Sovereignty, NATO Article 5, NIS2, and Covert Attacks on Submarine Cables

Recent incidents in the Baltic Sea have highlighted the vulnerability of undersea cables, both for communication and electric power transmission, to covert attacks by civilian vessels. These events underscore the complexities of attributing responsibility and the challenges they pose to sovereignty[1], international law, and security frameworks like NATO's Article 5[2] and the EU's NIS2 Directive.

The Strategic Targeting of Submarine Cables

Submarine cables are critical components of global infrastructure, serving as the backbone for communication and energy transfer. They are particularly attractive targets in hybrid warfare due to their strategic importance. Communication cables, which carry 95% of global internet traffic, are vital for economic stability, national security, and global connectivity. Similarly, electric power transmission lines[3] are essential for energy security, especially in regions like Northern Europe where interconnected grids depend on submarine cables for cross-border power supply.?

Recent incidents have exposed these vulnerabilities. In November 2024, two undersea internet cables in the Baltic Sea were disrupted. Investigations pointed to the Chinese-flagged cargo ship?Yi Peng 3, suspected of dragging its anchor for over 100 miles, severing the cables. While direct evidence linking the Chinese government is lacking, authorities believe the crew may have been influenced by Russian intelligence. This incident has heightened tensions with NATO, as member countries seek access to the ship and crew for further investigation. Similarly, on December 25, 2024, the Estlink 2 submarine cable, which transmits electricity between Finland and Estonia, was severed. Finnish authorities suspect that the Russian oil tanker?Eagle S, part of Russia's "shadow fleet," caused the damage, possibly by dragging its anchor. The vessel was intercepted and boarded by Finnish officials on charges of "aggravated sabotage." Repairing the 170 km cable is expected to take months, raising concerns about power shortages in Finland during winter.

?Sovereignty and Hybrid Threats

Covert attacks targeting submarine cables challenge the very notion of national sovereignty. These attacks operate within a legal and operational grey zone. Under international law, particularly the United Nations Convention on the Law of the Sea (UNCLOS)[4], protections for submarine cables are limited. While territorial[5] waters and Exclusive Economic Zones (EEZs)[6] fall under the jurisdiction of the coastal state, proving state responsibility for covert sabotage is a formidable challenge[7].?

The use of civilian vessels in these operations compounds the difficulty, as it provides plausible deniability for the states that sponsor such actions. Attribution often relies on circumstantial evidence, making it difficult to hold state actors accountable. These covert operations threaten sovereignty by undermining critical infrastructure that is essential for public services, national security, and economic stability.?

?NATO Article 5 and Collective Defense?

The applicability of NATO’s Article 5 to such incidents is complex. Article 5, which is the cornerstone of NATO’s collective defense, is invoked in response to an “armed attack” against a member state. While traditional military aggression is straightforward, hybrid threats involving covert sabotage blur the lines of what constitutes an armed attack.?

NATO has acknowledged that significant cyber[8] or physical disruptions could meet the threshold for invoking Article 5, provided their scale and intent justify it. However, the covert nature of these incidents, coupled with the lack of direct evidence implicating state actors, complicates collective defense responses[9]. Despite these challenges, NATO could issue collective warnings or conduct joint operations, such as enhanced maritime surveillance and security measures, to deter further attacks.?

?NIS2 Directive and Infrastructure Resilience

The EU’s NIS2 Directive[10] plays a critical role in addressing the vulnerabilities of critical infrastructure, including submarine cables. This directive mandates comprehensive risk assessments for operatores to identify vulnerabilities, particularly those posed by hybrid threats using civilian vessels. Operators of essential services are required to implement robust incident response measures and facilitate cross-border coordination to mitigate disruptions effectively.?

As hybrid attacks often involve both physical sabotage and cyber tactics, the directive emphasizes the integration of cybersecurity into the protection of critical infrastructure. The recent incidents in the Baltic and North Seas highlight the urgency of implementing NIS2 measures, particularly in regions where infrastructure is exposed to high-risk scenarios.?

Countering Covert Attacks

Addressing the threat of covert sabotage requires a comprehensive and coordinated strategy. Enhanced surveillance and monitoring systems, such as satellites and unmanned underwater vehicles (UUVs), are essential for detecting suspicious activities near submarine cable routes. Automatic Identification System (AIS) data and anomaly detection tools can help identify irregular ship movements that may signal covert operations.?

Advanced attribution mechanisms are also crucial. Investments in forensic[11] technologies can link covert actions to state actors, even when civilian vessels are used as proxies. Redundancy and resilience measures, such as creating backup cable routes and deploying tamper-detection systems, can help mitigate the impact of disruptions. Additionally, international cooperation between NATO, EU Member States, and private sector operators[12] is vital to ensure unified responses to these threats.?

Legal and Policy Recommendations?

