• NATO pit elite divers against new sensors to protect undersea cables from sabotage.
• Foreign adversaries have increasingly targeted undersea cables and underwater infrastructure.
• The training marks another shift in how NATO countries are preparing for future warfare.

NATO sent special operations divers to test new systems designed to help shield critical underwater infrastructure from damage and sabotage, growing problems.

Underwater cables and pipelines providing internet connectivity and energy have been damaged in a string of alarming incidents in recent years, with accusations of sabotage being thrown around about several just in the past couple of months.

These incidents highlight the vulnerability of these lines, but the NATO alliance is looking for answers.

Last fall, elite special operations divers from within the NATO alliance practiced bypassing underwater electronic detection sensors as part of an effort to boost protection for critical underwater infrastructure. NATO shared footage this week of the November training event — Exercise Bold Machina 2024 in La Spezia, Italy — as well as commentary from leadership.

The 13-nation event was the first of its kind, said US Navy Capt. Kurt Muhler, the maritime development director at the NATO Special Operations Headquarters, and was designed to test new sensors that could be used to defend against underwater sabotage attempts. This exercise, which Defense News first reported on, also tested allied special operations divers and their abilities to operate in increasingly transparent battlespaces.

Divers on offensive operations may not always be able to rely on dark, opaque waters to conceal their movements, Muhler, who has held SEAL team leadership positions, said, citing increased advancements in underwater detection system technologies.

"It's not knowing if somebody knows, or if you're being detected," Muhler told Defense News last fall. "It is understanding that there is a system that has the capability to detect you, but that you know nothing about it and don't know exactly what the capability is."

Undersea cables, pipelines, and other critical underwater infrastructure are at risk

The joint exercise in Italy came as damage to critical underwater infrastructure has become increasingly worrisome to Western officials who are scrambling to deter more damage to cables from vessels often quietly linked to Russian and Chinese governments.

Several underwater cables have been damaged in the past two months, including one telecommunications line linking Finland and Germany and another connecting Finland and Estonia.

Finnish officials said that they found a 60-mile seabed trail suggesting a tanker linked to Russia might be responsible for cutting cables. And around the same time, cables linking Germany and Finland and Sweden and Estonia were damaged with a Chinese vessel detected nearby when the damage occurred.

Such damage has spurred British defense officials to create a new joint operation with 10 European countries throughout the Baltic Sea area, using artificial intelligence to monitor potential threats from ships.

Undersea cables are critical components of international telecommunication infrastructure and the global economy — around 745,000 miles of cables span global seabeds and help transmit 95% of international data, including around $10 trillion in financial transactions daily.

NATO officials highlighted growing threats to cables from Russia last year, noting surveillance activity from Russian units specializing in undersea sabotage. But the barrier to entry for sabotage isn't particularly high. Russia has submarine units known to specialize in underwater sabotage, but cables have also been damaged by commercial vessels simply dragging their anchors along the sea floor.

And the concerns about the risk of underwater cable and infrastructure damage are not limited to European waters. Damage just last week to cables off the coast of Taiwan left that island's officials suspecting intentional damage from China.

"The underwater domain is hard both to protect and hard to attack," said Alberto Tremori, a NATO Centre for Maritime Research and Experimentation scientist who helped oversee the November NATO exercise. "It's not easy to protect because it's a complex environment, it's a vast environment."

• Undersea cables between Finland-Germany and Lithuania-Sweden were cut, potentially sabotaged.
• The incident is one of a number of similar incidents in recent years, highlighting the vulnerability of these lines.
• NATO is enhancing surveillance and coordination to protect critical underwater infrastructure.

Last month, an underwater data cable between Finland and Germany and another between Lithuania and Sweden were discovered cut within a day of each other. The damage to the cables, which European officials said appeared deliberate, highlights just how vulnerable these critical undersea lines are.

Yi Peng 3, a Chinese-flagged cargo ship that had departed from Russia's Ust-Luga port in the Gulf of Finland three days before and was tracked loitering near the two locations, is suspected in connection with the incident. It is said to have dragged an anchor over 100 miles, damaging the cables.

"No one believes that these cables were accidentally cut," German Defense Minister Boris Pistorius said in November. "We have to assume it is sabotage," he added.

In a joint statement with his Finnish counterpart, Pistorius said the damage comes at a time when "our European security is not only under threat from Russia's war of aggression against Ukraine but also from hybrid warfare by malicious actors."

