In brief

Damage to undersea cables between Estonia and Finland on December 31, 2025 drew regional attention. At the same time, leading analysts warn that not every such incident should automatically be attributed to a deliberate hybrid operation by Moscow. This matters for Ukraine: appropriate decisions by partners on monitoring and investigations directly affect the stability of our communications infrastructure and national security.

What the expert says

“It is likely in Russia’s interest to keep the Baltic Sea as trouble-free and navigable as possible, since their exports depend on the stability of the Baltic. From a strategic point of view Moscow does not need this mess. At the same time, Russia is also characterized by disorder, so one cannot completely rule out a situation where one hand does not know what the other is doing.”

— Andres Vosman, former analyst at the Estonian Foreign Intelligence Service; now Estonia’s ambassador to Israel

Causes of the incidents: what experts are analyzing

Vosman reiterates that incidents in recent years can be explained by a combination of factors, not solely malicious action. Among the key causes analysts point to are:

• increased maritime traffic toward Russia;
• poor technical condition of some vessels and low training standards among parts of their crews;
• a growing amount of subsea infrastructure, which makes systems vulnerable to accidental damage;
• previously recorded cases where anchors or storms damaged cables — but without major media attention.

What exactly happened on December 31

On the night of December 31, a fault was detected in an undersea telecommunications cable connecting Estonia and Finland; the damage was recorded in Estonia’s exclusive economic zone. According to Finnish police, the cargo vessel Fitburg, en route from Saint Petersburg to Haifa under the flag of Saint Vincent and the Grenadines, was detained near Helsinki.

The ship was carrying steel products of Russian origin that fall under EU sectoral sanctions. The cargo has been seized and investigative actions are underway; a pre-trial investigation into possible sanctions violations and obstruction of telecommunications is expected to begin. As of January 3, three of the 14 crew members are under travel bans, and another three are detained on suspicion of deliberately damaging infrastructure.

Context and views of Ukrainian and regional experts

Former SBU deputy head Viktor Yahun warns of the shadow fleet being turned into an instrument of hybrid pressure in the Baltic if Western countries do not strengthen oversight. The expert community emphasizes that investigations and ship detentions are an important signal — but this is insufficient without systematic work on monitoring and holding perpetrators accountable.

Why this matters for security

Undersea cables carry a large share of international internet traffic and financial flows. Even local damage can cause delays, strain backup routes and create risks for critical infrastructure. Forward-looking partner policies must include both technical monitoring and legal mechanisms to counter the shadow fleet.

What partners should do

Analysts recommend coordinated steps: increased surveillance of sea routes, exchange of AIS and satellite monitoring data, rapid procedures for inspecting high-risk vessels in ports, and strengthening sanctions and criminal pressure on operators of suspicious ships. Transparency in investigations is also important — it provides social proof and reinforces deterrence.

Conclusion

There is a real danger: if the shadow fleet remains unchecked, incidents may recur and escalate. But automatically blaming every damage on “Moscow’s hand” also risks undermining trust and distracting from real technical and regulatory problems. The ball is now in the partners’ court: will they turn statements into practical steps to protect undersea infrastructure and hold those responsible to account?