NATO States Blame Russia for Sabotage in Europe After Data Cables Cut

A group of European nations have issued a strongly worded statement on ‘systemic attacks’ by the Russian Federation as part of their campaign of ‘hybrid warfare’ against supporters of Ukraine’s defence.

Fibre-optic cables connecting Finland, Germany, Lithuania, and Sweden were cut by a Chinese-flagged cargo ship dragging its anchor in the Baltic sea earlier this week, disrupting internet connectivity in northern Europe. While this and a catalogue of other rare incidents in recent months could generally individually occur as accidents, the intensity of such events in recent months amid a deepening backdrop of Russian-European tensions over the Ukraine war leaves NATO capitals making accusations of sabotage.

Yet as expressed by German defence minister Boris Pistorius, making absolutely concrete assertions can be difficult in an environment where little can be quickly proven. He said: “No one believes that the cables were accidentally damaged. I also don’t want to believe that the ships’ anchors caused the damage by accident… We have to assume, without certain information, that the damage is caused by sabotage”.

On Tuesday night, the Foreign Ministers of Germany, France, Poland, Italy, Spain and the United Kingdom made a joint declaration condemning Russia’s war in Ukraine as a whole. But the group more specifically also called out its ‘hybrid warfare’ moves against Europe, a catch-all term much in currency now to describe everything from traditional espionage and sabotage to psychological warfare, to unconventional weapons like directed mass migration.

The joint declaration stated “Russia is systematically attacking European security architecture” while saying Moscow’s hybrid escalation is “unprecedented in their variety and scale, creating significant security risks.” These remarks followed another joint declaration on Monday from Finland and Germany, two of the nations impacted by the alleged cable-cutting, who said they were “deeply concerned” and that an investigation was underway.

The two nations stated: “The fact that such an incident immediately raises suspicions of intentional damage speaks volumes about the volatility of our times… Our European security is not only under threat from Russia‘s war of aggression against Ukraine, but also from hybrid warfare by malicious actors.”

On Sunday morning, a fibre optic cable operated by Swedish telecom company Telia Lietuva was damaged, reducing the available bandwith for internet traffic between Lithuania and Germany by one-third. Andrius Šemeškevičius, Telia Lietuva’s chief technology officer, told Lithuanian broadcaster LRT: “The cable was cut on Sunday morning, at around 10:00. The systems immediately reported that we had lost the connection. Further investigation and clarification took place, and it turned out that it was damaged”.

The following morning, a separate cable in the Baltic, Cinia telecom’s C-Lion1 was reported cut. Cinia said data traffic could be routed by other cables across and around the Baltic, but this would vary between different internet service providers. Underlining how long it can take to repair such fragile infrastructure as underwater cables, Cinia said maintenance ship the Cable Vigilance won’t depart France until Thursday and the repair won’t be complete until the end of the month.

British maritime-focus news blog Navy Lookout states Chinese-flagged bulk ship MV Yi Peng 3, which has been accused of dragging her anchors while underway to cut the cables, has been intercepted by the Danish navy. Publicly available ship tracking data shows, at time of publication, the Yi Peng at anchor in the Kattegat strait off Jutland lying directly alongside a Royal Danish Navy patrol boat.

Western intelligence agencies have warned that while Russia’s intelligence agencies and non-state actors have focussed on cyber attacks in the past, as relations decay they have shifted to “physical attacks”, and have been grooming cells to launch them. British spy chief Anne Keast-Butler said in May said she was becoming concerned about “suspected physical surveillance and sabotage operations… co-ordinating physical attacks against the West”.

Recent alleged Russian sabotage has ranged from arson to attempted poisonings of NATO bases. As reported then:

There were several such incidents across the continent in April, including the arrest of a Polish national in his home country, accused of conducting hostile reconnaissance against the airport used by Ukrainian President Volodymyr Zelensky when he flies abroad.

Because Ukraine is covered by a no-fly zone, when politicians enter and leave the country they travel first by VIP train across the Polish border and then to Rzeszów-Jasionka Airport, where flights can then take them worldwide. The Polish Prosecutor said of the allegations against the man: “The findings of the investigation show that the suspect’s tasks included collecting information that would be helpful in planning a possible assassination attempt on the life of the President of Ukraine by the Russian services… the detainee was charged with reporting readiness to act for foreign intelligence against the Republic of Poland… The act is punishable by up to 8 years in prison.”

In the same month two German-Russian dual citizens were arrested in Germany over alleged hostile reconnaissance of a U.S. Army base in Bavaria used to train Ukrainian soldiers. The pair were said to be planning to “commit explosives and arson attacks, especially on military infrastructure and industrial sites in Germany”. One of the suspects in the case, Dieter S., was accused of: “conspiring to cause an explosive explosion and arson, acting as an agent for sabotage purposes… membership in a foreign terrorist organization and preparing a serious act of violence that endangers the state.”

Again in April five people in the United Kingdom were facing charges over an arson attack that burnt out a Ukrainian-owned business in London. At least one of the group was charged with hostile activity intended to “assist a foreign intelligence service carrying out activities in the UK”. In February of this year Estonia arrested ten alleged saboteurs, who were accused of working to spread fear as part of a “hybrid operation”, the neologism now in currency for war by other means.

A remarkable case in December 2023 saw 14 ‘spies’, who among their number were Ukrainian refugees, sentenced by a court for a plot to gather information and launch a variety of actions and attacks. The court heard how the group were in communication with Russian intelligence and had been promised payments in cryptocurrency payments in return for their work.

The bounties on offer from Moscow were said to have included $5 for putting up a poster disseminating pro-Russian or anti-Ukrainian propaganda, or $400 for installing a wireless surveillance camera watching a port, airport, or railyard where military equipment transited from Europe to Ukraine. $10,000 in crypto was apparently offered in return for derailing a military train carrying equipment to Ukraine.

While derailing a train may seem fanciful, such tactics are already in widespread use in the Ukraine war itself and beyond, with pro-Kyiv saboteurs working overtime behind Russian lines to prevent ammunition and resupply trains reaching the front line, frequently blowing lines, burning equipment, and derailing trains. In some cases the Ukrainian partisans have gone further, planting car bombs on the personal vehicles of targets within Russia.