Hybrid Threats against Finland: Cable Damage in the Baltic Sea
The Christmas Day 2024 damage to a Finnish-Estonian electricity cable by a vessel of the Russian shadow fleet has further alarmed Europe about the vulnerability of its critical subsea infrastructure. In response, the NATO Summit of Baltic Sea Allies in January 2025 announced a new mission to counter destabilizing sabotage acts. Shortly after, the European Parliament debated on how to counter subsea sabotage by the Russian shadow fleet. For Finland, the recent cable damage adds to a growing list of sabotage acts against subsea cables, most notably the Balticonnector pipeline in 2023, bringing hybrid threats to the forefront of the political agenda. Finnish citizens are similarly alerted: The Ministry of Interior’s recent Preparing for Crises Guide has reached half a million people within a short time. Civil preparedness and psychological resilience form the backbones of Finland’s comprehensive security concept.
This report discusses the phenomenon of hybrid threats by the example of the recent series of Baltic Sea cable cuts. Finland’s Christmas Day 2024 cable damage by a vessel of the Russian shadow fleet serves as a case study. Then, the report outlines Finland’s comprehensive security approach to counter hybrid threats and singles out best practises that can serve as inspiration for Germany and other European countries.
Characteristics of Hybrid Threats
The concept of hybrid threats lacks a clear-cut definition and is closely related to hybrid warfare or hybrid operations, which creates conceptual confusion. The European Commission defines hybrid threats as a “wide range of methods or activities used by a hostile state or non-state actors in a coordinated manner in order to target the vulnerabilities of democratic states and institutions, while remaining below the threshold of formally declared warfare”. Since the 2014 Russian invasion of Eastern Ukraine, NATO, the EU and Western states have acknowledged the danger of hybrid threats. Hybrid threats have intensified over the past decade and are expected to grow even more frequent and impactful. Studying hybrid operations has proven complex since activities generally aim to be unattributable to a political actor to ensure plausible deniability. Hybrid threats aim to exploit and intensify the target’s existing vulnerabilities and are carried out in the middle between war and peace. Hence, hybrid actors do not risk triggering NATO’s collective defence, Article 5. This makes it difficult for targeted countries, to apply justified countermeasures.
Baltic Sea Subsea Cables as Targets
Finland and the whole of Europe is highly dependent on its undersea cables. Since the Russian invasion of Ukraine, a series of cable damages in the Baltic Sea have raised concern about the security of such critical infrastructure. Recent NATO reports warn about increased suspicious Russian activity around these cables, particularly the mapping of the exact cable routes in the Baltic Sea. Subsea cables are prime targets for hybrid threats by hostile actors, because they are inherently vulnerable in the grey zone of international waters. For one, most undersea infrastructure is privately owned and runs through the authorities of several countries, which complicates legal protection. Second, their location is publicly known and constant (military) protection of cables is highly resource intensive. Incidents such as the 2022 Nord Stream explosion and the damage to the Balticconnector gas pipeline demonstrate how susceptible Europe’s subsea infrastructure is to sabotage acts. Following the damage to an undersea data cable between Finland and Germany in November 2024, their foreign ministers warned that European security is not only under threat from Russia’s war of aggression against Ukraine, but also from hybrid warfare.
The Russian Shadow Fleet as a Hybrid Aggressor
On Christmas Day 2024, an electricity cable connecting Finland and Estonia was damaged. In a swift action, the Finnish Coast Guard seized the oil tanker Eagle S sailing under a Cook Islands flag and suspectedly part of Russia’s 'shadow fleet'. After the illegal invasion of Ukraine, the EU and its allies imposed strict sanctions on the Russian oil sector, a major source of revenue for the Kremlin’s war effort.
