Deterring the Seabed: A Strategic-Theory Framework for Undersea-Infrastructure Defence in the Post-Accession Baltic

Introduction

On 26 September 2022 a series of underwater explosions ruptured three of the four pipes of the Nord Stream system near the Danish island of Bornholm. Governments with oversight of the system concluded the damage to have been the result of deliberate sabotage (Neal, 2026). The episode inaugurated a period in which the floor of the Baltic Sea became, with remarkable speed, the most contested seabed on earth.

In October 2023 damage to the Balticconnector gas pipeline between Finland and Estonia and to adjacent communications cables was subsequently traced to an anchor dragged by a passing container vessel. In November 2024, two data cables – the BCS East-West Interlink between Lithuania and Sweden and the C-Lion1 cable that carries Finland’s only direct data connection to continental Europe – were cut within a day of one another as a bulk carrier that had departed a Russian port crossed both sites. On Christmas Day 2024, the Estlink 2 power interconnector between Finland and Estonia failed, together with four telecommunications cables, after a tanker linked to the Russian “shadow fleet” appears to have dragged its anchor across tens of kilometres of seabed. Finnish authorities boarded and detained the vessel, a far more assertive response than earlier Baltic incidents had drawn (Braw, 2025; Majcin, 2025). Further cable damage followed in 2025. NATO responded in January 2025 by launching Baltic Sentry, a multi-domain vigilance activity intended to raise maritime situational awareness and to deter and defend against attacks on undersea infrastructure (Braw, 2025).

The principal incidents and what has been established about each are summarised in Table 1.

The strategic significance of these events greatly exceeds the modest physical damage any single anchor inflicts. More than 99% of the world’s intercontinental data traffic travels through submarine cables, and the Baltic littoral is among the most cable- and pipeline-dense maritime spaces in the world. Its energy and data interconnectors are the very skeleton of an integrated Nordic-Baltic economy (Bueger & Liebetrau, 2021; Insikt Group, 2025). The accession of Finland in 2023 and Sweden in 2024 turned the Baltic into what has been called a “NATO lake” (Estonian Foreign Intelligence Service, pp. 22), concentrating allied infrastructure, allied responsibility, and allied vulnerability in a single semi-enclosed sea. The seabed campaign is thus a strategic problem of the first order for the alliance’s newest members, and it is one for which they are, by the admission of their own officials, not yet adequately prepared. The wider problem of deterring Russia in the region is not new: before accession, scholars and practitioners had examined Baltic Sea security through the lenses of deterrence and reassurance, including the position of Finland and Sweden as NATO partners rather than members (Dahl, 2018).

Yet the rapidly accumulating literature on seabed coercion is curiously thin where it most needs to be thick. There is no shortage of careful incident chronology, of institutional mapping, or of the observation – repeated almost ritually – that cable-cutting is a form of “hybrid” or “grey-zone” aggression (Bueger & Liebetrau, 2023; Majcin, 2025; Neal, 2026). What is largely absent is a strategic theory of the problem: an account of how, in principle, attacks of this kind might be deterred, and of why the instruments that deter conventional aggression do not straightforwardly transfer to the seabed. If the think-tank literature has begun to call, in general terms, for deterrence (Dombrowski & Jones, 2025) such a call does not constitute a theory of such deterrence, and the assumption that the concept can simply be imported from the conventional or nuclear domains is precisely what requires examination.

This article supplies the missing theory. Its central claim is that the difficulty of the deterrence of seabed coercion arises from three compounding reasons, each of which invalidates a different limb of the classical deterrence repertoire.

First, the acts are deniable: an anchor that drags across a cable is (initially, at least) indistinguishable from an anchor dragged by accident, while merchant vessels that carry out, or appear to carry out, these acts are subject to opaque ownership chains sailing under flags of convenience. Attribution secure enough to justify retaliation is rarely available expeditiously enough to be useful. This defeats deterrence by punishment, which presupposes that the punisher to be able to identify who they should be punishing.

Second, the acts fall below the threshold of armed attack: the damage is reversible, no one is killed, and the act is calibrated to remain beneath the level at which the law of collective defence or the logic of escalation would be triggered. This defeats the escalatory credibility on which punishment ultimately rests, because the threat to impose unacceptable costs for a sub-threshold act is itself scarcely credible. Third, the target is physically undefendable at scale: there are hundreds of cables and pipelines, laid across thousands of kilometres of seabed in waters open to lawful navigation, and no navy can guard them all. This defeats deterrence by denial, which presupposes that the defender can prevent the aggressor from achieving the objective.

The argument proceeds in five steps. Section 2 situates the seabed problem within the longer history of maritime strategy, tracing a genealogy that runs from command of the sea through sea denial to a third and newer contest for the seabed itself, and showing that the submarine “hider–finder” competition of the twentieth century is the proximate ancestor of the present difficulty. Section 3 sets out systematically why the punishment–denial dyad fails on the seabed, and introduces a fuller deterrence taxonomy – adding detection, entanglement, and legal-jurisdictional cost to the two classical modes – drawn from the cyber and cross-domain deterrence literatures whose problems most closely resemble the seabed’s. Section 4 isolates what I argue is the pivotal analytical obstacle: that deterrence by detection, the instrument to which the Baltic states have in practice turned, deters detection rather than action, and confers strategic effect only when detection is bound in advance to a credible response. Section 5 examines the most genuinely novel development in the Baltic record – the turn to vessel detention and the assertion of coastal-state jurisdiction – as the emergence of a deterrent by legal-jurisdictional cost, and assesses both its promise and the prosecution gap that constrains it. Section 6 synthesises these elements into a layered posture for the post-accession Baltic and argues that the binding requirement is not any single instrument but their integration. Section 7 concludes.

