Seabed zero: Baltic sabotage and the global risks to undersea infrastructure

By Bruce D. Jones | February 13, 2026

Finnish authorities took control of the Fitburg and escorted it to the port of Kantvik after it damaged an undersea cable. Image: MKFI, Public domain, via Wikimedia CommonsShare

For Finnish authorities, 2025 ended dramatically. On the very last day of the year, at 4:53 a.m. local time, a telecommunications company called Elisa noticed a significant disruption to data on one of its cables—a fiber optic line strung along the Baltic Sea floor connecting Helsinki to Tallinn, Estonia. Company reps alerted the Finnish Border Guard’s operations center, which triggered a national response, with Border Guard, customs authorities, the Finnish Defense Forces, and the Finnish Safety and Chemicals Agency all mobilized to respond. President Alexander Stubb released a statement stressing that “Finland is prepared for a range of security challenges and will respond as required.”

The cable that was damaged was a short one carrying a modest amount of data. But it was one link in the nearly one million miles of underseas fiber optic cables that carry 97 percent of all intercontinental data flows—the aorta of the global financial system and the mission-critical backbone of the technology sector. These cables, most of them privately owned, also facilitate more than four fifths of the US military’s communications. Aaron Bateman, assistant professor of history and international affairs at George Washington University, has aptly described the undersea cable network as the “soft underbelly” of American global power.

The incident was not the first undersea sabotage in the Baltic, and it won’t be the last. That shallow body of water has become a hotspot for targeting critical undersea infrastructure. Over the course of the past decades, major Western economies have become increasingly dependent on the flow of data and energy along the seafloor. Russia has begun to weaponize that dependency, and China looks set to follow suit. The West is belatedly rebuilding its capacity to patrol and protect its undersea infrastructure but still hasn’t adequately grappled with how to deter the growing risks below the waves.

What happened? Authorities in Helsinki suspected a modest-sized cargo ship, the Fitburg, of the cable damage. The 25-year-old vessel had recently departed St. Petersburg, Russia. Finland launched a Border Guard patrol vessel and maritime helicopter into the affected waters. Dramatic video footage showed Finnish soldiers, equipped like special forces, dropping from a helicopter onto the deck of the ship. An underwater camera indicated that the ship’s anchor had dragged along the seabed and likely caused the cable damage. Finnish authorities took control of the Fitburg, escorted it to the port of Kantvik, and detained the crew. One crew member, an Azerbaijani national, was later arrested and another, a Russian national, placed under a travel ban. (Later that day, Swedish telecommunications firm Arelion confirmed that two of its cables had also been damaged—one from Sweden to Estonia, the other from Estonia to Finland—likely by the same ship.)

It remains to be seen how the Finnish courts will respond. The obscurity of actions on the high seas and the complexity of global shipping makes attribution in such cases exceedingly difficult. Just a year earlier, in December 2024, the Estlink 2 power cable connecting Finland and Estonia was cut, and four other telecom lines were damaged. The Finns seized the Eagle S tanker, accused it of deliberate damage, and took its captain and two crew to trial. (Helsinki also noted that the ship was part of the “ghost fleet,” a group of up to 600 vessels often operating with false registration that Russia has been using to evade oil sanctions.) Later, a Finnish court dismissed the case against the crew members, given lack of clear evidence of attribution.

The Fitburg’s ownership, registration, and operations are characteristically complex. She was built by the Korean-owned Daewoo Mangalia Heavy Industries at a shipyard in Romania; had two previous names (Finex and Volmeborg); was owned and operated by a Turkish firm (the Albros Shipping and Trading company); was sailing between Russia and Israel; and had on board crew members from Georgia and Kazakhstan. As of now, Finnish authorities have not accused Russia or any other actor of sabotage. NATO also declined to formally make any accusation but did state that it was assisting the Finns “with analysis and information exchange from our NATO shipping center.” Still, Russian involvement is widely suspected.

Seabed zero. The Baltic Sea has become ground zero in targeting critical undersea infrastructure. Previous incidents include the dramatic attack on the Nord Stream pipelines in September 2022, seven months after the second Russian invasion of Ukraine. A year later, a data cable that links Sweden and Estonia and the Balticonnector pipeline that sends natural gas between Estonia and Finland both sustained significant damage. Similar incidents occurred in November 2024, December 2024, and January 2025.

On several occasions, European navies have detected Russian submarines sailing near vital undersea infrastructure, including fiber-optic cables in the Irish Sea and major seabed energy pipelines in the Norwegian Sea. Analysis by maritime intelligence firms also reveal a pattern of Russia-connected vessels sailing unusual patterns over seabed infrastructure.

Driven by this, and on the heels of the 2024-2025 spate of attacks in the Baltic, NATO established a multinational force operation named Baltic Sentry. The operation is part of a wider NATO effort to improve surveillance and protection of critical undersea infrastructure. The December 2025 incident suggests there’s more work yet to be done. And indeed, five days after the Fitburg was detained, Latvian authorities boarded another ship that was suspected of having caused damage to a telecom link to Lithuania.

