The Baltic Sea in Peace and War

In a string of incidents beginning in late 2023, commercial ships severed numerous pipelines and cables under the Baltic Sea. Departing from its insistence that the primary responsibility to respond to hybrid threats rests with targeted countries, NATO launched military activities which saw Allied ships and aircraft deploy to the region to deter and counter further attacks. These episodes highlighted both the need for states bordering the Baltic Sea to ensure a safe maritime environment, and the shortfalls in their capacity to do so at present.

Meanwhile, Finland and Sweden’s accession to NATO has put greater emphasis on the Baltic Sea as a critical theatre in wartime and highlighted further maritime capability gaps.

NATO’s response to Russia’s war in Ukraine has been most visible in the land and air domains. Among their efforts to enhance defence and deterrence in the Nordic-Baltic region, the Allies have deployed five Forward Land Forces contingents to Estonia, Finland, Latvia, Lithuania, and Poland, and enhanced their longstanding air policing commitment to the three Baltic states. There have, however, been few NATO initiatives in the maritime domain. Finland and Sweden’s accession to the Alliance has certainly seen Allied naval presence and power in the region grow. At the same time, this development has substantially altered the status of the Baltic Sea in NATO’s defence planning, placing more responsibility on regional naval forces in peacetime, crisis and war.

Russia’s Maritime Hybrid Warfare

In late 2023, the Baltic Sea emerged as a focus of Russia’s undeclared hybrid war against NATO and the Allies. Between October of that year and January 2025, some 12 pipelines and power and communications cables (and probably at least two Russian communications cables) were severed in four separate anchor-dragging incidents, three of them in the period between November 2024 and January 2025 alone. The frequency of these events, and their location and methods, point to a deliberate hybrid campaign with Russia the prime suspect. Its motives might include sowing fear, uncertainty and mistrust in governments among targeted populations, highlighting the current US administration’s ambivalence towards its European Allies, and demonstrating consequences for the West’s continuing support for Ukraine.

The affected states were initially slow to react to these incidents. The Newnew Polar Bear and the Yi Peng 3, which between them damaged four communications cables and the Balticconnector gas pipeline in October 2023 and November 2024, were able to leave the Baltic Sea largely unhindered, although NATO and the Joint Expeditionary Force (JEF) briefly stepped-up activities in the Baltic Sea. But the December 2024 severing of the Estlink 2 power cable and another four communication cables by the Eagle S, an oil tanker operating under Russia’s shadow fleet, triggered the launch of NATO’s still ongoing Baltic Sentry activity, as well as a JEF operation, Nordic Warden.

National and international coordination between civilian and government agencies around the Baltic Sea also improved and a concept of operations for dealing more robustly with this type of incident began to emerge. In January 2025, both the Eagle S and the Vezhen, a Maltese-flagged bulk carrier suspected of damaging two communications cables, were challenged on their legal and insurance status, boarded, and brought to Finnish and Swedish territorial waters. Although both ships were later released, these incidents sent important messages to ship-owners that vessels behaving suspiciously around critical infrastructure could be apprehended, possibly leading to costly delays and fines. In April 2025, Estonia also seized and detained a sanctioned shadow fleet tanker, Kiwala,which was sailing without a valid state flag.

But the growing confidence of the Allies was challenged in May, when the Gabonese-flagged tanker, Jaguar, refused to allow an inspection as it transited Estonia’s Exclusive Economic Zone and a Russian Su-35 fighter jet, which apparently arrived to offer protection, briefly violated Estonian airspace. There have been no reports of attempts to board or detain commercial vessels on the Baltic Sea since (although in September, French forces boarded the Kiwala, now renamed the Boracay, off Saint-Nazaire). Whether this is because commercial ships have ceased to behave suspiciously and begun to comply with legal and insurance requirements, or whether it is because the Baltic Sea states and their NATO Allies have become more reluctant to act following the Jaguar episode, is not clear. In any event, direct action appears to be both legally and militarily problematic, placing a higher premium on the need for greater efforts to deter hybrid attacks in the maritime domain.

