The northern Euro-Atlantic theatre is today a stage on which maritime asymmetric activities are involving and impacting non-state, state, and multinational actors. The underwater domain remains a particular area of state-based strategic contest because it remains opaque, cloaking submarine and, increasingly, uncrewed platform operations. In a significant Euro-Atlantic security shift, asymmetric activities and capabilities are bringing physical and strategic vulnerability to critical undersea infrastructure (CUI). This threat may have been underlined in late 2025, following concerns that a CUI incident in the Gulf of Finland may have involved a rogue commercial ship deliberately dragging its anchor across the seabed.
Senior NATO military leaders began warning about increasing underwater threats as far back as 2016. However, the CUI issue burst into European and international political and public consciousness in September 2022, when the Nordstream gas pipelines in the Baltic Sea suffered explosive ruptures. The Baltic became a global CUI security focus when three incidents of damage between October 2023 and December 2024 raised questions in NATO political and public debates over whether such incidents were attributable to rogue ships intentionally dragging their anchors at distance and speed across known CUI sites.
The Baltic incidents were not the only examples of suspicious damage to northern European CUI. In November 2021, sensor cables in a civilian-run environmental monitoring network off Norway’s Lofoten peninsula, were damaged; in January 2022, data cables connecting the SvalSat satellite station on Norway’s Svalbard Island to the Norwegian mainland also were damaged. These incidents occurred at either end of the Bear Gap, a maritime chokepoint through which underwater traffic transiting between the Barents and Norwegian seas must pass.
The increased CUI threat is reflected in NATO’s Allied Maritime Strategy (AMS). The first version (published, 2011) bracketed CUI protection within wider maritime security challenges to sea lines of communication (SLOCs). However, by the time the second version appeared (October 2025), the CUI threat profile had been elevated significantly not just by the Baltic incidents but because of greater state-based threats to maritime security as a whole, including to freedom of navigation, access at and from the sea, and strategically important SLOCs now recognised as including CUI.
CUI security’s central role in NATO maritime thinking is illustrated in how the risk was described in the latest AMS version. “By increasing maritime readiness, situational awareness, posture and mass, while enhancing existing capabilities with emerging technologies, NATO will have the maritime power required to assure maritime access, uphold freedom of navigation, safeguard vital SLOCs, protect critical infrastructure, and prevail in conflict,” the AMS said. Securing CUI is seen as flowing directly from enhancing NATO’s overall operational output.
Allied power
The Baltic incidents affected CUI connecting NATO states region-wide. Countries conducted national responses, alongside myriad examples of collective response.
Following the 26 September 2022 Nordstream explosions, Denmark, Germany, The Netherlands, Norway, and the UK surveyed collectively over 8,000 km of CUI in their national territorial waters, using uncrewed underwater vehicles (UUVs) supplied particularly by Norwegian industry.
Post-Nordstream too, six countries – Denmark, Germany, Finland, The Netherlands, Norway, and Sweden – established (under an existing naval capability cooperation framework) The Netherlands-hosted Seabed Security Experimentation Centre (SeaSEC), harnessing commercial and defence uncrewed capabilities to (SeaSEC said) ‘do something’ quickly about the threat.
In the wake of the 2023-24 Baltic incidents, the UK-led, 10-country Joint Expeditionary Force (JEF) – established previously to provide maritime and wider joint capacity to support NATO through deterring sub-conflict threshold threats in Northern Europe – established its ‘Nordic Warden’ CUI security operation, conducting various deployments since June 2024 to bring presence across an area encompassing the Barents to the Baltic seas.
NATO responded too, establishing in January 2025 its ‘Baltic Sentry’ maritime presence, surveillance, and deterrence activity. Led at sea by NATO’s Allied Maritime Command (MARCOM) and its standing naval forces (SNFs), ‘Baltic Sentry’ is now a core component of NATO’s wider enhanced vigilance activity (EVA) output across the region.
These and other responses illustrate the national power NATO and its member states can harness collectively in crisis response, working as an alliance or as multinational ‘spokes’ around the NATO ‘hub’. Such collective capacity and capability is where NATO has significant advantage over potential adversaries.
Regarding a challenge like CUI security, each NATO member state and its commercial industry hold significant information on the status of national CUI networks. Building CUI security through sharing and layering data to generate information superiority demonstrates how NATO could enhance its outputs and advantages through further integrating information and operations.
CUI security is a multi-stakeholder issue, combining government agencies (including those covering the maritime domain), the armed forces, and industry. For NATO countries, responding quickly to the threat means working closely with industry.
Commercial industry is changing its CUI security and resilience perspective. Recognising the threat, it understands the need for network security and repair capacity – not just to maintain operational-level supply for its customers, but to reduce strategic-level vulnerability for the countries concerned. Companies working in seabed infrastructure lay, monitor, repair, and replace it.
