‘It’s Our Backyard’: On Board a Lithuanian Patrol for Russian Hybrid Threats in the Baltic

BALTIC SEA — Through Captain Arunas’ binoculars, visibility is close to zero: "One kilometer, no more." 

The thick fog hanging over the Baltic Sea complicates the patrol for the 50 sailors aboard the Jotvingis. Their mission aboard the Lithuanian Navy command vessel: preventing hybrid threats as part of NATO's Baltic Sentinel operation.

On the horizon, a large black silhouette emerges from the winter gray. Yet the command bridge remains inactive. The container ship has just left Klaipeda, Lithuania’s third-largest city and its Navy’s home base. 

"No need to check this one — it answered our radio call earlier," the captain says. The massive vessel disappears into the mist.

Off the Lithuanian coast, military personnel ensure no ship displays threatening activity within their exclusive economic zone. 

"It's like our backyard. If we feel it’s under threat, it's bad for our people, and we will react," the captain says, eyes scanning the horizon.

Russia’s territorial waters lie 40 kilometers to the south. The exclave of Kaliningrad sandwiched between Lithuania and Poland is home to part of Moscow’s Navy.

On this freezing January morning, guard shifts on deck feel interminable. Upon rotation, the sailors quickly retreat inside the ship, where officers scrutinize radar screens, searching for suspicious vessels.

Covert tactics in the Baltic

If the Jotvingis and the dozen other Lithuanian Navy vessels remain on high alert, it is because tensions in the Baltic Sea are at historic levels. 

Since Russia’s full-scale invasion of Ukraine in 2022 and NATO’s subsequent expansion to Sweden and Finland, these shallow waters have become a stage for hybrid warfare, with attacks strongly suggesting Russian involvement.

"We are facing hybrid scenarios that were not on our radar a few years ago. Underwater infrastructure is the first target," Admiral Giedrius Premeneckas says in the officers’ lounge. 

Bordered by nine countries, the Baltic Sea is crisscrossed with electrical and communication cables. All of the four incidents involving them in the past three years have been attributed to Russia’s shadow fleet. 

These ships, flying foreign flags, transport hydrocarbons that fill Moscow’s coffers. Often aging, poorly insured and operating outside legal oversight, they allow Russia to bypass Western oil sanctions.

The most recent incident took place on Sunday, when a fiber-optic submarine cable linking Ventspils, Latvia, to Sweden’s Gotland Island was damaged. Swedish authorities detained the Michelis San, a bulk carrier sailing under the Maltese flag.

A month earlier on Dec. 25, the Estlink 2 power cable between Finland and Estonia was severed. Finnish authorities reported that an oil tanker, the Eagle S, dragged its anchor along the seabed for 60 miles before it latched onto the cables. The Cook Islands-flagged tanker was described by Finnish customs officials as part of Russia’s shadow fleet.

Carrying oil and gas in defiance of international sanctions, the vessel remains docked along the Finnish coast pending investigative results. Fingrid, Finland’s state electricity operator, estimates the damaged cable’s repair could last until late July and cost tens of millions of euros.

On Nov. 17, Lithuania also fell victim to sabotage when the 218-kilometer BCS fiber-optic cable linking Sweden’s Gotland Island to Lithuania was severed. Just hours later, at 4:04 a.m. the next day, the C-Lion1 cable connecting Helsinki, Finland, to Rostock, Germany, was also damaged.

Operation Baltic Sentinel

As of 2023, every Baltic Sea nation except Russia is a NATO member. 

In response to escalating hybrid attacks, leaders of the region’s eight NATO nations announced a set of security measures including Operation Baltic Sentinel at the Baltic Allies Summit in Helsinki on Jan. 14, aimed at deterring future sabotage.

“Since the beginning of June, we have inspected more than 300 tankers and boarded seven of them,” Estonian Prime Minister Kristen Michal said at the summit’s press conference.

As part of Operation Baltic Sentinel, frigates, maritime patrol aircraft and a fleet of small naval drones will be deployed. 

On the Jotvingis, the use of one such naval drone is crucial for inspecting underwater infrastructure. 

"It can descend 55 meters,” the commander explains, standing beside a launch boat. “Then, using a sonar system, it scans the cables, transmitting their condition over a specific area."

Once in the water, the torpedo-like device is controlled through a smartphone app. That day, no damage was detected on the cables 50 meters below the vessel.

In some operations, the Jotvingis also monitors the shadow fleet, although it does not board the ships. 

"We track them on radar, then conduct a visual inspection at sea. We question the captain and relay all information to the authorities," Admiral Premeneckas says.

These "authorities" are the NATO headquarters. A joint NATO-EU list has been compiled to identify ships suspected of operating under Kremlin influence. 

"It's a special list, shared by the European Union and NATO member states: the 'Shadow Fleet' list. For each inspection, we check whether the ship is listed," the admiral says. 

Nearly 100 vessels are currently on the list, though the actual fleet is believed to number in the hundreds.

Hybrid warfare

Hybrid warfare, as primarily conducted by Russia against the West, blends conventional military tactics with cyberattacks, disinformation, economic pressure and covert sabotage. Mark Galeotti, a specialist in Russian security affairs, has described it as “political warfare using all means short of open war.”

Dressed in his highest naval uniform, Admiral Premeneckas also notes the environmental risks posed by the outdated, poorly insured and barely maintained ships of Russia’s shadow fleet. 

"The Baltic is a confined sea, meaning a major oil spill could cause an environmental catastrophe," he says.

On Jan. 12, three German rescue vessels escorted the Eventin, carrying 99,000 tons of crude oil, to prevent a spill. 

Following the incident, German Foreign Minister Annalena Baerbock slammed Russia for "endangering European security not only with its war of aggression against Ukraine but also with decrepit tankers."

Between 2022 and late 2024, nearly 60 hybrid attacks attributed to Russian intelligence agencies, primarily the GRU and FSB, targeted Europe, with tactics ranging from physical sabotage to cyberattacks and election interference.

"With these operations, Russia is escalating its hybrid war in Europe, conducting attacks on an ever-shifting front," said Charlie Edwards, a senior fellow at the International Institute for Strategic Studies in London.

That day on the Jotvingis, no shadow fleet vessels were detected. But Captain Arunas remains steadfast. 

"Every Russian operation will receive a response from us," he says.

Not ready to support today?
Remind me later.