.jpg)
Fearful of their interests being overlooked by U.S. President Donald Trump in his desire to achieve a quick ceasefire in Ukraine, European leaders have begun to threaten increasingly severe actions against Russia if it refuses to participate earnestly in peace talks. One particular target of European officials is Russia’s “shadow fleet,” a network of vessels assembled to evade the G7 price cap on Russian oil exports. Although these ships are unofficially associated with Russia, shadow fleet vessels traditionally sail under flags of smaller third states. Yet Russia, for the first time, recently took official military action to protect a shadow fleet vessel in the Baltic Sea. Kremlin spokesperson Dmitry Peskov also said publicly, with reference to the shadow fleet, that Russia would defend its vessels in the Baltic Sea using “all means available.”
Three recent events in the Baltic Sea indicate that Moscow is feeling the heightened pressure from Europe. On May 13, a Russian Air Force fighter jet circled over a shadow fleet oil tanker named Jaguar, under escort by Estonian authorities—and violated NATO airspace in the process. Five days later, Russian authorities detained a Greek-owned oil tanker, the Green Admire, after it departed from Estonia. And on May 20, one week after the Jaguar incident, Polish military forces conducted a patrol flight to deter a suspicious shadow fleet vessel, also in the Baltic Sea.
While it has been assumed the primary intent of the Russian shadow fleet is sanctions and price cap evasion, there is more and more reason to see the ships as part of a Russian sabotage campaign. Indeed, one cannot separate these three events from a recent string of incidents involving suspicious damage to critical subsea infrastructure in the Baltic Sea. Estonian Defense Minister Hanno Pevkur revealed that the Estonian authorities had pursued the Jaguar because they were concerned that it might present a threat to Estonia’s undersea infrastructure. Similarly, Polish Prime Minister Donald Tusk noted that the shadow fleet vessel of interest to Polish authorities had performed “suspicious maneuvers” near a power cable connecting Poland and Sweden.
Such concerns are justified: In December 2024, a shadow fleet vessel—the Eagle S—was suspected of cutting four subsea data cables and the Estlink 2 submarine power cable, one of only two interconnectors between Finland and Estonia. In addition to hard security threats, the shadow fleet is overwhelmingly composed of aging vessels, increasing the risk of oil spills at sea.
Debates on how to deal with the shadow fleet and how to better protect Europe’s critical subsea infrastructure have thus far been relatively separate from one another. The events of May 2025 highlight why this can no longer be the case. As with related instances of damage to Baltic Sea cables and pipelines, these most recent showdowns offer a glimpse into the bold, creative, and proactive responses that European authorities are developing to maritime threats. At the same time, there are still shortcomings and unanswered questions that leave European coastal nations either vulnerable to additional sabotage or limited in their responses to it. In addition, Baltic Sea countries must prepare to deal with more direct activity from Russia to protect shadow fleet vessels.
Russia’s threats and demonstrated willingness to intervene militarily on behalf of the shadow fleet are a dangerous escalation in an increasingly securitized Baltic Sea. Not only do such action and rhetoric further raise tensions between Russia and its neighbors, but they also increase the possibility of direct confrontation between Russian and NATO forces. Nevertheless, Europeans cannot afford to let these acts by Russia deter them in taking further steps to protect their territorial waters. Rather, they must continue to adapt to this fluid environment with a new threat perception.
From Reactive to Proactive: Europe’s Intensified Responses to Potential Sabotage
The Estonian and Polish authorities’ actions in May 2025 followed a clear progression of Europeans learning from and building upon past responses to potential sabotage. In October 2023, the Hong Kong–flagged NewNew Polar Bear damaged two subsea cables and a gas pipeline in the Baltic Sea and ignored Estonian and Finnish requests for the vessel to halt its voyage. Just over one year later, the Chinese-flagged Yi Peng 3 severed two subsea cables connecting Germany with Finland and Lithuania with Sweden respectively. While the vessel eventually sailed on, it did so after spending roughly a month anchored in international waters in the Kattegat at the request of European officials. Yet the vessel refused to enter Swedish territorial waters, where national authorities would have had jurisdiction under international maritime law to board and investigate the ship.
