Spy ships, ‘gray-zone’ tactics and the NATO dilemma over protecting cables off the British Isles and Scandinavia

LONDON/OSLO —
Russian espionage operations around the British Isles and along Scandinavia’s coasts have shifted the security frontier to the ocean floor, where a web of fibre-optic and power cables carries almost all of Europe’s data and an increasing share of its electricity. Intelligence ships linked to Russia’s secretive Main Directorate of Deep-Sea Research (GUGI) have loitered above critical routes in the North Atlantic and Baltic Sea, mapping the infrastructure and, Western officials fear, rehearsing how to disrupt it in a crisis. The activity presents NATO with a hard choice: escalate defenses that could provoke Moscow, or accept heightened vulnerability to a strike that would be felt in bank transfers, military command links and daily life alike.

The Russian vessel Yantar — nominally an oceanographic ship but long identified by Western services as a mother ship for deep-diving submersibles — has emerged again as the symbol of this contest. Tracking data and allied navies have recorded Yantar and sister platforms loitering over choke points off Ireland and Scotland and along Norway’s long, cable-strewn coast. British and allied warships have repeatedly shadowed the vessel near internet trunk lines that run west from Ireland and Scotland to North America, according to officials and open-source tracking cited in recent reporting. Similar patrols have taken place in the Skagerrak and the Baltic approaches, where undersea lines are dense and shallow waters make physical interference easier.

Testing the seams of deterrence
The pattern fits a broader ‘gray‑zone’ campaign designed to probe the edges of NATO’s rules without crossing the threshold of armed attack. Undersea infrastructure offers perfect ambiguity: accidental damage is common in busy sea lanes, and the technical difficulty of attributing a cut or a tap allows actors to deny involvement. Analysts point to a string of cable and pipeline incidents since 2022 in the Baltic Sea — some likely accidental, others suspicious — which have nonetheless forced governments to deploy patrols and rethink how to police the seabed. In January 2025, a major fibre link between Sweden and Latvia was severed, prompting immediate NATO patrols and criminal investigations by Swedish authorities. Western analysts warn the cumulative pattern is a credible rehearsal for wartime disruption, even when specific incidents remain unproven.

Britain and the GIUK Gap
For the United Kingdom, the threat intersects with geography. The ‘GIUK gap’ — the naval bottleneck between Greenland, Iceland and the United Kingdom — is also a corridor of seabed cables and energy connectors. London has invested in niche capabilities: multi‑role ocean surveillance ships, autonomous underwater vehicles and a small cadre of specialists focused on ‘seabed warfare.’ Early this year, the Royal Navy publicly tracked a Russian surveillance ship suspected of lingering above UK‑adjacent cables, and ministers pledged closer escorting of suspect vessels transiting the Channel and Irish Sea. Privately, officials concede that the sheer length of cable routes — and the dependence on commercial owners to report anomalies — leaves unavoidable blind spots.

Norway to the Baltic: a map of targets
Norway’s offshore energy fields and the high‑voltage interconnectors that tie the Nordics to continental grids are a second bullseye. Farther south and east, the Baltic Sea has become a laboratory for hybrid pressure, with dense shipping, shallow depths and overlapping jurisdictions complicating surveillance. From Denmark’s straits to the Gulf of Finland, telecom and power cables crisscross sea lanes used daily by trawlers, tankers and research ships. NATO and EU officials say the challenge is less a lack of assets than a lack of persistent, fused awareness: knowing which vessel, in which patch of water, is doing something unusual in time to act.

The NATO dilemma
That informational problem drives the alliance’s central dilemma. If allies place armed escorts and seabed sensors over every ‘node’ — cable landing sites, repeaters, intersections with pipelines — Moscow can claim militarisation of the maritime commons. If they do not, a hostile actor gains opportunities to create cascading economic shock with limited risk of attribution. NATO’s answer so far has been to harden awareness rather than declare red lines: a Brussels‑based coordination cell for critical undersea infrastructure, new data‑fusion pilots that stitch together AIS, sonar and satellite feeds, and a push to standardise how states and private cable owners share alerts. This leaves open the question of response: what happens the next time a suspicious hull goes dark near a landing station?

