Russia’s hybrid war in the Baltic

According to the definition developed by the European Centre of Excellence for Countering Hybrid Threats in Helsinki, hybrid threats are actions designed to weaken or damage a specific target (e.g. a state institution or an element of critical infrastructure), carried out below the threshold of armed conflict. They are undertaken by states or other actors (e.g. terrorist organisations) against states. They primarily target the inherent vulnerabilities of democratic states, arising from the pluralism of social life and the absence of totalitarian control, and may occur across many areas of public life, including the political or economic spheres.[1] Though conducted in a targeted and synchronised manner, they are covert, deliberately making it difficult to attribute responsibility for them to a specific state in accordance with traditional principles of international law.[2] Russia’s activities in the Baltic Sea encompass precisely this wide range of measures,  where the disruption of maritime security is one of the intended, or at least accepted, consequences of its actions.

Kinetic attacks on critical infrastructure,[3] particularly undersea communication cables and pipelines,[4] should be seen as among the most serious breaches of maritime security. Notable incidents include severed undersea telecommunications and power cables between Helsinki and Tallinn, caused by “shadow fleet” ships dragging their anchors[5], as well as damage to the Balticconnector gas pipeline.[6] However, the main purpose of the “shadow fleet” is not to create hybrid threats. Russia uses it mostly to circumvent Western sanctions, particularly the price cap on Russian oil.[7] Analogous tools have been used by other countries in similar situations, such as Iran, Venezuela, and North Korea. At the same time, due to its poor technical condition, the fleet still poses a significant threat to maritime and environmental security.[8] Even greater risks emerge if “shadow fleet” vessels are utilised as drone carriers, for disrupting civilian air traffic, as sabotage launch pads, or platforms for arms smuggling or electronic warfare. Some media reports have suggested that the drones that disrupted Scandinavian airports may have operated from these vessels.[9]

Russia’s practice of jamming GPS signals in the Baltic Sea also has very serious consequences, causing navigation problems that are particularly acute in air traffic. Estonia has estimated the resulting losses from this disruption at around half a million euros,[10] and in September 2025, a Spanish military aircraft carrying Defence Minister Margarita Robles experienced jamming near Kaliningrad. Security incidents have also been triggered by Russian military aircraft flying without their transponders switched on, increasingly resulting in violations of the airspace of neighbouring countries.

The Baltic Sea in international law

The Baltic Sea as a semi-enclosed sea

The Baltic Sea’s specific legal status as a semi-enclosed sea offers the possibility to implement special regulations to address current hybrid threats. Maritime areas are divided into those within the territorial jurisdiction of a coastal state and those outside state sovereignty, with the legal status of zones not covered by the sovereignty of coastal states governed entirely by the norms of public international law. For areas subject to territorial jurisdiction, coastal states have exclusive competence to regulate their legal status through their domestic legislation; however, as has been clearly emphasised by the case law of the International Court of Justice (ICJ),[11] such regulations must not conflict with general international law. An example is the obligation on states to guarantee the innocent passage of ships of all flags through their territorial waters, provided that such passage does not pose a threat to the peace, good order or security of the coastal state. Passage can only be restricted if vessels fail to meet these requirements; in all other circumstances, the coastal state is obliged to respect it. In other words, states bordering the Baltic Sea do not have complete freedom to shape their legal regime, as they must take into account the general rules arising from international law of the sea.

Figure 1. Map of maritime zones in the Baltic Sea

The most important instrument governing international maritime law is the 1982 United Nations Convention on the Law of the Sea (UNCLOS). The Convention has been ratified by a significant majority of states (171, including all in the Baltic Sea basin). However, some nations withheld ratification, including Turkey and the USA, criticising specific provisions and arguing that it does not reflect customary law. Among signatories, UNCLOS supersedes the four 1958 Geneva Conventions, which had much less reach, with an average of 60 parties per convention.[12] Article 113(3) of UNCLOS allows agreements that modify or suspend certain provisions, but such modifications or suspensions apply only between the parties to the agreement. This reflects the general rule in Article 41 of the Vienna Convention on the Law of Treaties.[13]