A word on method and scope. This is a conceptual and historical-analytical article, not an empirical one. It does not test a hypothesis against a dataset of incidents; the incident record is too recent, too contested in its attributions, and too fast-moving for that. Its contribution is a framework – a way of thinking about seabed deterrence that organises the disparate instruments now being improvised into a coherent strategic logic, and that identifies the conditions under which each can be expected to work. The framework is offered in the conviction that the Baltic states are at present acquiring capabilities faster than they are acquiring a theory of how those capabilities deter, and that the gap between the two is where strategic surprise tends to live.

Three limits of scope should be stated at the outset. First, the article concerns the deterrence of seabed coercion below the threshold of armed conflict; it does not address the destruction of undersea infrastructure in open war, which raises distinct questions of targeting and defence to which the grey-zone logic analysed here does not apply. Second, it treats the merchant vessel as the proximate instrument and is concerned with deterring its use; the deeper problem of attributing and deterring the sponsoring state, which shelters behind the vessel’s deniability, is engaged only where the two questions intersect, and a fuller treatment of state-level attribution lies beyond its compass. Third, the framework is developed for the Baltic, whose semi-enclosed geography, dense infrastructure, and ring of aligned littoral states make it at once the most acute case and the most favourable environment for the integrated response the article recommends; the extent to which the framework travels to more open and less politically homogeneous waters is a question it raises but does not resolve.

2. The seabed as a strategic problem: a genealogy

Strategic novelty is almost always less complete than it first appears, and the seabed contest is best understood not as a rupture but as the latest movement in a very old argument about the control of the sea. The maritime-strategic tradition has long distinguished two contrary conceptions of that control. The first, associated above all with Mahan (1890), holds that the object of naval strategy is command of the sea, won by concentrating a battle fleet capable of destroying or neutralising the enemy’s, so that one’s own commerce and communications pass freely while the adversary’s are denied. The second, associated with Corbett (1911), is a corrective: command of the sea is normally disputed rather than absolute, the proper object of the weaker naval power is to deny the stronger the use of the sea rather than to seize command of it, and maritime strategy serves limited political ends through blockade, commerce warfare, and the protection of one’s own lines of communication. The distinction between sea control and sea denial, descended from this debate, remains the organising axis of maritime-strategic thought.

The seabed extends this argument into a third dimension. The lines of communication that Corbett took to be the object of maritime strategy were, in his day, the surface routes along which ships carried goods and despatches. In the twentieth century those communications descended beneath the surface, first as the cables that carried telegraph and then telephone traffic between continents, and later as the pipelines that carried hydrocarbons and the high-capacity fibre that carries the overwhelming majority of the world’s data. The strategic logic of attacking an adversary’s communications – the logic Corbett analysed under the heading of commerce warfare – did not change; its object descended to the seabed. What is new is not the impulse to cut an enemy’s communications but the location and character of the communications now most worth cutting, and the fact that they are owned and operated very largely by private firms and carry the traffic of friend, foe, and neutral indifferently (Bueger & Liebetrau, 2021).

The proximate ancestor of the present contest is the undersea competition of the Cold War. Once the submarine emerged as a strategic instrument, naval warfare acquired a two-sided “hider–finder” character: the submarine sought to exploit the opacity of the ocean to hide, and anti-submarine warfare sought to make the ocean transparent enough to find it. Coté’s (2003) study of what he called the “third battle” – the United States Navy’s sustained Cold War effort against Soviet submarines – showed that this was a winnable competition, prosecuted through passive sonar, fixed undersea surveillance arrays, and the patient accumulation of acoustic intelligence, and that the side that invested in detection could, for a time, deny the hider the concealment on which its strategy depended. The lesson of the third battle is directly relevant to the seabed: the undersea environment is not inherently a sanctuary for the aggressor, but rendering it transparent is expensive, technically demanding, and never complete.

What distinguishes the present, fourth contest from its predecessors is that the object of attack is now infrastructure fixed to the seabed rather than a vessel moving through the water, and that the attacker is most often not a submarine or a naval combatant at all but an ostensibly civilian merchant ship engaged in lawful navigation. This combination is what makes the seabed contest analytically distinctive. The fixed character of the target removes the hider’s advantage from the defender’s asset – a cable cannot manoeuvre or hide – and confers it instead on the attacker, whose instrument is the everyday traffic of a busy sea. The contemporary seabed competition has been recognised as a constituted strategic domain with its own emerging doctrine (Matisek et al., 2025), and the Baltic, with its density of infrastructure, its shallow and confined waters, and its heavy merchant traffic, has become its first sustained theatre. The genealogy matters because it locates the problem: the seabed contest inherits from the Cold War the truth that detection is the decisive variable in the undersea environment, but it inverts the Cold War’s geometry, so that the side investing in transparency is now the defender of fixed infrastructure rather than the hunter of a mobile adversary, and the concealment to be defeated is not acoustic but legal and evidentiary – the deniability of an ordinary ship doing an ordinary thing.