RELATED:

The ‘Zapad’ exercise and how Lukashenko learned to love the Bomb

These won’t be the last such incidents. And they are not accidents: They are expressions of a new Russian strategy.

From 2000 onwards, Russia has been rebuilding and modernizing its once-substantial navy. Moscow has paid particular attention to the undersea realm. Part of that effort is in continuity with Soviet naval thinking, which in the second half of the Cold War placed particular emphasis on the potential role of attack submarines in disrupting NATO resupply efforts across the northern Atlantic and on its nuclear-capable ballistic missile submarines. But the other part of Russia’s naval rebuilding focuses on a new mission. As the Russian Navy set out its new doctrine, it has explicitly adopted the goal of using a combination of surface and sub-surface assets to threaten—and appear to threaten—the critical undersea infrastructure on which the West relies. As Johanes Peters, head of the Center for Maritime Strategy and Security at Kiel University, has argued, “In an early stage of a conflict, disrupting these cables would be one of Russia’s main tactics.” The primary purpose would be to interrupt military communications. Civilian damage and financial confusion would be supplemental objectives. Putin evidently sees these undersea infrastructures—critical and under-guarded—as an “Achilles’ heel” of the West.

Not all damage to cables is intentional. Indeed, it’s likely that most incidents are accidental. Storms and undersea landslides can damage cables, and ship anchors and bottom trawl fishing that unintentionally sever cables has been a fact of undersea life since the mid 1800s. Additionally, shark bites—even if they don’t sever cables—can damage underwater lines by rupturing their protective coating and allowing seawater in. Still, there’s no real question that the frequency of deliberate attacks is rising.

Europe is particularly exposed to the new Russian threat: by proximity (the entire continent is surrounded by and increasingly dependent on a network of seabed infrastructure that brings oil, gas, electricity, and data to European governments, companies, and citizens); by bathymetry, or water depths (the seas in question are shallow, meaning they can be targeted without sophisticated equipment); and by complacency (since the end of the Cold War, Europe has allowed important parts of its capacity for undersea warfare and defense to atrophy). Several governments, notably Britain and Norway, have begun to rebuild these assets. But reversing two decades of underinvestment in naval defenses will take time.

This issue, however, is not limited to Europe, nor just shallow waters, and the threats don’t come only from Russia.

The China dimension. The vulnerability of Europe’s seabed infrastructure is perhaps the best illustration of a wider, problematic four-part phenomenon of the post-Cold War world: the dramatic industrial expansion in the oceans (for trade, energy, and data flows); the relative decline of Western naval power; resurgent Russian capacity underseas; and the explosive growth of Chinese maritime and naval power. All of these has left the West badly exposed to disruption of surface shipping (by the Houthis in the Red Sea, Russians in the Black Sea, and potentially China in the Western Pacific.) This vulnerability has now, also, extended to the flow of energy and data across the seabed.

And although Chinese activities are mostly noted in the Western Pacific, Europe suspects the Asian superpower’s involvement in its seas as well. In at least three of the cable-cutting incidents over the past two years, the boats in question were either Chinese owned or registered. For example, during the Balticonnector incident, two ships were implicated. The first was the Russian nuclear-powered cargo ship the Sevmorput, which has ties to the Russian state. The second, the Newnew Polar Bear, was registered in Hong Kong and owned by Hainan Xin Xin Yang Shipping. Beijing eventually acknowledged the ships’ involvement, though it claimed it was an accident. The fact that the two ships were later observed sailing in tandem formation alongside a huge concentration of gas pipelines off the coast of Norway—pipelines that now transmit the largest source of Europe’s energy imports—casts the “accident” assertion into question, to say the least.

There have been incidents in other regions too, notably close to Taiwan. In February 2023, the only two cables connecting Taiwan to its Matsu Islands were severed. The island’s 14,000 residents were left without internet, losing the ability to send emails or engage in e-commerce. It took nearly two months to restore the cables. Taiwan blamed China, specifying a Chinese fishing vessel and cargo ship for the attacks. And while the territory and number of people affected were insignificant, it was widely seen as a practice run for a wider severing of cables to Taiwan in the event of Chinese military action there.

Additionally, China recently unveiled a new deep-sea cable cutting submersible, a vessel with no purpose other than to threaten seabed infrastructure.

Its use threatens Taiwan’s connections to the outside world in an invasion scenario. But there are also substantial US military stakes in seabed cables and infrastructure, including several layers of submarine detection sonar arrays in the First and Second Island Chains, all connected to land by cable. These would be likely targets in the early stages of any major US-China conflict—and attacks on them would likely trigger a fulsome American response.

How to respond? For now, the use of commercial and dual-use ships to inflict partial damage on seabed infrastructure falls short of full-blown war. So do the options for response.