The most significant leap in European responses to subsea infrastructure damage came from Finnish authorities in their reaction to the Eagle S in December 2024, as it marked the first time European authorities boarded a shadow fleet vessel in the Baltic Sea. Once private sector cable operators informed government officials of the cable breakages, authorities were able to swiftly identify the Eagle S as the responsible vessel. The Finnish Border Guard set out in pursuit of the tanker and requested the ship enter Finnish territorial waters. The Eagle S complied, and once it was within Finnish jurisdiction, armed special forces descended from two helicopters and boarded the vessel. One month after the Eagle S incident, Swedish authorities similarly seized a vessel suspected of damaging a subsea cable between Latvia and Sweden, though in much less dramatic fashion.
The recent willingness of Estonian and Polish authorities to preemptively approach shadow fleet vessels before any damage could occur shows how seriously threats to subsea infrastructure are being taken in Europe. Following the recurring cable cuts in the Baltic Sea, both NATO and the UK-led Joint Expeditionary Force have launched new initiatives to more closely surveil suspicious vessels and increase naval patrolling in the Baltic and North seas. In January 2025, Baltic Sea NATO allies and the EU committed to signing a memorandum of understanding to increase cooperation on critical undersea infrastructure protection. And in February 2025, the EU released an Action Plan on Cable Security, which highlights prevention, detection, response capacities, and deterrence as areas of focus.
Preparing for All Scenarios
Beyond its concerns regarding the safety of its undersea infrastructure, Estonia had solid legal justification for inspecting the Jaguar: The ship lacked valid flag registration. The Jaguar, previously named Argent, was one of more than 100 ships sanctioned by the UK in May 2025 as part of Russia’s shadow fleet. According to Lloyd’s List, a shipping news journal, Gabon—whose flag the Jaguar had previously been flying under—revoked the Jaguar’s provisional registration on the same day the UK sanctions were issued. The ship was therefore flying without a registered nationality on May 13, allowing Estonian warships to approach the tanker under Article 110 of the UN Convention on the Law of the Sea (UNCLOS).
It was convenient for Estonian authorities that the Jaguar was not sailing under a valid flag, just as it was convenient for Finnish and Swedish authorities in December and January respectively that the ships they were pursuing complied with their requests to enter territorial waters. In each case, European authorities acted in accordance with international maritime law. Yet there are several imaginable scenarios where a legal mandate may be less concrete, leaving European coastal states with limited options to respond to sabotage or potential environmental catastrophe. Officials and militaries must address and prepare for these scenarios.
First, shadow fleet vessels and other suspicious ships will continue to sail in the North and Baltic seas, and it is unlikely that all will lack a valid country flag. Moreover, when foreign merchant vessels are properly registered, coastal states are generally not allowed under UNCLOS to detain them in exclusive economic zones (EEZs) or on the high seas without flag state consent. At the very least, Europeans should continue to closely surveil shadow fleet vessels and escort them whenever they enter European coastal state territorial waters or sail through their EEZs. Doing so ensures that authorities are in immediate proximity should any attempts at sabotage occur. In this regard, it is encouraging that NATO announced it would send even more warships, drones, and other maritime assets to the Baltic Sea following the Jaguar episode. The Swedish government’s announcement that, beginning July 1, it would collect insurance information from ships that sail through Sweden’s territorial waters and EEZ is a similarly positive development.
Europeans should also continue to sanction more shadow fleet vessels, placing pressure on flag states to remove these ships from their registries. It is a positive signal that hundreds of shadow fleet vessels are targeted in the EU’s seventeenth round of sanctions against Russia, which was formally approved on May 20. The EU must now better coordinate its sanctions on these vessels with the UK and the United States, ensuring maximum repercussions for those in violation. According to one analyst, as of May 29, 508 shadow fleet vessels are sanctioned by the EU, the UK, or the United States—only 43 of those 508 are sanctioned by all three. Importantly, Russian oil export volumes from shadow fleet tankers sanctioned by the EU, the UK, and the United States have decreased by 90 percent, compared to a 50 percent decrease from ships sanctioned by only the EU and the UK.
