In the early hours of Boxing Day, as most of Finland slept off the Christmas festivities, a group of armed Finnish border guards abseiled out of a helicopter above the Baltic Sea. Dangling over the icy waters, the team lowered themselves on to the deck of the Eagle S oil tanker, seizing control from its Georgian and Indian crew.

After sailing the vessel into a Finnish port, authorities launched a criminal investigation into the aggravated sabotage of cables — the veteran tanker is the latest in a series of maritime suspects thought to be behind attacks on the Baltic Sea’s underwater infrastructure. The Finnish border and coastguard team’s interception of the Eagle S was the first time such a vessel had been stopped and boarded.

“The authorities wanted control of the ship. The sea was quite cold and rough. So getting to the scene by helicopter was the best method under the circumstances,” one member of the border guards’ elite special intervention team, known by his call sign Hauki1, told public broadcaster Yle.

The leaders of an expanded Nato thought they would have greater control of the Baltic Sea, turning it into what some referred to as a “Nato lake”. After Finland and Sweden joined the western military alliance in 2023-24 as a result of Vladimir Putin’s full-scale invasion of Ukraine, politician after politician from the three Baltic states argued that Nato would rule the waves in the sea vital to Russia’s economy and military.

But the result has been very different. In the past 17 months, there have been multiple incidents of damage to gas pipelines and electricity and data cables in the Baltic Sea.

No motive has yet been officially established, but Pål Jonson, Sweden’s defence minister, has little doubt who is targeting Europe. “The main perpetrator in general has been Russia,” he says, underlining that he is talking in general terms and not about specific incidents. “We have taken note that Russia has a propensity to take great political and military risks.”

The security of infrastructure carrying power, data and petroleum between countries has long been overlooked. But after the repeated incidents of sabotage in the Baltic area, and a growing number of similar events off the coast of Taiwan, policymakers are taking it increasingly seriously.

“The awareness of this entire playbook of Russia and its peers has become more and more evident over the course of the past months,” says Elina Valtonen, Finland’s foreign minister. “This is not a regional issue. It is a part of the aggression and the threats that Russia is posing to our way of living.”

Despite the prospect of a ceasefire in Ukraine, European nations are preparing themselves for a longer-term confrontation with Moscow — and the Baltic Sea could well become a new flashpoint.

The waterway could be seen as an attractive target for any greyzone warfare tactics — threats deemed below the threshold of formal warfare. Its busy shipping lanes and web of undersea infrastructure make it a challenge to attribute any sabotage attempt to a specific actor. And more than 90 per cent of its international waters are shallower than 150 metres — easily reachable by dropped anchors.

The sabotage incidents raise questions, however, about the limits of Nato’s power and the ability of the alliance to protect critical infrastructure and coastlines. What action is taken will be crucial in determining Europe’s response to Russian aggression, especially in light of a possible US retreat from the Atlantic alliance.

“We are as strong as what we are prepared to do. Nato has all the ability to show strength. If we are not ready to do that, Putin will not care if we call it a Nato lake,” says Landsbergis, the former Lithuanian foreign minister who is currently writing a report on the Baltic Sea. “The countries around the Baltic Sea are the most vocal, offering the most aid to Ukraine, but also the most vulnerable.”

Accidents or sabotage?

It is not yet known who is behind the three recent incidents of potential sabotage, nor the extent of Russian and Chinese government involvement and collaboration. Two of the ships were Chinese; all three caused the damage with their anchors.

Russia itself has denied involvement in each incident. An earlier instance of sabotage in the Baltic Sea — explosions on the Nordstream gas pipelines between Russia and Germany — is still under investigation. The most prominent theory is that Ukraine was responsible — but some European governments suspect Russia could have been behind the sabotage.

At least one of the vessels suspected of damaging cables in the Baltic was part of Russia’s shadow fleet — a group of poorly maintained and shadily owned oil tankers used to get around the west’s sanctions on Moscow. They are derided by experts as little more than “rustbuckets”, but together they transport as much as 60-70 per cent of Russia’s oil exports out through this key trade corridor, generating vital revenues for its war machine.

Some claim that Russia has little interest in drawing attention to these shadow vessels and the quantity of oil departing via its Baltic ports.

A person close to several of the investigations says: “I’m still sceptical about the notion that there would be intentional sabotage. The Baltic Sea is a crucial transport lifeline for Russia, both in terms of exports and imports. So why would it want to draw attention to the problems of the shadow fleet by engaging in sabotage?”

But others argue all three could not have been accidents or down to bad seamanship.

“It is impossible to drag an anchor for 150km without knowing you’re doing it,” says Landsbergis, referring to how some vessels have been accused of dragging anchors for long distances. “Your ship runs slower. You consume way more fuel. You would know. We didn’t have such incidents before the war in Ukraine.”

Markku Mylly, a retired sea captain and former head of the European Maritime Safety Agency, puts it more bluntly. “I can believe that one case could be an accident. Two cases in a row? Hardly. Three and more? Never, impossible.”

The Eagle S incident occurred just weeks before the Baltic states of Estonia, Latvia and Lithuania disconnected from the Russian-controlled Brell power grid and joined Europe’s.

Before the Eagle S came two other suspected sabotage incidents — in October 2023 and in November 2024. Both involved Chinese-registered vessels.

Maritime law

Finland’s speedy apprehension of the Eagle S and robust response to its suspected sabotage has been hailed by many as a blueprint for future interventions.

