Seabed Battlefield: Cable Sabotage Reshapes Global Security

In the early hours of December 31, 2025, Finnish authorities scrambled after telecommunications company Elisa detected a sudden disruption in a fiber-optic cable connecting Helsinki and Tallinn. Within hours, special forces boarded the cargo ship Fitburg, finding its anchor dragging along the seabed—the latest in an escalating campaign of undersea cable sabotage that has turned the Baltic Sea floor into a 21st-century battlefield.

Since the September 2022 Nord Stream pipeline explosions, at least 11 suspected sabotage incidents have targeted submarine cables and energy pipelines in the Baltic Sea alone. What was once the domain of accidental anchor damage and fishing trawler mishaps has morphed into a strategic gray-zone campaign, with European and NATO officials increasingly pointing to Russian hybrid warfare—and, in some cases, Chinese-flagged vessels acting under ambiguous orders.

A Pattern of Deniable Destruction

The timeline is alarming. In October 2023, the Chinese-flagged Newnew Polar Bear dragged its anchor across the Balticconnector pipeline and Estlink cable. In November 2024, the BCS East-West Interlink and C-Lion1 cables were severed within hours, with the Chinese carrier Yi Peng 3 as prime suspect. On Christmas Day 2024, the Eagle S—a Cook Islands-flagged tanker from Russia's shadow fleet—damaged the Estlink 2 power cable. The Fitburg incident closed 2025 on an ominous note.

Each event follows a similar playbook: a civilian-flagged vessel, often linked to Russia's gray zone warfare tactics or opaque Chinese shipping networks, drags its anchor along cable routes in Baltic waters where depths of just 50 to 100 meters leave infrastructure uniquely exposed. Damage costs range from €5 million to €150 million per incident and can knock out a third of a nation's internet capacity overnight—as Lithuania discovered in November 2024.

The tactic exploits a critical legal gap. The global submarine cable network<!--/similar—spanning over 1.5 million kilometers—remains governed largely by the 1884 Convention for the Protection of Submarine Telegraph Cables, drafted when the telegraph was cutting-edge technology. Attribution is painstakingly difficult; Finland's Fitburg investigation concluded in early 2026 with four suspects but no public clarity on who directed the operation.</p> <h2>The Staggering Economic Stakes</h2> <p>Over 95% of intercontinental data traffic—from encrypted financial transactions to military communications—flows through submarine fiber-optic cables. <a href='https://www.nato.int/en/news-and-events/articles/news/2025/01/14/nato-launches-baltic-sentry-to-increase-critical-infrastructure-security' target='_blank' rel='noopener noreferrer'><u>NATO estimates</u></a> that roughly $10 trillion in daily financial transactions traverse these cables. Only about 80 specialized repair vessels serve the entire globe, and median restoration times stretch to 40 days. A 2025 TeleGeography study warned that two-thirds of the maintenance fleet will reach retirement age by 2040, requiring an estimated $3 billion investment just to sustain current service levels.</p> <p><i>The dependency of global finance on these cables cannot be overstated,</i> a senior <!--similar-->EU critical infrastructure protection official told reporters at a February 2025 briefing. A coordinated, multi-cable attack could freeze trillions in transactions and trigger cascading failures across trading platforms.

The Militarization of the Seabed

NATO's answer arrived in January 2025 with Baltic Sentry, a multi-domain activity that marks a historic shift: for the first time, the alliance is treating the seabed as a contested operational domain. Frigates, P-8 Poseidon maritime patrol aircraft, and over 20 uncrewed surface vessels now patrol Baltic waters, integrated with AI-driven maritime surveillance through systems like the UK-led Nordic Warden, which fuses satellite data, AIS ship-tracking, and machine-learning algorithms to detect anomalous vessel behavior in near real time. Response times have been slashed from 17 hours to approximately one hour.

We are moving from reactive to proactive, a NATO maritime commander explained in a March 2026 briefing. Deterrence by detection—if a ship captain knows every anchor drag is monitored in real time, the calculus changes. In February 2026, eight Baltic NATO allies—Denmark, Estonia, Finland, Germany, Latvia, Lithuania, Poland, and Sweden—agreed to fast-track acquisition of AI-enabled naval technologies following successful Task Force X-Baltic trials that tested 70 air and maritime drones between March and October 2025.

Yet Baltic Sentry remains a rotating operation dependent on member-state contributions, not a permanent architecture. The RAND Corporation warned in June 2026 that Russia is escalating: in 2025, Moscow dispatched fighter jets to deter Estonian authorities approaching a shadow-fleet vessel, while the deep-sea intelligence ship Yantar and three Russian submarines conducted operations directly over Western cable routes. The NATO Baltic Sentry operation has proven vital, but without sustained investment and clearer rules of engagement, the deterrent effect may erode.

The EU's Strategic Response

In parallel, the European Union unveiled its Cable Security Action Plan in February 2025, backed by €540 million. Announced by Commission President Ursula von der Leyen, the plan rests on four pillars: prevention, detection, response and repair, and deterrence. A new Submarine Cable Infrastructures Expert Group is mapping all existing and planned cables, conducting Union-wide risk assessments, and drafting a 'Cable Security Toolbox.' The Commission is also exploring 'Cable Projects of European Interest' to fast-track strategically vital routes.

The EU's approach confronts a fundamental tension: most submarine cables are privately owned by telecom consortia and tech giants like Google, Meta, and Microsoft, yet their security is a public good. A stress-test framework aligned with ENISA's 2025 Cyber-Stress-Test Handbook is rolling out across member states through 2026. Meanwhile, the United States has advanced its own Strategic Subsea Cables Act, imposing sanctions on foreign persons who sabotage undersea infrastructure—a sign that the seabed has become a new frontier of great-power competition.

Frequently Asked Questions

Who is behind the Baltic Sea cable sabotage?

Western intelligence agencies assess with medium-to-high confidence that Russia is orchestrating a hybrid warfare campaign using civilian-flagged vessels—including its shadow fleet of tankers—to sever cables while maintaining plausible deniability. Chinese-flagged ships have been implicated in some incidents, though the degree of coordination with Moscow remains unclear.

How vulnerable is the global internet to cable attacks?

Extremely. Over 95% of intercontinental data travels through approximately 600 active submarine cables. Critical chokepoints—the Strait of Malacca, the Suez Canal, the Luzon Strait near Taiwan, and the shallow Baltic Sea—are all vulnerable. With only about 80 repair vessels globally and median restoration times of 40 days, a coordinated multi-cable attack could cause significant, lasting disruption.

What is NATO doing to protect undersea cables?

NATO launched Operation Baltic Sentry in January 2025, deploying frigates, patrol aircraft, and uncrewed surface vessels. AI-driven surveillance systems like Nordic Warden have cut threat-response times from 17 hours to roughly one hour. The alliance has also established a Critical Undersea Infrastructure Coordination Cell and a Maritime Centre for CUI Security.

What does the EU Cable Security Action Plan entail?

Adopted in February 2025 with €540 million in funding, the EU plan focuses on prevention, detection, response and repair, and deterrence. It includes mapping all submarine cable infrastructure, conducting risk assessments, developing a 'Cable Security Toolbox,' and designating strategic Cable Projects of European Interest.

How much would a major cable attack cost?

Direct repair costs range from €5 million to €150 million per cable. Indirect economic damage from a multi-cable attack on major financial routes could reach hundreds of billions in disrupted transactions. The global maintenance system requires an estimated $3 billion investment over the next 15 years to sustain current service levels.