Earlier this month, as the world’s attention was focused on the horror unfolding in Israel and Gaza, it was easy to miss the news that two subsea telecommunications cables and a gas pipeline in the Baltic Sea had been damaged.

On the night of 7 October, the 77-kilometre Balticconnector gas pipeline and a separate but close-by subsea telecommunications cable stretching between Finland and Estonia were damaged ^[1] in the Gulf of Finland. A week later, it emerged that, on the same night, another subsea telecommunications cable—connecting Estonia and Sweden ^[2]—had also been damaged.

That might not seem particularly newsworthy. After all, subsea cables—despite facilitating around 95% of internet traffic, making them the physical backbone of our digital world—are notoriously vulnerable to damage. These fibre optic cables, often only the diameter of a garden hose, along with gas pipelines, zigzag all across the ocean floor, where they can suffer damage from storms, marine life, waves, earthquakes and accidental maritime vehicle activity. There are hundreds of such incidents ^[3] each year.

This case, however, appears to have been no accident.

Finland, Estonia and Sweden soon announced that the gas pipeline and cables had likely been deliberately damaged ^[4] and were being investigated as related incidents.

At the centre of the investigation was a Russian state-owned nuclear-powered cargo ship, the Sevmorput. Russia has long posed a threat to vital subsea cables in the region, particularly ^[5] since the start of the Ukraine war. The threat has escalated since the explosion of the Nord Stream gas pipeline in September 2022. Indeed, earlier this year Russia announced that it could damage subsea cables in retaliation for Nord Stream and European countries’ support for Ukraine. In June NATO even set up a subsea cable taskforce ^[6] because of the high threat of Russian sabotage in the region. And with Finland recently joining NATO—and Sweden in the process of joining—it’s highly likely that Russia damaged the cables in retaliation.

However, another vessel was also reported to be under investigation—a Hong Kong–registered cargo ship, the NewNew Polar Bear, that had been travelling with the Russian vessel.

Open-source tracking showed that both the Russian and Chinese vessels had been in the exact location at the exact time ^[7] when each of three lines—the two subsea telecoms cables and the gas pipeline—was damaged.

This is where the mystery starts to get stranger.

On 20 October, Finland announced ^[8] that the Chinese ship—not the Russian vessel—was the prime suspect for damaging the Balticconnector pipeline. Estonia and Sweden followed by saying that the Chinese vessel was also the prime suspect in both subsea cable incidents.

An investigation by Finland into the gas pipeline has since determined ^[9] that the damage was indeed caused by the Chinese vessel. Finnish authorities have recovered its anchor from the site. The next phase of the investigation will be to determine—somehow—whether the damage was done intentionally, accidentally or as a result of poor maritime activity, and what the motivation was. After the revelation that the Chinese vessel was at fault for the gas pipeline damage, Estonia and Sweden reaffirmed ^[10] that the subsea cable incidents were linked to the gas pipeline attack.

Unsurprisingly, both Russia and China have vehemently denied any involvement in damaging the cables. Russia, despite its history of threats to sabotage European subsea cables and its recent sabre-rattling over NATO expansion, has dismissed ^[11] the accusations as ‘rubbish’. China, for its part, has agreed ^[12] to provide information and called for ^[13] an ‘objective, fair, and professional’ investigation, emphasising the Chinese vessel’s routine maritime activities. Central to this mystery is why a Chinese vessel would even be involved in damaging subsea cables in the Baltic Sea in the first place. Would China really take its ‘no-limits partnership’ with Russia to a whole new level?

Indeed, this is where the situation gets murkier still.

While initially the NewNew Polar Bear was reported to be operated by China’s Hainan Xin Xin Yang Shipping Company, an update to the ship’s paperwork ^[14] while still in transit a few days ago has changed its operator’s name to Torgmoll, a Russian company specialising in maritime trade with China. Marine ownership and control are often opaque, and in some instances, downright shady. It’s possible that Russia chartered the vessel to conduct the sabotage, knowing it would test and complicate any European response if the vessel was registered in Hong Kong. Russia may have undertaken the sabotage with or without the knowledge of Beijing. Indeed, China may be involved, knowing that the murkiness of the situation makes it difficult to figure out who was responsible for what.

Attribution of responsibility for this kind of incident is extremely difficult, and it’s unlikely we will ever find out exactly what happened. And that of course, is exactly why Russia—or China—has done it. The deliberate targeting of subsea cables and gas pipelines during peacetime is a tactic that falls in the grey zone—actions that are coercive, effective and aggressive, yet fall below the threshold of armed conflict—even if it can be proved.

It’s not clear how this story will play out. What is clear, however, is that the world should be watching it closely, because it’s likely that the ripples from these attacks in the Baltic Sea will extend far beyond its waters.