The Baltic Sea has traditionally been described in legal doctrine as ‘regional’ or ‘semi-enclosed’.[14] This term was ultimately included in the text of UNCLOS, which devotes Part IX to such bodies of water. According to the definition contained in Article 122, an enclosed or semi-enclosed sea is a maritime area surrounded by two or more States and connected to another sea or ocean by a narrow channel, or consisting wholly or predominantly of the territorial seas and exclusive economic zones of two or more coastal States. Article 123 of the Convention obliges States bordering such bodies of water to coordinate in the areas of biological resource management, environmental protection and scientific policy. However, UNCLOS does not establish a separate regime for enclosed seas and does not derogate from the general rules of the law of the sea. It imposes a stronger requirement for regional coordination; the exercise of coastal states’ sovereign rights should be adapted to the interdependent nature of the body of water. In practice, this means that the specific characteristics of the Baltic Sea ecosystem must be taken into account – shallow waters with limited exchange with the ocean, which exacerbates the effects of any pollution and necessitates close cooperation. However, when a state deliberately acts in defiance of international law, as is currently the case with Russia, the obligation to cooperate, derived from the principle of state solidarity, is clearly not being respected.

The status of the Baltic (Danish) Straits and the Kiel Canal

The potential of regulations to limit the hybrid threats posed by the “shadow fleet” in the Baltic Sea is also influenced by the special legal status of the Baltic Straits. Comprising the Little Belt, the Great Belt, the Sound and the Kattegat, these straits constitute a critical transport hub for regional shipping. Together with the Kiel Canal, control of these straits determines all maritime access to and from the Baltic Sea. Due to their narrow width, the straits fall under different jurisdictions: the Great Belt lies entirely within Danish territorial waters, the Sound comprises both Swedish and Danish territorial waters, and the Little Belt constitutes Danish internal waters. The exception is the Kattegat, where, under a 1979 agreement, Denmark and Sweden limited the outer extent of their territorial waters in the strait, leaving a narrow corridor of high seas (6 nautical miles). Following the entry into force of UNCLOS, this corridor was replaced by two 3-mile-wide exclusive economic zones.[15]

The legal status of the straits, which for a long time were the sole link between the Baltic and the open ocean, influenced the struggle for dominance over the Baltic Sea region.[16] In practice, two approaches to the legal status of these straits emerged – one represented primarily by states engaged in Baltic shipping, and the other by Sweden and Denmark. The freedom of navigation reserved in the 1857 Treaty was of an erga omnes nature—i.e. it was not limited to the signatory states. As a result, states interested in unrestricted access to the Baltic Sea argued that the treaty aimed to remove obstacles to international navigation, rather than creating a special legal regime. Indeed, following its entry into force, navigation in the straits was opened to merchant ships of all flags.[17] While maintaining restrictions on the passage of warships was dismissed as anachronistic after the end of the Cold War,[18] given the radically altered security landscape following Russia’s aggression against Ukraine, these restrictions may be strategically useful. Both Sweden and Denmark have consistently maintained that the Baltic Straits are governed by a special legal regime, established by historical international agreements. Following the entry into force of UNCLOS, they unanimously emphasised that Article 35(c) of the Convention applies to the Baltic Straits, which excludes straits with historical international agreements which regulate the issue of passage in whole or in part. This position was also directly expressed in the declarations they made upon ratifying UNCLOS, formally reserving exceptions to the right of transit passage through the straits.[19] Codified in UNCLOS Articles 37–44, the right of transit passage guarantees freedom of navigation and overflight for civilian and military vessels when transiting international straits. This right ensures uninterrupted, rapid and unimpeded transit between distinct areas of the high seas or exclusive economic zones.

In accordance with the traditional customary norm, ships and vessels have the right of innocent passage through international straits without the obligation of prior notification, and coastal states may not suspend this right. The only exception arises from the recognition of the right to self-defence found in Article 25(1) of UNCLOS. In the case of the Baltic Straits, neither Denmark nor Sweden has relinquished the continuous exercise of their sovereign claims to regulate traffic. While UNCLOS prohibits the absolute suspension of passage through international straits, both Sweden and Denmark retain the authority under Article 25 to prevent non-innocent passage by transiting warships, treating them as a safety threat subject to notification and inspection. In the case of the merchant fleet, certain possibilities for restricting it can also be identified, particularly if there is confirmation of reports that “shadow fleet” tankers are being used to violate state sovereignty through drone incursions. The provision of UNCLOS Article 25(2)—which allows a coastal State to prevent breaches of the conditions required for entry into internal waters or use of port facilities—also provides a justification for potential restrictions on “shadow fleet” vessels whose poor technical condition poses a threat to the safety of navigation.

