of war and peace. So it's not possible to say that like, we're completely at peace still, but obviously, and especially since we are talking about like, what is the, how does this affect civilians in these countries?

 So the difference that I like to make between war and peace is like to what extent does it sort of like up end civilian life like if we were if we declared that we are at war it would mean like quite significant changes for, for civilian life in these countries and that's not the case yet.

So there is—on the one hand, there is value for Russia or like an adversary, China's also been involved in these incidents, to just generally cause sort of like fear or like so fear and uncertainty in the countries and potentially sort of just disrupt functions of the society.

But then with the view to a potential conflict later on, these attacks can provide the adversary very valuable information on the level of resilience and redundance, meaning that now they know that, okay, cutting these couple of cables is not going to do much, so it takes more to knock out critical infrastructure completely in these countries.

So they would now know, like, how they, how they would need to calibrate an attack if, for example, in an early phase of a conflict they wanted to knock out some, some, like, societal or state functions in the countries in the region. So, so this is, like, one thing to bear in mind.

And then of course, as I said, like the damage could have been much greater already in December if, if the ship had continued with the anchor down. So we've been lucky so far that it hasn't been worse.

So I would say that one issue with this maritime infrastructure, especially when it's like undersea cables that have been laid on the, on the seabed is that they were in the time when one didn't assume that they would be deliberately or less deliberately, but anyways, that there would be like this kind of physical threats to them and, and they've been laid in a way that makes it fairly easy to damage them.

And there's the companies who own these cables are thinking about how to, how to change this and how to, how to make it harder to, to damage this infrastructure as well. So there is in that sense, like redundancy is good, but it of course doesn't. In itself, make a single cable or individual cable less prone to damage.

Anastasiia Lapatina: We've been hinting at Russia throughout, throughout this time, and it's worth, it's worth unpacking that—the topic of perpetrators and whether, you know, how, how the governments are approaching this question of responsibility here.

Can you just walk us through what have been some of the investigations, theories about, you know, is this an accident? Is this Russia? Is this China? Who, who, who is behind these accidents and what, what do we know about it?

Minna Ålander: So in some cases it's sort of easier to tell who owns the ship, for example. So in one case in November, 2024, it was a Chinese owned ship that was, that was sailing under the Chinese flag so there wasn't much mystery about like, who's in charge of that ship.

However, otherwise there have been cases of the shadow, so-called shadow fleet ships, where the, the ownership structure is usually very difficult to completely follow through to the point that you would be able to say like, okay, it's definitely this or that country or like even company that it can be attributed to. And mostly the owners of the ships don't want to be sort of like brought into the daylight because the whole shadow fleet is a shady business.

So, that's sort of like the purpose of the whole enterprise, and so sometimes it, it can be basically impossible to, to find, like, as I mentioned, like court proof evidence that, okay, it was that this could definitely be linked to Russia or to China, whatever.

So in the first case with the Balticconnector gas pipeline in October 2023, it was pretty interesting because the ship was sailing under the Hong Kong flag. But then after the incident—when it was sailing off from the Baltic Sea along the Norwegian coast to the Northern Sea Route, that, that, that passes along the, the Russian Arctic coast, and that was its, its route back to Asia—it actually changed ownership to a Russian owned company. So it was like very, very murky.

Anastasiia Lapatina: I didn’t even know you could do that.

Minna Ålander: Like, yeah, it's like, it was very interesting how they did that. Like they had also changed the crew previously; I think it was in while the ship was in Kaliningrad in this Russian enclave in the Baltic sea. And yeah.

So that was, that was a very interesting case and, and that was also like not a very good show in terms of the response by the, the countries involved because like we were unable to stop the ship and, and, and do any proper investigation there. China, finally, like sometime in the, in the, in the fall, they, they actually admitted like, yes okay. The ship did damage that cable, but of course denied that it was intentional.

In this very latest case with the, with the data cable—I think it was between Latvia and Sweden—the Swedish investigation was actually pretty quick. So after only a couple weeks they concluded that this was an accident, whereas the, the Christmas Day Eagle S case where the Finnish authorities confiscated the, the ship that was suspected of, of the sabotage—that's still ongoing and we still don't have the results.

The, the issue here, and this is quite tricky for, for the, the Western countries or the European countries that, that have been targeted by these incidents, because of course, like we still value the rule of law, and for us, it matters whether you can actually prove something or not. And it is of course part of this, this like, plausible deniability, or I would actually rather call it implausible deniability, because it's very, it seems so unlikely that all of these incidents could be pure accidents. So, so that is like a big part of this, and, and makes it, it's very expedient for let's say Russia to have this, these incidents happen and being able to like deny any involvement in this.