RELATED:

New START ends. But a one-year extension could bring many benefits

As these incidents from the Baltic to the Taiwan seas accumulate, there’s a slow but steadily growing focus on protecting undersea cables. There’s an additional incipient recognition that the problem involves not just fiber-optic data links, but the wider undersea infrastructure—like power cables that bring electricity in from wind farms and natural gas pipelines. Some of the concern comes from the companies that own the cables and who under existing international law are liable for the costs of repairs. However, a growing number of governments recognize that even though these cables are for the most part privately owned and operated, they provide an essential public good and that the options for protection largely fall outside of the scope of corporate capacity. That’s particularly true if indeed it is the Russian Navy and its various hybrid affiliates that are threatening this infrastructure.

The most straightforward response, conceptually, is to deny saboteurs the intended effect of their actions. This can be done by one of two means: increased resilience or rapid repair. Resilience is a critical concept here. If signals can be rapidly rerouted to alternative cables, damage to one specific cable won’t have much effect. Similarly, if cables can be repaired in days, rather than weeks or months, then the effects will be limited. For states with myriad connections to the outside world, this is a viable approach. This tactic is, however, far less viable for states with fewer links. Two such states are Taiwan and Australia. Both play an important role in American military planning for possible war scenarios with China.

But many states are not inclined to let attacks on their infrastructure go unanswered, even if the damage from that attack is limited. And so, experts have seen governments move towards more muscular responses. One is what could be called dissuasion by exposure.  Attacks on undersea infrastructure are designed to be deniable. If they can be observed as they are happening, the benefits of gray zone action can be denied. NATO’s Baltic Sentry operation is designed with this in mind, deploying a combination of maritime patrol aircraft, surface ships, and drones to limit the ability of Russia (or any other state) to act without attribution. The sheer scale of the world’s oceans limits the possibilities here, though. And so, the second part of the response involves seizure of assets after the fact, as Finland has now done, twice.

The United States and the United Kingdom have also begun using seizure as a tool for sanctions enforcement, such as intercepting the Russian-flagged oil tanker Marinera off the coast of Scotland.

These measures may prove inadequate. As William B. Ruger chair of national security economics at the Naval War College Peter Dombrowski and I have written, Western countries may need to move up the deterrence chain and be willing to respond with more forceful measures. Attribution issues are difficult, but it seems unlikely that NATO members are going to continue to allow Russia to engage in sabotage or threaten sabotage against critical infrastructure with limited or weak responses. Governments are concerned about escalation dynamics, and European governments want to stay within the framework of international law. The viability of doing so grows ever more tenuous, though, as countries like Russia, and to a lesser degree China, operate beyond its bounds.

The undersea as a geopolitical hotspot. Powerful governments (and earlier, empires) have long sought to use the high seas to generate wealth and project power. In the 20th century, such efforts found expression undersea, as well. In the 21^st century, it seems likely that the undersea realm and the seabed itself will only grow in importance.

Threats to critical undersea infrastructure are one part of a wider set of approaches that straddle the worlds of gray zone aggression and war preparation. They do not in and of themselves pose an existential threat. But some actions, like severing cables that link US undersea sensors, could trigger escalation.

Governments should urgently increase their underseas defenses anyway for two reasons. First, the costs to European and Western societies from a sustained Russian or joint Russian-Chinese effort to degrade and damage the seabed infrastructure would be high, especially on civilians. Imagine the effects of a simultaneous severing of oil and gas flows into Europe from Norway and North Africa during winter, or the costs of significant delays to financial flows between London and New York.

Second, the tools used to inflict damage to undersea infrastructure are part of a widening arms race undersea that absolutely poses a threat to geopolitical stability. This includes the rapid buildup of Russia’s fleet of sophisticated attack submarines; the rapid buildup of China’s undersea forces; and new autonomous underseas devices. Russia has recently launched one such device, informally labeled by NATO as a “doomsday” weapon. This autonomous submarine drone, which is powered by a nuclear reactor and carries a nuclear payload, is one of the world’s most destabilizing weapons.

The seabed is a new zone of geopolitical contest and will only grow in importance as the AI build out generates huge additional data flows, governments look to the seabed for critical minerals and metals, and international tensions mount. It’s central to the dynamics of nuclear deterrence. And it will be the most important battle ground in the next great power war, if it comes.

Together, we make the world safer.

The Bulletin elevates expert voices above the noise. But as an independent nonprofit organization, our operations depend on the support of readers like you. Help us continue to deliver quality journalism that holds leaders accountable. Your support of our work at any level is important. In return, we promise our coverage will be understandable, influential, vigilant, solution-oriented, and fair-minded. Together we can make a difference.

Make your gift now

Keywords: China, NATO, Russia, cables, data flow, fiber optic, high sea, sanctions, submarines, the Baltic Sea, undersea
Topics: Disruptive Technologies