At approximately 5:00 a.m. on December 31, 2025, monitoring systems detected a massive fault in an undersea cable crossing the Gulf of Finland. A 132-metre cargo vessel, the Fitburg, travelling from St. Petersburg to Israel, was identified as having dragged its anchor directly over the cable infrastructure. Finnish Border Guard helicopters and a patrol ship intercepted the vessel within hours. Two crew members — a Russian and an Azerbaijani national — were arrested on suspicion of aggravated sabotage. Investigators later found the ship was also carrying sanctioned Russian steel.
Five days later, Latvian authorities boarded another vessel suspected of damaging a separate telecom link to Lithuania. Neither incident was the first. It was not close to the last.
Undersea telecommunication cables carry 99% of transoceanic digital communications and $10 trillion in financial transactions daily. They are, without serious competition, the most important physical infrastructure on the planet. And the pace at which they are being cut, dragged across, and deliberately targeted has accelerated sharply — while the legal, military, and governance frameworks meant to protect them have struggled to keep up.
The Incident Log
The Baltic Sea has become the primary theatre for what NATO and European governments now openly describe as a sustained campaign of hybrid warfare against undersea infrastructure. Since 2022, approximately ten subsea cables connecting the Baltic region have been cut, with seven of those cuts occurring in the concentrated period between November 2024 and January 2025 alone. In January 2024 through July 2025, roughly 44 incidents of cable damage were recorded globally — not all deliberate, but the frequency and pattern of Baltic incidents have convinced most European security analysts that an accident alone does not explain the clustering.
The incident that drew the most scrutiny before the Fitburg was the near-simultaneous cutting of two cables in November 2024. On November 17, 2024, BCS East-West Interlink, connecting Sweden to Lithuania, stopped working. Two days later, C-Lion 1, connecting Finland to Germany, was cut. Preliminary findings pointed to a Chinese vessel, the Yi Peng 3, which was en route from a Russian port with a Russian captain aboard — though no formal attribution has been made and investigations remain ongoing.
The pattern extends beyond the Baltic. In January 2025, four cables were severed globally in the same month. In the Red Sea, Houthi activity has threatened cable routes that connect Asia to Europe through one of the world’s most congested underwater chokepoints. Taiwan, acutely aware that the island’s four undersea cables represent its primary connection to the global internet, has been reinforcing patrols and building backup communication capacity. The isolated incidents have not met the threshold for a NATO Article 4 or 5 response — an attribution and legal problem the alliance has not yet resolved.
Russia’s posture has grown more brazen rather than more cautious under pressure. In 2025, Moscow sent fighter aircraft to deter Estonian authorities from approaching a vessel suspected of cable interference — an assertion of impunity that would have been difficult to imagine five years ago, and that illustrates exactly how limited the deterrence effect of current surveillance operations has been.
Why Undersea Cable Protection Is So Hard
The infrastructure itself makes defence structurally difficult. An estimated 100 to 150 cables are severed each year worldwide, mostly from fishing equipment and anchors — meaning the baseline rate of accidental damage is high enough that deliberately induced damage can be made to look routine. Attribution is hard, investigation is slow, and the legal framework for what constitutes an act of war versus an act of vandalism committed by a nominally civilian vessel remains genuinely unresolved in international law.
The physical characteristics of the seabed add a layer of operational complexity. Most cables run through shallow coastal waters near their landing points — the most vulnerable sections — before descending to depths where tampering is technically demanding but where surveillance is also extremely difficult. Repair ships, of which there are only a few dozen in the entire world capable of working at significant depth, take weeks to mobilise and months to complete major repairs. In May 2025, Nordic countries and Estonia began rolling out offline payment systems in case internet connections are lost from undersea cable sabotage — a workaround that acknowledges, implicitly, that restoration cannot be relied upon quickly enough to serve as the primary resilience strategy.
NATO’s response has been real but constrained. In January 2025, a summit of Baltic Sea allies launched Operation Baltic Sentry, deploying a mix of crewed and uncrewed maritime and air assets to enhance detection and deter sabotage, while establishing a Critical Undersea Infrastructure Network that has been meeting since May 2024 to coordinate military, security agency, and industry responses. The EU complemented this with a €1 billion Cable Security Action Plan launched in February 2025, calling for improved threat monitoring, investment in “smart cables” with greater resilience, more sanctions on Russia’s shadow fleet, and the eventual establishment of an EU Cable Vessels Reserve to shorten repair times.
The honest assessment from analysts who track this space is that these are meaningful first steps and inadequate responses simultaneously. Detection has improved; deterrence has not. The Fitburg incident happened after Baltic Sentry launched. The pattern of incidents has not slowed.