Inside the Russian toolkit
GUGI’s fleet sits at the heart of Western anxiety. Beyond large ‘mother ships’ like Yantar, Russia fields deep‑diving minisubmarines, remotely operated vehicles and seabed drones able to descend thousands of metres. Such platforms can clamp devices onto cables to siphon traffic, cut fibres outright, or tamper with power interconnectors. While tapping modern fibre requires specialist gear and precise placement, the abundance of public cable maps and the physical vulnerability of repeaters reduce the ‘search’ problem. In peacetime, even shadowing a suspicious vessel involves legal friction: research and fishing ships enjoy freedom of navigation, and a cut discovered days later may offer little forensic trace.

Costs of a cut
A localized cable break rarely cuts a country off the internet; traffic reroutes. But multiple simultaneous cuts in shallow waters — or damage to repeaters in deep Atlantic segments — can throttle latency‑sensitive services, disrupt financial settlements, and degrade secure military traffic that relies on commercial pathways. For Scandinavia and the UK, whose economies and militaries are tightly networked across borders, the second‑order effects would be swift: market panic, strained public‑safety communications, and the diversion of scarce naval and coastguard assets to search‑and‑repair.

What allies are changing
Allies are experimenting with a new division of labour. The UK has refitted auxiliary ships for seabed surveillance and commissioned unmanned systems to patrol approaches to cable landing sites. NATO has stood up prototypes that blend ‘seabed‑to‑space’ sensing and near‑real‑time anomaly detection, while national coastguards trial AI models to flag trawlers or research vessels whose patterns deviate from norms. Private operators are adding route redundancies and hardening repeaters; insurers are rewriting policies to account for gray‑zone sabotage. Crucially, governments are starting to pre‑agree response ladders: from quiet escort and illumination (forcing a suspect ship to keep its transponder on) to boarding operations in territorial seas and joint public attribution when thresholds are crossed.

A playbook for the next ‘mystery cut’
Officials outline a three‑layer approach for the coming winter, when storms and darkness widen the fog of attribution. First, persistent awareness: more maritime patrol flights over cable corridors and continuous, fused feeds from commercial satellites, seabed sensors and AIS. Second, rapid on‑scene presence: keeping a small number of allied ships and drones ready to ‘box in’ vessels behaving suspiciously near cable routes in territorial waters. Third, resilience by design: pre‑positioned repair gear and ‘dark’ restoration plans that prioritize lifeline services, including military bandwidth and emergency networks.

The risk of miscalculation
The hazard in all of this is escalation through misreading. A legitimate oceanographic expedition can look, on radar or AIS, like a covert survey; a trawler dragging a snagged anchor can cut a fibre as effectively as a saboteur. Russian planners count on that ambiguity to keep pressure high and costs low. NATO’s task — as several senior officials put it — is to shrink the room for deniable action without turning Northern European waters into a permanent exclusion zone. That means faster decisions, shared intelligence with the private sector, and credible, pre‑announced consequences for state‑directed sabotage.

The bottom line
The seabed campaign around the British Isles and Scandinavia is not a future threat; it is a live front in Europe’s security contest with Russia. Every escorted ‘research’ ship, every unexplained outage, and every scramble by a patrol aircraft is a spin of the escalation dial. Allies will not eliminate the vulnerability — the ocean is too vast and the infrastructure too sprawling — but they can raise the risks for sabotage and shorten the repair cycle when it happens. The measure of success may be quiet: a winter without major outages, a suspicious hull that keeps its distance, and cables that continue to hum beneath the waves.

Sources

Financial Times investigation on Yantar and GUGI activity near European cables, September 26, 2025.

Reuters: UK monitors Russian spy ship and steps up cable protection, January 22, 2025.

USNI News: Royal Navy tracks Russian surveillance ship loitering near underwater cables, January 22, 2025.

The Guardian: Russian spy ship escorted away from area with critical cables in Irish Sea, November 16, 2024.

NATO Allied Command Transformation: ‘Mainsail’ seabed-to-space situational awareness prototype, January 21, 2025.

RAND Commentary: Undersea cables are vulnerable to sabotage — but it takes skill, July 2025.

Wilson Center: Mapping undersea infrastructure incidents in the Baltic Sea, March 2025.