COMMENTARY: Russia's Navy in the Baltic — The Hybrid Escalation That Dares Not Speak Its Name

COMMENTARY: Russia's Navy in the Baltic — The Hybrid Escalation That Dares Not Speak Its Name

Introduction: When Naval Provocation Becomes Documented Normalcy

Le Monde's June 18, 2026 report: revelations that deserve far more attention than they received

On June 18, 2026, the French daily Le Monde published a piece that should have provoked a collective reaction far stronger than it managed: the Russian navy is now operating "in a completely overt manner" in the Baltic Sea, according to a Western naval officer cited by the paper. Russian jets and helicopters are being sent to signal to Western vessels that they have been spotted — a marking practice that, in the international naval code, constitutes a calculated provocation designed to test reactions and assert an intimidating presence.

In parallel, AIS spoofing operations — falsification of the automatic ship identification system — are described by that same officer as a "standard practice" of the Russian navy in the region. These two elements together paint the picture of a naval power that no longer hides, that claims Baltic maritime space as its own manoeuvring and intimidation ground. And Europe, by and large, continues to watch without a structural response.

The context: a Baltic Sea transformed by NATO's enlargement

The Baltic Sea has not been the same since Finland (March 2023) and Sweden (March 2024) joined NATO. Geographically, Russia now accesses the Baltic only through Kaliningrad (an exclave) and through the Gulf of Finland via Kronstadt and Saint Petersburg. Every Baltic coastline now belongs to a NATO member. In this context, Russian naval operations in the region carry particular strategic resonance: they serve both as a presence demonstration and as a response to a geopolitical environment that Moscow perceives as encirclement.

Russia's response to this perceived "encirclement" takes precisely the form documented by Le Monde: not a direct confrontation with NATO forces — that would be suicidal — but a calculated campaign of intimidation, harassment, jamming, and sabotage designed to constantly remind the region that Russia refuses to accept the geopolitical fait accompli.

AIS Spoofing: When Ships Lie About Their Position

AIS as a vector of maritime hybrid warfare

The AIS (Automatic Identification System) was designed for maritime safety: it allows vessels to broadcast their identity, position, heading, and speed in real time to other ships and maritime authorities. It is the backbone of global maritime traffic monitoring. AIS spoofing — the deliberate falsification of this data — transforms this safety tool into a vector of hybrid warfare. A ship that lies about its position can operate at strategically sensitive locations without its actual presence being easily detected by conventional surveillance systems.

The qualification of AIS spoofing as a "standard practice" of the Russian navy in the Baltic, as reported by the officer cited in Le Monde, implies that this practice is systematic, organized, and embedded in the fleet's operational protocols. It is not technical errors or anomalies — it is a deliberate doctrine of maritime deception. It considerably complicates the task of Nordic maritime authorities seeking to monitor movements of the Russian shadow fleet in the region.

Damaged submarine cables: the link to the shadow fleet

The link between AIS spoofing and incidents involving damaged submarine cables in the Baltic since autumn 2025 is documented, if not formally proven in every case. Ships belonging or affiliated to the Russian shadow fleet — those hundreds of vessels operating under flags of convenience to circumvent sanctions — have been geolocated near damaged fiber-optic cables and submarine electrical interconnections. Their AIS signal placed them elsewhere.

Investigations conducted by Swedish, Finnish, and Estonian authorities into these incidents have reached similar conclusions: direct evidence is hard to obtain, but the body of circumstantial evidence pointing toward deliberate involvement is convincing. This is precisely the logic of the perfect hybrid crime: enough traces for experts to understand, not enough for a formal attribution that would trigger proportionate retaliation.

Aerial Markings: The Language of Naval Intimidation

Jets and helicopters as vectors of strategic messaging

The practice of markings — sending jets or helicopters to signal to a Western vessel that it has been spotted — belongs to a coded military communication register that experienced navies understand perfectly. It is not an attack. It is not a coincidence either. It is a deliberate, calibrated message that says: "we see you, we are here, do not forget it." In naval terminology, this is an act of asymmetric messaging aimed at the adversary and, by extension, at the political decision-makers of that country.