A second feature distinguishes the fourth contest from the third, and it bears directly on deterrence. In the Cold War undersea competition the hider was a naval combatant, an instrument of the state whose very presence was an act of the state and could be answered as such. The seabed aggressor of the present is, characteristically, not a warship but a merchant vessel – a tanker or bulk carrier of opaque ownership, flying a flag of convenience, engaged in the lawful navigation that the law of the sea exists to protect. The instrument of coercion has been privatised and civilianised, and with that change the act has been removed from the register of overt state action and placed in the deniable space between accident and aggression. This is the maritime instance of a broader contemporary pattern in which the means of strategic harm are dispersed away from the formal military instruments of the state, and it is the source of much of the deterrence difficulty analysed below: one cannot answer a merchant ship as one would answer a warship, and the aggressor has chosen its instrument precisely for that reason. The counter-thesis – that the progressive transparency of the ocean will eventually strip the merchant vessel of its deniability as surely as passive sonar once stripped the submarine of its concealment – contains an important truth, examined in Section 4; but transparency, as that section argues, defeats concealment without defeating deniability, and the two are not the same.

3. Why the deterrence dyad fails on the seabed

Deterrence theory in its classical form rests on a distinction, formalised by Snyder (1961), between two ways of dissuading an adversary from a course of action. Deterrence by punishment threatens to impose costs so high that the expected value of the action becomes negative even if it succeeds; deterrence by denial threatens to prevent the action from succeeding, so that its expected value is negative because it cannot achieve its object. The two are analytically independent – one may deter by either or both – and the great body of Cold War deterrence theory, from Brodie (1946) onward, elaborated their requirements: the survivability of retaliatory forces, the credibility of threats, the communication of resolve (Schelling, 1966). The conventional-deterrence literature extended the framework to non-nuclear contingencies, where denial – the prospect that an attack will be defeated on the battlefield – does much of the work that the threat of unacceptable retaliation does in the nuclear case (Mearsheimer, 1983; Wirtz, 2018).

Applied to the seabed, each limb of this dyad encounters a structural obstacle.

Consider punishment first. To punish, one must know whom to punish, and one must be willing and able to impose costs sufficient to outweigh the benefit the aggressor expects. Seabed coercion defeats both conditions. The attribution problem is not, as in some domains, a matter of technical forensics alone but of a deeper indeterminacy: an anchor that drags across a cable produces the same physical signature whether the dragging was deliberate or negligent, and the vessels involved frequently fly flags of convenience, belong to layered and often offshore ownership structures, and can plausibly claim – as several have – that the damage resulted from bad weather, defective equipment, or poor seamanship. The Vezhen case of January 2025, in which Swedish prosecutors concluded that a cable break had been caused not by sabotage but by an anchor dropped through a combination of heavy weather, equipment defects, and suspected poor seamanship, illustrates the point precisely: the line between sabotage and accident was drawn only after the bulk carrier had been detained and examined (Åklagarmyndigheten, 2025). Attackers thus enjoy deniability of an unusually robust kind. It is not that the attacker hides the act – the act is plainly visible – but that the act is intrinsically ambiguous as to intent, and intent is what punishment must establish. The cyber-strategic literature has analysed the analogous difficulty as the attribution problem, and Lindsay (2015) has shown that attribution is less a binary fact than a contested, time-consuming, and politically freighted process whose very slowness undermines the credibility of a deterrent threat that depends upon it (see also Rid & Buchanan, 2015). The seabed reproduces this difficulty in a maritime register, and arguably worsens it, because the ambiguity is not merely about the identity of the actor but about whether a wrongful act occurred at all.

Even where attribution is achieved, the second condition – a credible and proportionate punishment – is hard to satisfy, because seabed acts are deliberately calibrated to remain below the threshold of armed attack. A severed cable is repaired, at some cost and after some delay, by one of the small global fleet of cable-repair ships; no one dies, and no territory is seized. To threaten military retaliation for an act of this magnitude is scarcely credible, and the threat’s incredibility is itself part of the aggressor’s calculation. Here the seabed problem joins a wider family of sub-threshold or “grey-zone” challenges that the strategic literature has found systematically resistant to deterrence. Kello (2017) argued that the most consequential contemporary aggression occurs precisely in the space below the threshold of war, generating strategic disruption while denying the target a casus belli; Rid (2013) had earlier insisted that most of what is loosely called cyber “war” is better understood as the extension of sabotage, espionage, and subversion – acts that states have always found difficult to deter because they are individually minor, cumulatively serious, and never quite worth a war. The seabed campaign is the maritime instance of this pattern. Its acts are individually deniable and minor, and cumulatively they erode the security and confidence of the target society; but no single act crosses the line at which the threat of decisive punishment becomes credible. Cormac and Aldrich (2018) have described the contemporary normalisation of “implausible deniability” – covert action conducted in a manner that does not even seriously attempt to deceive, but exploits the target’s inability to respond proportionately – and the shadow-fleet anchor-drag is a near-perfect specimen of the type.

