# ‘Shadow fleets’ and subaquatic sabotage: are Europe’s undersea internet cables under attack?

Europe is on high alert after a series of outages to cables and pipelines. This visual guide explains what happened and what’s being done.

## Europe is on high alert

Europe is on high alert after a series of outages to cables and pipelines. This visual guide explains what happened and what’s being done.

Headline and standfirst go here..



Finnish police detain oil tanker Eagle S. Photograph: Jussi Nukari

On Christmas Day 2024, Finland was investigating a mysterious incident that had  connecting the country with Estonia. Investigators could not rule out sabotage, and the next day Finnish authorities seized a cargo ship carrying Russian oil.

The captured ship, named Eagle S, registered in the Cook Islands and owned by a UAE company, is thought to be part of a  used to evade sanctions on Russian oil. Finnish authorities suspect that it damaged three undersea fibre-optic connections with Estonia as well as one with Germany.

The vessel had left the Russian port of Ust-Luga, heading towards Egypt. On Christmas Day, around the time of the power outage, it crossed the Estlink 2 power cable, according to Finland’s electricity system operator, Fingrid. About 90 minutes after the crossing, it made a suspicious change of course, before continuing on its initial route. It then carried on across four undersea fibre-optical cables, three of which registered failures around the time the ship crossed them. The ship was suspected by Finnish authorities of having dragged its anchor to damage the cables and was escorted into custody.

This is just one of a series of incidents in the Baltic Sea affecting undersea energy pipelines, telecommunication cables and power connections that have put European countries on high alert.

## Submarine fibreoptic cables

Submarine fibre-optic cables, which transmit an estimated 99% of all intercontinental internet traffic, as well as data and voice communication, are the invisible backbone of the global economy. Every day, they enable financial transactions worth trillions of pounds, as well as sensitive communications between governments. The ubiquity of these cables, which remain faster, cheaper and more reliable than alternatives such as satellites, makes them indispensable to modern life.

There are increasing concerns among European governments over the incidents affecting these cables, with increasing numbers of European officials – including Germany and Finland’s defence ministers –  by hostile actors such as Russia as their likely cause. The Russian government has repeatedly denied such claims,  of using “myths” to increase the alliance’s presence in the Baltic Sea and curb Russian oil exports.

According to a report by the US cybersecurity company Recorded Future, the quick and relentless expansion of the global submarine cable network – driven by the rapid growth in internet users and the demand for more bandwidth – has created new opportunities for attacks and espionage.



Underwater cables in the Mediterranean Sea. Photograph: Alamy

These cables are often no thicker than a garden hose where they lie across the seabed, and while they are generally sheathed in protective armour, they remain vulnerable. According to the Recorded Future analyst Matt Mooney, between 100 and 200 cable outages occur every year, mostly because of accidental damage from anchors and fishing trawlers. Yet, Mooney said the pattern associated with the cable fault events that have occurred in the Baltic Sea in the past 15 months makes it unlikely that none of them were intentional.

The following maps show a series of incidents that have concerned European officials and led experts to consider just how vulnerable this critical infrastructure is to sabotage and what can be done to protect it.

## The Baltic Region

Last November, two more submarine telecommunication cables in the Baltic Sea were damaged. The first, connecting Lithuania to the Swedish island of Gotland, stopped functioning on the morning of 17 November, while a second, connecting Germany to Finland, was damaged overnight between 17 and 18 November.



The Chinese bulk carrier Yi Peng 3. Photograph: Reuters

Once again, a joint investigation by Sweden and Finland focused on a cargo ship: the Chinese-owned Yi Peng 3. The presence of the ship at the location and time of both cable outages led the German defence minister, Boris Pistorius, to point to sabotage.

Suspicions were further fuelled by the vessel’s behaviour near to the cables. The ship’s speed was significantly reduced as it approached the two cables, and its transponder was turned off as it crossed the C-Lion1 cable.  revealed drag marks on the seabed and a twisted anchor on the ship, suggesting intentional anchor-dragging.

Over the past five years, several other undersea infrastructure outages were deemed suspicious by experts and national authorities. Many of these incidents occurred in the Baltic Sea, which hosts most of Europe’s undersea cables as well as strategic energy pipelines. Its relatively shallow seabed, combined with high maritime activity, makes the infrastructure particularly vulnerable.

## Russian Activity in the Baltic Sea

In 2023, the Balticconnector gas pipeline connecting Finland and Estonia was  along with two nearby cables: one owned by the telecoms company Elisa and another by Swedish company Arelion. The Finnish authorities recovered the anchor of the Hong Kong-flagged cargo ship Newnew Polar Bear in the vicinity of the damage. On 12 August 2024, the Chinese government confirmed the vessel’s responsibility in the incident, but attributed it to an “accident” caused by a “strong storm”.

