Russian Hybrid Operations
Once May Be an Accident; Numerous Times is Warfare
The Washington Post a couple of weeks ago published a piece refuting claims of Russian sabotage in several maritime incidents in which Baltic undersea cables were severed. The Post claims that US and EU officials have gathered evidence—including intercepted communications—that suggests dragging anchors on poorly maintained vessels with inexperienced crews were responsible for “accidents” that resulted in damage to the cables.
“Not Russian sabotage,” claims the Post.
Late last year, the Estlink 2 cable between Finland and Estonia was cut. Around the same time, three Internet cables connecting the two nations were cut, and a fourth fiber optic cable between Finland and Germany was severed.
Finland recently seized the Eagle S—a ship carrying Russian oil—on suspicion that it damaged an undersea power line and four telecommunications cables in the Baltic Sea. A Finnish court upheld the seizure after a UAE-based company—Caravella LLC FZ—tried to get the ship and crew released.
Caravella doesn’t appear on any sanctions lists… yet. Lloyds identified the tanker as part of Russia’s “shadow fleet” that’s involved in the Russian oil trade, and is affiliated with the Indian company Peninsular Maritime India PVT, which is affiliated with two sanctioned companies—both based in the UAE—Radiating World Shipping Services (designated by the UK) and Star Voyages Shipping Services (sanctioned by both OFAC and the UK) and considered to be leading shadow fleet operators. Both ceased operations after being sanctioned by the UK and transferred their fleets to related companies, including Peninsular Maritime India.
But beyond being linked to restricted Russian oil trade, this vessel is also a spy ship that contained Russian spy gear onboard.
The spy equipment was installed on board the Eagle S in large portable suitcases (including laptops with keyboards in Russian and Turkish to make calls to Türkiye and Russia) and was used to monitor radio frequencies, record NATO messages, and transmit the collected data to the Russian authorities. …According to the Lloyd's List source, the equipment was stored on the bridge or on the “monkey island” (the highest place on the ship), operated by Russian, Turkish, and Indian officers, and the devices were unloaded for analysis upon arrival in Russia.
Interestingly, according to OpenSanctions—a source I use a lot for information about designated individuals, entities, and vessels—after Finland seized the tanker for damaging the Estlink 2 submarine cable, information about the Eagle S in the Uniocean Marine Services fleet mysteriously disappeared from the company's website.
An ageing, unseaworthy vessel equipped with espionage gear that enables the Russian crew to make calls to Russia and Türkiye drags its anchor along the seabed and cuts communications cables of NATO allies. And then information about it starts to disappear from the web.
This doesn’t strike me as unintentional.
Multiple Incidents
If there was one such incident, I could be persuaded—with additional evidence—that this was an accident.
Several of these incidents—both against NATO allies and more recently Taiwan—scream “SABOTAGE.”
Early this month, Taiwan’s coast guard said it had intercepted the Xing Shun 39 — a Hong Kong-owned freighter carrying the Cameroonian and Tanzanian flags — after Taiwan’s biggest telecom company, Chunghwa Telecom, alerted authorities that an international undersea cable had been damaged on Jan. 3.
A “preliminary assessment” suggested the damage might have been caused by the freighter, which “transited the area at the time of the incident,” the coast guard said.
To be sure, incidents that damage communication cables appear to be relatively common. The International Cable Protection Committee says that on average, between 150 and 200 incidents that damage underwater infrastructure occur each year, and most appear to be accidental.
However…
A string of incidents against NATO allies and Taiwan involving either Russia or its best pal China in the past couple of years? Hard to believe these were accidents.
And several European officials are also skeptical of the “accident” assessment. One European official has asserted that evidence suggests intent. In an interview with the Finnish public broadcaster YLE, Chief Inspector Risto Lohi said the National Bureau of Investigation also suspects an intentional attack, although the Bureau is still investigating.
In September 2024, CNN reported that the United States detected “increased Russian military activity” around key undersea cables.