Denial fares no better, for a reason that is brutally physical. To deny is to prevent the act from succeeding, and on the seabed prevention runs into the sheer extent of the thing to be defended. The Baltic alone is crossed by a dense and growing web of power interconnectors, gas pipelines, and data cables; globally there are several hundred cable systems spanning well over a million kilometres (Insikt Group, 2025). These run through waters open to lawful navigation under the freedom-of-navigation regime, and they cannot be physically guarded along their length by any feasible naval force. The asymmetry of cost is extreme: the attacker risks a merchant vessel’s anchor and a plausible alibi, while the defender would have to escort, monitor, or harden infrastructure measured in thousands of kilometres. Denial in the strong sense – preventing the act – is therefore infeasible at scale. What remains possible is a weaker, indirect denial that operates not on the act but on its consequences: building enough redundancy, rerouting capacity, and rapid-repair capability into the network that the severing of any individual link fails to produce the disruption the attacker seeks. This is denial by resilience rather than by protection, and it is the seabed analogue of the logic that animates the Nordic tradition of total defence, which seeks to make a society so robust to disruption that an adversary cannot achieve strategic effect by attacking it (Fiala, 2020; Wither, 2020). I return to this possibility in Section 6.

A further dimension compounds the difficulty and connects the seabed to the wider strategy of economic coercion. The submarine cable network is not a neutral lattice but a structure of concentration and chokepoints: a handful of landing sites and trunk routes carry a disproportionate share of a region’s connectivity, so that the severing of a few critical links can produce effects out of proportion to the physical damage. Farrell and Newman (2019) have shown how asymmetric network structures of this kind can be weaponised, conferring on whoever controls or can interdict the critical nodes a coercive leverage that the network’s nominal openness disguises. The seabed cable network is a textbook instance: its very efficiency, the concentration of traffic onto a few high-capacity routes, is also its vulnerability, and an adversary who maps the network’s chokepoints can threaten disproportionate disruption at minimal cost. That the same cables carry the traffic of the aggressor’s own sponsor as well as the target’s only partially mitigates the threat, for the sponsor of seabed coercion is typically far less dependent on the specific links it attacks than the target is. The deterrence implication is sobering: the structural vulnerability is built into the network and cannot be engineered away at acceptable cost, which is why the difficulty of deterring its exploitation has invited comparison with the equally intractable problem of deterring attacks in cyberspace, where a similar combination of concentration, openness, and deniability has frustrated every attempt to import classical deterrence wholesale (Libicki, 2009).

The failure of the classical dyad does not mean that the seabed cannot be deterred; it means that deterrence must be sought through a wider repertoire of instruments than punishment and denial alone. The cyber and cross-domain deterrence literatures, confronting structurally similar difficulties, have developed exactly such a repertoire. Nye (2017) proposed that deterrence in cyberspace operates not through two mechanisms but four: punishment and denial, but also entanglement – the dense interdependence that makes an attack self-harming because the attacker shares in the damage it inflicts – and the normative taboo that raises the reputational cost of proscribed action. The cross-domain deterrence scholarship has gone further, arguing that deterrence in an era of complexity must combine instruments across domains and that no single mechanism, applied in isolation, is adequate to a sub-threshold, multi-domain challenge (Gartzke & Lindsay, 2019). The next two sections develop the two instruments that the Baltic case throws into sharpest relief – deterrence by detection and an emergent deterrence by legal-jurisdictional cost – and Section 6 returns to entanglement and to denial-by-resilience as the remaining elements of a layered posture.

4. The attribution-to-response threshold: detection deters detection, not action

Faced with the failure of punishment and denial, the Baltic states and NATO have in practice turned to a third instrument: detection. The reasoning is intuitive and, as far as it goes, sound. If the seabed aggressor depends for success on the deniability of an act that looks like ordinary navigation, then making the act visible – saturating the relevant waters with surveillance so that every vessel’s track, every anchor deployment, every loiter over a cable is observed and recorded – attacks the aggressor’s central advantage. This is the logic of “deterrence by detection”, a concept developed in the great-power-competition context by Mahnken, Sharp, and Kim (2020), who argued that persistent, networked intelligence, surveillance, and reconnaissance – particularly from long-endurance unmanned systems – could deter fait-accompli aggression by denying an adversary the secrecy on which a quick, unobserved seizure depends. NATO’s Baltic Sentry, with its frigates, maritime patrol aircraft, and naval drones, is in substance an application of this logic to the seabed: an effort to render the surface above the infrastructure transparent enough that no anchor can be dragged unseen (Braw, 2025; Majcin, 2025).

The turn to detection is correct as far as it goes, but it harbours a conceptual trap that the Baltic experience has begun to expose and that, I argue, is the pivot of the whole problem. Deterrence by detection, applied to the seabed, deters detection – it makes the act observable – but observation is not the same as prevention, and an observed act is not thereby a deterred act. The original formulation of deterrence by detection in the fait-accompli context relied on an implicit assumption that did not need to be stated: that an aggressor caught in the act of seizing territory would face the political and military costs of an overt, attributed act of war, and that the prospect of those costs, made unavoidable by detection, would deter. Detection deterred because it converted a deniable fait accompli into an undeniable casus belli, and the casus belli carried its own punishment. On the seabed this assumption fails. Detecting that a particular vessel dragged its anchor across a particular cable does not convert the act into a casus belli, because the act remains sub-threshold and the intent remains deniable. The aggressor caught on radar and satellite imagery loitering over a cable can still claim accident; the detection establishes the fact of the vessel’s presence and movement, not the intent that punishment would require, and it does nothing to lower the threshold below which retaliation is not credible. Detection, in short, solves the surveillance problem while leaving the response problem untouched.

