European officials claim sabotage after two internet cables were cut in the Baltic Sea

European officials are turning their attention to Russia after two undersea internet cables in the Baltic Sea were suddenly damaged in an apparent sabotage operation, just weeks after the United States warned Moscow was likely to strike a critical submarine infrastructure.

The cable between Lithuania and Sweden was cut on Sunday, said Telia Latvia, the telecommunications company that operates the link. Separately, state-controlled Finnish telecommunications company Cinia said one of its cables connecting Finland and Germany was damaged on Monday.

Sweden’s National Prosecutor’s Office said on Tuesday that the country’s National Organized Crime Unit had opened a preliminary investigation into suspected sabotage linked to the cut cables. The Finnish National Bureau of Investigation also said it had launched an investigation.

While the exact causes of the incidents are still under investigation, German Defense Minister Boris Pistorius said he believed it was most likely sabotage.

“Nobody believes these cables were accidentally severed,” he told reporters Tuesday morning ahead of a ministerial meeting in Brussels, Belgium. “We have to know that, without knowing specifically who it is coming from, that this is a hybrid action, and we also have to assume, without knowing exactly who it is, that it is sabotage,” Pistorius said.

His comments came after the foreign ministers of Finland and Germany said in a joint statement on Monday evening that they were “deeply concerned” by the cable cut between their countries and raised the possibility that the incident was part of a “hybrid war”.

“The fact that such an incident immediately raises suspicions of intentional damage speaks volumes about the instability of our times. A thorough investigation is being carried out,” the statement said. “Our European security is under threat not only because of Russia’s aggressive war against Ukraine, but also because of hybrid warfare on the part of attackers.”

However, two US officials familiar with the initial assessment told CNN on Tuesday that there was so far “no indication of nefarious activity or deliberate damage to seabed infrastructure” and suggested the failure was likely caused by an anchor pulled from a passing vessel.

Kpler and Spire tracking data did not reveal any ships near the area where the cables were allegedly cut. According to international law, all ships over a certain tonnage must have automatic identification systems that allow them to be tracked, and must keep them switched on at all times.

In some cases they can be disabled and warships do not need to have them enabled. Vessels that have it disabled are often involved in illegal activities such as oil smuggling and illegal fishing.

However, ship tracking data analyzed by CNN shows that at least one ship is crossing the Lithuania-Sweden cable.

The cable cuttings on Sunday and Monday fit a pattern of attacks linked to Russia. It is also no secret that Russia has shown increased interest in submarine cables in recent months, patrolling near critical maritime assets, often far from its shores.

In September, two US officials told CNN that the United States believes Russia now has a better chance of carrying out potential sabotage operations.

They say Moscow is strengthening its special secret Marine unit, which uses a fleet of surface ships, submarines and naval drones to explore the seabed.

The unit, known as “GUGI” (a Russian acronym for the General Staff’s Main Directorate of Deep-Sea Research), has previously been spotted lurking around critical infrastructure.

A joint investigation by the public broadcasters of Sweden, Denmark, Norway and Finland found in April 2023 that Russia had deployed a fleet of suspected spy ships in Nordic waters as part of a program to potentially sabotage undersea cables and wind farms in the region.

Hybrid War

European security officials and experts have been warning for months that Russia is waging a hybrid war against the West. The charges stem from a series of seemingly random arson attacks, hacking attacks and bombings that have occurred in numerous European cities in recent months.

These included arson attacks on a bus garage in the Czech capital Prague, the Occupation Museum in Riga (Latvia), a Ukrainian company warehouse in London and a shopping center in Warsaw (Poland). Numerous hacking attacks and spying incidents have also been reported in various European countries. At the same time, the European Union has accused Russia and Belarus of using migration as a weapon, pushing asylum seekers from third countries to their borders.

Rod Thornton, a senior lecturer in defense studies at King’s College London, said Moscow was using sabotage as an alternative to a full-scale war with NATO, which would have catastrophic consequences for Russia.

Instead, Russia is trying to cause destabilization without crossing the threshold that would trigger a forceful response from NATO. The principle that an attack on one member country is an attack on the entire alliance is the cornerstone of the group’s defense pact.

Thornton said it was significant that the failure occurred at a time when Russia was trying to increase pressure on Ukraine and the West.

“This can be seen as an intensification of the war and the consequences of the war in Ukraine before (US President-elect Donald) Trump takes office to increase the willingness of Western powers to end the war,” he told CNN. in an interview.

“You can see how Trump wants to end the war, and if the Russians increase the pressure on other Western countries and show them the consequences of the war, then those Western countries may be more inclined to support Trump in his desire to have a ceasefire,” he explained.

No one has yet claimed responsibility for the damage. If Russia was behind this, it is unlikely to admit it.

All the sabotages linked to Russia earlier this year had one thing in common: they were carried out in such a way that Moscow could deny involvement, usually by low-level operatives or common criminals who were paid to carry them out.

“This is important because international institutions such as the UN cannot blame Russia because there is no evidence. There’s circumstantial evidence, but there’s no real evidence, there’s no hard evidence that can be tied to it,” Thornton said.

Alexander Danylyuk, a fellow at the Royal United Services Institute, a British defense and security think tank, and a former Ukrainian defense and foreign intelligence official, said this kind of denial has long been a Russian strategy.

“The idea is to carry out the operation in such a way that everyone understands that it was carried out by Russia, but at the same time leave the opportunity for the victim to pretend that he did not know, because the victim is not interested in escalation. ” he said, also pointing to the events leading to the annexation of Ukraine’s Crimea peninsula by Russia in 2014.

“These little green men, everyone knew these were Russian troops, but because the West wasn’t ready to, you know, do anything, they could say, ‘Oh, that’s not certain, we should check what’s going on, maybe it’s kind of like a local militia,” he said.

Limited violation

The extent of failures, if any, caused by damaged cables is unclear. Accidents that damage submarine cables are rare, but they do happen, which is why most providers provide service along several different routes to avoid power outages.

The limited disruption may have been intentional, making the impact severe enough to be considered an escalation, but not enough to be out of control at this time.

“It’s true that it requires another step, but it cuts a cord that won’t offend too many countries. They could go to the Atlantic and cut the cable there between the US and the UK or between Europe and the US, which could have serious, serious consequences, so this is sort of a warning shot,” Thornton said.

In a statement, Cinia said services over the C-Lion1 cable connecting Helsinki to Rostock were unavailable, but added that Finland’s international telecommunications connections were laid out over several channels.

The company said a repair vessel had been sent to the scene and while it did not yet know how long it would take to fix the problem, it added that repairs to submarine cables typically take between five and 15 days.

According to Lithuanian media, Telia Lithuania’s technical director Andrius Semeskevicius said the damaged cable – BCS East-West – provides about a third of Lithuania’s internet capacity. He added that after the failure, traffic was restored.

CNN’s Stephanie Halas, Billy Stockwell, Paul P. Murphy and Jim Sciutto contributed reporting.

For more CNN news and newsletters, create an account at CNN.com.