Kaliningrad, undersea cables, jamming, the shadow fleet, drones: in the Baltic Sea, the confrontation between Russia and NATO takes paths that do not fit neatly into the usual categories. Nothing currently points to an imminent conventional offensive. Yet doctrines are evolving, deployments are growing denser, and civilian actors themselves are adapting their practices. The question then becomes less theoretical than it seems: how long would it take to recognise that the situation has changed in nature?
The Essentials
- On 5 October, BND president Martin Jäger told the Bundestag that Germany faces a growing risk of being drawn into a violent conflict with Russia. He relies not on troop concentrations but on cyberattacks, sabotage, drones and clandestine operations.[01]
- A few days earlier, Mark Rutte recalled that there is no imminent Russian military threat to NATO territory and that a large conventional attack would require observable preparations.[02] The two diagnoses coexist: one describes what general staffs know how to recognise, the other a confrontation already under way below the threshold.
- With Finland (2023) and Sweden (2024), almost the entire Baltic shoreline is Allied. Russia keeps the Gulf of Finland front and Kaliningrad.[03] But the phrase “NATO lake” says nothing about what happens on and beneath the water.
- On 30 September, Moscow warned that any attempt to isolate Kaliningrad could lead to the use of all its means, nuclear included.[04]
- Cables and gas pipelines are damaged by anchors as much as by saboteurs, which is what makes attribution so difficult. Baltic Sentry (January 2025) responds to this need for detection.[06]
- The most exposed states are adapting: Estonia is moving its units closer to the border,[07] and the Union funds emergency cable repair (€20 million in February 2026, then €40 million in June).[08]
- The heart of the piece: an adversary may benefit from staying below the degree of certainty that would ease the Alliance’s decision. The credibility of Article 5 also depends on the ability to establish the facts, attribute and decide fast.
Contents
- A Geography That No Longer Suffices
- The Incident Does Not Explain the Intent
- Shortening the Decision Time
- A Confrontation Whose Threshold Remains to Be Set
- Notes and Sources
by Jérôme Denariez — Paris, 5 October 2026.
On 5 October, Martin Jäger, president of the BND, Germany’s foreign intelligence service, told the Bundestag that Germany faced a growing risk of being drawn into a violent conflict with Russia. His remarks rested neither on the observation of a massive concentration of Russian forces on the Alliance’s borders, nor on the supposed imminence of an offensive against one of its members. He spoke of cyberattacks, sabotage, drones and clandestine operations: a confrontation already under way, liable to change degree.[01]
A few days earlier, Mark Rutte had recalled that no imminent Russian military threat weighed on NATO territory and that a large-scale conventional attack would require observable preparations and movements of forces.[02]
The two diagnoses can perfectly well coexist. One describes what general staffs know how to identify: constituted units, a border crossed, military or territorial objectives, an aggressor about whom there is little doubt. The other concerns a succession of acts, each of which may retain a limited, contestable or reversible appearance.
The Baltic today offers particularly fertile ground for this second form of confrontation.
A Geography That No Longer Suffices
Finland’s entry into NATO in 2023, followed by Sweden’s in 2024, profoundly changed the region’s strategic map. Almost the entire Baltic shoreline now belongs to the Alliance. Russia retains its Gulf of Finland frontage and the Kaliningrad enclave.[03]
Hence the expression “NATO lake”. Geographically, it makes sense. It accounts less well for what happens on the water and beneath its surface.
The Baltic remains one of the busiest seas in the world. Warships constantly cross paths with merchant vessels and tankers. Its seabed is criss-crossed by telecommunications cables, electrical interconnectors, pipelines and gas pipelines belonging to different operators and jurisdictions. Territorial waters are joined by exclusive economic zones, shipping lanes and international spaces. Surveillance can be particularly dense there without making it possible to see everything, still less to explain everything immediately.