“[The Finns] were not worried about escalation, they were not worried about a reaction,” says Landsbergis. “It shows: if you do it again, we will do the same [react quickly]. As time goes by, you will start to feel the pinch.”

Still, there are big legal questions for Nato. The Eagle S voluntarily complied with requests to move into Finnish territorial waters, allowing authorities to board. Experts say the situation would be less clear had it refused, just as the Yi Peng 3, accused of severing two cables in the Baltic Sea in November last year, rejected requests to enter Swedish waters.

“There is freedom of navigation in international waters. These vessels can sail in international waters all the way from Russia out of the Baltic Sea. They deliberately avoid EU territorial waters. Is there room for manoeuvre to do something else?” asks one EU legal official.

Some nations already think they can do something. The Estonian navy has said that where it believes there is a threat to critical infrastructure, it would intervene, even if outside its territorial waters.

A draft law in Estonia’s parliament would make it more explicit, giving the armed forces new powers to act in its exclusive economic zone, which lies beyond territorial waters.

Although disruptive, so far the impact of the sabotage events has been fairly limited. The data cables were all repaired quickly. The gas and electricity connections take more time to fix but alternative routes have also been used. An oil spill, while not a direct act of sabotage, would be of an entirely different magnitude.

“The tankers they are using are rusty and don’t necessarily have any insurance, so there is a significant risk to the environment,” says Valtonen. Another Finnish official adds: “It is shallow waters, it’s very narrow, it’s very heavily trafficked. It would be the nightmare scenario.”

Nato nations rally

There are dozens if not hundreds of vessels criss-crossing the sea at any one time on behalf of Moscow’s navy or shadow fleet. A number of them have been observed making unusual movements, which some believe are attempts to map critical cables, unsuccessful efforts at sabotage, or merely aimed at seeing what response they trigger from Nato.

Valtonen, Finland’s foreign minister, suggests that such attempts to provoke Nato could end up inflicting damage on the suspected perpetrators too.

“I’m pretty sure that for Russia, it is very important as well to keep its lines of communications and electricity lines open, especially in the Baltic Sea area. So I would suspect that at some point they realise . . . that they’re doing it against themselves.”

As a result of the recent incidents of sabotage, Nato has stepped up its presence, sending its own ships, drones and aircraft to monitor shipping traffic in an operation known as Baltic Sentry.

It is also using artificial intelligence to monitor suspicious ships and their movements and is deploying unmanned surface and underwater vehicles to detect threats and transmit real-time data.

“Nato countries now surround the Baltic Sea, and from Russia’s perspective its connections to the outside world are vulnerable here,” says Kaupo Rosin, director-general of Estonia’s foreign intelligence service. “Moscow believes that in the event of a conflict, Nato would likely take control of the Baltic Sea and impose a de facto blockade on Russia.”

But maritime experts believe there is just too much traffic in the Baltic Sea to prevent further sabotage incidents. “They can’t monitor all the vessels. It’s mission impossible,” says ex-ship’s captain Mylly.

Sanctions are one way of cracking down on rogue vessels. It is impossible to blanket-ban Russian oil tankers, but EU officials are trying to tighten the net by potentially targeting crews, owners and other middlemen. The process is slow and cumbersome but the hope is that it will make it more difficult and expensive for Russia to export oil.

Authorities are also looking to do more intrusive checks on vessels’ insurance, or seaworthiness, if they use an EU port. Finnish authorities found 32 deficiencies with the Eagle S.

Another possible deterrent might be to prosecute existing incidents of sabotage. Landsbergis argues that reversing the burden of proof — asking crews to show they had a good reason for dropping their anchor — could be one way.

Jonson, Sweden’s defence minister, says his country has invested “heavily” in systems to help identify the perpetrators of cable damage and attribute incidents where sufficient evidence is found. “We had a steep learning curve in Sweden,” he adds.

The resilience of the thousands of kilometres of cables could also be improved. While most experts rule out the possibility of encasing existing cables and pipelines in additional protection, such as concrete, officials believe Baltic Sea countries could increase their repair capabilities and plan for additional connections to be used in the event of a primary system failing.

“We need to have strong capabilities for recovery and repair . . . and not depend on just one connection,” says Valtonen, noting that the data cables broken on Christmas Day were repaired within days. Any sustained outage would have implications for multiple nations.

A lingering question is what kind of incident might draw a bigger response.

Senior European officials said after the Nordstream sabotage that an attack on critical infrastructure could trigger Nato’s collective defence pledge, known as Article 5. However they have been more circumspect in recent months after the increase in sabotage incidents, not just in the Baltic Sea but involving parcel bombs, fires in warehouses and vandalism across Europe.

The issue is made more complicated now the Trump administration has made it clear the US no longer wants to be the primary guarantor of security for Europe.

“I have asked the question [on Article 5]: what would it take us to change our posture? Sabotage on a pipeline? On an LNG terminal? A mass casualty event? These are not necessarily rhetorical questions,” says Landsbergis.

But allowing such acts of sabotage to go unpunished risks inviting more attacks on critical cables and pipelines beyond the Baltic Sea. Many of those most critical to Europe and the US are located elsewhere, in the North Sea or Atlantic. There have also been incidents in Asia. In late February Taiwan’s coastguard said it caught a Chinese-owned freighter in the act of cutting a communications cable.

Intelligence services in Norway, the biggest supplier of gas to the EU and UK, warned in February that Russia was “likely” to attempt sabotage against it and its vast array of undersea pipelines.

A senior European official warns: “The Baltic Sea is just the beginning.”