On December 25, the oil tanker Eagle S severed a power cable along with several telecommunications cables connecting Finland and Estonia. This incident follows a series of suspected sabotage operations in recent months involving commercial shipping vessels linked to Russia and China dragging their anchors to sever cables and pipelines in the Baltic Sea.

The European seabed hosts extensive subsea infrastructure, categorized into telecommunications cables, oil and gas pipelines, and electricity cables. These assets are vital for sustaining European societies and economies. Despite advances in satellite communications, submarine cables still carry more than 97 percent of the world’s telecommunications. They also support financial markets, facilitating over $10 trillion in daily financial transactions every day. Pipelines in the North Sea transport oil and gas from offshore fields to shore, while those in the Baltic Sea connect the Baltic States to Nordic countries, reducing dependence on Russia. Additionally, subsea electricity cables are increasingly critical as Europe integrates its electricity market and transitions to renewable energy systems.

The Eagle S is part of Russia’s so-called “shadow fleet”—a network of vessels assembled to circumvent the G7 price cap on Russian oil exports. These ships operate under complex ownership structures, fly flags of convenience, lack Western insurance and frequently disable tracking systems to conceal their movements. Since sanctions were imposed on Russia in 2022, the shadow fleet has expanded rapidly, now reportedly comprising over 1,000 ships—approximately 17 percent of the global tanker fleet. While its primary purpose is to sustain Russian oil exports, vessels in this fleet are increasingly suspected of interfering with subsea infrastructure.

Using the shadow fleet for sabotage provides Russia with several advantages, the most significant being deniability. The fleet’s opaque ownership, management, and flagging arrangements make it difficult to trace control of a vessel back to Russia. For instance, the Eagle S is operated by a company based in the United Arab Emirates, managed by an Indian firm, and registered under the Cook Islands flag. This complexity allows Russia to claim ignorance, as evidenced by its assertion that Finland’s seizure of the Eagle S was not its responsibility.

The fleet’s size effectively extends Russia’s naval and intelligence capabilities. While these vessels lack conventional warfighting functions, they are well-suited for grey-zone tactics and hybrid threats. Operating under the guise of commercial activities and protected by international maritime law, shadow fleet vessels can navigate international waters largely unnoticed. Unlike Russian naval or research ships, which are closely monitored, commercial vessels are harder to track.

Recruiting shadow fleet vessels for sabotage is relatively simple, as they are already under some form of Russian state control. Convincing a crew to drag an anchor and damage subsea infrastructure requires minimal effort. Furthermore, these actions have psychological implications. Although only a few ships are currently suspected of sabotage, the entire fleet becomes tainted with suspicion. This implicit threat—Russia’s ability to order widespread sabotage—amplifies the fleet’s strategic impact.

Beyond outright sabotage, shadow fleet vessels engage in other activities. The Eagle S, for example, may have carried signals intelligence (SIGINT) systems, according to a Lloyd’s List report. Previously, it deployed “sensor-type devices” in the English Channel, further underscoring the fleet’s hybrid capabilities.

NATO, the EU, and their member states are grappling with these challenges. At the NATO level, the Critical Undersea Infrastructure Coordination Cell in Brussels fosters coordination between military and civilian stakeholders. At the same time, the UK-based Maritime Centre for Security of Critical Undersea Infrastructure aids NATO decision-making. The EU has initiated several civilian coordination efforts, including the Submarine Cable Infrastructure Informal Expert Group, tasked with developing a Cable Security Toolbox to mitigate risks and vulnerabilities. Multilateral initiatives have also emerged, such as the North Sea countries’ collaboration to protect subsea infrastructure, followed by a similar effort among the Baltic States. On the military front, the Joint Expeditionary Force (JEF) activated a response option in November 2023 to deploy maritime and air capabilities in the North Sea and Baltic Sea. In January 2025, JEF launched “Nordic Warden,” a UK-led AI system to assess risks posed by vessels in high-threat areas.

Sanctioning vessels is part of the solution to the shadow fleet threat, but its effectiveness is limited. Sanctions require accurate identification of shadow fleet vessels, and the fleet’s complexity hinders comprehensive mapping. For instance, the UK recently sanctioned twenty vessels, a small fraction of the over 1,000-strong fleet. The Eagle S, implicated in the Finland-Estonia incident, was not on the EU’s list of seventy-nine sanctioned ships.

Enhanced naval protection also forms part of the response, but it is resource-intensive and cannot guarantee complete security. Monitoring suspicious vessels is crucial for removing Russia’s plausible deniability. Yet proactively guarding all subsea infrastructure is impractical. Coast guard and naval resources are already stretched, and diverting them from other essential tasks could benefit adversaries like Russia. Additionally, cable sabotage can occur within minutes, leaving little time to react in vast maritime spaces.

A more promising approach involves targeting the vessel and its crew. Damaging subsea infrastructure requires active decisions by the crew, and investigations can determine whether negligence or intent was involved. Proactively detaining suspicious vessels and crews, combined with clear deterrence measures, may discourage sabotage. Recent incidents demonstrate this strategy: Finnish special forces boarded the Eagle S, steered it to Finnish waters, and detained its crew. A few days later, Finland refused to give the ship permission to operate after a technical inspection found major safety issues. The Swedish Navy recovered the Eagle S’s anchor using the submarine rescue ship HMS Belos.

While a robust approach to seizing and detaining ships could deter further sabotage, it carries risks. Shadow fleet operations exist in legal grey zones, making arrests and seizures legally complex. Western nations must uphold maritime law to maintain international credibility, and questionable actions could undermine this principle. Retaliation from adversarial nations, including the seizure of legitimate vessels on false pretenses, could disrupt international trade, which is vital to Western economies.

Addressing the shadow fleet threat requires a multifaceted strategy, balancing sanctions, naval protection, and direct deterrence while upholding international law. Without such measures, the risk to Europe’s critical subsea infrastructure will continue to grow.

Henri van Soest is a Senior Analyst at RAND Europe and a Professor of Policy Analysis at the RAND School of Public Policy.

Image: Alexey Bakherev / Shutterstock.com.