When a suspect vessel is found to be flying a false flag, a warship could invoke the right of visit to carry out an inspection based on UNCLOS Article 110(1)(d) and (e). Exercised on the high seas where there is a suspicion that a vessel is stateless, is flying a foreign flag or refusing to show its flag while sharing the warship’s nationality, this section authorises dispatching a boarding party under an officer's command to verify the ship's entitlement to its flag. If these checks fail to resolve the suspicion, a further inspection of the ship may be carried out, which the Convention expresses must be carried out “with all possible consideration.”

When it comes to the Kiel Canal, it has not had international status since 1936, meaning that the German authorities may freely regulate the passage of commercial and other vessels. Under the current regulations dating from 1971, commercial vessels must, among other things, comply with international and national standards and regulations concerning navigation safety, the protection of the marine environment, and safety issues in Germany’s internal waters.[20] In Germany, regulations implementing EU sanctions are in force, prohibiting access to ports and locks for Russian-flagged ships or vessels which changed their flag or registry from Russian after 24 February 2022. This effectively restricts “shadow fleet” access to this shipping route, and customary international law applies to warships, requiring that permission be obtained through diplomatic channels. This legal situation provides the German authorities with extensive powers to control ships passing through the canal and potentially allows for a far-reaching expansion of that control.

Figure 2. Map of the Baltic Straits and the Kiel Canal

Countering the “shadow fleet” under existing law

Environmental protection standards

To counteract the harmful activities of “shadow fleet” vessels, regulations protecting the marine environment serve as the first line of defence, and are the most frequently mentioned tool in both public and expert debate. The legal basis for the protection of the Baltic Sea is established by general provisions applicable to all seas and oceans.[21] In this regard, the 1973 Convention for the Prevention of Pollution from Ships is of fundamental importance, supplemented by the 1978 Protocol (MARPOL 73/78). Ratified by 157 states, including all Baltic Sea littoral states,[22] the convention was incorporated into EU law via Directive 2005/35/EC of 7 September 2005. Following the amendment introduced to this Directive on 27 November 2024 by Directive 2024/3101,[23] the framework now factors in Russia’s sanctions violations through the “shadow fleet.” The amended provisions explicitly address the environmental risks posed by tankers carrying Russian oil and aim to ensure consistent application of administrative penalties across the Union. To enhance the deterrence effect of anti-pollution sanctions, administrative penalties must at least include fines imposed on the vessel’s beneficial owner, though enforcement of this mechanism may be complicated by complex corporate structures, which serve to obscure responsibility between shipowners, operators, charterers, and managers. Furthermore, when determining the level of sanctions to be imposed on the polluter, national administrative and judicial authorities should take into account all relevant circumstances, including repeat offences.

The MARPOL Convention applies widely, covering both ships flying the flags of the parties to the Convention, but also extending to ships flying other flags, provided the latter are operated under the administration of a state party. A ‘harmful substance’ is defined by the Convention as any substance that may give rise to a hazard; the Convention’s definition of an ‘incident’ is equally broad, covering any event involving an actual or alleged discharge into the sea of a harmful substance or a spill containing such a substance. Article 5 of the Convention imposes an obligation on ships to carry special certificates documenting compliance with operational requirements. If these certificates are absent or invalid, or if the vessel otherwise violates MARPOL’s provisions, a State Party may deny entry to a port or transhipment terminal or take other action against the ship. In each case, the flag State’s authorities or the diplomatic or consular representation must be informed. The clause contained in Article 5(4) of MARPOL allows the Convention to be applied to non-Contracting Parties to the extent necessary to ensure that ships belonging to those States are not treated more favourably. Consequently, such a mechanism could serve as a basis for extensive inspections, regardless of the declared flag of a “shadow fleet” vessel.