So a likely result is that the authorities can never like conclude that yes, there was a direct link to Russia, and they may also not be able to prove intent because unless it's basically a crew member confessing, like, yes, we did this on purpose, like it's just very hard to prove something like that. So often the attribute remains sort of like technical—like, we can prove that it was this ship and its anchor that damaged the, the, the infrastructure, the cable, but we cannot sort of like attribute intent.

And I think that this is something that we will have to sort of like learn to live with, that there remains this degree of uncertainty that it's sort of like this case of like, you can neither confirm nor deny that, that it was, it was Russia because you don't really have proof either way.

Anastasiia Lapatina: You mentioned Russia's shadow fleet. I think we should explain what that is and how that really works, because that the concept and that fleet is playing a huge role in Russia's war against Ukraine in the Russian economy and basically allows Russia to export a bunch of its crude oil all around the world, despite the heavy sanctions that have been put on Russia.

So could you just explain a little bit how, how the mechanics of that work and how come Russia can still export its oil on these weird ships under different flags and evade sanctions like that?

Minna Ålander: The shadow fleet is, is historically not a new phenomenon and Russia is not the only one who has been using it. There has, have been also other, other states that have been sanctioned for different reasons that have then used this so called shadow fleet to circumvent those sanctions.

So the idea is that it's a fleet of very old ships that have maybe been already decommissioned from their previous, previous roles. And and these have been bought by different companies, often sort of maybe located in some far away islands, like, I don't know, Cayman Islands, the Cook Islands; the Eagle S for example, that damaged the cable in the Gulf of Finland is on, was sailing under the Cook Islands.

And this is sort of like to make it harder in an incident where some damage happens to get the investigation going, because basically according to the Law of the Sea, it needs to be that the flag country that conducts the investigation.

Anastasiia Lapatina: That's so interesting that, that, that's like, you know, the military investigating itself.

Minna Ålander: Yeah, exactly. It's like, like talk about like giving the, the hen to the fox to guard.

Anastasiia Lapatina: Yeah, exactly.

Minna Ålander: So that was exactly what happened, for example, with this Yi Peng case and with the Danish and Swedish authorities who were trying to investigate it. It was in back in November last year that China then sent an investigation team to the ship according to these rules and Swedish investigators were allowed on board, but only in an observation role. So obviously that, that investigation didn't yield much and then they just like sailed off.

This is like one issue here, but on the other hand, it can also be sort of—I mean, the Finns sort of used this to their advantage in the Eagle S case where it was Cook Islands that is the flag country because like they obviously weren't going to provide an investigation team. So then Finland said that we're doing this now ourselves, the investigation and such. And the problem here is that the law of the sea is sort of like, it is pretty vague and there's like very little sort of possibilities for literal states to intervene because of the freedom of navigation.

And of course it is also very important for these countries to consider what kind of global consequences it can have if we start sort of like confiscating all kinds of ships and like intercepting them and so on. Because like the Baltic seas, of course, not in a vacuum and what happens in the Baltic sea can be done elsewhere. So we can also end up in a situation where others start doing the same to our ships and complicate our commercial operations as well.

But obviously it's a very different context when there's like these, this, this like sudden frequency of severe damage to, to critical infrastructure. So, so that is like, of course, a different case. And and for example, right now, Finland, along with other countries in the Baltic Sea region is looking at the Law of the Sea to figure out whether some new interpretation could be made of it that could enable the countries to intervene more easily, and especially earlier.

Like if there already is some suspicion that like now the ship is doing some like weird maneuvers around critical infrastructure or headed towards critical infrastructure at a suspicious speed or whatever so that, that then like, the countries could intervene, possibly even before damage has been done.

Anastasiia Lapatina: There was a case recently right authorities stopping the ship.

Minna Ålander: Yeah, but so far it has always happened after the fact. So it's of course better than just like letting the ship just slip away and not even intercepting it. But of course it would be even better if because the question is. How can we sort of like do something about this that is more of a preventive nature and not only reactive?

Anastasiia Lapatina: Right

Minna Ålander: So like after the fact that something has happened, but then just like to get back to this this overall phenomenon of the shadow fleet.

So, so of course for Russia the shadow fleet is incredibly important because it is a way to circumvent these sanctions on oil export and Russia's war effort in Ukraine, depends on it, depends on those funds that it gets from, from the oil exports. So this is why completely irrelevant, the question of intentionality in this, in this cable incidents is actually pretty irrelevant in my opinion because the real issue here is that Russia is using this fleet in the first place

And I found it very interesting when we had like a couple weeks ago this whole sort of debate in the media about whether this is intentional or not online and like what if it, it has been pure accident because like I don't really think that it it changes anything in the need to act against it and do something about it.

