The Proxy Pattern

Eighty meters below the surface of the Baltic Sea, on the night of September 26, 2022, something detonated.

Swedish seismological stations recorded it first — a sharp spike that looked like an earthquake but was not. Then another. Then two more. By morning, the Nord Stream 1 and 2 pipelines were destroyed, methane boiling up from the seabed in circles a kilometer wide, and the world had a new category of warfare it did not yet have a name for.

Three nations launched investigations. Germany, Denmark, Sweden — each proceeding separately, each arriving at the same threshold conclusion: deliberate sabotage. The charges had been placed by divers, timed and positioned, in international waters within the Danish and Swedish exclusive economic zones. Germany issued a European arrest warrant for a Ukrainian national. Italian police arrested a suspect. Polish police arrested another, then released him when a court denied extradition.

As of February 2026, no government has publicly attributed the attack. The investigation continues. The pipelines do not.

What matters for this chapter is not who did it. What matters is what it proved: that the undersea infrastructure on which the modern economy depends — the pipelines and cables and power links running beneath the world's oceans — is practically indefensible against a determined attacker. That the gap between the importance of this infrastructure and the capacity to protect it is vast. And that someone has noticed.

Proxy warfare is not new. The Cold War was fought largely through proxies — Soviet weapons in Vietnamese hands, American weapons in Afghan hands, each superpower maintaining the fiction of distance from conflicts it was fueling. The pattern is ancient: use someone else's soldiers to fight your war, and maintain deniability when the cost is counted.

What is new is the target.

In Cold War proxy conflicts, the objective was territory, ideology, or the exhaustion of an adversary's resources. The battlefields were jungles, mountains, deserts, cities. The infrastructure of daily life was sometimes damaged, but it was not the point.

In the twenty-first century, the infrastructure is the point.

The evolution began before Nord Stream but accelerated after it. Within fourteen months of the pipeline's destruction, the Baltic Sea became a laboratory for a new kind of warfare — one fought not with missiles or rifles but with anchors.

October 2023: the Balticconnector subsea gas pipeline between Finland and Estonia was severed, along with telecommunications cables connecting Estonia to Finland and Sweden. Finnish investigators identified the Chinese container vessel NewNew Polar Bear, which had dragged its anchor across the pipeline and cables. The vessel was en route to a port near St. Petersburg.

November 2024: two submarine telecommunications cables were cut near-simultaneously in the Baltic — the BCS East-West Interlink and the C-Lion1 fiber optic cable. NATO accused the perpetrators of hybrid warfare. The suspect vessel was the Chinese cargo ship Yi Peng 3, which had departed the Russian port of Ust-Luga two days earlier carrying fertilizer. Investigators established that the ship dropped anchor in Swedish waters and continued sailing at greatly reduced speed, the anchor dragging across the seabed. The first cable was cut. Six hours later, the second. The weather was mild. The likelihood of an accident, analysts noted, "appears minimal." Western intelligence officials believe Russian intelligence induced the ship's captain — who was Russian — to drag the anchor. Encrypted communications were reportedly relayed to the vessel by Russian ships four days later.

December 2024: the Estlink 2 undersea power cable between Finland and Estonia was cut, along with four telecommunications lines. Finland seized the tanker Eagle S, registered in the Cook Islands, part of Russia's "shadow fleet" of vessels evading oil sanctions. The ship had allegedly dragged its anchor over sixty miles.

January 2025: a fiber optic cable connecting Latvia and the Swedish island of Gotland was damaged. Sweden seized a Maltese-flagged bulk vessel.

February 2025: a data cable between Germany and Finland was damaged east of Gotland. Sabotage suspected.

In sixteen months, at least six major undersea infrastructure incidents in a single sea — each involving vessels with links to Russia or China, each exploiting the same method: anchor-dragging, which is nearly impossible to prove as intentional in court. When Finland prosecuted the captain of the Eagle S, the court dismissed the case. Prosecutors could not demonstrate intent. Negligence, the judge ruled, must be pursued by the flag state — which was the Cook Islands, a tiny Pacific nation with no capacity or interest in prosecution.