This is the attribution-to-response threshold: the point at which improved detection, having furnished knowledge of who did what, runs into the separate and unsolved question of what may credibly be done about it. The two problems are routinely conflated, in policy discourse and in the design of capabilities, under the comfortable assumption that to see is to deter. The Baltic record refutes the conflation. Surveillance over the Baltic has improved markedly since 2022, and yet the incidents have continued, because the aggressor’s calculation turns not on whether the act will be seen but on whether being seen will be costly – and detection, by itself, alters the former without altering the latter. A vessel whose master knows that dragging an anchor across a cable will be observed, but also knows that observation will yield at most a diplomatic protest, a contested investigation, and the eventual release of the ship, has not been deterred; it has merely been watched.

It follows that detection confers strategic effect only when it is bound, in advance, to a credible and pre-declared response – when the observed act triggers a consequence the aggressor has been told to expect and has reason to believe will follow. The element that converts surveillance into deterrence is therefore not the sensor but the commitment: the prior, public, and credible declaration that vessels detected behaving in specified ways over critical infrastructure will face specified consequences, whether boarding and detention, denial of port access, insurance and flag-state pressure, or coordinated allied sanction. Schelling’s (1966) analysis of the commitment as the core of coercion is directly applicable: what deters is not capability alone but the binding of capability to a threat the adversary believes. Detection supplies the capability – the certainty of being seen – but only the pre-declared, credible response supplies the threat. The Baltic states have built the sensors faster than they have built the commitments, and the gap between the two is precisely where the campaign has continued.

There is a further subtlety. Even a credible commitment to respond will not deter unless the response is itself proportionate to a sub-threshold act and lawful as a matter of international law, for a disproportionate or unlawful response is not credible – the aggressor will not believe that a state will, for instance, sink a merchant vessel over a repairable cable. The response problem thus folds back into the threshold problem: the consequence that detection triggers must be severe enough to deter yet measured enough to be credible and lawful for a sub-threshold act. It is exactly this requirement – a consequence calibrated to the grey zone – that the emergent practice of vessel detention has begun to meet, a development to which Section 5 turns.

The credibility requirement also points to the value of collective response. A single coastal state contemplating the detention of a foreign merchant vessel, or the denial of port access to a flagged operator, faces both legal exposure and the prospect of bilateral retaliation, and may for that reason hesitate – a hesitation the aggressor anticipates and exploits. A consequence imposed collectively, by a coalition of states acting on a pre-agreed schedule, is both more credible and more bearable: more credible because the aggressor cannot pick off a lone actor, and more bearable because the legal and political costs are shared. The post-accession concentration of aligned states around the Baltic is, in this respect, a deterrence asset of the first importance, for it makes possible exactly the collective pre-declaration of consequences that the credibility of detection-bound-to-response requires. The deterrent value of Baltic Sentry, on this reading, lies less in the surveillance it provides – valuable though that is – than in its character as a visible, collective commitment: a standing allied presence whose existence signals that detected acts will meet a coordinated rather than a national response. Whether that signal is matched by an actual, pre-agreed schedule of consequences is the question on which its deterrent value turns, and it is here that declaratory policy has lagged behind operational deployment.

Maritime history offers a partial precedent. In August 1937 Italian submarines began torpedoing merchant ships across the Mediterranean in unacknowledged attacks presented as Spanish Nationalist, although known everywhere to be Italian (Smoke, 1977, pp. 55, 327). At Nyon in September, Britain, France, and seven other states did not make attribution the condition of response: they agreed that any submarine attacking non-Spanish merchant ships contrary to the rules of submarine warfare would be “counter-attacked and, if possible, destroyed”, and organised naval patrols to enforce it (Nyon Arrangement, 1937, paras. II, IV). Smoke (1977, pp. 335–336) judged the arrangement “an exercise in virtually pure deterrence”, and one that held only while forces remained committed to it: when the patrols were reduced in January 1938, the attacks resumed. A proportionate collective consequence attached to specified conduct rather than to the actor can thus deter a deniable campaign without first naming its sponsor, but only while the capability behind it remains on station.

5. The emergent legal-jurisdictional deterrent

The most genuinely novel feature of the Baltic record is not technological but legal. When Finnish authorities boarded the tanker Eagle S on the night of 25–26 December 2024 and investigated the matter as aggravated criminal mischief, they broke with the relatively muted earlier Baltic responses: they asserted coastal-state jurisdiction over a vessel suspected of damaging seabed infrastructure, and imposed upon it the tangible costs of seizure, delay, investigation, and reputational exposure (Braw, 2025; Majcin, 2025; Police of Finland, 2025). Sweden’s detention of the Vezhen a month later, even though it ended in the vessel’s release, confirmed the pattern: the Baltic states had begun to reach for the one instrument that is at once proportionate to a sub-threshold act and capable of imposing real cost – the detention of the suspect vessel itself.

This is, in the framework of this article, the emergence of a deterrence by legal-jurisdictional cost: an instrument that sidesteps the attribution-to-response threshold by substituting a legal-administrative consequence, calibrated to the grey zone, for the military retaliation that the sub-threshold character of the act renders non-credible. Its logic is distinct from both punishment and denial in the classical sense. It does not threaten unacceptable retaliation, and it does not prevent the act; it raises the expected cost of the instrument – the merchant vessel – by making its detention, and the disruption of its commercial employment, a foreseeable consequence of behaving suspiciously over critical infrastructure. For a shadow-fleet tanker operating on thin margins under a flag of convenience, the prospect of weeks under detention, of crew investigation, and of heightened scrutiny at future ports is a cost that bears directly on the economics of the activity. The instrument works, where it works, by attacking the deniability that defeats punishment: it does not require proof of intent sufficient for a war, only suspicion sufficient for a boarding, and it shifts the burden of the ambiguity from the defender to the vessel.

