Global connectivity under threat
Increasingly frequent incidents of deliberate underwater sabotage targeting critical fiber optics, power cables and pipelines raise significant global security concerns.

In a nutshell
- Strategic underwater sabotage highlights malign Russia-China coordination
- NATO members’ hesitance to respond emboldens adversaries
- Undersea attacks threaten global connectivity, economics and security
- For comprehensive insights, tune into our AI-powered podcast here.
In the early hours of November 19, an underwater fiber-optic cable for high-speed internet traffic between Finland and Germany in the Baltic Sea was cut in Swedish waters. According to the Finnish company Cinia Oy, which owns the 1,200-kilometer cable, all its connections went down. Just hours later, a similar cable between Sweden and Lithuania was also severed.
Investigators from Finland, Sweden and Lithuania launched a criminal investigation, suspecting that a passing ship had intentionally cut the cable by dragging its anchor along the seabed. Commenting on the event, the German minister of defense, Boris Pistorius, explicitly said it was a case of deliberate sabotage. Matters heated up when evidence from Swedish maritime surveillance showed that the Chinese cargo vessel Yi Peng 3 had passed both points when the breaks occurred.
Immediately after the incident, the vessel, otherwise en route to Egypt from the Russian port of Ust-Luga, attempted to leave the Baltic Sea and moved into the strait between Sweden and Denmark. There it was intercepted by Danish Navy and Coast Guard vessels. Refusing demands that it move into Swedish territorial waters, where Swedish authorities would have jurisdiction, the ship dropped anchor in international waters. It remained there, surrounded by naval vessels from several countries, while diplomatic negotiations took place for several weeks. China allowed European investigators, accompanied by Chinese officials, to board the Yi Peng 3 on December 19. Two days later, the ship resumed its voyage.
This was not the first time a Chinese vessel had been involved in such activity.
This was not the first time a Chinese vessel had been involved in such activity. In October 2023, the Hong Kong-flagged container ship Newnew Polar Bear was suspected of damaging two underwater fiber-optic cables and a gas pipeline, the Balticconnector, between Finland and Estonia. Ignoring calls from Finnish and Estonian authorities to stop, the vessel continued its journey and eventually reached the Port of Tianjin in China via the Russian Northern Sea Route.
At a press conference following the 2023 event, Finnish investigators presented evidence of a trail up to 4 meters wide on the seabed left by an anchor that was dragged to the pipeline that then ruptured. The investigators also shared evidence of the Chinese vessel missing one anchor. Faced with these findings, the Chinese government admitted guilt but claimed it had been an accident.
Although NATO had warned European lawmakers about the dangers of sabotage against underwater assets critical to the continent, states generally refrained from acting. As a result, the situation remained little changed through the end of 2024. However, a rude Christmas awakening was in store.

On December 25, 2024, still more undersea cables in the Baltic were cut, this time connecting Finland and Estonia in addition to a cable linking Finland and Germany. Authorities identified the Russian-linked oil tanker Eagle S, which traversed the area of the cuts at the time of the outages, as the culprit. This time, Finnish authorities delivered a more proactive response than in past Baltic Sea sabotage incidents, deploying military forces that boarded the ship from a helicopter, assumed control of the vessel and forced it into Finnish waters. Investigations have documented that the vessel had dragged its anchor for dozens of kilometers and was on the verge of sabotaging another cable when it was intercepted.
In the first week of January 2025, a Chinese-owned vessel cut an undersea fiber-optic cable near Taiwan in yet another apparent act of sabotage, according to Taiwanese authorities. On January 26, an undersea fiber-optic cable between Latvia and Sweden was compromised; Sweden has opened an investigation into likely sabotage and has seized control of the suspect vessel.
Enough is enough for NATO
Only after a clear pattern of sabotage emerged have European nations finally initiated some preventative measures.
The Estonian Navy in early January stepped up maritime patrols in the Baltic, looking for ships with anchors missing or trailing cables. In mid-January NATO Secretary General Mark Rutte announced “Baltic Sentry,” a mission to increase the surveillance of the Baltic Sea using ships, aircraft and drones.
In late January, authorities in the United Kingdom announced that they had been tracking suspicious movements of a Russian vessel, the Yantar, which was in British waters last year and had recently returned. They said the Russian vessel was mapping out British undersea critical infrastructure. In a joint statement, UK and American officials said that Moscow was waging a “reckless campaign of sabotage” across Europe.
London has deployed aircraft, seaborne and underwater assets and changed its rules of engagement to allow Royal Navy ships to move closer to suspect vessels. The UK even surfaced a nuclear submarine in close proximity to the Russian ship as a warning, and has also boosted surveillance of its waters and joined in preemptive NATO measures in the Baltic.