The method is the message. Anchor-dragging creates a deliberate attribution gap: the act is clearly hostile, but the legal system cannot reach it. The vessel flies a flag of convenience. The crew claims ignorance. The anchor was dropped by accident. The wind was strong. And the cable, carrying financial data or electrical power for an entire country, is severed on the ocean floor.

This is not improvised. Russia has been preparing for undersea infrastructure warfare for decades.

The Yantar is a 108-meter intelligence collection vessel operated by Russia's Main Directorate of Deep-Sea Research — known by its Russian acronym, GUGI. Since its commissioning in 2015, the Yantar has been tracked by Western navies near cable routes across the Atlantic and Arctic. It carries deep-diving submersibles and advanced sonar. Western naval officials assess that it can "alter the frequency pulses passing through communication cables, causing disruptions" and is "likely pinning where a disturbance would cause maximum harm."

In November 2025, the Yantar entered UK waters north of Scotland. Britain's defense secretary confirmed it was "engaging in espionage and the mapping of UK's undersea cables." Satellite imagery showed the vessel systematically charting cable and pipeline routes. The crew pointed low-powered lasers at a Royal Navy patrol aircraft that was shadowing them — a provocation, but not an act of war. The Yantar was part of what analysis revealed to be a larger campaign: several Russian naval vessels had been monitoring British waters for thirteen months.

The Yantar is a symptom of doctrine. GUGI operates deep-diving nuclear submarines and survey ships capable of operating at six thousand meters. Russia has, according to the Small Wars Journal, "spent considerable money, time and effort in developing the platforms and capabilities that could target undersea infrastructure" and has "made attacks on seabed infrastructure a core objective of its modernized naval strategy."

What the Soviet Union did with active measures — sabotaging industrial infrastructure, co-opting civilian vessels for intelligence missions, maintaining plausible deniability through layers of cutouts — Russia now does to the digital nervous system of the Western economy.

NATO responded. Within three weeks of the November 2024 cable cuts, the alliance deployed warships to the Baltic under the banner of "Baltic Sentry." In May 2025, NATO established a Maritime Center for Critical Underwater Infrastructure, tasked with building "patterns of life" — tracking vessels that frequently change direction, loiter, or slow near critical cabling. The response involves warships, AI-powered tracking systems, F-35 fighters, and reaction times of "within half an hour or an hour" to suspicious behavior.

But NATO's response confronts a structural catch-22 that may have no solution. Protecting cables requires surveillance. Surveillance requires data transmission. Data transmission requires the cables. The system that enables the defense depends on the infrastructure being defended — a circularity that an adversary willing to cut the right cable at the right moment can exploit.

And the legal framework is not up to the task. The 1884 Paris Convention first established international protection for submarine telegraph cables. The United Nations Convention on the Law of the Sea — UNCLOS, ratified in 1982 — requires every state to make it a "punishable offense" to break or injure a submarine cable beneath the high seas, willfully or through culpable negligence. Article 113 is clear enough on paper. In practice, most countries — including the United States — have never passed domestic legislation implementing its penalties. Flags of convenience render enforcement nearly impossible. The intent requirement defeats prosecution. And UNCLOS does not explicitly regulate wartime conduct against cables — meaning that in a conflict, undersea infrastructure exists in a legal void.

The Finnish court's dismissal of the Eagle S case may be the most consequential legal precedent of the decade. If courts cannot convict cable saboteurs because intent cannot be proven for anchor-dragging, the legal system has effectively created a permission structure for infrastructure warfare. Drag an anchor. Shrug. Sail on.

The proxy pattern has not yet escalated to trunk routes. The Baltic incidents targeted secondary cables — important regionally but not globally catastrophic. The transatlantic cables carrying ninety-five percent of intercontinental data traffic remain untouched. The cables transiting the South China Sea, critical to Asian economies, remain intact.

But the capability has been demonstrated. The doctrine exists. The intelligence mapping is underway. The legal framework to deter it does not function. And the targets — not military bases, not army columns, but the thin glass threads carrying the digital economy across the ocean floor — are as vulnerable as they were the day before Nord Stream.

The old proxy pattern gave someone else your guns and pointed them at your enemy's soldiers. The new proxy pattern gives someone else an anchor and points it at the nervous system of civilization.

Someone will target the trunk routes. Whether the system will be ready when they do is another matter. The evidence, so far, suggests it will not.