The Challenge of Deterrence

To deter by denial, states attempt to communicate that their defensive actions will prevent the aggressor from gaining any expected benefits. Deterring attacks on critical underwater infrastructure according to this concept thus requires tangible defensive measures to be put in place. Passive options include infrastructure hardening and the creation of redundancy in energy and communications networks, both of which force the adversary to invest more for his attack to have an impact. These measures also raise the cost for the defender; an obvious, but unresolved question is who should bear these additional costs.

More active options include improving capacity for surveillance, which raises the likelihood that a malicious actor will be identified, and capacity for response, which raises the likelihood that he will be intercepted. Improving surveillance is partly a technological matter. Maritime situational awareness has advanced in the Baltic region, in particular with Finland and Sweden’s accession to NATO. Even so, the picture is incomplete, and further progress in the coverage and capabilities of sensors is needed to provide a better idea of what is happening on and under the Baltic Sea. Uncrewed and autonomous surveillance systems are likely to play a greater role in the coming years, but a lack of resources will still be an obstacle to monitoring all possible targets at all times.

Surveillance may also be improved simply by having more (naval) ships at sea. This is a key part of the rationale for the NATO and JEF deployments to the Baltic region. Another is that present ships also provide a capacity for a range of responses to miscreants, including harassment, boarding, escorting and, in extremis, attack. The NATO and JEF deployments thus currently provide stronger deterrence through more presence. However, it is unlikely that either NATO or the JEF can sustain long-duration deployments to the Baltic region. There is insufficient capacity across the Alliance for such operations, in particular as few NATO warships are optimised for operations in the confined and shallow waters of the Baltic Sea. Local naval and coastguard forces are, in any case, often better suited than visiting navies, as they are more likely to spot the anomalous indicators of a possible hybrid attack and have a more straightforward legal mandate to intervene with suspicious vessels. But the naval capacity of the Baltic Sea states is, despite Finland and Sweden’s accession to NATO, limited and not always fit for purpose: vessels of the Baltic navies, for example, were prevented from fully taking part in recent infrastructure protection operations by adverse weather conditions.

States may also consider attempting to deter by punishment, communicating that they will impose harsh costs in response to any attack. In the maritime hybrid context, this is a harder problem still. One key difficulty is attribution: formal enquiries into the anchor-dragging incidents have so far been unable to assign blame to any state actor. Another is designing an appropriate response. National views on issues of proportionality, the acceptability of targets, the strength of the message sent by any response, and the fear of escalation vary to the extent that finding consensus among Allies—which is politically if not legally necessary—will always difficult. In short, the states of the Baltic region and their Allies lack many of the capabilities necessary for a credible deterrence by denial strategy and have yet to formulate a coherent concept for deterrence by punishment. In such circumstances, it is hard to imagine that there will not be further hybrid incidents in the Baltic Sea.

Nonetheless, the multinational naval presence provided through Baltic Sentry at least signals that the entire Alliance is committed to dealing with the problem of hybrid incidents. Official policies remain somewhat ambiguous: NATO has, since 2016, maintained that hybrid attacks might trigger an article 5 response, but at the same time is very clear that dealing with hybrid attacks is primarily the responsibility of the targeted state. The spread across Europe of Russian-sponsored hybrid attacks with a physical component (also including, for example, sabotage, GPS jamming, suspicious drone activity) suggests that NATO and the EU should move towards formally collectivising their response in the hybrid domain, just as they have, for many decades, collectivised their response to conventional military attack. The benefits are already apparent in the Baltic region, where multilateral cooperation and response have grown organically as the Baltic Sea states have learned to deal with critical underwater infrastructure incidents.