However, industry’s contribution relates to more than just CUI information and security. Norway’s commercial offshore sector operates a collective pool of over 600 remote-controlled and autonomous UUVs. The sensing mass within such pools can help bolster deterrence effect.
Integrating industry
Norway’s geostrategic position – and CUI incident background – is a useful illustration of the national and multinational approaches NATO countries take in securing CUI. Its underwater geography also underlines the broad nature of the CUI threat.
Talking to DefenceIQ’s ‘Seabed Security’ conference in Tróia, Portugal in September, Commodore Kyrre Haugen – the Royal Norwegian Navy’s (RNoN’s) Commander Norwegian Fleet – explained the varying geophysical challenges countries and their CUI stakeholders must consider.
Norway’s exclusive economic zone (EEZ) includes shallow waters under 100 m deep, where CUI can be accessed by underway maritime shipping, Cdre Haugen explained. In EEZ waters 100–1,000 m deep, CUI is at damage risk from fishing trawlers, he added: while commercial activity is not usually present beyond 1,000 m, specialist equipment (like that built for research or military activity) can provide access.
In vessel terms, the CUI threat comes in these and other forms. Merchant ships, fishing vessels, and submarines can all deploy UUVs, for example. Responding to the broad threat means government agency and organisation, industry, and armed forces integration – the latter including integrating naval, air, and space domains, to harness surveillance and wider maritime situational awareness (MSA) sensing presence.
Norway’s CUI stakeholders interact regularly, including conducting tabletop exercises and through industry actors’ own operations centres, via which they can integrate with the RNoN’s maritime operations centre (MOC) to share and access information, Cdre Haugen explained.
While Norwegian industry’s UUV fleet offers significant surveillance and MSA capability and capacity the RNoN can draw on, the navy is building its own presence. “We are developing and growing capacity on the seabed, by introducing a fleet of uncrewed systems, which we can use for surveillance and to investigate what is going on in different areas,” the Cdre said. “So far, the RNoN has improved its ocean-going autonomous UUV capabilities, using a container-based system that can be deployed from several ships in the fleet.”
Noting too that adversaries’ uncrewed systems provide surveillance and sabotage threats against CUI, “The most important thing is to be able to deny deniability,” said Cdre Haugen. “We need a combination of all layers – space, cyber, surface, and sub-surface, combined with proper intelligence gathering – to be in the right place, at the right time, with the right capacities to deny deniability when there are threats to our CUI.”
Industry is strengthening its own capacity to support the response. Here, Cdre Haugen explained, contributing to common MSA is the key driver, with industry fitting sensors to offshore platforms and integrating these and other sensors (for example, radars fitted on rigs or helicopters) into the wider CUI and MSA networks.
Adding capacity
When the Norwegian and Nordstream incidents occurred, Finland and Sweden were not NATO states. Russia’s invasion of Ukraine in February 2022 precipitated their membership, formalising what had been close, long-standing, strategic-level partnering with NATO and its members.
The later, 2023–24 Baltic incidents occurred around the time Finland and Sweden became members (April 2023 and March 2024, respectively). What their membership added in the Baltic CUI context was significant understanding of the region’s naval environment, especially underwater, plus substantial MSA capacity and capability. The potential benefit Finland and Sweden offer here is augmenting deterrence through attribution, assisted by their knowledge of local shipping. Both countries also have proven records of maritime security information-sharing across national stakeholders.
Regarding information sharing to enable attribution, navies contribute through integrating surveillance pictures. “We are able to support CUI protection with our sea surveillance capabilities. That is the baseline operation: make sure we know every merchant ship that operates in the region,” Rear Admiral Tuomas Tiilikainen, Commander Finnish Navy, told ESD in December.
Such information is shared with stakeholders including the Finnish Border Guard. “We work very closely with the Border Guard: we share the same situational awareness, and the Border Guard has some unique authorities and capabilities because they are ‘police’: they have the constabulary authority,” Rear Adm Tiilikainen explained. “We share information, we share resources, and we plan in advance for using the resources so we have maritime presence in key areas ‘24/7, 365’.” For incident response during peacetime, the Border Guard leads with the navy in support, the admiral added.
While the region’s national stakeholders already have integrated relationships, NATO adds value in building and sharing the integrated MSA picture. “NATO’s contribution is information sharing, giving us a ‘heads up’ on vessels of interest entering the Baltic Sea basin,” said Rear Adm Tiilikainen, noting that such advanced information can include concerns over suspicious behaviours or previous visits to ports of interest.
The MARCOM-based NATO Maritime Centre for the Security of CUI (NMCSCUI), established as the Alliance’s maritime operational-level information-sharing ‘hub’, brings particular impact as an Alliance navies’ asset. NMCSCUI can play a central role in harmonising processes for sharing contacts of interest and for incident response, said Rear Adm Tiilikainen. NMCSCUI has played an increasing role in supporting ‘Baltic Sentry’, too.