Suspicious incidents are not limited to the Baltic. In April 2021, a 12-tonne section of cable belonging to the Norwegian Lofoten-Vesterålen Ocean Observatory was ripped out, causing an outage. Investigations revealed that the cable had been cleanly cut, suggesting a deliberate act. A Russian trawler, the Saami, had been conducting suspicious manoeuvres in the area, passing back and forth over the cable at least four times, and had been directly above it at the time of the outage.



Underwater drone footage revealed grooves dug in the seabed. Photograph: Norwegian Police Service

Eight months later, a communications cable connecting mainland Norway to Svalbard was damaged. The cable had been buried under the seabed for protection. Underwater footage revealed that deep trenches had been dug through the mud, suggesting a deliberate act.

Russian trawlers Melkart 5 and Yagry had been in the area, and their patterns were described as suspicious by experts. The ships’ owners denied any wrongdoing.

## Global Network Growth

Growth in global internet traffic has led to a dramatic increase in the number of , which have more than doubled since 2013. The speed of deployment keeps accelerating. With it, the need to protect the expanded network has also increased, with security concerns well beyond northern Europe.

For instance, the 2023 cutting of cable connections between the Matsu Islands and Taiwan in the East China Sea – another suspected act of sabotage – left 14,000 people without internet access for several days, and then with limited connectivity in the two months needed to repair them. Last March, the severance of four cables in the Red Sea – a major geopolitical chokepoint – led to the disruption of 25% of data traffic between Asia and Europe.

The intricate nature of global shipping makes it difficult to pinpoint clear responsibility for most of these incidents. Ships often operate under “flags of convenience", which allow their owners to register the vessel in countries that offer laxer regulations and more anonymity, and crews are often recruited from a mix of countries.

While being cautious about identifying culprits for recent events, Mooney believes that the suspicious nature of these incidents is cause for concern. Several western governments have condemned what they deem a sabotage campaign aimed at destabilising Nato allies.

“I think adversarial nations are very likely going to continue to embrace grey-zone or hybrid warfare against the west,” Mooney said. “It's a means of inflicting economic damage, hampering military capabilities, causing societal disruption, and will likely intensify in conjunction with key geopolitical conflicts. Plausible deniability will almost certainly remain a key operational hallmark for sabotage of critical infrastructure.”



The damaged gas pipeline in the Baltic Sea. Photograph: Reuters

It is unclear whether any easing of  under President Donald Trump will lead to a reduction of sabotage incidents. But so far European leaders are not putting a lot of hope on these diplomatic efforts.

In the face of these mounting threats, European nations are intensifying their efforts to safeguard the network. In response to the 2022 sabotage of the Nord Stream pipelines, Nato established the Critical Undersea Coordination Cell, a unit tasked with mapping vulnerabilities and sharing best practices on cooperation between Nato allies, partners and the private companies operating much of this critical infrastructure.

In January 2025, , a mission aimed at enhancing maritime presence and surveillance in the Baltic Sea through the deployment of aircraft, ships, and naval drones. An initial flotilla has assembled off the coast of Estonia, with more ships expected to join the effort. Cmdr Erik Kockx, the head of a mine countermeasures taskforce involved in the operation, explained that the flotilla was intended to act as the “security cameras of the Baltic Sea”.

In February 2023, the UK brought into service the RFA Proteus, a vessel equipped with advanced monitoring systems and submersible drones. Last November, the ship was deployed to monitor the Russian vessel Yantar, suspected of  operations in UK waters.

Although critical, Mooney explained, these interventions are not guaranteed to protect an area as vast as the Baltic, and it is yet to be seen whether monitoring missions will be able to keep up with an increased rate of sabotage operations. More than 500 cables are believed to be in operation globally, stretching nearly 870,000 miles (1.4 million kilometres).

Teija Tiilikainen, the director of the European Centre of Excellence for Countering Hybrid Threats, stressed that while investigating incidents and defending the infrastructure was important, building resilience into the system would be critical. She said: “We shouldn't be too dependent on any single pipelines or data cables. We should make sure that the companies create reserve systems, we should use surveillance or monitoring tools that we have, using forms of international cooperation for sharing intelligence.”

Tiilikainen believes the recently announced  takes important steps towards resilience, infrastructure mapping being one of the most critical: “Not all infrastructures are of equal importance. We should be able to define the most critical ones, which of course are the most vulnerable ones due to our dependence on them. Resilience implies that we may not be prepared to counter a malign act, but we are prepared to make sure that an emergency situation would be short and return back to normal would be smooth.”

## Most viewed

1. 
2. 
3. 
4. 

Most viewed

1. 
2. 
3. 
4. 
5. 
6. 
7. 
8. 
9. 
10. 

## Explore more on these topics

* 
* 
* 
* 

## Most viewed

1. 
2. 
3. 
4. 
5. 
6. 
7. 
8. 
9. 
10. 
```