Just last month, the bulk carrier Vezhen belonging to Bulgarian shipping company Navibulgar, was seized in the Baltic Sea by Swedish police forces, after a submarine communication cable between Latvia and Sweden was cut on 26 January. The Vezhen is suspected to have committed sabotage at the Russians’ request. Navibulgar CEO Aleksander Kalchev denied that the crew had intentionally committed sabotage, but admitted that they had noticed one of the ships anchors to be damaged on 26 January and said an “accident” could not be ruled out. The company’s position is that the incident was just force majeure.
In October 2023, the anchor of a Hong Kong–flagged, Chinese-registered vesselNewNew Polar Bear damaged two undersea data cables and a gas pipeline in the Baltic Sea.
In December 2024, two subsea communications cables connecting (1) Germany and Finland and (2) Lithuania and Sweden—the BCS East-West Interlink and C-Lion1 fibre-optic cable— were believed to have been severed by the Yi Peng 3, a Chinese cargo ship that left Russia’s Ust Luga port with a load of fertilizer. The Russian “research vessel” Admiral Vladimirsky was spotted loitering near the C-Lion 1 communications cable just this past week.
That’s a lot of “accidents.”
The Atlantic Council reminds us that Russia has been well-positioned for years to attack underwater infrastructure.
Threats to undersea cables are increasing. For example, Russia is well positioned to conduct malicious attacks on undersea cables with the help of its intelligence ship, Yantar, which was spotted loitering near cable locations in 2019 and 2021. NATO Assistant Secretary General for Intelligence and Security David Cattler expressed particular concern about Russian activity in European waters, following the 2022 invasion of Ukraine. Cattler told reporters in May 2023 that Russia could attack infrastructure such as undersea cables in an attempt to “disrupt Western life and gain leverage over those nations that are providing support to Ukraine.”
Russian Hybrid Warfare
Cutting cables is convenient and offers plausible deniability—especially to Russia, which has been purchasing old, unseaworthy vessels to transport its oil above the $60 per barrel price cap—and can claim unintentional damage. The Kremlin can also claim that the incidents were really the fault of the West, because if it wasn’t for those pesky sanctions and oil cap, Russia wouldn’t have to buy all these old ships to circumvent the restrictions.
(Yes, I rolled my eyes as I typed that.)
And underwater cable-cutting is only a part of Russia’s hybrid warfare strategy.
“Little Green Men” in Crimea in 2014? Hybrid warfare.
Possible payments to the Taliban to target coalition troops in Afghanistan? Hybrid warfare. The New York Times published the story several years ago, which interestingly was poo-pooed because there was supposedly disagreement about the strength of the evidence about the payments. Except the Insider did more research (and I’ve found their research to be stellar on other issues, such as Viktor Labin’s sanctions evasion network) and got corroboration for the NYT report.
Heck, there was even a storyline about this in the last season of Homeland! (I highly recommend the show if you haven’t seen it.)
And the GRU unit supposedly involved in the Taliban payments program is the same one that received a commendation for use of non-lethal acoustic weapons in combat activities in urban settings - Unit 29155. Havana Syndrome. The EU a few days ago sanctioned three members of Unit 29155 for their malicious cyber activities against Estonia and other partners and allies.
Cyber attacks, disinformation, and election interference? Hybrid warfare.
Given Russia’s history with these tactics, it’s not difficult to imagine that cutting underwater cables to disrupt communications could be part of Russia’s hybrid warfare strategy.
Is there undeniable evidence that Russia has been engaging in intentional sabotage of underwater communication cables?
No.
Is the evidence persuasive enough to make the assessment that it’s exactly what’s been happening, despite some officials’ claim to the contrary?
Yes, it is.
And why would some officials claim the “accident” theory?
Well, if you examine the last administration’s “escalation management” vis-a-vis Russia, the “why” becomes pretty clear.
Thank you for this excellent summation. There don’t seem to be any limits to the Kremlin’s efforts to bring chaos into the global order. Russia needs to be designated as a terrorist nation.