The frequency and intensity of these marking practices in the Baltic have increased since the beginning of 2026, according to diplomatic and military sources cited by several European outlets. This intensification is inseparable from broader events: Ukrainian deep strikes into Russian territory, the approaching NATO Ankara summit, and the presentation of the Polish white book on hybrid sabotage. Moscow is reminding the region of its existence, even in a sea that is increasingly surrounded by NATO members.

The NATO response: between vigilance and refusal to escalate

The response of NATO member states bordering the Baltic to these provocations is deliberately measured: monitor, document, protest diplomatically, reinforce presence — but avoid any reaction that Moscow could use to justify escalation. This restraint is strategically justified under current circumstances, where the priority is to maintain support to Ukraine and avoid any pretext for a direct NATO-Russia confrontation.

But this restraint has a cost: it allows Russia to progressively normalize behaviours that, a decade ago, would have triggered formal protests, diplomatic reprisal measures, and discussions about Article 5. The line between pragmatic tolerance and gradual capitulation is not always easy to draw — and Moscow has remarkable expertise in testing it centimetre by centimetre.

Incidents Multiply: A Chronology of Security Deterioration

Autumn 2025 – Spring 2026: a series of incidents that form a system

Since autumn 2025, incidents in the Baltic Sea involving the Russian shadow fleet or Russian naval vessels have multiplied with a regularity that excludes coincidence. Submarine cables linking Finland to Estonia, Sweden to Latvia, and the Baltic states to one another have been damaged. Submarine energy interconnections have experienced unexplained failures. GNSS disruptions over the Baltic have affected hundreds of civilian flights. Aerial and naval marking incidents have repeated.

Taken individually, each of these incidents could theoretically receive a non-deliberate explanation. Taken together, in their chronology and geography, they draw a coherent picture of a methodical destabilization campaign. This is precisely the purpose of the Polish white book presented on June 16, 2026 in Luxembourg: to transform this accumulation of incidents into collective evidence of a deliberate policy of sabotage and subversion.

National responses: between effectiveness and fragmentation of efforts

Each Baltic coastal country has developed its own responses to Russian hybrid incidents. Finland has reinforced coastal surveillance and investigation protocols. Estonia has deployed additional underwater detection systems. Sweden, newly integrated into NATO, has activated bilateral cooperation frameworks with its Scandinavian and Baltic neighbours. Poland has presented the white book. These individual efforts produce partial results — but the absence of structured coordination at the European level limits their overall effectiveness.

This is exactly the deficit that Sikorski sought to address in Luxembourg: a common architecture of surveillance, data sharing, and coordinated response that would transform fragmented national efforts into a robust collective capability. The demand is clear. The response remains to be built.

AIS Spoofing and International Maritime Law: A Legal Grey Zone Being Exploited

The inadequacy of the international legal framework against maritime hybrid warfare

The international legal framework governing maritime navigation — notably the United Nations Convention on the Law of the Sea (UNCLOS) and International Maritime Organization (IMO) conventions — was not designed to treat deliberate AIS spoofing as an act of hybrid warfare. The sanctioning tools available are limited and slow. Formal complaint procedures take years. Evidence is difficult to gather in a form admissible before an international forum.

This inadequacy of international maritime law against new forms of hybrid conflict is being intentionally exploited by Russia. Moscow has invested intellectually in understanding international legal gaps it can exploit without exposure to formal retaliatory measures. This is a sophisticated approach that deserves to be recognized as such — and that in return demands an urgent updating of international maritime law to explicitly cover hybrid sabotage and deception practices.

Initiatives to adapt international law to the hybrid reality

Discussions are under way at the IMO and within the EU Council to adapt maritime regulatory frameworks to new hybrid realities. Proposals include: automatic sanctions against vessels whose AIS spoofing is proven, enhanced identification mechanisms for shadow fleet vessels, and rapid multinational investigation procedures for incidents involving critical submarine infrastructure. These reforms are progressing slowly — too slowly — but they are advancing, particularly under pressure from Nordic and Baltic countries that directly bear the consequences of inaction.

France and Germany, whose geographic positions distance them from the immediate Baltic front, need to be more involved in these discussions to give them the political weight they require. Without the two largest EU economies carrying these reforms, they risk remaining regional initiatives without structural impact on Europe's overall security posture.

