European investigators increasingly see Russian fingerprints around recent acts of suspected sabotage on strategic infrastructure but are struggling to respond.
Reacting to clandestine threats is difficult because evidence around the suspected attacks—including a severed undersea gas pipeline , cuts in a vital internet connection and the disruption of a rail network —often isn’t conclusive. Potential culprits in big cases include commercial shipping or fishing vessels that have been engaged in apparently legitimate maritime transport or trawling for fish near sensitive seabed installations that were destroyed around the same time. They rarely have direct connections to Russian authorities, investigators say.
European governments have charged some Russians and Russian proxies in smaller incidents and are getting more vocal in accusing Moscow of waging hybrid warfare, but are stopping short of accusing Russia of specific attacks. In the most brazen suspected incidents, a lack of clear proof has prompted officials to leave cases open or declare investigations inconclusive.
Last fall, Finnish investigators linked a Chinese-registered ship, operated by a Russian crew, to the cutting of the Balticconnector natural-gas pipeline to mainland Europe. As the investigation advanced and the ship sailed around Scandinavia back toward Russia, the Finns contacted Norwegian counterparts about their suspicions. Norwegian authorities contemplated forcing the ship into one of their harbors for inspection, but ultimately decided they lacked clear evidence. A Norwegian coast-guard ship shadowed the Newnew Polar Bear as it was passing sensitive marine infrastructure.
“Only a week or two later we would have had enough evidence to stop and search the ship, but by then it was already too late,” one Norwegian official said.
Detecting potential attacks is increasingly difficult because Russia, since launching its full-scale invasion on Ukraine two years ago, has turned more to civilians and commercial vessels to survey and possibly attack critical infrastructure such as undersea connections, offshore energy facilities, transport networks and military installations, people familiar with the cases say.
Some governments are also refraining from blaming Moscow for fear of escalating tensions beyond control. The suspected attacks often fall below the threshold of what would be considered warlike acts of aggression because they involve civilian vessels, with operators who willingly talk with investigators and claim innocence.
Investigators and prosecutors must meet European justice systems’ high bar for criminal evidence while authorities grapple with enforcing national-security laws against potential culprits benefiting from Western democracies’ freedoms.
To prevent attacks, European governments have put the systems protecting critical infrastructure on high alert, added security personnel and placed more cameras and sensors at rail and maritime facilities.
German prosecutors last month detained two dual Russian-German nationals suspected of spying for Moscow with the goal of disrupting Western military assistance to Ukraine through sabotage. Germany’s population of roughly 83 million people includes a Russian community of nearly four million, and Moscow’s spymasters are targeting them for recruitment, security officials said.
Ordinary civilians are recruited via social media such as Telegram, as well as through the chat functions of popular online games, investigators said. Recruits sometimes remain unaware that they operate on behalf of Russia.
Polish officials in February detained a man working for Russian intelligence who they said planned to commit acts of sabotage, including setting fire to facilities in the western city of Wroclaw, a big supply hub to Ukraine. A Polish court late last year sentenced six men to prison on espionage charges.
Some officials believe that one of Moscow’s objectives is to spread fear and distrust through disruptions. These officials believe that a more prudent course than responding by accusing Russia and potentially spreading fear is to remain quiet about suspicions, though this approach has drawn criticism.
“If the current strategy is in fact to avoid attribution in cases where significant evidence points to Russia,” said Benjamin L. Schmitt, a senior fellow at the University of Pennsylvania who specializes in European energy security, “this will only degrade deterrence and invite further attacks against critical infrastructure.”
More governments are going public with warnings.
On Tuesday, Norway’s security agency plans to publish a major report that is expected to analyze the threat of Russian sabotage in the country, which borders Russia and hosts critical North Atlantic Treaty Organization military assets. Norway also trains Ukrainian soldiers and provides ammunition and hardware to Kyiv.
Britain’s cyberintelligence agency GCHQ is “increasingly concerned about growing links between the Russian intelligence services and proxy groups to conduct cyberattacks—as well as suspected physical surveillance and sabotage operations,” its director Anne Keast-Butler said last week.
