Sabotage as Signal: Why Attacks on Maritime Infrastructure Challenge our Model of Sense-Making

CSDS POLICY BRIEF • 7/2025

By Roderick Parkes

26.3.2025

Key issues

• Over the past two years, maritime sabotage around Europe became more targeted and overt, yet it is still treated as if it were a covert, confusing hybrid threat.
• This suggests our way of making sense of international threats may be locking us into outdated assumptions, blinding us to new signals.
• If we have misread the past two years, we may do so again – continuing to focus on Europe’s place in East-West rivalry while neglecting broader global competition.

 

Introduction

Almost instinctively, Allies classify maritime sabotage as a classic hybrid attack – covert, opportunistic, attritional. But this interpretation may be misleading. Since 2022, attacks on undersea infrastructure have become increasingly overt, targeted and even symbolic – deliberate signals from adversaries about the evolving nature of international competition. If Allies continue to view these attacks on energy pipelines and data cables through pre-2022 deterrence frameworks, they risk missing a deeper transformation: a contest for control over the infrastructure that will define the Fourth Industrial Revolution. Europeans may be fighting the right battle – but they may have misidentified the war.

Anchor bias: why alliances struggle to tear up old doctrines

Since September 2022, maritime sabotage in the Baltic has surged, with attacks on Europe’s undersea energy pipelines and data cables raising alarm. Many see this as a continuation of Russia’s hybrid warfare playbook – using covert tactics to weaken the liberal international order while avoiding direct retaliation. These acts of sabotage are perceived as just as scattered, deniable and opportunistic as Russia’s past weaponisation of migration, cyberattacks and disinformation campaigns. This perception is reinforced by a well-oiled North Atlantic Treaty Organisation (NATO)-European Union (EU) framework established in 2016 specifically to counter hybrid threats, especially those from Russia.

But does maritime sabotage still fit the 2016 model? Far from being covert, it is overt. It is not scattered but concentrated on a few critical targets, not ambiguous but brazen and seemingly symbolic. Moreover, Russia’s is no longer the only playbook involved. A wider range of players – including China, Iranian proxies, foreign vessel crews and transnational criminal networks – have been implicated in overt sabotage operations around Europe. And these actions are no longer confined to the Euro-Atlantic theatre; similar patterns are emerging in the South China Sea, suggesting that multiple actors are testing strategies across regions.

Allies’ swift response to the Estlink 2 power-cable sabotage is widely seen as a validation of the 2016 playbook: rapid detection, attribution and public shaming. Yet drawing too much reassurance from the rapid exposure of an operation likely intended to be overt and brazen could be misleading. This reinforces a familiar modus operandi, even as it risks obscuring a deeper shift in global competition. European Allies still see their actions as defending the long-standing rules-based international order, yet control over energy pipelines, digital cables and maritime chokepoints is increasingly shaping a new one.

Once international organisations converge on a shared approach, revisiting established doctrines can be diplomatically costly. And when a strategy is evidently succeeding, there is naturally little incentive to rethink it. Yet strategic sense-making demands that Allies stay alert to emerging signals. If today’s sabotage is overt, symbolic and globalised, can it still meaningfully be classified as a hybrid threat under the 2016 definition? And if Europe’s geopolitical awakening is just unfolding, how can we ensure we are accurately identifying and prioritising the most pressing threats?

This CSDS Policy Brief, first presented at the annual SHADE MED conference to NATO and EU personnel in December 2024, explores how Ukraine’s defence fits within a larger global contest for control of the “Fourth Industrial Revolution” – where energy, data, supply lines and chokepoints shape Europe’s future security – and questions whether our frameworks for understanding these dynamics are keeping pace.

Below the surface: the need to acknowledge that a new pattern has emerged

In three key ways – how they are carried out, what they target and where they happen – the recent acts of maritime sabotage break from the past.

