By Joe Durigan and Craig Whiteside
Since 2022, Russia has sharply increased its employment of illegal/coercive/aggressive/deceptive (ICAD) maritime tactics in the Baltic Sea, often loosely referred to as “gray zone” activities. Assessing Russian hostility toward Europe, new NATO chief Mark Rutte recently noted that “Russia is already escalating its covert campaign against our societies” and that the alliance must be prepared for a Russian attack within five years. Whether Rutte’s assessment is correct is hard to judge, but could the dramatic increase in ICAD maritime tactics be the cause for this perception? Is Russian aggression imminent in the Baltic Sea region?
Our analysis of Russian illicit maritime tactics in the Baltic Sea since 2022 leaves us skeptical of any escalation. We argue that Russia employs irregular maritime statecraft to offset declining conventional naval power, sustain sanctioned energy exports, and pressure NATO without triggering open conflict. These nefarious activities—shadow fleet operations, undersea infrastructure sabotage, and electronic interference—are disruptive but strategically limited. While effective at harassment and signaling, they cannot deliver decisive political outcomes and increasingly risk attribution, backlash, and escalation. Putting aside Russia’s robust capabilities and malign behavior in other domains, its maritime “gray zone campaign” is a defensive, compensatory strategy chosen out of weakness, not a pathway to strategic advantage. NATO’s real challenge is managing persistent disruption without over or under-reacting—the strategic analog to the Goldilocks rule.
Russian Maritime Strategic Culture and its bad hand in the Baltic Sea
Russia’s maritime behavior in the Baltic Sea is best understood through the constraints imposed by strategic culture and geography rather than through explanations of deliberate escalation or doctrinal mastery. Historically a land‑centric power, Russia has struggled to convert naval forces into reliable political leverage, particularly in confined maritime spaces. Unlike its confidence in ground operations or information warfare, Moscow has long treated the sea as an exposed domain—one where visibility is high, control is fleeting, and conventional superiority is difficult to sustain. As a result, Russia has tended to favor ambiguity, deception, and indirect methods at sea over overt demonstrations of naval power.
That discomfort has become more pronounced since 2022. Russia’s inability to move naval forces through the Turkish Straits, its lack of reliable sea lines of communication, and a shipbuilding sector that cannot replace aging vessels—combined with the Kremlin’s persistent relegation of the maritime domain to the bottom of its strategic priorities—have all contributed to this increasingly apparent weakness. These factors, combined with NATO’s expansion to include Finland and Sweden, have transformed the Baltic from a contested maritime space into one that is effectively NATO‑enclosed. At the same time, Russia’s growing dependence on seaborne energy exports has raised the strategic importance of uninterrupted maritime access through a region where its freedom of action is sharply constrained. Moscow thus faces a paradox: it must preserve the Baltic as an economic lifeline while lacking the conventional forces needed to dominate or defend it.
In response, Russia has not developed a sophisticated maritime gray zone doctrine so much as defaulted to familiar tools often employed when power projection is risky and escalation control matters. The use of civilian vessels, deniable electronic interference, and legally ambiguous undersea activity reflects adaptation under pressure rather than confidence or strategic ambition. These methods enable harassment, signaling, and limited disruption while avoiding open confrontation, but they are poorly suited to producing durable political outcomes. Russia’s irregular maritime statecraft in the Baltic is therefore best understood as a holding action—an effort to manage decline and preserve room for maneuver from a constrained strategic position, rather than a pathway to maritime advantage.
Russia’s Three-page Playbook of Maritime Irregular Statecraft
Russia’s maritime irregular statecraft in the Baltic Sea relies on a narrow, repeatable playbook optimized for deniability and persistence rather than control or coercive leverage. Far from demonstrating doctrinal sophistication, this approach reflects the limited options available to a constrained actor operating in a NATO dominated maritime environment. At its core are three mutually reinforcing tools: the shadow fleet as both economic lifeline and operational cover, selective disruption of undersea infrastructure to exploit political sensitivity and attribution delays, and low-cost electronic interference to degrade the maritime picture in the Baltic. Together, these tactics enable harassment and signaling below the threshold of armed conflict while minimizing immediate escalation risks—but they do not scale into durable strategic advantage.