However, a critical exemption is contained in Article 4(3) of the Convention on the Protection of the Marine Environment of the Baltic Sea Area and Article 3(3) of the MARPOL Convention. According to these provisions, neither convention applies to warships, auxiliary fleets, military aircraft, or other vessels and aircraft temporarily used by a state. This potentially opens the door to vessels or ships with such status being used to violate sanctions, while remaining formally protected by state immunity. To date, there is no evidence of this loophole being exploited; the “shadow fleet” is civilian in nature, despite reports identifying uniformed and likely armed officers on board certain vessels.[24]

Mandatory compliance with environmental standards and the requirement to carry appropriate survey certification on board are also found in the 2004 Convention on the Control and Management of Ships’ Ballast Water and Sediments and the 2001 Convention on Harmful Anti-fouling Systems on Ships, both adopted under the auspices of the International Maritime Organisation. The former aims to prevent the spread of harmful aquatic organisms and pathogens through ballast water, whilst the latter restricts the use of harmful organic compounds in anti-fouling hull coatings. Together, these regulations provide a potential basis for controlling old and environmentally hazardous vessels in the “shadow fleet.”

In addition to general international provisions, regional standards also apply to the Baltic Sea. The cooperation required by Article 123 of UNCLOS is implemented via the 1992 Convention on the Protection of the Marine Environment of the Baltic Sea Area. Along with its annexes, which form an integral part of the text, this treaty replaced the earlier 1974 Convention. The new Convention retained the Baltic Marine Environment Protection Commission (HELCOM), established under the previous Convention, expanding its scope to comprehensive protection against all sources of pollution, the conservation of biodiversity, and the sustainable use of marine resources.[25] Crucially, it extended HELCOM’s remit—covering environmental protection, monitoring, assessment, and regional coordination—to the entire Baltic Sea basin. However, current challenges go beyond this cooperative framework. The deliberate subversion of environmental standards by states utilising dangerous “shadow fleet” tankers exposes a structural vulnerability in traditional environmental protection treaties, which did not anticipate premeditated and systemic bad-faith breaches of their provisions.

Alongside regional regulations, EU law also plays a significant role in protecting the Baltic Sea’s marine environment. Of particular[26] importance, the Marine Strategy Framework Directive 2008/56/EC (MSFD) establishes a framework for Union action on marine environmental policy, covering all marine waters within the jurisdiction of coastal Member States. Under this framework, Member States are obliged to update their marine strategies every 6 years to prevent the degradation of the marine environment, restore marine ecosystems, and eliminate existing pollution. Article 5(2) of the MSFD requires Member States that are also parties to the 1992 Convention on the Protection of the Marine Environment of the Baltic Sea Area to cooperate, ensuring regional coordination and consistency in implementation of the MSFD. The updated Baltic Sea Action Plan (BSAP), developed by HELCOM and adopted in 2021, sets out a framework of regional objectives. The Plan’s two overarching objectives, namely ‘A Baltic Sea free from hazardous substances and waste’ and ‘Environmentally sustainable maritime activities,’ provide Member States with the strategic basis to incorporate domestic legal provisions aimed at countering the activities of “shadow fleet” vessels and safeguarding critical maritime and subsea infrastructure such as wind farms and pipelines. Consequently, this should also lead to the inclusion of state-level countermeasures in the BSAP itself to address environmental breaches that are organised and deliberate in nature, rather than incidental. This applies to deliberate actions by state actors, such as “shadow fleet” operations and the deliberate targeting of cables and pipelines via anchor dragging.

Standards for the protection of maritime infrastructure and the safety of navigation

Current international law fails to adequately protect subsea infrastructure in the context of hybrid activities. While Articles 113–115 of UNCLOS cover damage to submarine cables resulting from intentional acts or culpable negligence, they leave significant room for interpretation when it comes to threats deliberately caused by states as part of a hybrid campaign. The difficulty in countering such acts stems from the very nature of international law, as, unlike other areas of law, it is predicated on the good faith of states and does not anticipate premeditated action aimed at circumventing or breaching it. Although states can pursue remedies for internationally wrongful acts under the framework of state responsibility, this relies on attributing the specific damage to the responsible state. This highlights why strict compliance with flag state regulations is essential to prevent states from evading accountability. Attempts to pursue liability before national courts have so far failed due to evidentiary challenges and the obligation for democratic states to uphold procedural guarantees, particularly the presumption of innocence.