The legal foundations of this instrument are, however, contested and incomplete, and the framework would be dishonest if it did not say so. The international law of the sea was not designed for seabed coercion. The United Nations Convention on the Law of the Sea (United Nations, 1982) guarantees the freedom to lay submarine cables and pipelines and the freedom of navigation, and it addresses damage to cables chiefly through Article 113, which obliges each state to make it a punishable offence for a vessel flying its flag, or a person subject to its jurisdiction, wilfully or through culpable negligence to break or injure a submarine cable. The criminalisation duty thus rests primarily on the flag state – which, in the case of a shadow-fleet vessel registered for convenience, is precisely the state least likely to prosecute. The coastal state whose infrastructure has been damaged has, beyond its territorial sea, only limited and contested enforcement competence; the older Convention for the Protection of Submarine Telegraph Cables of 1884, though it permits a warship to demand proof of a suspect vessel’s nationality, shares the same dependence on flag-state prosecution. The result is what scholars have termed a prosecution gap: a structural mismatch between the state with the will to act and the state with the clearest jurisdiction to prosecute (Bueger, Liebetrau, & Franken, 2022; Neal, 2026). The dismissal in October 2025 of the Finnish case against the Eagle S on jurisdictional grounds is a concrete instance of the gap: the will to impose cost outran the settled law of jurisdiction. That the Helsinki Court of Appeal reversed the dismissal in August 2026, in a ruling not yet final, shows how contested the question remains (Helsingin hovioikeus, 2026).

The gap is not, however, unbridgeable, and the direction of its bridging is visible in the Baltic states’ own practice. Three avenues are available, and they are complementary rather than alternative. The first is the harmonisation of national criminal and maritime-enforcement legislation among the Baltic littoral states, so that an act damaging infrastructure anywhere in the sea attracts a predictable consequence regardless of which state’s waters or which vessel’s flag is involved. The second is the assertion, through coordinated and repeated practice, of an expanded coastal-state competence to inspect and detain vessels reasonably suspected of damaging critical infrastructure within the exclusive economic zone – a competence that the law of the sea does not at present clearly grant beyond the territorial sea, but to whose establishment sustained and concerted state practice can, over time, contribute. The third is the use of mechanisms outside the law of the sea altogether: port-state control, insurance and classification-society pressure, sanctions on owners and operators, and the targeting of the shadow fleet’s commercial enablers. None of these is sufficient alone, and each carries legal risk; but their coordinated deployment by a bloc of aligned states is the most plausible route by which the improvised seizure of 2024 becomes the settled and credible consequence that deterrence requires.

The strategic significance of the vessel-detention turn is therefore double-edged. On one hand, it is the most promising deterrent yet improvised, because it is the only instrument that imposes real, proportionate, and lawful-in-principle cost on the actual instrument of seabed coercion. On the other, its legal foundations are unsettled, and an instrument whose lawfulness is contested is an instrument whose credibility – and therefore whose deterrent value – is correspondingly uncertain. The development of seabed deterrence will turn in large part on whether the Baltic and Nordic states can consolidate the detention practice into a settled and collectively endorsed legal doctrine: whether, through coordinated national legislation, regional agreement, and the progressive development of the law of the sea, they can convert an improvised seizure into a predictable and lawful consequence that an aggressor must expect. This is a task of legal statecraft as much as of strategy, and it is one for which the post-accession concentration of like-minded states around a single sea is unusually well suited. The instrument that has the greatest deterrent potential is also the one most dependent on a legal consolidation that has not yet occurred.

6. A layered posture for the post-accession Baltic

The argument so far has been largely diagnostic: each instrument, taken alone, fails or falls short. Punishment founders on deniability and the sub-threshold character of the act; denial founders on the physical extent of the infrastructure; detection deters detection but not action; and the legal-jurisdictional deterrent, though the most promising, rests on contested foundations. The constructive claim of this article is that the appropriate response to this diagnosis is not to seek a single decisive instrument – there is none – but to integrate the available instruments into a layered posture whose elements compensate for one another’s weaknesses. This is the seabed application of the cross-domain deterrence insight that, against a sub-threshold and multi-domain challenge, deterrence must be sought through the combination of instruments rather than the perfection of any one (Gartzke & Lindsay, 2019). Four layers may be distinguished.

The first layer is detection bound to pre-declared response. The lesson of Section 4 is that surveillance is necessary but not sufficient, and that its strategic value depends on a prior, public, and credible commitment specifying the consequences that detected behaviour will trigger. The Baltic states have built the sensing layer – Baltic Sentry, national coastguard and naval assets, commercial and allied space-based monitoring – to a level that makes the relevant waters substantially transparent. What remains underdeveloped is the commitment layer: a pre-declared, collectively endorsed schedule of consequences, calibrated to the grey zone, that converts the certainty of being seen into the expectation of being made to pay. The integration of detection with response is the first and most urgent requirement, because it is the cheapest – the sensors largely exist – and because it is the layer at which the attribution-to-response threshold is crossed.