The How – from plausible deniability to deliberate visibility: plausible deniability was a hallmark of pre-2022 hybrid threats. It apparently plays little part in this sabotage. The Eagle S tanker severed the Estlink-2 power cable by dragging its anchor across the seabed. The Yi Peng 3 bulk carrier did the same to undersea cables linking Sweden, Lithuania, Finland and Germany. These were not sophisticated cyber-physical operations but crude, physical acts – deliberately unsubtle, highly visible and seemingly indifferent to exposure.

Little effort was made to disguise intent, evade detection or obscure responsibility. Large, slow-moving commercial ships carried out these attacks in full view of maritime surveillance. Unlike classic hybrid actions, which relied on ambiguity, these incidents appear designed to be seen. Whether as geopolitical signalling or a test of Allies’ response, sabotage is no longer about secrecy – it is about demonstrating reach, impact and impunity.

The What – a shift from economic disruption to industrial power strikes: hybrid attacks once probed the weaknesses of the Western-led globalised economy – finance, information technology, electoral systems. But the focus of this sabotage is different. The targets are no longer the mechanisms of a liberal economy but the arteries of contemporary industrial power: energy and data. These repeated strikes cannot be considered incidental; they target the infrastructure that underpins Europe’s technological and economic future. And critically, the scope has narrowed.

In 2016, NATO and the EU struggled to pinpoint the most at-risk infrastructures. Confronted with threats spanning over 30 countries and up to 13 infrastructure classes, they adopted a broad “system of systems” approach, mapping cascading vulnerabilities across finance, ICT, manufacturing and R&D. But today’s sabotage is not scattergun – it is precise. These attacks no longer create diffuse uncertainty across multiple sectors. Yet despite this clear pattern, responses still treat them as unpredictable and disconnected.

The Where – from peripheral probes to the erosion of neutrality: as in 2016, peripheral Euro-Atlantic states remain prime targets – but the pattern is shifting. A decade ago, Russia’s hybrid tactics focused on Turkey, Norway, Finland and Sweden – states with strong defence policies but not fully embedded in both NATO and the EU. The goal was to test EU-NATO solidarity, probing the limits of cooperation and the autonomy of these non-members through disruptions that demanded a joint economic-military response.

Today, Baltic infrastructure is under attack, keeping Finland and Sweden on the front line. But the risk profile is shifting. Threat analyses now highlight growing risks to Ireland, Cyprus and Malta, as well as landlocked Austria. These states are neutral/non-aligned and have positioned themselves as infrastructure hubs for energy and data, leveraging their status for financial and diplomatic advantage. Once a source of security, this role now makes them vulnerable, as competition over critical infrastructure intensifies.

Europe advancing or adrift: two readings of today’s sabotage

There are two ways to read these apparent shifts:

Continuity – maritime sabotage as hybrid warfare’s next phase: the prevailing view is that these attacks are simply the latest evolution of Russia’s hybrid warfare against Europe. From the cyberattacks of 2007 to energy coercion in 2022, the Kremlin has continuously refined its unconventional tactics. Maritime sabotage – like the attempted assassinations of German businesspeople or arson attacks on Polish shopping malls – is just the latest addition to this familiar playbook. Their increasing brazenness is not a break from past tactics but a classic attempt to sow division by making Europeans feel directly implicated in the war in Ukraine.

Indeed it could be the success of the 2016 NATO-EU playbook for countering hybrid threats, which has forced adversaries into the open. The shift from exploiting broad vulnerabilities to concentrated strikes on energy and data systems suggests that NATO and the EU are managing to contain the threat. Targeting non-NATO states like Ireland and Austria may indicate that adversaries are running out of easier options, as Finland and Sweden’s NATO accession has closed previous gaps. This pattern could be a sign that deterrence is working – pushing adversaries into narrower, riskier moves.

Radical change – sabotage as a battle for global infrastructure: but what if these attacks are not just an evolution of Russian hybrid war – but a shift to something else entirely? The real contest may no longer be about preserving the old order but about controlling the foundations of the next – energy, data and maritime chokepoints. In an era where economic power is defined by who controls global supply chains, digital infrastructure and strategic waterways, attacks on undersea cables and pipelines may not be about mere disruption. They may be part of a larger struggle to shape the rules of global commerce and security.

