The Merkuriy missile corvette, one of Russia’s most advanced naval assets, was escorting an oil tanker in the Baltic Sea when the German warship approached.
The German frigate F223 had followed the two Russian ships up to a spot near the Danish island of Bornholm before it dispatched its Sea Lynx helicopter, armed with powerful surveillance equipment, to have a closer look after a series of incidents in the area had put security forces on edge.
The Russian corvette responded by shooting flares at the aircraft, forcing the pilot to turn back. No one was hurt and the helicopter, designed to hunt and destroy submarines, wasn’t damaged, German officials said.
This incident on Nov. 26, the details of which haven’t previously been reported, was part of an increasingly heated standoff between Russia and the North Atlantic Treaty Organization in Europe, with the Baltic region emerging as the key flashpoint in a confrontation unseen since the height of the Cold War.
Since Vladimir Putin launched the full-scale invasion of Ukraine, Russian warships have fired warning shots at NATO vessels, powerful Russian jamming systems have disrupted air traffic and Russian jet fighters have conducted dangerous maneuvers, including dumping fuel on allied spy planes in the skies over the Baltics, according to multiple Western officials.
Beyond military signaling, Russia has escalated an often violent campaign of sabotage and subterfuge .
Critical infrastructure such as data cables and pipelines has been attacked by commercial ships that Western security officials say were used by Russian intelligence. Clandestine Russian operators used Lithuania, a Baltic nation, as a springboard for a terror operation involving shipping incendiary devices on commercial aircraft using services such as the logistics giant DHL, according to Western intelligence and law-enforcement officials.
In Britain, a man has admitted to carrying out an arson attack on a Ukrainian-owned property in London on behalf of Russia. In Poland, a shopping mall was torched, with authorities suspecting Russia to be behind the incident.
The threat from such so-called hybrid attacks, which fall below the threshold of direct military confrontation yet endanger lives and critical infrastructure, is becoming so high that one of the nations affected could conceivably consider triggering NATO’s collective defense clause, Bruno Kahl , the head of Germany’s foreign-intelligence service, said in a rare public warning last month.
Jens Stoltenberg , the former two-time NATO secretary-general, said that during his tenure, which ended in October, Russia expanded the range of its targets, including destructive sabotage, cyberattacks and interfering in elections in European Union nations that belong to the security alliance.
“It’s a real threat…and part of a Russian campaign of hostile acts against EU and NATO members in Europe,” said Stoltenberg, now head of the Munich Security Conference, a global security forum.
“There is no doubt that Russia is involved, and Russian security services are connected to several people arrested,” he said. “The aim is to create confusion, to undermine the political support for Ukraine, and also to intervene in political processes in our countries.”
NATO allies have stepped up intelligence sharing and set up a dedicated outfit for protecting critical undersea infrastructure during his tenure, he said, gathering evidence against suspected Russian perpetrators.
Russia’s onslaught in Ukraine prompted Sweden and Finland to join NATO, and now eight of the nine nations that enclose the Baltic Sea are members of the alliance, prompting jubilant commentary from allied leaders that it had become a “NATO lake.”
German Chancellor Angela Merkel and the President of the German Federal Intelligence Agency (BND) Bruno Kahl attend the 60th anniversary of the founding of the BND in Berlin, Germany, November 28, 2016. REUTERS/Hannibal Hanschke
Yet Russia has since significantly boosted its military presence in the region, escalating its aggressive posture toward the neighbors in a way unseen since the Cold War, Germany’s defense minister, Boris Pistorius , said.
He confirmed the incident with the German navy helicopter in a statement and said that Germany’s navy acted in a “de-escalatory” way. The navies of Germany and other allies would now increase their presence in the Baltic, he said.
Further confrontations in the waters are likely.
Russia relies heavily on its Baltic ports for servicing its fleet because Turkey denies all warships passage through the Bosporus, which connects the Mediterranean with the Black Sea, home to the Kremlin’s key naval bases. Apart from the Baltic, the last remaining Russian naval stronghold in ice-free waters in the wider region is in Syria—and Moscow might be pushed out of there after its ally Bashar al-Assad was toppled by Islamist insurgents.