To evade the embargo on its seaborne oil and an oil price cap, Russia established a shadow fleet, which sails under flags of convenience and dubious ownership to conceal its transport of sanctioned oil. Vessels are mostly old and poorly maintained, posing environmental risks such as oil spill. Moreover, illegal practices like transmission of false location data compromise maritime safety. The Baltic Sea forms a central gateway for Russia’s illegal oil exports: For April 2024, the KSE Institute estimated that 82 % of oil exports were transported through the Baltic, mostly by shadow fleet vessels.
Besides financing Russia’s war, shadow fleet vessels can act as hybrid aggressors, as the latest Finnish cable case demonstrates. The Swedish Navy also suspects tanks to collect intelligence. Hence, a meeting of the Council of the Baltic Sea States in June 2024 focused on Russia's hybrid threats in the Baltic Sea. The Finnish Christmas Day cable damage stands out as a prime example of resolute action against hybrid threats: the swift seizure of the suspicious vessel allowed for an investigation showing that ship’s dragging anchor caused the damage. Current International law protecting subsea infrastructure is not suited to account for hybrid threats. Following the latest Finnish incident, the EU searches for legal means to seize shadow fleet vessels in the Baltic Sea, without risking further escalation with Russia.
Countering Hybrid Threats: Finland’s Comprehensive Security Approach
NATO's decentralized approach to addressing hybrid threats places the responsibility for responding to these acts on the affected country, which renders resilience a vital national security issue. The Helsinki-based Hybrid Threats Centre of Excellence defines resilience as the “ability of society to resist, absorb and recover from the negative effects of threats and emergencies”. Hybrid threats circumvent conventional methods and institutions for responding to security threats, calling for effective cross-sectoral coordination.
Finland and the Nordic countries have ample experience with ‘whole-of-society’ approaches to resilience and security. During the tense Cold War environment, their security models engaged broad parts of society to maintain vital functions of the state during (military) crisis, building on their strong social cohesion and trust in the government. Finland, but also Norway and Sweden embraced the concept of total defence, which combines military capacities with civil society and private sector resources. In contrast to the other Nordic countries, Finland kept the key aspects of its total defence approach after the Cold War, including territorial defence, male conscription, and joint military-civilian planning. Hence, Finland is internationally recognised a role model for a whole-of-society approach to hybrid threats.
In 2017, Finland formulated its Comprehensive Security strategy protecting vital state functions against various threats, including cyberattacks and natural disasters. This ‘all-hazards’ approach jointly engages government actors, the private sector, civil society and citizens. Those institutions cooperate by sharing and assessing information, joint planning and educational trainings for national defence. Psychological resilience of citizens and households’ preparedness are also vital pillars of Finnish societal resilience.
Key elements of the comprehensive security approach are the security of supply and media literacy. Besides having critical goods in stock, the security of supply strategy builds upon the strong public private partnership to ensure the resilience of critical services and infrastructure. It encompasses various critical sectors and is mostly based on voluntary private sector participation. Media literacy efforts are another key area of public-private cooperation. Finland ranks first on the European media literacy index, measuring the resilience to disinformation. This is critical because hybrid threats are designed to create informational uncertainty to sow fear and confusion.
Take-aways for Germany and European Democracies
Hybrid threats require fertile soil to be effective. Their decade long experience with Russian threats has led Finland and the Nordic countries to develop effective strategies for resilience against these hostile acts. Despite the distinct societal features that shape Nordic resilience concepts, Germany and other European democracies can draw inspiration from Finnish and Nordic best practices. Finland’s recent legal reforms specifically target hybrid threats, for example Russian acquisitions of real estate in strategic locations or foreign investments in critical infrastructure. The Christmas Day incident illustrates the effective collaboration between government actors in grey zone scenarios: Soon after grid operator Fingrid reported the transmission outage and pointed to possible sabotage, the Finnish Coast Guard seized the suspicious vessel. While hybrid threats against Germany have increased since Russia's invasion of Ukraine, most notably the Nord Stream pipeline damage, they have not attracted the same political attention as in the Nordics. Thus, Germany can benefit from Finnish best practices when reconsidering its civil defence approach.
