Navigating Murky Waters

Another incident that damaged Baltic Sea infrastructure has focused transatlantic attention on the growing threat of hybrid warfare. Two submarine data cables in the Baltic Sea, one connecting Germany to Finland and the other Sweden to Lithuania, were severed in mid-November. The Yi Peng 3, a Chinese-flagged commercial vessel with a Russian captain, is suspected of causing the damage.

This is reminiscent of a similar event 13 months ago. Then, a Hong Kong-flagged container ship, the Newnew Polar Bear (accompanied by a Russian cargo ship), damaged the Balticconnector gas pipeline and two other undersea telecommunications cables by dragging its anchor along the seabed. While Europeans condemned the incident, the Newnew Polar Bear sailed from the Baltic Sea to Russia’s Murmansk port without interruption. This time, a Danish naval patrol intercepted the Yi Peng 3, a bulk carrier, off the coast of Denmark. 

Since then, the Yi Peng 3 has been anchored in the Kattegat Strait and remains under constant surveillance by the Danish navy. Germany and Sweden have dispatched coast guard ships to Denmark’s waters to join that country’s naval patrols. Meanwhile, Swedish, Danish, and Finnish authorities continue to pressure China for permission to board the vessel, and Swedish Prime Minister Ulf Kristersson has urged the Yi Peng 3 to enter his country’s waters, presumably to facilitate investigations into the latest incident. Finland, Germany, and Sweden have all opened such investigations. The affected countries have also dispatched vessels to the sites of the damaged cables. 

The incident has raised concerns about potential cooperation between Russia and China on hybrid activities against NATO allies. The Yi Peng 3 is suspected of being responsible because it was the closest vessel to the sites of the damage and exhibited unusual navigation patterns. In addition, Danish media report that the ship’s anchor is heavily damaged, which could point to contact with the cables. Some European countries have been calling the act deliberate, but others have been slower to publicly label it such. German Defense Minister Boris Pistorius described it as “a hybrid action”, stating that his government “assumed – without knowing it – that it is sabotage”. Should it be found that the ship’s crew or other actors deliberately damaged the cables, this would demonstrate a new level of hybrid aggression toward NATO countries.

Even short of this confirmation, the incident again highlights Europe’s vulnerability to hybrid attacks on undersea infrastructure at this especially tense time. Moscow recently announced that it would lower its threshold for nuclear weapons use in response to conventional attacks by countries in coalition with nuclear states. This change was formalized after the Western powers’ decision to permit Ukraine to fire long-range missiles into Russian territory.

As tensions with Russia and other adversaries of the West continue to rise, rival nations may exploit the difficulty of determining intent behind infrastructure damage. Hybrid actions can provide an opportunity to impose cost while allowing perpetrators to maintain plausible deniability.

Continuity and Change

Fortunately, in the wake of the latest incident, the heightened allied cooperation that followed the Newnew Polar Bear episode and strengthened the resilience of undersea infrastructure left European countries better positioned to take more decisive action to identify the perpetrators and to use military resources to apprehend them. Such action is key since disruption to undersea cables, digital lifelines transmitting a wide range of information, may undermine economic and social stability and security. It is also important to send clear signals and deter potential future attacks.

In the past, NATO countries have struggled to respond quickly and decisively to incidents against infrastructure. The allies have had varying perceptions of hybrid attacks and lacked consensus on appropriate responses to them. This remains a challenge, despite recent efforts to collaborate on enhancing undersea infrastructure resilience, deterrence, and defense. Germany, Sweden, and Lithuania were swift to preemptively treat the recent incidents as a sabotage, but Finland and the United States had more nuanced responses. EU High Representative Josep Borrell was also cautious, stating that it was too early to lay blame.

The West’s To-Do List

A more structured and unified response system is necessary to deter future attacks by malign actors. A previous GMF report outlining prior incidents discusses the importance of strategic communication and other strategies to allow the transatlantic allies to address undersea infrastructure damage. Additional steps should be taken into consideration: 

• NATO and industry leaders should continue to enhance surveillance of the seabed. Quick detection and clarity on events as they unfold is the first step in preparing decisive responses.
• NATO allies must further advance information sharing to create a better foundation for demonstrating culpability and intent. At the same time, governments should advance public-private communication channels, share best practices and open-source intelligence, and standardize response processes.
• Governments affected by the cable disruption, the EU, and NATO must make clear to adversaries that there are serious repercussions to their involvement in hybrid activities. The processes for civil, criminal investigations and commercial compensation are lengthy. An act of suspected sabotage or hybrid attack requires swift and persistent political signaling and calibrated action. Individual European countries, the EU, and NATO must continue to devise clear scenarios and coordinate countermeasures in response to hybrid attacks.
• US and European policymakers and analysts should devote greater resources to understanding the evolving nature of Sino-Russian cooperation on hybrid actions to deter and respond to threats.