The second layer is the legal-jurisdictional deterrent analysed in Section 5: the consolidation of vessel detention from an improvised act into a settled, collectively endorsed doctrine. The post-accession Baltic offers conditions for this that exist nowhere else – a semi-enclosed sea ringed almost entirely by NATO and EU members with closely aligned interests, dense institutional cooperation, and the legal capacity to harmonise national legislation and to advance, through coordinated practice, the progressive development of the relevant international law. The strategic prize is a regime in which a vessel that behaves suspiciously over critical infrastructure can expect, with high probability, to be detained, investigated, and subjected to insurance, flag-state, and port-access pressure – a predictable and lawful consequence that closes the prosecution gap through regional cooperation rather than waiting for the universal law of the sea to catch up.

Taiwan’s practice shows the reach and the limit of this layer. Following amendments to seven statutes, promulgated on 5 January 2026, damage to undersea telecommunications and power cables and gas and water pipelines carries uniform penalties –1–7 years’ imprisonment for intentional damage, 3–10 where there is intent to endanger national security or social stability, and punishment for negligent damage – and a vessel used for intentional damage must be confiscated whether or not it belongs to the offender (Office of the President, Republic of China [Taiwan], 2026). Taiwanese courts had already sentenced the master of the Togo-flagged Hong Tai 58 to three years’ imprisonment for damaging the Taiwan–Penghu No. 3 cable in February 2025, in a case that raised little jurisdictional difficulty because the cable lay inside Taiwan’s baselines (Chiang & Liao, 2025). Such legislation raises the cost of misusing vessels where coastal-state jurisdiction is secure; it cannot by itself close the prosecution gap beyond the territorial sea, where the Eagle S case arose.

The third layer is entanglement and denial-by-resilience, which operate not on the act but on its consequences. Nye’s (2017) entanglement mechanism is weaker in the seabed context than in the cyber, because the shadow-fleet operators who serve as instruments of seabed coercion are, by design, only loosely entangled in the economy they damage; but entanglement is not wholly absent, for the wider sponsor’s stake in the freedom of the seas and in the orderly functioning of maritime commerce can be made a point of leverage. More consequential is denial-by-resilience: the deliberate construction of redundancy, rerouting capacity, and rapid-repair capability into the Baltic’s energy and data networks, so that the severing of any individual link fails to produce the disruption the aggressor seeks. This is the seabed expression of the Nordic total-defence tradition, which has long held that the most reliable defence against an adversary’s attempt to coerce a society through disruption is to make the society robust enough that the disruption fails to coerce (Fiala, 2020; Wither, 2020). Resilience deters in the specific sense that it removes the strategic pay-off of the act: an aggressor who knows that cutting a cable will inconvenience but not cripple, and that the cable will be swiftly repaired, has a weaker incentive to cut it. The contemporary scarcity of cable-repair vessels and the long average time to repair are, in this light, not merely operational deficiencies but strategic vulnerabilities, and their remedy – a regional rapid-repair capability – is a deterrent investment as much as a maintenance one.

The deterrent logic of resilience deserves emphasis because it is the most counter-intuitive and the most neglected. Deterrence is ordinarily conceived as operating on the adversary’s expected costs; resilience operates instead on the adversary’s expected benefits, removing the strategic pay-off that makes the act worth attempting. An adversary contemplating the severing of a Baltic cable must weigh not only the probability of being seen, named, and having its vessel detained, but also the probability that the act will simply fail to achieve its purpose – that the data will reroute, the power will flow by another path, and the cable will be repaired in days rather than weeks. Each of these is a deliberate investment: in network redundancy and diverse routing, in the spare capacity of interconnectors, and above all in a regional rapid-repair capability that the present scarcity of cable-repair vessels conspicuously lacks. The slowness and fragility of cable repair is, in this light, not a technical footnote but a strategic vulnerability, because a network that heals quickly is a network whose disruption does not coerce. This is the seabed expression of the total-defence proposition that a society robust enough to absorb an attack has, by that robustness, denied the attacker the effect it sought – and it is the layer at which the Nordic-Baltic states’ deep institutional tradition of comprehensive, whole-of-society preparedness gives them an advantage that no adversary can easily offset.

The fourth layer is attribution and the contest over the narrative. Because the central advantage of the seabed aggressor is deniability, the patient construction of attribution – forensic, intelligence-based, and legal – is itself a deterrent activity, not because attribution enables punishment (it rarely will) but because it strips the aggressor of the plausible-accident cover on which the activity depends and because it underwrites the legal-jurisdictional and detection-bound-to-response layers. Here the seabed problem connects to the wider contemporary contest over provenance and attribution that the strategic literature has analysed in the information and cyber domains, where the capacity to establish and to communicate convincingly who did what has become a strategic instrument in its own right (Lindsay, 2015; Rid & Buchanan, 2015). The Baltic states’ investment in seabed forensics, in the rapid recovery and matching of anchors and damage signatures, and in the collective communication of attribution judgements is, properly understood, part of the deterrent architecture, because it raises the probability that an act will be not merely seen but named – and naming, repeated and collective, is the precondition of every other consequence.

