Making sense of the Baltic cable incidents

While tough fighting continues in Ukraine and the world’s attention is riveted on the dramatic and dangerous developments in the Middle East, a very worrying set of developments is unfolding further north.

On October 15, Finnish authorities noticed a significant drop in pressure in a major natural gas pipeline that connects Finland and Estonia. They later confirmed that the pipeline had sustained significant damage, taking it offline for several months. The next day, Swedish authorities announced that a data cable that links Sweden and Estonia had also been damaged.

An accident was quickly deemed unlikely. The extensive scale of the damage to the Balticconnector pipeline in particular led Finnish authorities to suggest that it was deliberately caused. The Estonian defense minister stated publicly that, “This damage must have been caused by some force that was not created by … a diver or a small underwater robot; the damage is more massive.”  The Finnish authorities later said that they had not ruled out a “state actor.”

State actor involvement?

Initial speculation focused on Russia. A reconstruction of the movement of ships through the Baltic channel at the time of the explosion, using AIS data and other intelligence, highlights the presence of a Russian hydrographic ship, the Sevmorput (operated by Rosatomflot, a state corporation) in the location of the attacks. Neither Estonia, Sweden, Finland, nor NATO has specifically accused Russia of a deliberate attack — and Russian President Vladimir Putin has denied any involvement. Both the United States and NATO Secretary General Jens Stoltenberg have expressed strong support for Finland, Sweden, and Estonia and vowed a response if more detailed investigations prove Russian involvement.

It raises the question of how NATO would react if this is eventually proven to be a deliberate attack from a state actor. This is not, per se, a military act, but it’s certainly an unlawful attack on critical civilian infrastructure. Undersea infrastructure, especially in Northern Europe, is simultaneously vital to civilian and economic operations, and highly vulnerable. A limited attack on that infrastructure does not necessarily trigger Article 5 (a joint response by NATO), but it requires a deterrent answer. Some Finnish analysts have suggested that NATO needs to treat this as an “Article 4.5” issue — just short of an act of war.

But there’s another, even more troubling issue: the parallel presence of a Chinese commercial ship, the NewNew Polar Bear, in the locations of the attacks. The Chinese ship is a small container vessel — but a rather special one — built to the highest standards for operating through polar ice. (It is designated as 1A Super ice class by the Finland-Sweden ratings system, the global standard.) Originally built in Germany, the ship has been owned and operated by several countries over its decade-plus life and was sold in June 2023 to a Chinese shipping firm.

China has issued no detailed statement yet about the presence of the NewNew Polar Bear in the area of the attacks, other than to assert that its voyage was routine. Finland and Estonia have initiated a diplomatic request to Beijing for its help in contacting the ship. Indeed, both have now expressed a greater focus on the Chinese ship presence than the Russian, as initial reports come in. The most recent development is the recovery of a large anchor part at the site of the rupture to the Balticconnector. That might point to an accident — but leaves entirely unexplained the second rupture to a data cable. An accident is just that; two in a row is rather harder to explain.

Bridge over Northern waters

After the attacks, the two ships, Russian and Chinese, were observed regrouping off the northern coast of Norway — in the vicinity of (though at present, not immediately proximate to) vital energy infrastructure that links Norway with Europe. Norwegian and NATO officials are watching closely. At the time of writing, AIS data shows the NewNew Polar Bear docked at a Russian container terminal outside of Archangel, while the Sevmorput remains off the Norwegian coast.

Russia and China have a complicated relationship in these northern waters. Russia is an Arctic power and China has not been but wants to be, giving Russia leverage in that otherwise rather one-sided relationship. Relations between Beijing and Moscow in the Arctic have not been easy. But cooperation is growing, especially on ocean sciences — a civilian but inherently dual-use domain.

If a Chinese ship were in any way involved in this — especially if it led the damage — that would represent a major departure and a significant blow to the possibility of stable relations between the West and China. Hopefully, a more benign explanation will emerge.

The problem of attribution

Perhaps it was an odd double accident. Perhaps the Chinese ship was operating without directions from Beijing — perfectly possible. But its presence and route are grounds for suspicion and deep concern. So much so that the onus is now on Beijing to explain the ship’s presence, provide a detailed explanation to the three countries directly affected, and clarify its posture on critical undersea infrastructure. Only a clear, compelling explanation from Beijing can dispel serious concern about its intentions here.

The two incidents highlight the importance of constant monitoring of vital undersea infrastructure, and of early attribution of attacks or disruptive actions. This is hard and would require significant investments in coast guards, unmanned observation systems, partnerships with commercial ship operators, and satellite and manned airplane observation, all meshed into an effective monitoring system. But in the absence of early attribution, Western actors are left with speculation and risk losing the narrative advantage. The undersea infrastructure is vital — and vulnerable.