Naval Warfare

Russia’s hybrid warfare, though, is not the only concern for regional naval forces. Russian strategic thinking conceives conflict as a continuum rather than a binary state of war or peace. In this conception, hybrid attacks may not just be provocations, but a preliminary stage of conflict, beneath the threshold of all-out war; indeed, Russia would likely precede a potential escalation to war with NATO with an intensification of grey-zone activities as it did in Ukraine in 2014 and 2022.

Through its doctrine of ‘active defence’ Russia would then seek to control escalation through the calibrated use of limited force. At this point, the key function of deterrence would be to prevent Russia escalating from hybrid to conventional warfare. To achieve this, NATO needs credible military capabilities able to resist aggression across all domains. Land forces will provide the main defence against territorial incursion. But they will rely on robust air and maritime support, meaning that preparation for naval contributions to joint and multi-domain warfare in the Baltic region, as well as preparations for naval warfare itself, are of paramount importance.

Collectively, navies need to be ready to establish and maintain sea control and protect sea lines of communication as well as contribute to, for example, air defence, intelligence, surveillance and reconnaissance, and fire support for ground operations, including long-range fires and deep precision strikes. Russia can be expected to attempt to take advantage of any vulnerabilities in the maritime domain: weaknesses here may undermine NATO’s efforts on land.

Sea Blindness

The naval capabilities of Western states, however, weakened after the end of the Cold War. The spotlight on land and air forces during the era of discretionary expeditionary warfare that followed led to a neglect of the maritime domain—sea blindness. During this period, navies also focused on blue-water operations, leading to an even sharper decline in interest in littoral areas such as the confined and shallow waters of the Baltic Sea.

The situation is somewhat improved today. The defence plans of several Allies include sizeable investments in naval capability. Nonetheless, the list of shortfalls is long, including in the Baltic region. Here, there is a need for improved sea surveillance, air defence, coastal defence missile systems, intelligence and targeting capabilities, minelaying platforms, and upgraded surface fleets. Upgraded submarine capabilities and an appropriate mix of drones to augment the operational effects delivered by crewed platforms will also be required.

The Baltic Sea states cannot expect the rest of NATO to meet these needs and must play their part in the regeneration of NATO’s naval capability. Estonia, Latvia, and Lithuania too should no longer expect to focus primarily on land forces, looking to other Allies to take care of the sea. If they limit their maritime ambitions to just mine countermeasures and coastal patrol—as they have since the re-establishment of their independence—the three Baltic navies will not become mature maritime organisations, able to undertake the full range of peacetime and wartime tasks essential to the security of a coastal state. They will remain unable to cooperate on an equal basis with the navies of the other states in the region and unable to contribute fully to counter-hybrid tasks.

Estonia’s recently approved ten billion euro defence development plan for 2026-29, however, provides little for the navy. Maritime surveillance will be improved, and additional sea mines and Blue Spear anti-ship missiles will be procured. These are important enhancements. But the core of the naval fleet, the mine countermeasures vessels that will reach the end of their useful service life towards the end of the decade, will be renovated, rather than replaced with the multi-purpose vessels and uncrewed platforms envisaged in the Baltic Naval Vision 2030. This will create challenges for Latvia and Lithuania too, as the vision, developed in cooperation with them, foresaw joint procurement to deal with the shared problem of rapidly aging surface fleets.

The Baltic Sea has not become the ‘NATO lake’ proclaimed by enthusiastic commentators when Finland and Sweden joined NATO. It will likely be a critically important area in any future conflict between NATO and Russia and, as recent events have demonstrated, presents numerous hybrid risks to the states that surround it. The security of the Nordic-Baltic region depends on the security of the sea at its centre. It is imperative that the states that surround this sea recognise its importance and invest in its protection.

The author is grateful to the co-authors of the ICDS policy paper, ‘Hybrid and High-End Warfare in the Baltic Sea Region’, on which this article is based.

Views expressed in ICDS publications are those of the author(s).