Logic for involvement in undersea sabotage
The most immediate question concerns why China allows itself to be involved in actions with few obvious upsides but potentially severe downsides. Being implicated in acts of pure sabotage will not help improve commercial relations with Europe or nations in the Far East at the moment when Beijing is grappling with an economic downturn and a looming trade war with the United States. A likely answer is that, in the Baltic cases at least, it serves as a form of quid pro quo. Given that China depends on transport along the Russian-controlled Northern Sea Route, Beijing may have felt it needed to lend a helping hand to Moscow. The situation near Taiwan appears to be Beijing’s way of highlighting the vulnerability of the island that it claims to be its own.
Given that China depends on transport along the Russian-controlled Northern Sea Route, Beijing may have felt it needed to lend a helping hand to Moscow.
Allegations that the Yi Peng 3 captain is a Russian citizen support this interpretation, as do intelligence sources cited by The Wall Street Journal, which claim that he received direct instructions from Russian intelligence. A more sinister possibility is that Beijing is simply gaining experience to use in a heightened confrontation over Taiwan.
Turning to the question of why Russia is engaging in such activities, the obvious answer is that it is simply testing the limits of what it can get away with. The two incidents involving Chinese vessels fit well into a prior pattern where Russian trawlers have been involved in similar practices of cutting underwater cables by dragging anchors along the seabed. In April 2021 and again in January 2022, cables linking the strategically located Norwegian archipelago of Svalbard with the Norwegian mainland were cut. Although Russian fishing vessels could be shown to have made numerous passes over the areas in question, no action was taken.
These incidents are part of a broader pattern of what is often described as Russian “hybrid warfare” against NATO. On December 12, the U.S. Helsinki Commission, an American government organization, released a report about a Russian “shadow war on NATO,” intended “to destabilize, distress and deter the transatlantic alliance from its staunch support of Ukrainian sovereignty.” It identified four categories of hybrid operations: critical infrastructure attacks, violence campaigns, weaponized migration, and election interference and information campaigns. The report included a map of Europe, where red dots marked each of about 150 different operations. The map appeared as if Europe had come down with a case of measles.
The situation near Taiwan appears to be Beijing’s way of highlighting the vulnerability of the island it claims as its own.
Although there has been ample cause for European governments to voice concern over the recent spate of sabotage against civilian and military industries, unknown drones flying over military installations and even an incendiary device found on a DHL flight in Germany, there are compelling reasons to regard attacks on critical underwater infrastructure as a unique issue.
One reason is that such infrastructure is notoriously difficult to protect. Another is that actions can be taken with a fair degree of plausible deniability. A third is that quite substantial damage may be caused.
A case in point is the sabotage of the Nord Stream pipelines in the Baltic, which had massive consequences for European energy supply and intra-European discussions on managing relations with Russia. Although the matter has been surrounded by substantial controversy and finger-pointing, it is significant that it has still not been possible to achieve clarity concerning culpability.
A more sinister possibility is that Beijing is simply gaining experience to use in a heightened confrontation over Taiwan.
Returning to the case of Russian motivations for waging a hybrid war against NATO, the main question concerns the escalation ladder. Assuming that NATO will not be ready to play hardball until there is substantial kinetic escalation, the Russian strategy is finely tuned to stay just short of the level where retaliation is bound to follow. Attacks on fiber-optic cables present an excellent illustration. While breaks may be swiftly repaired, reducing the immediate harm, such incidents offer the Russian side ample input for learning about the scope of the damage, response times and political fallout.
Likely targets of future malign Russian and Chinese actions
Although further Russian escalation in the form of attacks on land is possible and likely, the main playing field will remain on the seafloor. In principle, this is nothing new. During the Cold War, both Russia and America were busy creating their own underwater infrastructure for communications and early warning. One may safely assume that both sides had ample information about where the opponent deployed its assets and detailed plans for sabotage.
The main difference between those games and the events currently unfolding lies in the knowledge that interference with Cold War underwater infrastructure would have been fraught with great danger. As it could have been perceived as the first stage of a major war, it was either not done or done with great care. In the present day, Russia is blatantly and deliberately pushing the envelope and is learning along the way. Moscow is only able to do so because it is presented with a target-rich environment and little resistance.
The network of oil and gas pipelines rolled out on the North Sea’s seabed is enormous and impossible to protect in its entirety. To this may be added the ongoing construction of large offshore wind farms, designed to account for a substantial share of European energy generation.
While attacks on pipelines may cause considerable economic damage, interconnectors will ensure that damage to the energy system can be limited. The same goes for attacks on power lines from offshore wind farms. Temporary power outages will be costly, but systems are designed to manage such incidents.