Because even if you took a very very sort of like good faith, lenient interpretation of this and said like, okay, maybe these are pure accidents, and it's just because of the, the pure, poor condition of, of the ships—they tend to be very rusty with insufficient insurance and with apparently very loose anchors that tend to just like drop every once in a while unexpectedly.

So even if you take this kind of an interpretation, it's still unacceptable that this kind of damage happens. Like it, it creates costs and, and, and it, it can cause disruptions and something needs to be done about it. And we need to make sure through either regulation or other means that ships that are actually not like almost not really seaworthy cannot sort of sail freely around the Baltic Sea and cause also potentially huge ecological damage if, if they have some more serious incident and then, and then, like, there's a, there's a big oil spill or something.

We had actually a close call with, with a ship in a Russian port just, like, last week, where there was some, some heavy malfunction in a ship that had just gotten 130 tons of oil loaded on it.

This is, like, a constant danger here, and what I would like to add to the, the, the issue. So there's, of course, like, the, the hazard that this poses to critical infrastructure, and the ecological hazard or the potential for an ecological and environmental catastrophe.

But then a third really serious issue is also the navigational hazard. Because the ships really often sort of manipulate their AIS signal, which is sort of like this location tracker signal that that ships use, so that it's like not necessarily always possible to know their real time position. And according to the Finnish Coast Guard, there were at least four close calls over the last fall–

Anastasiia Lapatina: Oh wow.

Minna Ålander: –with this kind of situation that, that the ship's location data was just like inaccurate.

Anastasiia Lapatina: This is kind of a very big question, but is there any way to, like, prevent the Russians from just coming into the Baltic sea? Is there any way to, you know, I don't know, check the ships for Russian crew members? I don't even know how one would go about doing that, but like, if we were to expel the Russian ships from the sea completely, is there a mechanism?

Minna Ålander: No, there isn't really a mechanism to do that. And one of the best examples was that Norway actually, as part of the investigation of the latest incident in January 2025, Norway confiscated a Norwegian owned ship with a completely Russian crew. So even this kind of stuff still happens or, or like it's like the last Norwegian company basically that is, that still continues to ship fish to Russia.

So there isn't really a way to do that because of the, the freedom of navigation. And obviously Russia is also a Baltic Sea littoral state. And I think that like any kind of idea of sort of like, for example, militarily blockading these ships from entering the Baltic Sea or something—that is not really at all feasible or like not anywhere in, in the realm of reality or realistic options.

Also because—so for example, Finland is very dependent on transport through the Baltic Sea for its own security of supply. So about 90 percent of Finland's exports and imports go through the Baltic Sea. So it's actually a vital interest for a country like Finland that the Baltic Sea stays open, and that our sort of like supply lines are not interrupted there.

So no, we, we need to find some other way to deal with this. Obviously it's, it's not very easy. And I think that like, what is, what makes it so tricky is that it's not really a military problem. So NATO after the, the, the Christmas day incident, a couple of weeks later, NATO. sent out a sort of monitoring operation, the Baltic Sentry. And despite this, this operation or this mission in the Baltic Sea, a week later, another cable was cut.

So this shows that this is not a problem that can be solved or even deterred by military means, and what NATO can do here is, of course, like, improve the cooperation among the, the, the countries involved to provide capabilities to, to monitor critical infrastructure—like, of course, like, apart from showing presence—so actually it was really good.

So partially the, the Swedish reaction to this latest cable cutting and, and the speed at which they were able to confiscate this ship for investigation was partly thanks to the NATO cooperation through this, this operation. And so, so that helps. It also makes it easier because like in the end, when something like this happens, it has to be a country close to the incident spot that nationally justice, like intercepting and confiscating.

So when you think about like countries like the Baltic States or the Nordic countries—they're pretty small countries, so it's like kind of helpful to, to know that you have the backing of, of NATO to intervene like this. But then on the other hand, if we want to really find some way to prevent these incidents, it needs to be probably like legal measures, some new regulation.

The EU is trying to figure out something that they could do about this and that could prove sort of useful because like, it needs to be some kind of angle. How can you regulate against the use of this kind of ship?

So there's—I would, I would think that there are, there's a number of angles, like the insufficient insurance, sort of like, if you have insufficient insurance on your ship, you don't sail in the territorial waters or like, or, or in the exclusive economic zones of some countries. Or like, I don't know, if the condition of the ship is too poor or whatever. I mean, I think that like, especially with this environmental angle, there could be something that could be done about this.