The international community must address legal and policy gaps to counter these hybrid threats effectively. Amendments to UNCLOS could explicitly address the protection of submarine cables against hybrid attacks, ensuring greater accountability[13] in international waters. Deterrence strategies, including publicizing the consequences of such actions and conducting joint[14] military and cybersecurity exercises, can showcase readiness and discourage potential aggressors.?

Establishing rapid response teams specialized in submarine cable security can provide immediate support during incidents. These teams should include expertise in both physical and cyber domains to address the multifaceted nature of hybrid threats. Strengthened legal frameworks, combined with proactive security measures, are essential for safeguarding these vital infrastructures.?

The attacks on submarine communication and power cables represent a critical test for sovereignty, international law, and collective defense mechanisms like NATO’s Article 5. By leveraging the NIS2 Directive, enhancing surveillance, and strengthening international cooperation, NATO and the EU can safeguard these vital infrastructures against evolving hybrid threats. The recent incidents in the Baltic and North Seas are stark reminders of the urgency to act decisively in protecting the physical and digital lifelines of the modern world.

?

[1] Sovereignty, the supreme authority within a territory, encompasses internal governance and external recognition by other states. Historically, it evolved from medieval power-sharing to the Westphalian principle of non-interference and modern notions of popular sovereignty rooted in Enlightenment ideals. Philosophers such as Jean Bodin and Thomas Hobbes laid foundational theories, while international law recognizes state sovereignty under the UN Charter, tempered by global norms and obligations. Contemporary challenges include globalization, cyber sovereignty, and interventionism, with debates on its absolute or conditional nature shaping responses to modern threats like hybrid warfare and technological impacts on critical infrastructures.

[2] NATO's Article 5, part of the?North Atlantic Treaty or Washington Treaty (1949), directly interacts with the concept of sovereignty. It establishes the principle of collective defense among NATO member states, stating that: "[...] an armed attack against one or more of them in Europe or North America shall be considered an attack against them all […]" This article embodies mutual defense commitments while maintaining the sovereignty of individual member states.

[3] Submarine electricity cables are increasingly being targeted, potentially because of their role in renewable energy projects and the interconnectivity of national networks. Attacks can cause power cuts in various regions, economic disruption, geopolitical tensions and an impact on sovereignty. The interruption of electricity supplies jeopardises a state's ability to function, directly undermining its sovereignty. Attributing responsibility for attacks remains a challenge, especially in hybrid scenarios in which they may involve private actors, mercenaries or states operating covertly.

[4] https://www.un.org/depts/los/convention_agreements/texts/unclos/unclos_e.pdf

[5] Article 2?of UNCLOS states that a coastal state has sovereignty over its?territorial sea, which extends up to?12 nautical miles?from its baseline. This sovereignty includes the airspace over the territorial sea, its bed, and subsoil. However, this sovereignty is subject to certain limitations, including the right of?innocent passage?for foreign vessels, as provided under?Article 17.

[6] Article 56 of UNCLOS grants coastal states sovereign rights within their Exclusive Economic Zones (EEZ), which extend up to 200 nautical miles from the baseline. These rights are specifically for exploring, exploiting, conserving, and managing natural resources (both living and non-living) in the water column, seabed, and subsoil. While the EEZ is not part of the state's sovereign territory, the coastal state has jurisdiction over certain activities, including environmental protection, marine scientific research, and the establishment of artificial islands and installations, as provided under Article 60.

[7] Attacks or disruptions to cables within a state’s jurisdiction challenge its sovereignty and operational integrity. Many cables traverse international waters, complicating the enforcement of sovereign protections and the attribution of attacks.

[8] With the rise of cyberattacks, NATO expanded the interpretation of "armed attack" to potentially include significant cyber operations (similar logic could apply to attacks on critical infrastructure like submarine cables). Sovereign states must now assess the threshold for activating Article 5 in such scenarios. Cyberattacks challenge traditional notions of territorial sovereignty, as attacks often originate from non-state actors or states acting covertly. This has led to debates on how Article 5 should be interpreted and applied in the cyber domain.

[9] An attack on cables may affect multiple states, raising the issue of collective defense.

Disruptions could involve hybrid tactics (e.g., sabotage, cyberattacks) that blur the lines between traditional warfare and non-military aggression.

[10] NIS2 strengthens the sovereignty of EU states by enabling them to better manage and secure their critical infrastructure, and encourages cross-border collaboration, essential for submarine cables that connect multiple countries.

[11] Strengthen forensics capabilities to trace disruptions back to state sponsors.

[12] To address the evolving threat of covert sabotage, NATO, the EU, and individual states must adopt a multi-pronged strategy, based on the principles of surveillance and control, strengthened attribution mechanisms (capable of linking covert actions to state actors, even when civilian means are used), redundancy and resilience, as well as international cooperation.

[13] Strengthening the protection of submarine cables in international waters.

[14] Carry out joint NATO and EU security structure exercises to demonstrate the ability to protect critical maritime infrastructure.