These four layers share a feature that the analysis has so far held implicit and that must now be made explicit: each depends, for its execution, on actors the state does not command. The cables and pipelines of the Baltic are owned and operated overwhelmingly by private firms – telecommunications carriers, energy utilities, and the consortia that finance and lay new infrastructure – and it is they who decide where links are routed, how much redundancy is built in, which repair contracts are held, and what monitoring is installed. A deterrence posture for the seabed is therefore unavoidably a public–private construction, and its weakest joint is the seam between the state’s strategic interest in resilience and detection and the private operator’s commercial interest in cost. The state may want the diverse routing and spare repair capacity that the operator, absent regulation or subsidy, has no commercial reason to provide; it may want the sensor data and incident reporting that the operator has reason to withhold. The integration of private operators into the deterrence architecture – through regulation, through the subsidy of strategic redundancy, through information-sharing arrangements, and through the inclusion of critical-infrastructure firms in national defence planning – is thus not an administrative afterthought but a structural requirement of every layer, and one for which the Nordic tradition of comprehensive defence, with its long habit of binding civil and private actors into the national defence effort, is once again unusually well prepared (Wither, 2020).

No one of these four layers deters seabed coercion. Detection without response merely watches; the legal-jurisdictional deterrent without settled law is contested; resilience without detection and response invites endless probing; attribution without a consequence to which it can be attached is a forensic exercise without strategic effect. Their integration, however, produces something the classical dyad could not: a posture in which the aggressor confronts the certainty of being seen, the probability of being named, the prospect of having its instrument detained, and the likelihood that the act, even if executed, will fail to produce the disruption it sought. The deterrent effect resides not in any single layer but in their interaction, and the strategic task of the post-accession Baltic is the unglamorous one of building and integrating all four. This conclusion is, in one sense, deflationary: it offers no silver bullet, and it asks of the Baltic states a sustained, multi-instrument effort rather than a single decisive capability. But the history of strategy is consistent on the point that against a sub-threshold, deniable, and physically undefendable challenge, it is precisely the integration of imperfect instruments, rather than the perfection of any one, that does the work.

7. Conclusion

The Baltic seabed has become, since 2022, the proving ground for a strategic problem that the wider world will increasingly share, as the dependence of every advanced economy on undersea cables and pipelines deepens and as the deniable severing of those links becomes a recognised instrument of sub-threshold coercion. The policy response so far has been energetic but under-theorised: a proliferation of surveillance, a scattering of vessel detentions, and a general invocation of deterrence whose conceptual content has remained largely unexamined. This article has tried to supply that content. Its argument has been that seabed coercion defeats the classical deterrence dyad along three axes at once – deniability defeats punishment, the sub-threshold character of the act defeats the credibility of retaliation, and the physical extent of the infrastructure defeats denial – and that a workable deterrence must therefore be assembled from a wider repertoire: detection bound to a pre-declared response, an emergent deterrent by legal-jurisdictional cost, denial-by-resilience drawn from the total-defence tradition, and the patient construction of attribution.

The pivotal analytical claim has been that deterrence by detection, the instrument to which the Baltic states have most readily turned, deters detection rather than action, and confers strategic effect only when surveillance is bound in advance to a credible and proportionate response – that the sensors have been built faster than the commitments, and that the gap between them is where the campaign has continued. The most promising development in the record, the turn to vessel detention, has been read as the emergence of a legal-jurisdictional deterrent uniquely suited to the grey zone because it is at once proportionate and capable of imposing real cost; but its dependence on a contested and incomplete law of the sea, dramatised by the conflicting jurisdictional rulings in the Eagle S case, marks the limit of what improvisation can achieve and the work of legal consolidation that remains.

The framework advanced here is deliberately modest in its claims. It does not predict that seabed coercion can be eliminated, and it does not promise that the four-layer posture will end the Baltic campaign; deniable, sub-threshold aggression is, by its nature, never fully deterred, only managed and raised in cost. What the framework offers is a way of thinking that replaces the reflexive call for deterrence with an analysis of which instruments deter, under what conditions, and in what combination – and that locates, in the attribution-to-response threshold and the unconsolidated legal-jurisdictional deterrent, the two specific points at which the present Baltic effort is incomplete. If the analysis is correct, the most valuable next steps are not technological but institutional and legal: the binding of existing surveillance to a pre-declared collective response, and the consolidation of vessel detention into a settled regional doctrine. Both lie within the reach of the post-accession Nordic-Baltic community, and both are cheaper than the capabilities the search for a single decisive answer would otherwise pursue.

For the post-accession Nordic-Baltic community, the argument carries a specific implication. The transformation of the Baltic into a sea ringed almost entirely by aligned states is not merely a strategic liability – a concentration of vulnerable infrastructure under collective responsibility – but a strategic opportunity, because the conditions for building and integrating the four-layer posture, and above all for consolidating the legal-jurisdictional deterrent into a settled regional doctrine, exist around the Baltic as they exist almost nowhere else. Collective responsibility, in this domain, means a standing division of labour rather than a larger naval presence: the aligned states’ coastguards, police, and prosecutors undertake surveillance, boarding, and prosecution under a jointly pre-declared schedule of consequences, with allied navies in support, while the private firms that own, operate, and repair the infrastructure share responsibility for its redundancy and for reporting suspicious activity. The deterrence of seabed coercion will not be achieved by any single capability, and the search for one is a distraction. It will be achieved, if at all, by the patient integration of imperfect instruments into a posture whose elements compensate for one another’s weaknesses – which is to say, by treating the seabed not as a novel domain demanding novel answers but as the latest theatre of the very old maritime task of protecting the communications on which a society depends. That task is now Europe’s as much as the Baltic’s, for the dependence on undersea infrastructure that the Nordic-Baltic states confront most acutely is shared, in degree, by every maritime economy; and the framework by which they learn to deter seabed coercion in their own enclosed sea may yet prove the template by which the wider alliance comes to defend the cables and pipelines on which all its members have come to depend.