Anchors in the dark: reading attacks on undersea infrastructure

The seabed is where the modern world actually runs — the cables that carry its data and power, the pipelines that carry its gas. Since 2023, a series of failures in the Baltic has made those hidden lines a front line, and vessel tracking the forensic tool that reads what happened.

A pattern emerges

October 2023 — Balticconnector. The gas pipeline and a parallel telecom cable between Finland and Estonia were damaged. Investigators linked the damage to a dragged anchor, and attention focused on a Hong Kong-flagged container ship whose track crossed the site; an anchor was later recovered near the pipeline. Finland treated it as a criminal investigation.

November 2024 — two cables cut. Two Baltic telecom cables — one between Lithuania and Sweden, one between Finland and Germany — failed within a day. A bulk carrier was suspected of dragging its anchor for tens of nautical miles across both.

25 December 2024 — Estlink 2. The Estlink 2 power cable between Finland and Estonia, along with several telecom cables, was damaged. Finnish authorities boarded and seized the tanker Eagle S — a Cook Islands-flagged vessel linked to the sanctioned shadow fleet — on suspicion of anchor-dragging, and recovered evidence consistent with a dragged anchor.

Three winters, one recurring signature: a ship, an anchor, and a line on the seabed that stopped working. In January 2025, NATO responded with an enhanced Baltic patrol presence.

How vessel tracking becomes evidence

You cannot see the seabed. But you can see the ship, and that turns out to be enough to reconstruct a great deal.

When infrastructure fails at a known location and time, investigators pull the AIS tracks of every vessel that was in the vicinity and look for the signature of a dragged anchor:

• A slowdown to a few knots — the pace of a ship whose anchor is catching on the bottom, far slower than a normal transit.
• A track that runs along or across the damaged cable or pipe at the exact time it failed.
• Sometimes an AIS gap or anomaly around the event, or a heading that no ordinary voyage would take.
• Later, physical corroboration: a missing anchor, or drag marks on the seabed matching the track.

Correlating the tracked position and speed of a suspect vessel with the location and timing of the damage is what moves a case from “a cable broke” to “this ship was over it, moving like this, at that moment.” In the Baltic incidents, that reconstruction — built on AIS — has been central to identifying and detaining suspect vessels.

Why this is hard, and where it goes wrong

Anchor-dragging is deniable by design. An anchor can be “accidentally” left down; a ship can claim weather or error. That is exactly why the data matters — a single slow pass might be innocent, but a track that hugs the infrastructure for tens of miles is very hard to explain away.

It is also why the analysis cannot rest on AIS alone. A vessel involved in this kind of activity has every incentive to switch off, spoof, or falsify its broadcast — the same manipulation tradecraft seen across the shadow fleet. Robust attribution corroborates the AIS story against other evidence: satellite imagery placing the hull, the physical anchor, seabed surveys, and the vessel’s ownership and history. The overlap between the ships implicated in Baltic incidents and the sanctioned shadow fleet is itself part of the picture.

The stakes

Undersea cables carry an estimated 95%+ of intercontinental data; subsea power and gas links hold national grids together. They were built on an assumption of benign neglect — that no one would bother attacking something so hidden. The Baltic has ended that assumption, and it has made maritime domain awareness a matter of critical-infrastructure defence, not just sanctions or fishing.

For the agencies protecting these lines, the task is the one we build for in maritime domain awareness: fuse AIS with satellite and behavioural analysis to spot the vessel loitering where it should not be, moving how it should not move, before the cable goes dark — and to reconstruct, with defensible evidence, what happened when one does. The seabed is invisible. The ships above it are not.

---

Sources: Finnish, Estonian, Lithuanian and Swedish authority statements on the Balticconnector (Oct 2023), November 2024 cable cuts, and Estlink 2 / Eagle S incident (Dec 2024); NATO Baltic patrol announcements (Jan 2025); contemporaneous reporting. Investigations were ongoing at time of writing.