The Alliance’s geographic advantage therefore solves only part of the equation. Knowing which state a coast belongs to is relatively simple; determining why a cable was cut, what a ship did several hours earlier, or whether an electronic disturbance reflects hostile intent is far less so.
This uncertainty of interpretation itself becomes a factor in the balance of power.
Kaliningrad provides a first illustration. The Russian enclave, wedged between Poland and Lithuania, hosts significant military assets and gives Moscow a forward foothold in the Baltic. Its position in turn imposes a particular logistical dependence. What constitutes a threat to Russia’s neighbours is also a territory that must be resupplied and kept connected to the rest of the Federation.
On 30 September, Moscow warned that any attempt to isolate Kaliningrad could lead to the use of all the means at its disposal, including nuclear ones. The threat belongs to a rhetoric that has become familiar. It nonetheless takes on particular significance in a space where the proximity of military assets and the density of civilian traffic shorten distances, physical and political alike.[04]
Nearby lies the Suwałki corridor, which provides the land link between Poland and the Baltic states. In an open conflict, the stakes would be relatively easy to identify. The events that might precede one are much less so: a maritime interception, a disruption of communications, a movement of forces, an air incident or a preventive measure can change meaning depending on who is watching.
The Incident Does Not Explain the Intent
The explosions that damaged the Nord Stream gas pipelines in September 2022 reminded us, with some brutality, that infrastructure laid on the seabed was fully part of the European strategic landscape. German investigations have since implicated several Ukrainian suspects. The example matters here less for the identity of its alleged perpetrators than for what it revealed: a strategic infrastructure could be destroyed in the heart of the Baltic, while judicially establishing responsibility would take several years.[05]
Since then, several incidents have affected telecommunications cables, electrical links or the Balticconnector gas pipeline. Obviously, not all of them amount to sabotage. Undersea cables are regularly damaged by anchors, fishing or navigational accidents. This possible ordinariness is precisely what complicates attribution.
When a link stops working, the physical break is quickly established. Its origin much less so.
It is in this context that NATO launched Baltic Sentry in January 2025. Frigates, maritime patrol aircraft, uncrewed systems and national assets are meant to improve the surveillance of critical infrastructure and make it possible to track unusual activity more precisely.[06]
The system does not turn every cable break into a military matter. Rather, it reflects the impossibility of still regarding this infrastructure as mere technical equipment. A telecommunications outage, a power cut or the shutdown of a pipeline can have major consequences without the event that causes them being immediately classifiable.
One must then reconstruct a trajectory, bring several pieces of information together, establish correlations and, possibly, demonstrate that an accident was not one. Situational awareness is no longer merely useful for anticipation; it also conditions the possibility of a sufficiently well-grounded political decision.
The so-called “shadow” fleet adds to this difficulty. These tankers notably allow Russia to circumvent part of the sanctions that hit its hydrocarbon exports. As long as the matter remains commercial and regulatory, responsibilities are fairly clearly divided. Things become less simple when a ship is monitored or intercepted and Moscow chooses to show its interest in its fate by military means.
A tanker remains a civilian vessel. A Russian aircraft that comes to observe it has not, by that fact alone, committed a hostile act. A legally grounded inspection operation is no more an act of war. The simultaneous presence of a tanker, coast guards, a warship and possibly a combat aircraft nonetheless quickly reduces the margin for error.
What matters then is not only the power available, but the time needed to understand what each party is doing.
A single event can thus fall successively under maritime law, policing, intelligence and then defence, without any obvious signal marking the passage from one to the next.
Shortening the Decision Time
The most exposed states are beginning to draw the consequences of this uncertainty.
Estonia is durably moving its main combat units closer to the Russian border and developing a doctrine of “active defence”. Tallinn does not say it anticipates a massive offensive in the short term. The scenario that worries its officials more is that of a limited action, capable of creating a local fait accompli before the Alliance has settled on its response.[07]
Narva naturally occupies a special place in this reasoning. Located directly on the Russian border, facing Ivangorod, the city has long been one of the points on which scenarios of a limited crisis between Russia and the Alliance concentrate.