Read and listen to more from Russian and Eurasian expert Stefan Hedlund
- The transformation of Arctic security
- China and Russia: Calculated relations
- GIS Radio: Georgia’s trajectory: From revolution to Russian influence
The network of fiber-optic cables is different in that while pipelines and power lines are mainly regional, fiber-optic cables are a global concern, extending across the oceans. For example, the severed cable near Taiwan extended to the U.S. A concerted attack on undersea fiber-optic infrastructure could destabilize targeted societies, paralyze payment systems and cause mayhem in financial markets that depend on instant information flows. The question of vulnerability must be viewed against this background.
An additional danger in allowing Russia or China to escalate the game of hybrid attacks lies in proliferation. If rogue states accumulate knowledge on how to attack critical underwater infrastructure, as well as where and what reprisal to expect, if any, it could unleash a major escalation. This might result in damage much broader than that caused by Houthi rebels firing low-quality missiles in the Red Sea.
The prospect of a massive attack on global internet connectivity is truly frightening, especially as both Russia and China are pursuing revanchist agendas and seeking to create a new world order. Moreover, in contrast to the dangers of a global thermonuclear war, few safeguards are in place when it comes to undersea infrastructure. Even a common understanding of what the problem looks like is absent.
Scenarios
Likely: Hybrid attacks continue
One possible scenario is based on continuity, assuming that Russia (and China or any other malign actor) is allowed to get away with steadily more egregious provocations. The danger is that with every iteration, governments and populations in targeted countries grow accustomed to hybrid attacks and start seeing them as somehow “normal.” Meanwhile, the Kremlin observes and learns how to fine-tune further escalation.
Given that Russia will continue to push until it is stopped, the core question must concern how far it can go with its provocations, and how high the stakes will be allowed to rise, before NATO decides that responses must escalate from mere words to practical action and more robust measures.
Precedent boosts the likelihood of more of the same. Although the escalation of Russian hybrid attacks has been ongoing for some time, and NATO has had ample latitude to strike back, little has been done beyond observation, condemnation and the recently announced Baltic Sentry mission.
One example is Russia’s “shadow fleet” of old tankers, which it uses with impunity to circumvent sanctions on its oil exports. Aggressive controls and lengthy detentions of these ships could easily be combined with harsh measures against the Greek shipping magnates who provided them.
Another example is the Russian practice of jamming global positioning system (GPS) signals, which presents serious dangers to civilian aviation. In 2024, Russia disrupted air traffic with this tactic. Given that the jammer has been localized to the Kaliningrad exclave, it could be easily dealt with via a massive hacker attack to disrupt the jammer and overall internet traffic in the oblast.
A third is the “research vessels” involved in mapping underwater infrastructure in the North Sea and around the British Isles. Although they have been loitering in critical locations with their transponders turned off, little has been done. A determined NATO push to stop such activities could range from “accidental” ramming in thick fog to electronic measures and even sabotage against rudders.
The obvious reason why little has been done is that even limited actions from Russia, which could be undertaken with plausible deniability, have been considered by many to be dangerously escalatory.
Given that about 70 percent of Russian oil exports pass through the Baltic Sea, a determined push from NATO to support Finland and Estonia in disrupting the shadow fleet could have serious consequences. Finland has upped the ante by stating that no icebreaker assistance will be provided to such vessels. The current standoff provides a critical test of NATO resolve. Yet, although Nordic steadfastness may result in major losses in Russian export revenue, it is only part of the picture.
Possible: NATO states move decisively against underwater sabotage
The scenario of NATO finally deciding to firmly push back departs from the assumption that the ultimate Russian objective is to test at what point NATO will trigger its Article 5 on common defense. Given that such an outcome could result in a major confrontation, continued Western indecisiveness makes it unlikely that Russia will desist any time soon.
Consequently, barring any changes, more spectacular attacks are likely to follow. This trend may eventually lead to cross-border provocations against smaller NATO members. Although limited at first, such provocations may escalate to the level of “little green men” crossing borders to support local insurgencies.
There will come a time when NATO will be forced to push back, and in fact, we may be witnessing that now based on recent activities in the Baltic and around the UK. But if NATO states continue to dawdle, the alliance will face irrelevance. Already, some threatened European governments and their leaders, such as Prime Minister Robert Fico of Slovakia, are scrambling to make deals with Moscow. When that sustained point of determined action will arrive in earnest, however, is uncertain. Meanwhile, as the showdown is pushed further into the future, the danger of rogue states engaging in hybrid attacks will rise, and China is watching and learning.
Contact us today for tailored geopolitical insights and industry-specific advisory services.