Submarine Cables: The Achilles Heel of European Connectivity

90 percent of global internet traffic, exposed and fragile infrastructure

Submarine cables carry roughly 90 percent of global data traffic — the internet, financial communications, military coordination — all pass through these wires laid on the seabed. Their physical fragility has been known for decades, but their protection has been systematically under-prioritized in European national security planning. A cable just a few centimetres in diameter, laid without significant protection on the floor of the Baltic Sea, conditions the connectivity of millions of people and critical institutions.

Russia has identified and mapped these vulnerabilities with a precision that recent revelations confirm. Damage incidents since autumn 2025 target specific cables, at specific moments, with specific effects — a signature of deliberation, not accident. Europe must invest massively in the physical protection and redundancy of this critical infrastructure — not in ten years, but in the next two to three years.

Protection and redundancy initiatives launched since 2024

Since 2024, several initiatives have been launched to strengthen submarine cable resilience in the Baltic. Finland and Estonia collaborated on a redundant cable project with alternative routes avoiding the most exposed areas. Underwater monitoring systems — hydrophones, passive sonars, pressure sensors — have been deployed to detect physical disruptions in real time. And NATO activated a specialized task force for submarine infrastructure protection.

These initiatives are positive but insufficient relative to the scale of the vulnerabilities. Funding remains disparate, technical standards non-harmonized, and operational coordination imperfect. An integrated European programme for submarine cable protection, resourced to match the strategic stakes, is the response the situation demands.

Energy Interconnections: Another Sabotage Vector

Submarine electricity cables targeted for their strategic value

Alongside data cables, submarine electricity interconnections between NATO countries in the Baltic region face the same sabotage risks. These cables allow electricity capacity sharing between national grids, increasing regional energy system resilience. Damaging them simultaneously creates electricity supply problems and a psychological message of vulnerability aimed at the populations concerned.

The Baltic states have accelerated their gradual disconnection from the Russian BRELL electricity network — a process whose completion was scheduled for 2025–2026 — to connect to the European grid. This transition makes them less dependent on Russia but requires connection cables to Western European networks that cross precisely the Baltic Sea. Their protection has become a first-order strategic priority.

The integrated defence-energy approach: a structural necessity

Protecting submarine energy infrastructure requires an integrated approach that transcends the traditional administrative silos between defence and energy ministries. Shared surveillance protocols, coordinated incident response plans, investments in coastal surveillance vessels capable of detecting and documenting disruptions — all of this requires inter-ministerial and inter-state cooperation that existing bureaucratic structures facilitate poorly.

Countries like Estonia and Finland have made significant progress in this defence-energy integration at the national level. The challenge is to replicate this integration at the European level — which demands the political will that the Polish white book seeks precisely to catalyse in Luxembourg and beyond.

Assessment of the Baltic Situation: Between Alert and Institutional Paralysis

Europe knows — but is it acting fast enough?

The fundamental question raised by Le Monde's report of June 18, 2026 is not whether Europe is aware of the Russian hybrid threat in the Baltic — it is. The question is whether it is acting with sufficient speed, coordination, and determination to counter a campaign that is intensifying. The honest answer is: not yet. Not enough.

There are too many committees meeting, too many reports being published, too many summits producing ambitious communiqués followed by disappointing implementation. The European institutional machinery is not fundamentally ill-suited to these challenges — it is simply too slow relative to the adversary's operating tempo. Accelerating that machinery without breaking it is the leadership challenge European leaders must rise to meet.

Progress indicators to watch over the next six months

It is possible to define concrete progress indicators for the European response to the Russian hybrid threat in the Baltic. One: do the Ankara summit results include an explicit mandate on the maritime hybrid dimension? Two: does the EU Council adopt by the end of 2026 a reinforced regulatory framework on submarine cable protection? Three: is a structured intelligence data-sharing mechanism on Russian shadow fleet operations operational by the first quarter of 2027? These indicators are not exhaustive — but they will allow a judgement on whether the momentum created by the Polish white book has translated into concrete, lasting action.

This commentary, like all those that preceded it on the Russian hybrid threat, is only worth something if the decision-makers who read it draw consequences for their political decisions. Diagnoses are not lacking — what remains insufficient is the will for transformative action. The Baltic Sea is waiting.