Hence Estonia’s investment in long-range fires and its wish to have a much faster reaction capability if an attack were to be established.
The reasoning goes to the very functioning of deterrence. The adversary must know that aggression will provoke a response whose cost will exceed the expected benefit. But the equation becomes more complicated when the nature of the aggression may remain, for a few hours or a few days, open to debate.
There is good reason to think that an adversary who cannot reasonably hope to defeat NATO in a conventional confrontation has more interest in testing its political procedures than in frontally testing its military power. Multiplying possible interpretations, forcing several governments to take a position while information remains incomplete, and buying time may constitute an objective in themselves.
The Alliance’s military power does not guarantee the speed of its political decision.
Moreover, the responses put in place in the region do not concern combat assets alone.
The European Union now funds emergency repair capabilities for undersea infrastructure. In February 2026, a €20 million call was launched specifically for the Baltic to fund cable repair modules. Coast guards, navies and public bodies responsible for crisis response are among the potential beneficiaries. A second €40 million call then extended the approach to other maritime basins.[08]
The sums are modest compared with European defence budgets. Their purpose is more revealing. The interruption of an infrastructure is now a hypothesis taken seriously enough for the means of quickly restoring service to be organised in advance.
The approach resembles that of a continuity plan: when a risk cannot be entirely eliminated, the duration over which it produces its effects must be limited. Applied to the Baltic, it means that a hostile disruption gradually ceases to be treated as an extraordinary contingency. It enters the procedures.
Persistent maritime surveillance assets meet the same need. Autonomous systems make it possible to track more vessels and to keep a sufficiently precise record of activity to be able, after the fact, to reconstruct a sequence. Intelligence thus acquires an additional function: providing the elements on which decision can rest.
A Confrontation Whose Threshold Remains to Be Set
None of this allows us to assert that the Baltic is already at war.
The term would quickly lose its usefulness if a cyberattack or a jamming incident were enough to consider that an armed conflict had begun. Russia denies wanting to attack NATO; the Alliance says it does not observe preparations for an imminent conventional offensive. These statements must be taken for what they are.
The alternative between peace and invasion nonetheless describes poorly what happens in between.
Jamming, cyberattacks, possible sabotage, air incidents, pressure on infrastructure, clandestine operations and maritime intimidation may each retain a limited scope. Yet their repetition leads the riparian states to modify their postures, NATO to devote more resources to surveillance of the sea, the European Union to organise cable repair, and German intelligence services to speak openly of a confrontation liable to become violent.
The change in behaviour is probably more instructive than the vocabulary used to describe it.
Nobody seems to know the exact form a possible military confrontation would take. Many, on the other hand, are seeking to reduce the time needed to understand that an event has just changed the situation.
NATO’s collective guarantee rests on a clearly formulated assumption: when one of its members suffers an armed attack, the others must determine the response to give it.
The Baltic introduces an additional difficulty: an adversary may precisely have an interest in keeping its action, for long enough, below the degree of certainty that would facilitate that decision.
Article 5 retains its full scope. Its credibility, however, also depends on what precedes it: the ability to establish the facts, to attribute an action, and then to obtain a political agreement on its nature quickly enough.
Kaliningrad, undersea cables, the shadow-fleet tankers, jamming or Narva’s particular vulnerability belong to different problems. Yet they are linked insofar as they all reduce the distance between civilian incident, clandestine operation and military confrontation.
In this type of situation, it is not even necessary to conceal one’s action perfectly. It may suffice to leave enough uncertainty to delay the response and make interpretations diverge.
The Baltic does not allow us to date the next European war. It does, however, allow us to observe how the actors are beginning to prepare for the moment when it will be necessary to decide that peace no longer suffices to describe the situation.