Who Actually Owns This Infrastructure
Understanding who owns the cables is essential to understanding why governance is so difficult — and the ownership picture has changed dramatically in the last decade in ways that have significant geopolitical implications.
Historically, undersea cables were built and owned by telecommunications consortia: groups of carriers that shared costs and capacity, with no single entity controlling the full route. That model has been largely displaced. Amazon, Google, Meta, and Microsoft now own or lease around half of all undersea bandwidth worldwide. Approximately 98% of the world’s undersea cables are manufactured and installed by four private firms: US company SubCom, French firm Alcatel Submarine Networks, Japanese firm NEC, and China’s HMN Technologies — formerly Huawei Marine Networks — which held an 11% manufacturing market share as of 2021 and has been growing faster than any competitor since.
Google has significant ownership stakes in at least 20 cable systems. Its Dunant cable, connecting the United States and France, that carries Google traffic exclusively. It’s Equiano cable, running from Portugal to South Africa, serves Google’s cloud infrastructure in Africa. These are not shared infrastructure assets: they are private cables, built for private traffic, on terms set by a single corporation. Meta announced Project Waterworth in February 2025 — a $10 billion, 50,000-kilometre cable that will connect five continents, making it the world’s longest subsea cable project, with Meta as the sole owner.
The concentration this represents is striking. Rather than renting capacity from infrastructure providers, the largest technology companies are vertically integrating infrastructure with their content services — owning the physical layer of the internet in a way that raises questions about market concentration, national security oversight, and what happens when a corporation’s strategic interests diverge from a government’s security needs.
The China dimension adds a further layer. HMN Technologies — rebranded from Huawei Marine Networks after the US blacklisted Huawei — has been responsible for 18% of global cable installations over four years, leveraging cost advantages and targeting emerging markets. Alcatel Submarine Networks, the French firm, was 80% acquired by the French state in 2024 — a move explicitly designed to prevent the cable manufacturing sector from becoming further concentrated in Chinese hands. The US has moved to exclude HMN from cables touching American shores, but cables that don’t touch American shores are outside that jurisdiction, and the company continues to expand its footprint in Asia, Africa, and the Middle East.
The Undersea Cable Governance Gap
The structural problem underlying all of this is that the cables are almost entirely privately owned, the threats are primarily state-sponsored, and the legal frameworks governing both protection and accountability were not designed for this combination.
Private operators who first detect something unusual occurring are typically the ones who alert national authorities to investigate and attempt any law enforcement or military response, whose security clearances, if any, vary by jurisdiction. The absence of a binding international legal framework for undersea cable protection — comparable to, say, the conventions governing airspace or maritime law — means that a vessel dragging an anchor across a cable in international waters occupies a legal grey zone that states have been reluctant to resolve precisely because resolution would require commitments they are not prepared to make.
The replacement infrastructure debate has produced one counterintuitive finding: satellite systems, including Starlink and its competitors, are not a viable substitute for cables at the bandwidth levels modern economies require. NATO strategy has looked to space to protect data flows in the event of major cable disruption, but analysts warn this creates a catch-22: a conflict serious enough to knock out undersea cables would likely also target low-earth-orbit satellite constellations, meaning the backup and the primary system face simultaneous threats from the same adversary.
The uncomfortable reality is that the internet’s physical backbone was built for a world in which state-sponsored sabotage of civilian infrastructure was considered beyond the pale. That world has ended. The Fitburg incident and the pattern of which it is a part are not accidents: they are expressions of a deliberate Russian strategy to probe, stress, and degrade NATO’s critical infrastructure in ways that fall below the threshold of formal military engagement — a strategy for which NATO does not yet have a fully formed doctrine of deterrence, let alone response.
The cables will keep being cut. The question is whether the governance frameworks can close the gap between detection and consequence before the next significant escalation makes the stakes plain in a way that cannot be managed quietly.
Sources: War on the Rocks, “Deterring Russia Beneath the Waves” (June 2026); CSIS, “Safeguarding Subsea Cables” (July 2025); CSIS Strategic Technologies Blog, “Beneath NATO’s Radars” (December 2024); Bulletin of the Atomic Scientists, “Seabed Zero” (February 2026); RealClearDefense, “NATO’s Subsea Cable Strategy Turns Into a Catch-22” (October 2025); Silicon Canals, “Who Owns the Undersea Cables” (March 2026); Oxford Internet Institute (March 2025); Open Markets Institute (March 2025); CNBC, “Big Tech AI Underwater Cables” (November 2025); gCaptain, “Timeline of Suspected Underwater Sabotage in the Baltic Sea” (January 2026); Cyberwarzone (January 2026); Jackson School of International Studies, University of Washington (July 2025); Wikipedia, 2024 Baltic Sea submarine cable disruptions.