Concrete Proposals: A Road Map for Baltic Europe

Five urgent measures to respond to Russia's hybrid naval warfare

First measure: immediately deploy an integrated maritime surveillance system covering the entire Baltic Sea, combining satellite data, coastal radars, underwater hydrophones, and coordinated naval patrols. This system must be operated collectively by NATO member states bordering the Baltic, with a coordination centre in Helsinki or Tallinn. Second measure: reinforce sanctions against the Russian shadow fleet by adopting an automatic designation regime for vessels whose AIS spoofing is proven, with asset freezes and prohibition of access to European ports.

Third measure: massively fund the redundancy of critical submarine cables in the Baltic through a dedicated EU fund. Fourth measure: adopt at NATO level an explicit doctrine for responding to maritime hybrid attacks that specifies the thresholds for collective response. Fifth measure: create a rapid multilateral attribution mechanism allowing official attribution of maritime hybrid incidents without waiting for complete legal certainty. These five measures are ambitious but technically achievable within the next twelve to eighteen months.

The Baltic Sea as a test of European credibility

The Baltic Sea has become the credibility test of European security policy in its hybrid dimension. Everything that Europe says it wants to do on collective defence against non-conventional threats will be judged against what it actually does to protect the waters that lap its northern shores. If incidents continue to accumulate without a structural response commensurate with the challenge, the message sent to Moscow — and to every power watching — is that Europe can be harassed with impunity in its own waters. That message is unacceptable. It depends on us that it not be sent.

The naval officer cited in Le Monde who confirmed the "standard" nature of Russian AIS spoofing deserves our gratitude for his candour. He did his job by telling the difficult truth to his superiors and to the public. It now falls to political decision-makers to do theirs by transforming that difficult truth into robust and lasting security policy for the Baltic region.

Conclusion: The Baltic Sea Awaits a Response Equal to the Threat

From documentation to action: the unavoidable sequence

What Le Monde documented on June 18, 2026 — the Russian navy operating openly, AIS spoofing as standard practice, incidents multiplying since autumn 2025 — is not a surprise to the experts. What is missing is not knowledge of the problem. What is missing is the translation of that knowledge into concrete and lasting political decisions at the European and Atlantic level. The Polish white book, Le Monde's reporting, ISW's analyses — all intellectual tools that have value only if politicians and officials use them to change policies.

The Baltic Sea is a NATO sea. Russia knows this, and it is seeking to contest that operational reality by every means available in the grey zone. Europe and NATO must respond to this contestation with a clarity and firmness that Moscow cannot ignore. The price of inaction is paid in severed cables, disrupted navigation, anxious populations — and ultimately, in lost credibility.

The next step: from Ankara to a common Baltic doctrine

The NATO summit at Ankara on July 7–8, 2026 is the opportunity to transform diagnosis into doctrine. The Alliance members gathering in Turkey within days have the information, the analytical tools, and — in theory — the will to protect the Baltic region against Russian hybrid warfare. What will be needed is bold political leadership to inscribe this dimension in the summit's conclusions in a manner sufficiently binding to produce real-world effects. The hour calls for action — not more declarations of good intent that the Baltic region no longer needs.

This commentary is a call — a call to governments, institutions, and leaders — to transform this documentation into political decisions commensurate with the threat. The history of European security since 1945 offers clear lessons on the price of inaction in the face of gradual aggression. The Baltic Sea of 2026 must not become another chapter in that history of ignored warnings. The urgency is real, documented, and can no longer be denied by anyone acting in good faith.

The Brexit Question and NATO-EU Cooperation in the Baltic Sea

The United Kingdom outside the EU but inside NATO: a persistent geopolitical complexity

The political geography of the Baltic Sea raises an institutional question far from simple to resolve: should security cooperation in the region flow primarily through NATO or through the EU? The United Kingdom, a NATO member but outside the EU since Brexit, possesses considerable maritime and intelligence capabilities that the EU framework cannot formally mobilize. Conversely, the EU's legal and economic instruments — sanctions, regulations, investment funds — are indispensable for a complete response to the hybrid threat.

Ad hoc cooperation mechanisms exist between the United Kingdom and the EU on specific security questions — the war in Ukraine demonstrated their feasibility. These mechanisms should be more formally codified for the protection of critical Baltic infrastructure, without waiting for a global political solution to post-Brexit UK-EU relations. Security cannot be held hostage to residual Brexit political calculations.