NATO issued an exceptionally blunt statement this month accusing Russia of waging “an intensifying campaign of…sabotage, acts of violence, cyber and electronic interference, disinformation campaigns, and other hybrid operations.”
Authorities believe Moscow is using civilian equipment for spying and sabotage. Russia has in recent years employed its vast commercial fishing fleet, as well as marine-research ships for intelligence gathering in the Arctic, an area crucial for its strategic nuclear-submarine deterrence that is based there, an official for Norway’s security service PST said. Some of the vessels are modern ships, more than 300 feet long, equipped with sonar and other technology that allows them to scan the seabed, the official said.
Since the start of the full-scale invasion of Ukraine, such vessels have mapped critical subsea infrastructure around Europe and identified potential targets in case of a full-blown confrontation with NATO, several officials said. U.S. officials see similar threats to subsea cables in the Pacific Ocean .
The Balticconnector rupture shows investigators’ challenge in linking damage to culprits. On Oct. 7 the Chinese-registered containership Newnew Polar Bear left Russia’s Baltic Sea port of Kaliningrad and sailed north. Staffed by a Russian crew, it crossed the pipeline’s area at the same time the link broke.
The ship, which was trailed by the Sevmorput, a nuclear-powered merchant ship owned by the Russian government, then docked in St. Petersburg, before retracing its path and sailing around Norway to the northern Russian port of Arkhangelsk. It traveled at least a large part of the 3,600-mile route almost simultaneously with the Sevmorput, according to satellite data reviewed by The Wall Street Journal.
Finnish investigators believe that the pipeline was cut by the Newnew Polar Bear’s anchor. A spokeswoman for the Finnish investigation authority said that the ship’s Chinese owners were collaborating with investigators and that the probe sought to determine whether the rupture was an accident, the result of negligence, or a deliberate act of sabotage.
The owner of the ship, Hainan Xin Xin Yang Shipping, didn’t respond to a request for comment.
Immediately after the pipeline was cut, Finnish officials identified the ship as a potential culprit, but they were unable to search it because it was in international waters.
A Finnish official familiar with the investigation said investigators are unlikely to attribute responsibility at the end of the probe.
In Germany, officials and investigators say they suspect Russia could have been behind an attack on the railroad that temporarily halted all rail traffic in the north of the country in October 2022.
The rail attackers crippled both the railway’s main communication network and its backup by almost simultaneously severing two data cables located roughly 200 miles apart, investigators said. Whoever carried out the sabotage had detailed knowledge of the network, investigators said.
“It smells like Russia. It looks like Russia,” a senior investigator said. This person said that the attack failed to cause greater public concern because it only disrupted traffic for around four hours, which he said was a relatively unexceptional disturbance for passengers using Germany’s delay-plagued rail system .
In January 2022, as Russia was positioning its forces to attack Ukraine, a Russian fishing trawler was detected traversing the icy waters above a major fiber-optic cable around the time it was cut. The cable carried data from SvalSat, one of the largest commercial satellite ground stations in the world, located on Norway’s Svalbard archipelago in the far north.
The cable carries data that is essential for internet traffic across Europe. Russia has in the past said that the West uses the facility to spy on marine traffic. A backup cable ensured continuous operation, albeit at a lower capacity.
The Russian trawler crisscrossed more than 100 times over the exact spot where the cable was cut, according to satellite traffic-monitoring data, said Ronny André Jørgensen, a prosecutor from the northern city of Tromsø who investigated the incident.
Footage from an underwater drone revealed that the seabed where the cable was cut had been plowed by a hard object, the tracks of which resemble the impact of the equipment carried by the Russian trawler Melkart 5. The captain of the ship was questioned but no evidence was found against him, and the company denied responsibility.
The owner of the trawler, Murman SeaFood, didn’t immediately respond to a request for comment.
“The bar for evidence in a criminal investigation is very high, and we have not been able to reach it,” Jørgensen said.
Jørgensen said that Russian fishing boats have been spotted over the area where another cable was cut off the coast of northwest Norway less than two months before the Svalbard incident. The cable, belonging to a local ocean observatory, was used to monitor marine life, but in theory could be used to trace the movement of ships and submarines, he said.
Write to Bojan Pancevski at bojan.pancevski@wsj.com
