The Balticconnector Incident: Hybrid Attacks and Critical Infrastructure Protection

Geopolitical Dimensions and Energy Diversification
As long as Finland was a neutral country, the region of the Baltic Sea was relatively stable. After Finland officially joined the North Atlantic Treaty Organization (NATO) in April 2023, tensions have arisen in the region. The Gulf of Finland has specially become vulnerable to escalated tensions between NATO and Russia as it stretches eastwards into Russian waters and ends at the port of St. Petersburg, the Headquarters of Russia’s Baltic Sea fleet. Military leaders from NATO and the Heads of the state of the front line states have been warning that an attack by Russia on NATO territory is no longer unthinkable.8 In this context, the rising vulnerability of critical infrastructure has become a significant matter of concern in the regional geo-political dynamics.

The Baltic countries meanwhile have been seeking energy independence from Russia for two decades. In this regard, their quest predates mainland Europe’s energy diversification that became a top priority agenda only after Russia launched its 2022 Special Military Operation in Ukraine.9 The plan to link the natural gas grids of Finland and the Baltic states was first floated in 2013 when the Finnish gas concern Gasum, together with Estonian gas distribution grid EG Vorguteenus, planned to build the Balticconnector gas pipeline.

The final construction agreement was finalized between Elering, Estonia and Gasgrid, Finland in 2016 at a cost of about Euros 300 million.The same year it was included in trans-European energy networks (TEN-E) to help the EU fund part of the priority project.10 The pipeline opened in December 2019 to enhance integration of gas markets of Finland with the Baltic states of Estonia, Latvia and Lithuania and bring more flexibility in supply by providing Finland with access to the Inčukalns underground gas storage facility in Latvia.

The China Angle
Although the Finnish Prime Minister termed the Balticconnector as caused by an ‘external attack’, the investigation by the Finnish and Estonian authorities have not ended conclusively. Finnish authorities have been cautious in not naming anyone, although tacitly implying Russia could be behind the attacks as its nuclear-fueled cargo ship, Sevmorput, was in close vicinity of the damage. President Vladimir Putin has, however, dismissed such claims.11

However, what merits attention is the China–Russia angle in the Balticconnector incident that came to surface over the course of investigation regarding a Chinese cargo ship, Newnew Polar Bear. The damage to the gas pipeline and two data cables (between Finland and Estonia and between Sweden and Estonia) coincided with the ship’s voyage, merely within few hours of each other.12 The Finnish Navy also found a severed six ton anchor from near the site of the damage.13

Finnish analysts have opined that China would have no rational motive for sabotaging the gas pipeline and the two data cables.14 Moreover, it remains unconvincing for any private enterprise to engage in such acts of sabotage either. For the record, China has never interfered militarily in European affairs. Chinese interference in damaging the pipeline would be an “extraordinary historical turn”15 which would indicate that China is willing to risk its economic relations with Europe, a far-fetched proposition. By all markers, China has sought to improve its relations with Europe lately.

Despite disagreement on the motives, there is evidence that the damage to the Balticconnector pipelines and the two cables has indeed been caused by the Newnew Polar Bear with Russian crew onboard, which is most likely not accidental.16 However, what has been confirmed by the remarks of the Finnish Police is the lack of motive, not the action per se.17

What also remains strange from Europe’s perspective is that port authorities in St Petersburg allowed the Chinese ship to embark on its return journey without its other anchor. Furthermore, it remains a mystery why the Newnew Polar Bear’s crew failed to inform authorities immediately about the severed anchor and its location on the seabed, given that it could pose a danger to undersea infrastructure. The chain of these events indicate an unprecedented link between Russia and China in the northern European energy infrastructure theater.

Critical Infrastructure Protection
Since 2016, NATO has publicly stated that a hybrid attack could trigger the mutual defense clause in Article 5 of the North Atlantic Treaty. Following the Balticconnector attack, NATO has increased its patrols in the concerned waters. In September 2022, Commission President Ursula von der Leyen had stated that “any deliberate disruption of active European energy infrastructure is unacceptable and will lead to the strongest possible response.18 However, as the Balticconnector case shows, there is little preparation that exists across Western platforms to tackle this even when protection of critical infrastructure has been high on Europe’s priorities and has been termed as the new frontier of warfare.

