European officials are looking toward Russia after two submarine internet cables in the Baltic Sea were suddenly disrupted in an apparent sabotage operation, just weeks after the United States warned that Moscow was likely to target critical undersea infrastructure.
A cable between Lithuania and Sweden was cut on Sunday, according to Telia Lithuania, the telecommunications company that runs the link. Separately, the state-controlled Finnish telecoms company Cinia said one of its cables, which connects Finland and Germany, was disrupted on Monday.
The Swedish Prosecution Authority said Tuesday that the country’s National Unit against International and Organized Crime had opened a preliminary investigation into suspected sabotage over the cut cables. Finland’s National Bureau of Investigation also said it had launched an investigation.
While the exact causes of the incidents are still being investigated, Germany’s Defense Minister Boris Pistorius said he believed it was likely sabotage.
”Nobody believes that these cables were accidentally severed,” he told reporters on Tuesday morning ahead of a ministerial meeting in Brussels, Belgium. “We have to know that, without knowing specifically who it came from, that it is a hybrid action and we also have to assume that, without knowing by whom yet, that this is sabotage,“ Pistorius said.
His comments came after the foreign ministers of Finland and Germany said in a joint statement on Monday evening that they were “deeply concerned” about the severed cable between their nations, and raised the possibility of the incident being part of a “hybrid warfare.”
“The fact that such an incident immediately raises suspicions of intentional damage speaks volumes about the volatility of our times. A thorough investigation is underway,” the statement continued. “Our European security is not only under threat from Russia‘s war of aggression against Ukraine, but also from hybrid warfare by malicious actors.”
However, two US officials familiar with an initial assessment told CNN Tuesday that as yet there were “no indications of nefarious activity, nor intentional damage to seafloor infrastructure” and suggested the disruption was likely caused by an anchor dragged from a passing vessel.
View this interactive content on CNN.comTracking data from Kpler and Spire did not show any ships near the area where the cables are believed to have been cut. All vessels above a certain tonnage are required by international law to have automatic identification systems that allow them to be tracked, and must keep them on at all times.
There are some instances where these might be turned off, and military ships are not required to have it turned on. Vessels that have it turned off are frequently involved in illicit operations such as oil smuggling and illegal fishing.
However, ship tracking data analyzed by CNN shows at least one ship crossing the Lithuania-Sweden cable.
The cutting of the cables on Sunday and Monday fits the pattern of attacks that have been linked to Russia. Additionally, it is no secret that Russia has been showing increased interest in undersea cables in recent months, patrolling close to critical maritime infrastructure often far from its shores.
Two US officials told CNN in September that the United States believed Russia was now more likely to carry out potential sabotage operations.
They said Moscow has been beefing up its dedicated secretive marine unit that deploys fleets of surface ships, submarines and naval drones to survey the seabed.
Known as “GUGI,” the Russian acronym for the “General Staff Main Directorate for Deep Sea Research,” the unit was previously spotted lurking around critical infrastructure.
A joint investigation by the public broadcasters of Sweden, Denmark, Norway and Finland found in April 2023 that Russia had deployed a fleet of suspected spy ships in Nordic waters as part of a program of potential sabotage of underwater cables and wind farms in the region.
Hybrid warfare
European security officials and experts have been warning for months that Russia was waging a hybrid war against the West – accusations prompted by a series of seemingly random arson attacks, hackings and explosions that occurred across multiple European cities in recent months.
These included arson attacks against a bus garage in the Czech capital of Prague, the Museum of Occupation in Riga, Latvia, a warehouse of a Ukrainian company in London and a shopping center in Warsaw, Poland. Multiple hacking attacks and spying incidents have also been reported in different European countries. As the same time, the European Union has accused Russia and Belarus of weaponizing migration by pushing asylum seekers from third countries to its borders.
Rod Thornton, a senior lecturer in defense studies at King’s College London, said that Moscow has been using sabotage as an alternative to a full-on war with NATO, which would be disastrous for Russia.
Instead, Russia is trying to cause disruption without crossing the threshold that would trigger a forceful response from NATO. The principle that an attack against one member country is an attack against the whole alliance is the cornerstone of the group’s defense pact.
Thornton said it was telling that the disruption happened at the time Russia is trying to increase pressure on Ukraine and the West.
“It could be seen as Russia ramping up the war and the effects of the war in Ukraine before (US President-elect Donald) Trump comes into power to increase the willingness of Western powers to bring an end to the war,” he told CNN in an interview.
“You can see how Trump wants to bring an end to the war, and if the Russians increase pressure on other Western countries and show them the effects of the war, then those Western countries might be more amenable to supporting Trump in his desire to have a ceasefire,” he explained.
Nobody has so far claimed responsibility for the damage. If Russia was behind it, it is unlikely to admit so.
All of the sabotage attacks that have been linked to Russia earlier this year had one thing in common: they were done in a way that allowed Moscow to deny any involvement, usually by low-level operatives or common criminals paid to conduct them.
“This is important because international institutions like the UN can’t blame Russia because the evidence isn’t there. The circumstantial evidence is there, but not the real evidence, there’s no actual kind of smoking gun that can be linked back to them,” Thornton said.
Oleksandr V. Danylyuk, an associate fellow at Royal United Services Institute, a UK defense and security think tank, and a former Ukrainian defense and foreign intelligence official, said this kind of deniability has long been Russia’s strategy.
“The idea is to conduct the operation in the way that everybody understands that it was done by Russia, but at the same time, it leaves some room for the victim to pretend they didn’t know, because the victim is not interested in escalation,” he said, also pointing to the events leading to the annexation of the Ukrainian peninsula of Crimea by Russia in 2014.
“Those little green men, everybody knew that they were Russian forces, but because the West wasn’t ready, you know, to do anything, they could say ‘oh, it’s not certain, we should check what’s going on, maybe it’s some kind of local militia,’” he said.
Limited disruption
The extent of the disruption, if any, caused by the damage to the cables is unclear. Accidents that cause damage to undersea cables are rare, but they do happen, so most providers run services through several different routes to avoid blackouts.
The limited disruption could have been intentional, making the impact serious enough to be seen as an escalation, but not enough to spiral out of control, for now.
“It does take it that that one stage further, but it’s cutting a cable that isn’t going to offend too many countries. They could have gone to the Atlantic and cut a cable there between the US and the UK, or between Europe and the US, which could have major, major consequences, so this is a kind of warning shot,” Thornton said.
Cinia said in a statement that services running through the C-Lion1 cable that connects Helsinki with Rostock were down, but added that Finland’s international telecommunication connections were routed via multiple links.
The company said a repair vessel had been dispatched to the scene and, while it did not yet know how long it would take to fix the issue, added that it typically takes between five and 15 days for submarine cables to be repaired.
Telia Lithuania’s chief technology officer Andrius Šemeškevičius was quoted by Lithuanian media as saying that the cable that was disrupted – BCS East-West – handled roughly a third of Lithuania’s internet capacity. He added that traffic has been restored since the disruption.
CNN’s Stephanie Halasz, Billy Stockwell, Paul P. Murphy and Jim Sciutto contributed reporting.