The second scenario Europe must prepare for is responding to ships suspected of sabotage that do not comply with authorities’ requests to stop either in European countries’ territorial waters or on the high seas. As mentioned, in the most recent instances of confirmed damage to European undersea infrastructure, the captains of suspected vessels agreed to sail into European waters where the ships were then boarded by authorities. It is likely that the captains of future suspicious vessels will not comply with such requests, much like the Jaguar refused to obey the Estonian navy’s orders when it attempted to check the ship’s registration.
If a vessel is caught damaging critical subsea infrastructure while in a European country’s territorial waters, and that country has laws that criminalize such damage, then the coastal state possesses the legal right under UNCLOS to pursue and intercept the vessel. It is less clear, under current international legal provisions, whether European governments can do the same if an offending ship is beyond territorial waters. That does not mean officials do not have options to explore. In particular, they can change their interpretation of international law to assert extraterritorial criminal jurisdiction under UNCLOS, something policymakers in Europe have been hesitant to do so far. The key going forward will be coordination and standardization: Such attempts will only succeed if there is a common European reinterpretation of how to approach suspected vessels in a coastal state’s EEZ or on the high seas.
In all cases, once there is a sound legal basis for pursuing a suspected vessel, European authorities must possess the capabilities to board these ships from both the air and the sea if deemed necessary. Following the Jaguar incident, it was reported that the Estonian navy lacked the armed vessels and aerial capabilities to forcibly board a resistant vessel like the nonflagged tanker. Estonia, in coordination with regional allies, must decide whether it is a priority to address these shortcomings on its own, and how other NATO allies and vessels could assist in future scenarios. Either way, Estonia alone should not be left with sole responsibility for addressing the threat posed by the shadow fleet in the Baltic Sea, especially as these ships pass several other NATO allies on their way to Russia. All parties involved should find ways to improve crisis-scenario coordination between navies, police, and border guards—domestically and regionally.
No Room for Error
The incidents with the Jaguar and the Green Admire indicate that increased Western sanctions and scrutiny on Russia’s shadow fleet are having their intended effect. European and NATO officials should not be deterred by Russia’s increasingly aggressive actions and rhetoric, but they should understand that room for error is shrinking. On the same day Russian forces detained the Green Admire, a Russian navy vessel accompanied the Marshall Islands–flagged tanker Sirtaki on its journey from Kaliningrad to St. Petersburg. Finnish Defense Minister Antti Häkkänen also told national media on May 24 that Russia was providing a “military escort and the presence of armed forces” for its shadow fleet in the Gulf of Finland. It remains to be seen whether Russian military vessels will regularly accompany in- and outbound oil tankers, or how long such escorts will last, but Europeans must prepare for this as a possibility—or even a new normal.
Additionally, following the Jaguar incident, Russia issued a maritime closure area bordering Estonian territorial waters that remains valid until September 1, 2025. This zone could be used by Russia as legal justification for military retaliation against European authorities if they cross into the specified area while pursuing suspicious vessels. As one analyst notes, “an interdicting Western vessel could inadvertently stray into these closure areas and therefore, be legally . . . fired upon.”
Baltic Sea countries should of course exercise caution to minimize the risks of direct confrontation between NATO and Russian forces in the Baltic Sea. At the same time, these countries must proceed without delay to identify and fill existing capability gaps, intervene when necessary to ensure the security of their subsea infrastructure, and respond with solid legal justification. The latter is important not just to minimize risks of accidental military exchange, but also because of the global ramifications of any action taken in the Baltic Sea.
Indeed, any military action or legal modification made in or with reference to the Baltic Sea will not merely apply to Europe. For example, closing EEZ corridors in Baltic Sea straits might embolden countries like China to do the same in other operational theaters. Pevkur, the Estonian defense minister, recently admitted this dynamic, noting actions taken against the shadow fleet are “not only for the Baltic Sea. . . . It’s a global impact.” Yet it is precisely because steps taken in the Baltic Sea have global implications that Europe possesses a unique opportunity to shape the way countries respond to hybrid maritime threats. It should seize this chance.
.jpg)