Turkey and the Bosphorus: a Mediterranean dimension of Baltic security

It may seem paradoxical to invoke Turkey and the Bosphorus in an analysis of Baltic Sea security. And yet, Turkish control of the maritime passage between the Black Sea and the Mediterranean — which Ankara has kept closed to Russian military vessels since March 2022, in application of the Montreux Convention — has had direct consequences for the Russian Baltic Fleet. Vessels that could have been transferred from the Black Sea to other theatres are blocked or must take long, costly routes. This geographic reality is one factor explaining why the Baltic Fleet remains in the Baltic despite losses suffered in the Black Sea.

The NATO summit at Ankara on July 7–8, 2026 is being held precisely in the capital of the country that controls this strategic maritime chokepoint. This geographic and geopolitical context is not coincidental — it is a reminder that European maritime security forms an interconnected system that cannot be segmented into watertight theatres.

Russian Disinformation About the Baltic: Manufacturing a Counter-Narrative

How Moscow frames Baltic incidents for domestic and international audiences

Faced with growing documentation of its hybrid operations in the Baltic, Russia has developed carefully constructed counter-narratives for domestic audiences and certain international audiences sceptical of the West. These narratives follow recurring patterns: presenting incidents as navigation accidents unrelated to Russia, describing NATO exercises in the region as provocations justifying Russian presence, and accusing the Baltic states and Poland of Russophobic hysteria for domestic electoral reasons.

These counter-narratives are relayed not only by Russian state media such as RT and Sputnik — now banned in the EU — but also by relays in European alternative media and social networks. Their effectiveness is limited in countries directly exposed to the threat, but they find an echo in more distant countries where the threat seems abstract. Countering these narratives with documented facts — as the Polish white book does — is a strategic necessity.

The information war as an inseparable dimension of Baltic security

The informational dimension of Russia's hybrid war in the Baltic cannot be treated separately from its physical dimension. Severed cables and jammed drones are acts against the physical world — the disinformation surrounding them is an act against the cognitive world. Both are instruments of the same strategy. An effective response must address both with the same coherence and determination.

The EU has the East StratCom Task Force and several mechanisms for detecting and refuting disinformation. These tools have been reinforced since 2022, with visible results. But their funding remains insufficient relative to the scale of the Russian disinformation machinery and its adaptive capacity. At minimum doubling the resources devoted to counter-disinformation in the Baltic region is a measure the EU should adopt without delay.

Lessons From the Black Sea Applied to the Baltic

What Russia's naval defeat in the Black Sea teaches the Baltic

The Black Sea offers an eloquent precedent for the Baltic Sea. The Russian Black Sea Fleet, supposed to dominate that maritime theatre, has suffered considerable losses since 2022 under Ukrainian strikes using surface drones, Neptune missiles, and aerial drones. The cruiser Moskva, the fleet's flagship, sank in April 2022. Dozens of other vessels have been damaged or destroyed. The fleet ultimately had to withdraw from Sevastopol to more distant ports, significantly limiting its operational capacity.

This Black Sea experience validates Ukraine's asymmetric naval defence doctrine and confirms that vessels of the Boyky's size — surface corvettes — are vulnerable to relatively inexpensive but precisely guided vectors. The Russian Baltic Fleet, aware of this vulnerability, should theoretically adjust its operational posture. But the perceived urgency of maintaining a presence in the NATO Baltic seems to override tactical prudence — which is itself an exploitable vulnerability.

Naval surface drones: a new dimension of maritime hybrid warfare

Ukraine's use of naval surface drones (USVs) in the Black Sea opened a new dimension in maritime hybrid warfare. These autonomous, low-cost, hard-to-detect vessels can be used for strikes on military ships, sabotage of submarine infrastructure, or surveillance missions. Their hypothetical deployment in the Baltic Sea in a scenario of wider conflict would fundamentally change the calculus of the Russian Baltic Fleet and considerably reinforce NATO's defensive posture in the region.

Several NATO members have begun developing or acquiring USV capabilities for their respective navies. Coordinating these emerging capabilities in a common operational concept for the Baltic Sea is a priority that NATO planners must address explicitly in the months ahead.

The Psychological Dimension: Baltic Populations Under Intimidation Pressure

The unstated objective: eroding civil society's resilience

Behind the severed cables, marking jets, and jammed radio frequencies lies a psychological objective that Russia's hybrid doctrine pursues methodically: eroding the resilience of the populations of Baltic coastal countries. An Estonian or Finnish citizen who regularly sees their communications disrupted, who hears about severed cables, who perceives naval tensions just kilometres off the coast — that citizen may progressively develop security fatigue, a demand for "normalization" of relations with Russia to restore peace.