As Russia received added scrutiny, Kremlin spokesman Dmitry Peskov denied Russian involvement in the incident, saying that "it is quite absurd to continue to blame Russia for everything without any reason."

Critical but vulnerable

In recent years, a string of incidents involving damage to underwater infrastructure has occurred, many of them in the same region.

Last year, Newnew Polar Bear, another Chinese cargo ship, damaged a gas pipeline running between Estonia and Finland. China's investigation concluded the damage was accidental; however, Estonia and Finland's investigation is still ongoing.

In 2022, a Norwegian underwater data cable was damaged, and there were indications of human involvement in that incident. In 2021, a 2.5-mile-long section of another data cable disappeared from waters north of Norway.

The incident that received the most attention, though, was the sabotage of the Nord Steam gas pipelines between Russia and Germany in September 2022. There have been indications that Ukrainian elements might have been behind the sabotage, but this has not been confirmed.

Underwater infrastructure is increasingly critical to modern life. The vast majority of internet traffic passes through underwater fiber-optics cables, and underwater energy pipelines are common in many regions. But protecting this infrastructure, which can stretch for hundreds or thousands of miles, is difficult.

"There's no way that we can have NATO presence alone all these thousands of kilometers of undersea, offshore infrastructure," then-NATO leader Jens Stoltenberg said in 2023. Yet, NATO can be better at collecting and sharing information and intelligence "and connecting the dots," he added.

Indeed, NATO and the European Union are trying to do that.

In May this year, NATO held its first Critical Undersea Infrastructure Network meeting and launched its Maritime Centre for the Security of Critical Undersea Infrastructure to better coordinate the capabilities of its members and increase collaboration between them.

Further, the EU is funding several initiatives to develop uncrewed surface and underwater systems to surveil critical areas and detect threats early.

But there are also legal difficulties to protecting underwater infrastructure, as it usually traverses the territorial waters of several countries and can also pass through international waters.

The usual suspects

Although it can often be difficult to establish a culprit whenever such infrastructure is damaged, officials have pointed out that Russian activity near underwater cables has intensified.

In 2017, the US admiral in charge of NATO's submarine forces said the alliance was "seeing Russian underwater activity in the vicinity of undersea cables that I don't believe we have ever seen."

The war in Ukraine has added another dimension to this matter.

"There are heightened concerns that Russia may target undersea cables and other critical infrastructure in an effort to disrupt Western life, to gain leverage against those nations that are providing security to Ukraine," David Cattler, NATO's intelligence chief, said last year.

Russia has developed a number of underwater capabilities and has a specialized unit, the Main Directorate for Deep Sea Research, committed to the task.

GUGI, as the operation is also known, is an elite Russian unit that employs specialized surface and underwater vessels capable of underwater sabotage and surveillance. Yantar, one of GUGI's special-purpose spy vessels, which nominally acts as a survey vessel, has often been spotted near underwater cables.

Furthermore, a joint investigation released in 2023 by the public broadcasters of Sweden, Denmark, Norway, and Finland discovered that Russia, over the past decade, employed a fleet of 50 boats — masking as research or commercial vessels — to gather intelligence on allied underwater cables and wind farms in the Nordic region.

"When you look at the evidence of their activities now, the places they are doing surveys, overlaid with this critical undersea infrastructure … you can see that they are at least signaling that they have the intent and the capability to take action in this domain if they choose," Cattler said.

• A Chinese cargo ship is under investigation related to severed data cables in the Baltic Sea.
• A probe found that the vessel steamed ahead while dragging its anchor for over 100 miles.
• Western officials believe Russia likely orchestrated the attack on EU maritime infrastructure.

Two key undersea data cables in the Baltic Sea were severed earlier this month, prompting an investigation into a Chinese cargo ship for suspected sabotage.

European authorities said the Chinese-flagged bulk carrier, identified as Yi Peng 3, dragged its anchor over the Baltic seabed for over 100 miles, cutting the critical internet cables that link four NATO countries.

A timeline of events

On November 15, Yi Peng 3 departed from Russia's Ust-Luga port on the Baltic Sea carrying Russian fertilizer.