In addition, Russia’s so-called shadow tanker fleet uses the Baltic to ship cargo such as oil, arms and other material in violation of Western sanctions. The General Skobelev, the tanker that sailed with the Russian corvette last month, has been shipping oil from the Baltic to Russian naval installations in Syria, according to Western military and security officials.
There are other potential tripwires in the Baltic.
The German F223 frigate involved in the incident with Russia’s Merkuriy corvette was deployed to patrol the area, together with other German, Danish and Swedish warships, after a Chinese-owned bulk carrier called Yi Peng 3 was detained on Nov. 19 on suspicion that it deliberately severed two data cables —one linking Finland and Lithuania and the second linking Germany and Sweden—by dragging its anchor for many hours. The ship has since been anchored in the Kattegat Strait between Denmark and Sweden, surrounded by police vessels and NATO warships.
Investigators say they believe that its Chinese captain was induced by Russian intelligence to cut the cables with the ship’s anchor. China is cooperating with the investigation, according to Chinese and European officials, and has ordered the ship to drop anchor. But Beijing hasn’t yet allowed investigators to board the ship and question its crew.
On Nov. 21, the Merkuriy, which mainly operates in the Mediterranean and often escorts Russian sanction-busting cargo ships, arrived in the Kattegat and engaged in electronic surveillance of the Yi Peng 3 and the area around it as it accompanied the General Skobelev toward the Baltic, according to officials. They said the Russian corvette relayed encrypted information to a Russian headquarters in Kaliningrad, Russia’s Baltic exclave.
NATO has so far struggled to respond to these assaults and in some cases authorities have decided not to attribute them to Russia in order to not spread panic among their populations, according to multiple officials.
“We can’t really defend the entire critical structure—cables, pipelines, energy facilities, data centers—from hybrid attacks,” said Nico Lange, former chief of staff at the German Ministry of Defense. “Only now we understand how very, very vulnerable we are.”
Ignoring attacks invites more aggression, but attributing them is also difficult because NATO countries would be under pressure to respond without having good options to do so, said Christopher Chivvis, a former U.S. national intelligence officer for Europe who served under the Trump and Biden administrations.
“Our adversaries like hybrid warfare exactly because it’s so hard to respond to directly and proportionally; the West is so much more open and easy to penetrate for such subterfuge than Russia,” Chivvis, now senior fellow at the Carnegie Endowment for International Peace, said.
For Western democracies, the bar for responding in kind—with covert action inside Russia—is extremely high, Chivvis said. Governments should focus instead on increasing resilience, mitigating damage and boosting their capabilities to deter Moscow.
Some governments are already doing this. Finland has worked to prepare critical infrastructure firms, including by building backup cables and other contingency plans. Germany has been issuing detailed briefings to some companies, including in the shipping industry.
In the Czech Republic, where defense contractors as well as other companies have been repeatedly targeted by sabotage attempts, including arson, the government is working with the private sector to build up resilience and preparedness, said Tomas Kopecny, the Czech government envoy for the reconstruction of Ukraine.
“We train companies at board level—everyone starting from the CEO must know this is an issue, how to prepare for it, and how to react when it happens,” Kopecny said.
Adapting to the threat means that businesses and civilian installations would need inbuilt security such as surveillance technology, security guards and drones, which requires expensive investment. Only a change of legislation forcing companies to take those steps can guarantee that, said Lange, the former German defense official.
Some old Cold War hands argue that Russia has simply returned to a posture that was customary before the fall of the Berlin Wall.
“This is normal business, but the West has developed ‘war hypochondria,’ ” said James Droxford, a former British naval-intelligence officer who now runs a maritime-intelligence consulting firm and detected the Merkuriy as it entered the Kattegat last month.
Chivvis, the former U.S. intelligence official, agrees that Moscow’s subterfuge hasn’t had a major impact so far, but warned that Russia is “playing with fire” by escalating with plots such as the one involving shipping firebombs on commercial airplanes.
“That incident is really alarming and it puts Russia in the category of Iran when it comes to terror,” he said, even if “traditionally, it never wanted to be in that category.”
Write to Bojan Pancevski at bojan.pancevski@wsj.com