Undersea cables, energy grids and maritime chokepoints like the Suez Canal, the Strait of Hormuz and the Panama Canal are more than trade arteries – they are the foundation of the next wave of industrialisation. Secure supply chains and access to rare earths are essential for advanced manufacturing, while energy pipelines and data cables power new industries. The focus on these targets shows that sabotage is now aimed at the infrastructure sustaining Europe’s economic power. Control over these networks is not just about continuity of business – it ties Europe into a larger, global struggle over the future order.

Global anchor or strategic backwater: are we misreading our own importance?

If this sabotage does mark a radical shift, it may not yet be fully reflected in Allied thinking, which remains shaped by the long-standing view that the Europe-Russia stand-off is the central battleground for defending the rules-based international order. From that perspective, this sabotage in the Baltic is just the latest stage of that struggle. But what if the brazenness and diversity of saboteurs in the Baltic and Red Sea are not signs of a deepening fight to preserve the old order, but of a new contest to shape the global order – one in which Europe is on the periphery?

The war in Ukraine has undoubtedly globalised, and the range of actors involved in sabotage in the Baltic has widened. This shift can be read in two ways. The obvious interpretation is that China, Iran and North Korea have intervened because Europe remains the front line in the contest between autocracy and democracy – a view that held true a year ago. But the alternative is that Europe is not the prime battleground but a backdrop, more useful as a stage for signalling in a broader global conflict than as a decisive arena. That now seems the more accurate reading.

The nature of recent sabotage may offer clues about how adversaries currently assess Europe’s strategic weight. If the defining contest of this era is the race to master the “Fourth Industrial Revolution” – through innovation, access and rule-setting – then one might expect a strategically central Europe to face more calculated and nuanced pressure. Instead, recent attacks on European infrastructure have often been blunt and performative, seemingly designed more to provoke uncertainty than to shape outcomes. This could indicate that Europe is viewed less as the centre of gravity, and more as a space for strategic experimentation.

Neutral states are set to feel this shift most acutely. During the Cold War, neutrality in a prime theatre like Europe was viable because both blocs saw strategic value in preserving it. Today, great powers no longer afford such flexibility. The “Fourth Industrial Revolution” is capital-intensive, demanding long-term infrastructure commitments. In a secondary theatre, no major power will invest in a state that masks its true allegiance. Great powers will no longer tolerate fence-sitters – even if that means pushing them into the rival camp. This marks the end of non-alignment and the rise of “presumed allegiance”.

As Allies focused their resources on high-profile sabotage in the Baltic, China has been positioning itself for long-term advantage elsewhere. It would be overstating the case to suggest that Beijing is using the seas around Europe as a deliberate strategic distraction from broader global politics. Still, in a time of flux, such questions are bound to surface among Allies, particularly among those with a significant stake in the Pacific. And if the recent wave of sabotage is not evidence of Europe’s centrality to global affairs, it becomes all the more urgent to identify emerging patterns and underlying motives with speed and precision.

Island Fortress: could our operational response cut Europe off?

An inaccurate diagnosis risks blunting the impact of our response. There is a risk that well-established deterrence policies may inadvertently limit Allies’ ability to engage in emerging arenas of global competition.

The 2016 framework relied on deterrence in two forms: denial, which strengthens infrastructure to make opportunistic attacks too costly, and punishment, which ensures swift attribution and proportionate retaliation. Against early scepticism, both are deemed increasingly effective. Sabotage attempts are being forced into the open, and attacks have been pushed to the geographical fringes of Europe, such as the Red Sea. By its original benchmark – proving that hybrid threats could be deterred – this strategy has apparently succeeded. But if the goal is positioning Europe for the “Fourth Industrial Revolution”, success is far less clear.

Deterrence by denial assumes all partners can afford to harden shared infrastructure, yet not all Europe’s neighbours in North Africa can. With French and Italian energy firms developing projects in Libya and Tunisia, Europe is expanding its links across the Mediterranean. The challenge is not just securing infrastructure but expanding and integrating it to keep supply chains open, diverse and resilient. Yet Europe’s push for costly sensors and redundancies in pipelines and cables risks cutting off the “Global South” just as it becomes vital for industrial competition. Building Europe’s resilience risks disconnecting it.