The Ust-Luga port is the largest universal port on the Baltic Sea and the Kremlin's second-largest port after Novorossiysk on the Black Sea. Since Sweden and Finland joined the alliance, the Baltic Sea has been referred to as "NATO lake" because it is almost entirely populated by alliance members.

Two days later, investigators established that the Chinese vessel dropped its anchor around 9 p.m. local time, The Wall Street Journal reported Wednesday. However, the ship continued steaming with its anchor dropped and is believed to have severed an undersea telecoms cable connecting Sweden and Lithuania, per The Journal.

Investigators said Yi Peng 3 continued to sail for another 111 miles with its dragging anchor, which then cut the only communications cable connecting Finland with Germany less than twenty-four hours later.

It was only then that investigators said the vessel raised anchor and continued its route.

It's highly unusual for any vessel to drag its anchor for this long due to the dangers and fuel waste, an impediment that cannot go unnoticed by the ship's watch-standers. A crew typically recovers the anchor, or in the worst case, jettisons it, before steaming ahead.

The Chinese bulk carrier is now anchored in the Kattegat Strait and is being monitored by Danish naval patrol vessels as European authorities continue to investigate the potential sabotage.

Concerns of potential sabotage

Investigators said Yi Peng 3's movements couldn't be charted after it went "dark," meaning that the ship's transponder was shut down or disabled, thus obscuring its position.

Open-source satellite imagery, however, reportedly placed the Chinese ship near the damaged cables at the time of the respective incidents.

An investigator on the case told The Journal that it's "extremely unlikely" that the ship's captain wouldn't have noticed the vessel's dragging anchor.

"It's extremely unlikely that the captain would not have noticed that his ship dropped and dragged its anchor, losing speed for hours and cutting cables on the way," the investigator said.

An analysis by Kpler, a global trade analytics firm, provided to The Journal found that "given the mild weather conditions and manageable wave heights, the likelihood of accidental anchor dragging appears minimal."

Germany's Defense Minister Boris Pistorius said he believed the incident was a result of potential sabotage, telling reporters last week that "nobody believes that these cables were accidentally severed."

"We have to know that, without knowing specifically who it came from, that it is a hybrid action, and we also have to assume that, without knowing by whom yet, that this is sabotage," Pistorius said.

Russia accused of waging 'hybrid warfare'

Yi Peng 3's origin of departure raised concerns over potential Russian involvement in the incident, possibly in connection to the war in Ukraine.

Though the Chinese vessel and associated parties are under investigation over damaged cables, Western officials believe that Russian intelligence agencies orchestrated the incident.

Kremlin spokesman Dmitry Peskov denied Russian involvement, calling the accusations "absurd."

"It's quite absurd to keep blaming Russia for everything without any grounds. It is laughable in the context of the lack of any reaction to Ukraine's sabotage activities in the Baltic Sea," Peskov told reporters on November 20.

Foreign ministers of Finland and Germany released a joint statement on November 18, saying they were "deeply concerned" about the incident, which "immediately raises suspicions of intentional damage [and] speaks volumes about the volatility of our times.

"Our European security is not only under threat from Russia's war of aggression against Ukraine but also from hybrid warfare by malicious actors," the ministers said in the statement. "Safeguarding our shared critical infrastructure is vital to our security and the resilience of our societies."

The incident in the Baltic Sea comes just weeks after US officials warned that Russia would likely target undersea cables and other critical maritime infrastructure.

"We are concerned about heightened Russian naval activity worldwide and that Russia's decision calculus for damaging US and allied undersea critical infrastructure may be changing," a US official told CNN in September.

The official added that "Russia is continuing to develop naval capabilities for undersea sabotage" through its dedicated military unit known as the General Staff Main Directorate for Deep Sea Research, or GUGI.

China complying with the investigation

Denmark's foreign ministry said in a statement earlier this week that investigators were engaged in ongoing "diplomatic dialogue" with the countries "most involved in handling this case, including China."

A Chinese foreign ministry spokesperson confirmed the talks in a statement last Friday, saying Beijing "is currently working with relevant parties, including Denmark, to maintain smooth communication through diplomatic channels."

Chinese company Ningbo Yipeng Shipping, which owns Yi Peng 3, is also cooperating with the probe and allowed the vessel to be stopped while Swedish and German authorities negotiate access to the ship and its crew, The Journal reported.

The vessel's crew, which also includes a Russian sailor, has yet to be questioned due to restrictions under international maritime law.