This is precisely the scenario that the Polish white book and reporting like Le Monde's seek to prevent: by clearly naming the source of the problem, documenting the deliberate nature of the disruptions, and making the overall logic of Russian strategy visible, they allow populations and decision-makers to maintain a coherent response rather than being worn down by ambiguity.

National resilience as a strategic countermeasure

Estonia offers the most developed example of national resilience constructed as a strategic countermeasure to Russian intimidation. A total defence system, regular civilian exercises, media literacy integrated into school curricula, institutionalized cybersecurity culture — all of this forms a resilience fabric that makes Estonian society far more resistant to Russian hybrid operations than its less-prepared neighbours.

This Estonian model cannot be copied wholesale in all European contexts — it is the product of a specific culture, history, and perceived threat. But its fundamental principles — transparency about the threat, civilian preparedness, critical education — are universally transferable. The EU should make the Estonian national resilience model an official reference and fund its adaptation in member states that still have far to go.

Outlook for the Ankara Summit: The Baltic in the Discussions

What Ankara must decide for Baltic security

The NATO Ankara summit of July 7–8, 2026 represents a major opportunity to formally inscribe maritime hybrid security in the Baltic among the Alliance's priorities. Several concrete outcomes would be positive signals: the adoption of a strategic concept for hybrid maritime defence in the Baltic region, the funding of a permanent naval force for incident surveillance and response, and the formal designation of submarine sabotage operations as acts capable of triggering consultations under NATO's Article 4.

These decisions are politically achievable if the heads of state present at Ankara choose to prioritize the Baltic dimension in their discussions. The Polish white book, presented three weeks before the summit, created the necessary intellectual and political context. It falls to the leaders gathered at Ankara to turn that context into decisions that matter for real security in the region.

Long-term monitoring: an indispensable structural commitment

Beyond the Ankara summit, Baltic maritime security demands a long-term structural commitment that cannot depend on electoral cycles or the changing priorities of rotating presidencies. A permanent integrated maritime surveillance authority for the Baltic Sea, equipped with a clear mandate, sustained resources, and operational response capacity, is the institutional response the situation demands. It can only be created by the collective political will of NATO member states bordering the Baltic — and that will must be confirmed or denied at Ankara.

The naval officer who spoke to Le Monde on June 18, 2026 may have risked his career to say a truth that diplomats still hesitate to formulate as clearly. The decision-makers at Ankara owe it to him, and above all owe it to collective security, to translate his difficult truth into doctrine and resources. That is the minimum one can expect from a summit of the Atlantic Alliance in 2026.

By Maxime Marquette, columnist

Columnist's transparency note

What I know with certainty and what remains uncertain

This commentary draws on public sources: Le Monde's report of June 18, 2026, publicly accessible maritime security expert reports, and official government communiqués from the countries concerned. I do not have access to classified information about Russian naval operations in the Baltic. Quotes attributed to an unnamed naval officer in Le Monde's article are reproduced as found — their accuracy rests on the journalistic rigour of the newspaper, not on my own independent verification.

My editorial biases and the limits of my expertise

I favour a strong and coordinated European and NATO response to the Russian hybrid threat. This bias structures my analysis. I am not a military expert or maritime lawyer — my analysis of legal and doctrinal implications relies on secondary expert sources. The proposals I advance in this commentary are contributions to the debate, not prescriptions drawn from technical expertise I do not fully possess. I offer them in that spirit of contribution to the public debate on European security.

Sources

Primary sources

Le Monde — Incidents multiply in the Baltic Sea, Russian navy now operates in a completely overt manner — June 18, 2026

News Ukraine RBC — Russia linked to massive GPS jamming — 2026

El País English — Putin's invisible front: hybrid warfare and sabotage test Europe — June 5, 2026

United24 Media — Russia is redirecting Ukrainian drones into NATO airspace — 2026

Secondary sources

EU Insider — PISM: report on Russian hybrid warfare against Baltic Sea states — 2026

Asymmetric Intelligence Monitor — European strategic autonomy weekly brief — June 17, 2026