In the January 2023 EU–NATO Joint Declaration, the protection of critical infrastructure was identified as a core area for increased cooperation.19 It underscored the value of reaching tangible results in countering hybrid and cyber threats through operational cooperation and capacity building of partners. On 16 March 2023, the new NATO–EU Task Force on Resilience of Critical Infrastructure was launched which seeks to facilitate cooperation between their staff to share best practice, improve situational awareness and increase resilience.20

According to its final assessment report published in June 2023, energy, transport, digital infrastructure and space were identified as focus areas. The report also identified targeted recommendations to strengthen the resilience of critical infrastructure. In the case of energy, it was acknowledged that while challenges to secure energy infrastructure have intensified in the current geopolitical environment, military activities alone would not be able to tackle the challenge. The report stated in unambiguous terms that military activities in the context of protecting critical infrastructure significantly rely on civilian energy networks and supplies.

Therefore, this report has made recommendations for not only increased engagement but also synergistically linking military and civilian efforts. According to the report, this may be done by promoting best practices and assessments and enhancing monitoring for security implication and cooperation between civilian and military actors. The notable fact is that civilian actors can often furnish realistic assessments of threats to critical infrastructure. The report makes a strong case for synergizing such parallel and coordinated assessments for a holistic picture through structured dialogue on resilience.21

It also mentions the critical role that scenario-based discussions can play with the support and expertise of European Centre of Excellence for Countering Hybrid Threats (Hybrid CoE) at Helsinki. The Hybrid CoE is a specialized platform countering hybrid threats where NATO and the EU have been cooperating and coordinating efforts since 2017.22 Although the Hybrid CoE is an autonomous network-based organization, both the EU and NATO are members, and its activities are open to all EU and NATO countries.

The central aim of the Hybrid CoE is to help prevent and counter hybrid threats by producing relevant research, providing expertise and hosting exercises for countering hybrid threats.

Its strength lies in fusing the information and assessment generated by civilian and official sources that the military can then optimally utilize. It is also unique because it is the only actor where both EU and NATO work and conduct exercises together.

However, the damage done to Baltic Connector and the inconclusive evidence behind its motive once again highlights that the existing efforts need to be reinforced by closing gaps in a holistic approach that coalesces parallel assessments.

Protection of energy infrastructure remains one of the most crucial areas of concern for individual EU and NATO countries. The vulnerability of global energy infrastructure has been repeatedly highlighted by country-specific experts. For instance, post the Nord Stream attacks, Norwegian oil and gas installations have become particularly vulnerable and Oslo has deployed military capabilities to protect them better. Denmark and Netherlands have also increased security around energy infrastructure. France, which is particularly vulnerable to sub-sea cable security, has plans to invest Euros 3.1 million in ocean floor defense to improve the protection of natural resources and undersea infrastructure like cables. It has also invested Euros 11 million in purchasing two unmanned underwater vehicles to further protect its infrastructure.23 President Emmanuel Macron has announced that the government would invest in a fleet of drones and robots to be deployed by 2025.24

Although not a part of the EU anymore, the United Kingdom has announced that the first of its two multi-role ocean surveillance ships shall be tasked with safeguarding underwater telecommunications cables as well as oil and gas pipelines.25 Germany released a strategy paper that discusses new regulations aimed at protecting critical infrastructure.26   As a follow-up, the Scholz cabinet has updated the plan with newer measures for ensuring resilience.27 The updated plan was introduced for consultation to other ministries in July 2023 and it will be finalized towards the end of 2024. It is expected to come up with cross-sector stringent measures for plugging Germany’s infrastructural vulnerability. Italy too has improved the surveillance of submarine energy and telecommunications cables.28

Europe on the whole has been ramping up security of the European communications infrastructure that is not only crucial for the functioning of the global economy and digital services, but also important for national security, as military and intelligence operations heavily depend on them. According to the EU’s own assessment, the protection and resilience of its sub-sea cable network is insufficient and should be improved. The latest guideline to have emerged from the bloc is the new digital networks act likely to be released in 2024.29

In view of increasing use of drones for carrying out malicious activities, the EU commission has set out an EU counter-drone policy to address the potential threat posed by their illegal, irregular and malicious use in 2023.30 This policy highlights a five-phase31 approach for counter-drone stakeholders that can provide guidance to protect critical infrastructure. However, most of these measures are relatively new and will have to operate in real-time situations to prove their efficacy.

Conclusion
Attribution is always challenging in hybrid attacks. There is the recognition that Europe needs to invest more resources to proactively prevent attacks such on those related to the Nord Streams in 2022 and Balticconector in 2023. Both the incidents have shown that it is virtually impossible to take decisive action in the fog of mis-information and geo-political risks. The best strategy remains to have a proactive approach that can prevent such attacks by increased monitoring of the region.

Views expressed are of the author and do not necessarily reflect the views of the Manohar Parrrikar IDSA or of the Government of India.

Swasti Rao is Associate Fellow at Manohar Parrikar Institute for Defense Studies and Analyses. This article was originally published by Institute for Defense Studies and Analyses.