KLAIPĖDA, Lithuania—As Russia has carried out its brutal invasion of Ukraine, it has increasingly resorted to hybrid warfare tactics—sabotage and cyber threats—to destabilize the European Union and NATO. As a result, the Baltic States and their allies find themselves on the front line of Moscow’s expanding aggression in Europe.
The nine countries that border the narrow Baltic Sea are connected by undersea electrical and telecommunications cables essential for communication and economic exchanges. The sea is also a busy commercial shipping route, handling 15 percent of the world’s cargo. That creates a risk for damage—both accidental and incidental. In the past 18 months, at least 11 cables running under the Baltic Sea have been damaged, and NATO and European leaders have treated the incidents as threats.
While investigations involving the United States and a half-dozen European security services have turned up no definitive proof that commercial ships intentionally dragged anchors across seabed systems, a recent report by The Guardian detailed several incidents suspected to be the work of Russia’s “shadow fleet”—private tankers that are used to help Russia evade oil sanctions.
A report by the Defense Intelligence and Security Service of Lithuania that I was able to read highlighted the urgency of the situation, treated the cable damage as a threat, and warned that “the intensity of attacks against Lithuania and neighbouring countries has increased significantly.”
NATO launched its Baltic Sentry operation in mid-January as an emergency measure to secure the infrastructure below the surface after several cables were severed in recent months.
In November, communications cables linking Lithuania to the Swedish island of Gotland and Finland’s Santahamina Island to Rostock, Germany, were severed on consecutive days. And on Christmas Day, a ship named the Eagle S, suspected of being part of Russia’s “shadow fleet,” damaged three cables connecting Finland to Estonia and one between Finland and Germany. Finnish officials detained the ship and its crew, but eventually released the ship and some crew members. Three crew members remain detained.
I spent a day on the Jotvingis, the flagship of the Lithuanian navy, in the first weeks of Baltic Sentry, observing the sailors on patrol in search of sabotage and talking to the crew.
“We’re in the middle of a hybrid war in the Baltic,” Adm. Giedrius Premeneckas, commander of the Lithuanian navy, tells me. “Our main role and duty at sea is to gather information about what’s going on. To get a complete picture of the Baltic Sea and share this information with allies.”
However, the Lithuanian navy and the Jotvingis do not board any suspicious ships they encounter. “We track them using technical means, in particular via radar. We identify them visually from nearby vessels, ask questions if necessary, and then pass on all this information to the relevant authorities,” Premeneckas says, telling me that his crew is on alert for ships using unusual shipping lanes, or reduced speeds. We have specific algorithms for identifying ships likely to represent hybrid threats.”
This restraint is not without its problems. “In some cases, we have achieved 80 percent certainty, but without the remaining 20 percent, we cannot formally designate Russia or invoke [NATO’s] Article 5,” explains Linas Kojala, director general of the Vilnius Center for Geopolitical and Security Studies, about the challenges of ascribing suspicious activity to the Russian government.
There have also been false alarms. On January 31, in response to the severing days earlier of a fiber-optic cable connecting Sweden’s Gotland island to Latvia, Swedish police boarded a suspicious vessel crewed entirely by Russians. After an investigation, the authorities concluded on February 3 that the cable had not been sabotaged.
The threat presented by damage to underseas cables grew in February, when the Baltic states unplugged from Russia’s electricity grid and joined the European Union’s network. Plans for the move—which had been in the works since 2007—had been stepped up after Russia’s full-scale invasion of Ukraine in 2022. The so-called Brell power grid—which stands for Belarus, Russia, Estonia, Latvia, Lithuania—is controlled almost entirely by Moscow and had long been seen as a vulnerability for the three Baltic states.
“Electricity lines with Russia and Belarus are being dismantled,” EU President Ursula von der Leyen said on February 7. “These chains of power lines linking you to hostile neighbours will be a thing of the past.”
However, the power lines linking them to a friendly neighbor—Estonia, Latvia, and Lithuania are getting their electricity via undersea cable from Poland—present a different vulnerability.
Sabotage isn’t Russia’s only hybrid warfare tactic. For Latvia, the most immediate battlefield is in cyberspace. Since February 2022, the level of cyber threats in the country has remained high, and in 2024, it reached its most critical point since the start of Russia’s full-scale invasion of Ukraine.
The situation is much the same in Lithuania, as the national threat assessment from Lithuanian defense intelligence and security services considers it likely that Russian and Chinese cyber capabilities will remain a threat to critical infrastructures and the network security of Lithuanian institutions.
“Although we face more significant cybersecurity risks than ever before, cyberattacks encountered so far have not caused serious or long-lasting effects on Latvian society,” said Andris Sprūds, Latvia’s minister of defense. “We are constantly monitoring the situation within our cyberspace. Furthermore, we are capable of attributing malicious activities both technically and politically.”
Russian hybrid tactics, whether in the form of cyberattacks, disinformation, or sabotage, are viewed as a stress test for NATO’s ability to adapt to an evolving security landscape. Sprūds, like his Lithuanian and German counterparts, sees these maneuvers as part of a broader attempt to erode Western resolve. “Russia is carrying out a wide range of hybrid activities against the West and the Baltic states to undermine Western support for Ukraine,” he said.
Kojala, of the Vilnius Center for Geopolitical and Security Studies, prefers the term “sabotage” to hybrid warfare, but he argues that the consequences of these actions are very real. “Today, we are faced with physical damage that entails economic costs, but also human costs,” he warns. “For the Baltic States, the red line has already been crossed several times. Now it’s a matter of finding a consensus with our partners.”