Deterrence by punishment does little to win over new stakeholders. Industrial revolutions are capital-intensive and disruptive, concentrating power among a few while leaving many excluded. In the Levant and North Africa, the top 1% of earners already control around 23% of income, while the bottom 50% receive just 12%. With youth unemployment hovering around 30%, frustration is mounting, making violence and sabotage against foreign interests and infrastructure increasingly likely. Punishing disenfranchised groups risks reinforcing exclusion rather than demonstrating that Europe can adapt the rules-based order to include its neighbours.

There is a risk that this deterrence approach, while effective in defending infrastructure, could limit Europe’s ability to build strategic connectivity with emerging partners. It is right that Allies should focus on defence, but they must be aware that others are shaping the future by creating new infrastructure. China, often seen as risk-averse, may in fact be best positioned to benefit from the destruction of existing infrastructure. Through Belt and Road investments and rapid infrastructure diversification, it is not just adapting to disruption but using it to bypass Western security structures and reshape global integration on its own terms.

Signals in the fog: what message should Europe take from this?

With sabotage now overt and even predictable, Europe must ask whether its key vulnerability lies not only in its sprawling infrastructure, but also in how it interprets evolving strategic signals. Large organisations, once they adopt a threat model, are sometimes slow to reassess it. This might lead to a rigid framing of sabotage as chaotic and unreadable – certainly not as something that could convey clear signals or intent. As a result, Europe may have underestimated the extent to which recent sabotage carries deliberate strategic messaging. Consider this:

We may have entered a strategic dialogue without realising it. These acts of sabotage are neither covert nor ambiguous; they may even be deliberate signals – calculated responses to European actions. For instance: when Europeans lay claim to the Baltic as a “NATO lake” while rightly condemning China’s claims over its own maritime sphere, they invite a response. A Chinese vessel dragging an anchor across the Baltic may not be opportunistic aggression but a direct reply to European naval manoeuvres in the Taiwan Strait – a message that China, too, deserves its exclusive sphere of influence.

We may be drawing the wrong message. Europeans have framed these attacks as a wake-up call to reduce energy and supply chain dependencies on non-European countries. The real lesson is that Europe must build new partnerships. Pipelines between Tunisia and Sicily highlight its growing reliance on southern neighbours, while Germany’s shift from Russian hydrocarbons has deepened its dependence on Mediterranean energy. Meanwhile, security concerns stall wind farms in the Baltic. Europe must turn these infrastructural ties into sources of positive influence rather than vulnerabilities.

We risk mistaking acceleration for crisis. Shielded within its protective bubble, Europe is still adjusting to a world shaped by accelerating technological change and a new wave of industrialisation – one of extreme inequality and fierce competition for resources and access. Yet in North Africa and the Middle East, European businesses already find themselves relying on private militias and security contractors to safeguard infrastructure, exposing a failure to build local buy-in. If Allies continue to rely on deterrence alone for such infrastructure, they may soon find themselves engaging in ever more crisis management.

We have yet to fully engage the regions that will help define our future. Holding the line against Russian aggression is necessary but insufficient. The global contest is no longer just about the defence of Ukraine – vital as this is. It is about shaping the next world order. While Europe is right to focus on building up its capability for deterrence, it neglects the need to integrate those disenfranchised by the old system. Allies’ security framework could usefully expand beyond defence and deterrence, let alone crisis management, to cooperative security – to shared infrastructure with the “Global South”.

For all the recent shifts in Europe’s security thinking, one assumption remains unchanged – that geopolitics is still defined in East-West terms. Despite growing focus on resilience, autonomy and great power competition, Europe’s southern partnerships often remain under-prioritised in strategic thinking. The real contest ahead is not just about deterrence – it is about who integrates whom into the next global order. While China invests in infrastructure and supply chains, Europe may become trapped in a defensive mind-set, securing what it has rather than expanding its influence. If it treats large parts of the world as peripheral, it may soon find itself peripheral to the global balance of power.

__________