On Nov. 18, hours after two communication cables were severed in the Baltic Sea, 30 NATO vessels and 4,000 military staff took to the same body of water for one of northern Europe’s largest naval exercises.

The 12-day ‘Freezing Winds’ drill was part of a push to step up the transatlantic defence alliance’s protection of infrastructure in waters that carry 15% of global shipping traffic and are seen as increasingly vulnerable to attack.

The Baltic Sea is bordered by eight NATO countries and Russia. There have been at least three incidents of possible sabotage to the 40-odd telecommunication cables and critical gas pipelines that run along its relatively shallow seabed since 2022, when Russia invaded Ukraine.

“NATO is stepping up patrols, … allies are investing in innovative technologies that can help better secure these assets,” said Commander Arlo Abrahamson, a spokesperson for NATO’s Allied Maritime Command.

Yet the ease with which a ship’s anchor can slice through a cable, coupled with the often-treacherous sea conditions, makes actual prevention of such attacks almost impossible.

On day three of the exercise, German Navy commander Beata Król tried to launch an underwater drone from her de-mining vessel, the Weilheim, to inspect the seabed as a winter storm raged.

Suspected underwater sabotage incidents in the Baltic Sea

NOV 2024: BALTIC TELECOM CABLES

In the most recent case, two undersea fibre-optic communications cables located more than 100 nautical miles (about 200 km) apart in the Baltic Sea bottom were severed subsequently on Nov. 17 and 18, raising suspicions of sabotage by bad actors.

A 218-km (135-mile) internet link between Lithuania and Sweden’s Gotland Island went out of service at about 0800 GMT on Sunday, Nov. 17, according to Lithuania’s Telia Lietuva, part of Swedish Telia Company TELIA.ST.

A 1,200-km (745-mile) cable connecting Helsinki to the German port of Rostock stopped working around 0200 GMT on Monday, Nov. 18, Finnish state-controlled cyber security and telecoms company Cinia said.

Investigators in the involved countries have zeroed in on Chinese bulk carrier Yi Peng 3, which left the Russian port of Ust-Luga on Nov. 15, and a Reuters analysis of MarineTraffic data showed that the ship’s coordinates corresponded to the time and place of the breaches.

OCT 2023: BALTICCONNECTOR GAS PIPE AND CABLES

Last year, a subsea gas pipeline, the Balticconnector, which links Finland and Estonia under the Baltic Sea, was severed by what Finnish investigators later defined to have been a Chinese container vessel NewNew Polar Bear dragging its anchor in the early hours of Oct. 8, 2023.

Estonian police suspect the ship of also damaging two separate telecoms cables connecting Estonia to Finland and Sweden on Oct. 7-8, before hitting the gas pipeline on its way to a port near St Petersburg, Russia.

China has promised both Finland and Estonia to assist with the investigations but has done little to fulfil its promises.

Neither the Finnish or Estonian investigators have been able to state if the Hong Kong-flagged vessel caused the damage by accident or deliberately, and have yet to provide their conclusions in the cases.

SEPT 2022: NORD STREAM BLASTS

Nord Stream 1 and Nord Stream 2, built across the Baltic Sea by Russia’s state-controlled Gazprom GAZP.MM to pump natural gas to Germany, were damaged on Sept. 26, 2022.

Swedish seismologists registered several subsea blasts, some 17 hours apart, off the Danish island of Bornholm, that ruptured three out of four lines of the Nord Stream system, sending plumes of methane into the atmosphere.

In the investigations, Sweden found traces of explosives on several objects recovered from the site, confirming it was a deliberate act, but in 2024 both Sweden and Denmark closed their investigations without naming suspects.

No one has taken responsibility.

Some Western officials have suggested Moscow blew up its own pipelines, an interpretation dismissed as “idiotic” by Russian President Vladimir Putin.

Russia has blamed the United States, Britain and Ukraine for the blasts, which largely cut Russian gas off from the lucrative European market. Those countries have denied involvement.

In August this year, Germany issued a European arrest warrant against a Ukrainian diving instructor accused of being part of a team that blew up the Nord Stream pipelines, but the man had already left Poland.

After a 30-minute delay in launching it, the drone had frozen and could not operate.

“The batteries got cold,” she said, shrugging, as she waited for the equipment to warm up.

Having spent years detonating World War Two-era mines on the Baltic seabed, NATO is repurposing its six-vessel minehunting fleet to also monitor suspicious underwater activity, with its hull-mounted sonar scanning the seabed, drones able to take pictures and video under the water, and specialist divers on hand.

But its powers are still limited.

“We are a defensive alliance, so by conducting training and exercising, also in areas which are crucial with underwater infrastructure, we show presence and prevent rather than actively engage,” Król said.

CAUSES OF CABLE DAMAGE HARD TO PINPOINT

Security sources say the Chinese bulk carrier Yi Peng 3, which left the Russian port of Ust-Luga on Nov. 15, was responsible for severing the two undersea cables in Swedish economic waters between Nov. 17 and 18 by dragging its anchor on the seabed.

As of Monday, it was stationary in Danish economic waters, being watched by NATO members’ naval ships, having been urged by Sweden to return to be investigated. Some politicians had accused it of sabotage, but no authority had shown evidence that its actions were deliberate.

China has said it is ready to assist in the investigation, while its ally Russia has denied involvement in any of the Baltic infrastructure incidents.

The case is similar to an incident last year when the Chinese ship NewNew Polar Bear damaged two cables linking Estonia to Finland and Sweden as well as an Estonia-Finland gas pipeline. China made similar promises to assist, but the ship was not stopped and, a year on, Finnish and Estonian investigators have yet to present conclusions.

Damage to cables is not new. Globally, around 150 are damaged each year, according to the UK-based International Cable Protection Committee. The telecoms cables, power lines and gas pipes in the shallow Baltic are particularly vulnerable due to its very intense ship traffic, the U.S.-based telecom research firm TeleGeography said.

If any of the recent incidents are proven to be sabotage by another country, it would mark a return of a type of warfare not seen for decades.

“You should go back to World War One or the American-Spanish war to find a state-sponsored sabotage of a submarine cable,” said Paul Brodsky, a senior researcher at TeleGeography.

To counter this potential threat, NATO in May opened its Maritime Centre for Security of Critical Undersea Infrastructure (CUI) in London, which wants to map all critical infrastructure in NATO-controlled waters and identify weak spots.

In Rostock, on Germany’s Baltic coast, a multinational naval headquarters opened in October to protect NATO members’ interests in the sea.

“What I think we can achieve is to place the responsibility after an incident,” CUI’s Branch Head, Commander Pal Bratbak, said onboard the Weilheim, stressing the growing power of technology.

NATO’s Centre for Maritime Research and Experimentation in Italy is launching software that will combine private and military data and imagery from hydrophones, radars, satellites, vessels’ Automatic Identification System (AIS) and fibres with Distributed Acoustic Sensing (DAS), which private telecom companies use to localise cuts in their cables.

“If we have a good picture of what’s going on, then we can deploy units to verify what the system tells us,” Bratbak said.

German Lieutenant-General Hans-Werner Wiermann, who led an undersea infrastructure coordination cell at NATO Headquarters until March, said no pipeline or cable can be guarded all the time.

“The right response to such hybrid attacks is resilience,” he said, adding that companies were already laying cables to add “redundancies” – spare routings that will allow critical pieces of infrastructure to keep working if one cable is cut.

On board the Weilheim, Król’s second drone is finally able to brave the storm to continue the inspection drill underwater.