But as was also stated in after—so there was a NATO Baltic Sea member state meeting after the Christmas Day incident. And in their statement or in the press conference afterwards, it was also pointed out that like, this cannot be completely prevented. There is no way to completely stop this from happening, because there is no way to have sort of like full control or like full situational awareness at all times. The Baltics is extremely heavily trafficked and that's why it's sort of impossible to completely get to a point that we can say like, this cannot happen again.

But I think that there are still ways to tackle this that could at least make it much harder and much costlier to whoever is behind this to constantly sort of drop the anchors.

Anastasiia Lapatina: This is—all of this sounds like a typical example of something Russia is very good at, which is finding the kind of vague, weak spots of, you know, the legislation, the rules based order, you know, the, these international norms that countries abide by and like, finding little loopholes that they can exploit and just using that. Like they, they, they obviously know that there is so little that the Baltic states can do about it. And this is exactly why they're doing it.

Minna Ålander: Yes, exactly.

Anastasiia Lapatina: We also should mention probably the fact that it's not just the shadow fleet. I am almost saying the Black Sea fleet every time, but I stopped myself, it's the shadow fleet.

They're not only using the shadow fleets or the oil exports for this kind of stuff. They're also using like fishing expeditions and fishing ships and, you know, science related research, you know, quote unquote activity, which is like a whole another matter as well, right?

Because there's all of this shipping cooperation happening still, correct me if I'm wrong, between Russia and the Baltic States. So, some of the sabotage has also been done by a bunch of fishing sailors who are somehow protected by armed men on the ship. It's all very weird.

Minna Ålander: Yeah, so actually, because there's been also some talk about, like, whether this is just a direct result of the sanctions on Russia and they are just like now reacting to that by increasing the use of this shadow fleet ship.

By the way the, the shadow fleet has been vastly expanded now. Like it used to be a very manageable problem, but now it's a number of ships, like over a hundred or that is much harder to, the potential for serious damage here is much, much greater now.

But so for example, one of the first incidents of a data cable being cut was actually in 2021. And that was between, in the Arctic, so that wasn't even in the Baltics, it was in the Arctic, it was between mainland Norway and Svalbard, this island.

Anastasiia Lapatina: Yes, we should talk about that.

Minna Ålander: Yes, exactly. So, that, that, that case was very interesting because that cable was severed and, and later on it was shown with the help of these maritime traffic websites that monitor the movements of different ships, that it had been a Russian fisher vessel that, that went back and forth over the cable a number of times.

And the, the Nordic public broadcasters also made a whole documentary about Russia's use of fishing vessels, for example, or other commercial like civilian ships for espionage purpose. So this is actually a very, very old strategy or like tactic that they, that Russia has been using like already like in the Soviet times. And it's sort of a running gag even in the Nordic countries and for example in Norway about this fishermen, like, who happened to somehow, like, have, have some dual use purposes.

There was also an incident in northern Norway when some Russian seamen came onshore in military looking uniforms which was like really confusing. Like, why would they do that? And like the Norwegian authorities had to ask them, like, please don't wear this because it looks like really confusingly similar to, to some, some actual uniforms. So there's been a number of, and it's like, sort of, it's a known fact that these vessels are used for, for espionage purposes.

And so, yeah, there are many ways to sort of be creative here. And Russia is, as you say, very good at that. But what I think that we need to do in the West is we cannot start sort of compromising on the democratic and, and rule of law principles because then we end up sort of like undermining, undermining the ground that we're standing on. And Russia's purpose is to attack the, the rules based order and, and create uncertainty, and the trap is in a way that we start undermining our own rules and norms here, which is why I think we should not do that.

However, we should be also much more creative about how to use the system. And I think that we need to start seeing it as a toolbox rather than like just restrict, restrictions. So there are ways of hitting back with means that are well within our own sort of framework of norms and, and rules, we just need to get better and more creative at, at finding those ways and methods.

Anastasiia Lapatina: Minna, this was super interesting. Thank you so much for coming on.

Minna Ålander: Thank you so much for having me.

Anastasiia Lapatina: The Lawfare Podcast is produced in cooperation with The Brookings Institution. You can get an ad free version of this and other lawfare podcasts by becoming a Lawfare material supporter through our website lawfaremedia.org/slash support. You'll also get access to special events and other content available only to our supporters.

Please rate and review us wherever you get your podcasts. Look out for our other podcasts, including Rational Security, Chatter, Allies, and The Aftermath, our latest Lawfare Presents podcast series on the government's response to Jan. 6. Check out our written work at lawfaremedia.org.

The podcast is edited by Jen Patja and your audio engineer this episode was Cara Shillenn of Goat Rodeo. Our theme song is from Alibi Music. As always, thank you for listening.