Jérôme Denariez
Notes and Sources
[01] Reuters, “Germany at risk of violent conflict with Russia, intelligence chief says”, 5 October 2026. Martin Jäger describes a Russian “shadow war” and notably raises the possibility of low-intensity military actions in the Baltic states. — Source ↩
[02] Reuters, “No imminent threat to NATO territory from Russia, Rutte says”, 30 September 2026. Mark Rutte states that a conventional attack against the Alliance would be preceded by observable preparations. — Source ↩
[03] NATO: Finland joined the Alliance on 4 April 2023 and Sweden on 7 March 2024, bringing the number of member states to 32. — Source ↩
[04] Reuters, “Russia sends nuclear warning to NATO as tensions rise in the Baltic”, 30 September 2026; see also the Reuters analysis of Kaliningrad’s dual nature, a military foothold and a logistical vulnerability. — Source ↩
[05] German Federal Prosecutor’s Office: Serhii K. was indicted on 30 June 2026; Vladimir Z. was arrested in Croatia on 19 August 2026 on a European arrest warrant. These elements relate to ongoing judicial proceedings and do not constitute a final judgment. — Source ↩
[06] NATO, launch of “Baltic Sentry”, 14 January 2025: frigates, maritime patrol aircraft, naval drones and integration of national surveillance assets. The Alliance explicitly distinguishes its detection and deterrence functions from the policing competences retained by national authorities. — Source ↩
[07] Financial Times, “Estonia shifts troops closer to Russia in ‘active defence’ push”, 5 October 2026. Estonia is durably moving its main combat units closer to the border and developing its long-range strike capabilities, notably in the face of the risk of a limited action intended to test the Alliance’s cohesion. — Source ↩
[08] European Commission / HaDEA: €20 million call launched on 5 February 2026 for emergency repair modules for undersea cables in the Baltic; second €40 million call launched on 18 June 2026, extended to the Mediterranean and the Atlantic. — Source; second call ↩
Decoding: Those Who Know What “Next to Russia” Means
Jérôme Denariez describes a war that does not say its name: one where you know a cable has been cut, but not yet why. For a reader in Paris, Madrid or Rome, the Baltic may seem remote and the warnings somewhat abstract. In Helsinki, Stockholm, Warsaw, Tallinn, Riga or Vilnius they are not, and that is no accident.
These countries share with Russia a border, a sea and a memory. Finland suffered the Soviet attack of 30 November 1939 and lost part of Karelia; Poland was invaded by the Red Army on 17 September 1939, then lived through Katyn; Estonia, Latvia and Lithuania were annexed in 1940 and endured mass deportations; Sweden remained non-aligned for more than two centuries before joining the Alliance in 2024. Their perception of the threat is not a neurosis: it is an experience.
This experience sheds light on the central thesis of the piece. The danger of the grey zone is not so much the adversary’s power as the time it makes democracies lose in deciding. These states understood it before the others, and their responses (units moved closer to the border, emergency cable repair, maritime surveillance) are preparation, not alarmism.
Two cautions are nonetheless in order. Rutte and the German services do not describe the same thing, and both are right: there is no imminent conventional threat, there is a confrontation below the threshold. And attribution remains the weak point: a cable can be torn up by an anchor as easily as by a saboteur.
One factor is missing from the piece: Washington. The credibility of Article 5 depends on how quickly the Allies can decide politically, and that rests, in the end, on the American commitment. Yet the signals are contradictory: on 1 May the Pentagon announced the withdrawal of 5,000 troops from Germany,[09] some 1,000 American soldiers reportedly left Lithuania in June without being replaced,[10] then on 22 September the Lithuanian president announced the arrival of a new rotation, at least equal to the previous one.[11] This uncertainty is itself part of the grey zone.
One question remains that we, Western Europeans, should ask ourselves: how long would it take us to recognise that an event has changed the nature of the situation? Those who live next to Russia already have an answer, and it is short.