A case in point occurred in February 2025, when the Bulgarian vessel Veshen was released after investigations failed to confirm sabotage as the source of the damage to the undersea data cable linking Sweden and Latvia. In early October 2025, the Swedish prosecution service concluded its investigation into the matter, stating that the available evidence was insufficient to determine that the data cable had been intentionally damaged. In the same month, a Finnish court handed down its first-instance judgment in the case concerning the damage caused by the shadow fleet tanker Eagle S to the Eastlink 2 cable in December 2024. In the judgment,  the Finnish court found that its jurisdiction was limited in accordance with UNCLOS, identifying the event described in the indictment as a ‘maritime incident’ within the meaning of Article 97(1) of UNCLOS, and thus falling under the exclusive jurisdiction of the flag State and the State of which the crew members were nationals.[27] Consequently, when the flag state is unwilling or unable to take the necessary legal measures, these maritime incidents frequently go unpunished.

Further serious threats to shipping can be posed by deactivating or manipulating transponder signals for the maritime automatic identification system (AIS), as well as spoofing of GPS signals. Such practices endanger the navigation of vessels and contravene the 1988 Convention for the Suppression of Unlawful Acts against the Safety of Maritime Navigation. Article 3(f) of that Convention classifies intentionally and knowingly communicating false information as an offence, due to the danger it poses to safe navigation. However, enforcement is constrained by Article 7, which states that responsibility for arrest is entirely the responsibility of the State in whose territory the alleged offender is present.

A far greater challenge would be posed if “shadow fleet” vessels were used as drone platforms for disrupting civilian air traffic, or as launch pads for sabotage. As noted above, there are suggestions that such incidents may already have occurred. The primary challenge remains attributing such actions to Russia, as the fleet operates under various flags. However, these activities could potentially be classified as aggression under UN General Assembly Resolution No. 3314 on the definition of aggression from 1974.[28] In particular, Article 3(g) addresses the dispatch by or on behalf of a State of irregular forces or bands which commit acts of armed force against another State. Classifying “shadow fleet” activities as acts of aggression would even imply the possibility of using force, should the need arise. This aligns with the International Court of Justice’s 1986 judgment in the Nicaragua case. In its ruling, the Court affirmed that Article 3(g) of the resolution reflected existing customary law, and connected the definition of aggression to the right to self-defence expressed in Article 51 of the United Nations Charter.[29]

A step further – a regional convention for the Baltic

Given that Russia poses a hybrid threat to security in the Baltic region, the region’s states must implement a lasting solution and reject the assumption that a swift restoration of cooperation based on respect for international law is possible. A close alignment of interests exists among the states exposed to Russia’s hybrid activities. The collective willingness to enforce sanctions is illustrated by the United States’ boarding and detention of vessels violating sanctions against Venezuela—most notably the January 2026 seizure of the tanker Marinera, which had rapidly transferred its registration to the Russian maritime register to evade capture.[30] Recent decisive actions taken by France and the United Kingdom to detain suspect vessels relied on national legislation specifically concerning the enforcement of sanctions.[31] Amendments to Polish law are also moving in a similar direction, strengthening protection for maritime infrastructure and authorising the use of the Armed Forces to counter hybrid threats.

A two-pronged approach appears most effective for the implementation of potential countermeasures. The first prong focuses on utilising previously-implemented solutions, including the ‘Baltic Guard’ mission and strict enforcement of EU sanctions against “shadow fleet” vessels. The second prong utilises existing international agreements to enforce compliance with environmental protection standards. This requires meticulous checks of documentation—targeting survey certificates, and certificates of seaworthiness—mandated by the MARPOL Conventions, the Conventions on the Control and Management of Ship-generated Ballast Water and Sediments, and the Convention on Harmful Anti-fouling Systems on Ships. The control system established in Article 5 of the MARPOL Convention is further clarified in the Paris Memorandum of Understanding on Port State Control of 26 January 1982.[32] It operates on the principle that the shipowner or operator bears primary responsibility for compliance with international maritime conventions, while the flag state is responsible for ensuring it. As a non-binding agreement, the Memorandum does not create obligations under international law and cannot constitute an independent basis for coercive measures such as detaining or inspecting a vessel. Such enforcement powers must derive solely from other provisions of international law (e.g., detention of a ship in the contiguous zone) or national law (e.g., whilst in port).[33]