The Finnish Navy has contributed to ‘Baltic Sentry’ in several ways. Most recently, between August and November, the navy’s mine-hunting vessel FNS Katanpää joined MARCOM’s Standing NATO Mine Counter Measures Group 1 (SNMCMG1) SNF. Here, it has learned much about national and NATO contributions to CUI security.
“From our perspective, ‘Baltic Sentry’ is a success story. It was launched swiftly and decisively, and it really showed NATO’s commitment and dedication to protect CUI,” said Rear Adm Tiilikainen. Such effect relates not only to NATO’s SNFs at sea, but to the building and sharing of MSA between the navies and their MOCs to generate a comprehensive understanding of rogue shipping movements and potential emerging threats, he added.
Moreover, the admiral continued, “‘Baltic Sentry’ has been a platform upon which we have been able to train and execute comprehensive presence in the region, not only for our navies but the maritime patrol aircraft and (other) assets.” Such training and operating includes encompassing key maritime areas, surveilling contacts of interests, building awareness to ensure no surprises occur, and enhancing attribution capacity. “So, in that sense, coordination, situational awareness, and C2 have been tested during ‘Baltic Sentry’, and to me it’s been a success story,” Rear Adm Tiilikainen said.
One development the Finnish and Swedish navies recognise when it comes to supporting NATO operations – particularly during times of tension, and potentially during times of crisis and conflict – is the requirement for sustained operational capability including for the CUI task. This has already been evident in their support of NATO’s Baltic EVA requirements, especially ‘Baltic Sentry’, and in their capacity to provide MSA.
When non-aligned, Sweden would have used its navy in conflict for high-end warfighting over a short, intense period to allow full, joint force mobilisation. As illustrated by ‘Baltic Sentry’ – now underway for a year – NATO operations are usually more sustained. ‘Baltic Sentry’ has been led by the MARCOM SNF Standing NATO Maritime Group 1 (SNMG1). The Royal Swedish Navy (RSwN) was one of the first navies to add a ship to SNMG1 during the operation: HSwMS Visby joined briefly in January 2025, also becoming the first RSwN ship to operate under NATO command.
“‘Baltic Sentry’ is not a two-week job …. It’s still ongoing,” Rear Admiral Johan Norlén, Sweden’s Chief of Navy, told ESD in October. “If that is some sort of description of the peacetime we have right now – peace, or slight crisis – then you need persistent ISR (intelligence, surveillance, and reconnaissance) operations.” Here, the high-end technology the RSwN has been developing brings impact, the Chief explained. “We have, for instance, autonomous vehicles in every aspect – underneath the surface, on the surface, and in the air – that will enable us to complement crewed ships during that time so we can maintain operations for a much longer period than we used to.”
Generating sustained operations – something central to the CUI task – is a daily focus for the navy, Rear Adm Norlén said. The RSwN’s MSA capability – again, crucial to CUI security – brings wider operational benefit for NATO, he added. “The baseline for every operation in this area and one of the major things we bring to the NATO table is that we have really good surveillance operations, ‘24/7, 365’, and consequently MSA that is really good – especially together with Finland.” Reflecting the requirement for integrating information, Rear Adm Norlén said a key RSwN aim is enhancing its connectivity so such information can be shared wider-still with allies.
Characterising the Baltic Sea as a confined, congested, and (now) contested space, Rear Adm Norlén highlighted the challenge posed by asymmetric activities. These threats can include accidental or intentional CUI damage, GPS jamming, or ship automated identification system (AIS) spoofing. “There are a lot of hybrid operations ongoing. Hybrid operations are no less dangerous than conventional operations,” the admiral said. “The only problem with hybrid operations is that attribution is the main issue.”
The Baltic is a ‘strategic sea’ for NATO and Russia. NATO’s increased presence there is due not just to deteriorating regional security, but because eight of the nine Baltic states are NATO members. Russia may see such presence as challenging its access opportunities into the North Sea for ships and trade flowing from St Petersburg and Kaliningrad.
For an issue like CUI security, any tension – like that existing around the Ukraine war – can create escalation risk. Here, the potential involvement in the Baltic CUI incidents of rogue ships linked to Russia, and the consequent need for NATO and its navies to shadow such ships, is part of that risk. “We are there. We exercise our rights to have these sea lanes open – but at the same time, we are not too provocative because we don’t want to escalate anything,” said Rear Adm Norlén.
Nonetheless, NATO recognises the need to maintain deterrence presence. That just one further CUI incident has occurred since the establishment of ‘Baltic Sentry’ points to that deterrent effect.
Dr Lee Willett