An equally important step will be long-term action taken at the international level, primarily among the interested Baltic Sea states. The Council of the Baltic Sea States[34] offers a suitable format to drive the discussion forward, given its members share a similar perspective on the threats posed by Russia’s aggressive actions and its “shadow fleet” vessels. The evolution of threats requires a shift from a reactive to a preventive model of maritime security, with existing maritime law being adapted to counter new hybrid challenges. Calling for the introduction of new norms into general international law carries the spectre of years of negotiations with no guarantee of success, even though hybrid threats extend far beyond the Baltic Sea. Given the urgent need for immediate action, Poland is well-positioned to advance a new Baltic Sea regional convention on maritime security, formulating rules tailored to the specifics of the region and the hybrid threats.

However, states do not have complete freedom of action in this area. They must take into account the general rules arising from international law of the sea and may not restrict the traditional freedoms of the high seas. In this regard, UNCLOS Article 311(3) restricts the possibility of modifying or limiting the rights of third-country vessels concerning navigation in the Baltic Sea, thereby reaffirming the strong guarantee of the freedom of the high seas enshrined in Article 87. Even so, this same article poses no obstacles to establishing a new inter se agreement between regional parties, modifying the application of certain UNCLOS provisions to meet their specific security needs.

Under Article 311(3) of UNCLOS, any modifying framework must not compromise the effective realisation of the convention’s object and purpose, nor can it affect the application of the fundamental principles contained in UNCLOS or the exercise by other parties of their rights and the fulfilment of their obligations under it. However, there are no legal barriers preventing regional parties from implementing a new Baltic Sea agreement that establishes higher standards than the UNCLOS baseline.

Although any proposed agreement would have the legal character of regional international law—with Russia likely remaining outside its scope—it would create a robust legal regime among the other Baltic states that foreign flag states would have to take into account. The framework could impose provisions such as a required minimum safety standard (or a gradation of such a standard, together with a corresponding level of required insurance) that vessels must meet as a prerequisite to navigate the waters. The requirement to hold a “Baltic Sea navigation permit” could then be integrated with heightened monitoring measures, such as electronic tracking or physical surveillance, whenever vessels pass over critical infrastructure such as cables and pipelines.

Based on the specific nature of the legal regime governing the Baltic straits and the strict wording of port regulations—such as the EU prohibition on servicing ships without a certificate of sanctions compliance—the actual effect would be to enforce the implementation of these measures on all states whose ships sail in the Baltic Sea, even if they are not party to the agreement. Although this solution carries the risk of a lawsuit before the International Court of Justice or the International Tribunal for the Law of the Sea in Hamburg on grounds of UNCLOS infringement, it remains a viable option in light of Russia’s overtly hostile actions and systematic circumvention of sanctions.

Ultimately, concerned states could attempt to amend the general rules, arguing that hybrid threats not only affect the security of states located on the Baltic Sea but also other semi-enclosed waters, such as the Mediterranean and Red Seas. As pursuing this through an amendment to UNCLOS (pursuant to Article 312 thereof) carries the risk of an extremely lengthy negotiation process and a distant date of entry into force, the best alternative would be a separate convention modifying UNCLOS between the parties under Article 311(3). Such an instrument could leverage the UNCLOS Article 123 provision on coordination and cooperation between states bordering enclosed or semi-enclosed seas. This framework could supplement traditional rights and obligations with explicit new obligations: preventing sanctions circumvention by tracking the movements of “shadow fleet” vessels, establishing simplified inspection procedures for suspect vessels, or establishing a rapid response mechanism for hybrid maritime incidents such as deliberate damage to cables. Poland  could put forward an initiative at the UN for a new convention on maritime safety in enclosed and semi-enclosed seas, preceded by consultations with a wider coalition of interested states.