The shadow fleet sits at the center of this playbook. Economically, these vessels are indispensable to sustaining Russia’s war effort by moving sanctioned energy exports through the Baltic. Operationally, they offer deniable platforms that exploit legal ambiguities, mask movements, and complicate enforcement. Yet this dual use is inherently self-limiting. The same ships Russia depends on for revenue are increasingly visible, tracked, and exposed to interdiction, legal action, and seizure. Aggressive employment of the shadow fleet for coercive purposes therefore risks undermining the very economic lifeline it is meant to protect. As a result, the fleet functions less as a tool of escalation than as a constraint on how far Russia can push its maritime campaign.
Undersea infrastructure disruption and electronic warfare act as force multipliers within this constrained approach, but they exhibit clear diminishing returns. Pipelines, power cables, and fiberoptic links are attractive targets primarily because they are exposed and politically sensitive components of energy systems and lines of communication, not because they provide decisive leverage. Damage is typically repairable, escalation tends to remain bounded, and repetition of these tactics steadily generates political backlash alongside improved monitoring and faster attribution. Electronic interference—particularly ship based Global Positioning System (GPS) and Automatic Identification System (AIS) jamming—reinforces these dynamics at low cost by degrading maritime safety and complicating enforcement in congested waters, yet such effects are fleeting and increasingly detectable. Over time, the operational signatures that these activities leave behind erode deniability rather than preserve it.
Taken together, this narrow and self-limiting playbook enables disruption without control and visibility without leverage—a strategy of management rather than momentum that raises a more fundamental question: whether Russia’s maritime gray zone campaign represents a durable form of competition with options for escalation or the early signs of strategic exhaustion.
Whither the “Gray Zone”?
Three years into Russia’s irregular maritime campaign, its strategic gains are limited and diminishing as they invite stronger legal and political backlash. These tactics do not scale well into operational advantages, and work better when maritime conventional forces can back them up. The best example of this is the Chinese navy’s support for its Coast Guard and Maritime Militia harassment of neighboring fishing vessels in East and South China Seas. Russia’s maritime capabilities are too weak to integrate power in this fashion. The backlash in Europe is producing a balancing effect, as efforts to improve attribution and legal charges against perpetrators limit Russian efforts. NATO states have boarded suspicious vessels, seized vessels involved in sabotage (e.g. MV FITBURG), and increased maritime domain awareness to identify and document future attacks. ICAD tactics are best suited for harassment, signaling, and economic necessity; they are poor tools for reversing Russia’s strategic woes.
Advocates of the gray zone concept a decade ago predicted it would eventually become the prevalent method of undermining the status quo and be difficult to combat. This does not make it an inherently low-risk strategy. The accumulation of ICAD events and the attention given to them in the post-Ukraine invasion era make it impossible for Russian acts to fly “below the radar.” Instead, the very escalation that these tactics seek to avoid becomes more likely as states react to the constant drumbeat of malign behavior.
How should NATO leverage the growing visibility of irregular maritime tactics and the certainty that Russia is behind them? First, accelerate efforts to determine attribution and expose these tactics immediately in a coordinated fashion with NATO partners. Increased maritime domain awareness at all levels is a priority; this includes investing in seabed monitoring, AIS/Global Navigation Satellite System (GNSS) analytics, and forensic investigation capacity. Rapid and credible attribution enables legal action, sanctions, interdiction, and future deterrence by exposure.
Secondly, NATO should transition from passive monitoring of Russia’s “shadow fleet” to a posture of active maritime containment. Under NATO’s 2025 Alliance Maritime Strategy (AMS) to uphold freedom of navigation and secure strategic trade routes, NATO should no longer treat these vessels as mere commercial anomalies. Instead, the Alliance should designate uninsured or AIS-spoofing vessels as “Navigational and Environmental Hazards,” providing the legal predicate for mandatory boardings and inspections within territorial and contiguous waters. By continuing to work towards active maritime containment, NATO can normalize interdictions that raise the insurance premiums and operational costs for Moscow’s economic lifelines, transforming its primary source of revenue into a point of strategic vulnerability.
Thirdly, NATO should operationalize its “Digital Ocean Vision” to secure critical undersea infrastructure. The defensive posture of the past three years—characterized by slow attribution and repair—is obsolete. Following the framework of Operation Baltic Sentry, NATO should scale Task Force X to deploy a persistent, autonomous undersea maritime infrastructure resiliency initiative. By integrating uncrewed underwater vehicles (UUVs) with high-resolution acoustic sensors, NATO can create a real-time “networked ocean” that detects anomalies—such as the 2024 Motor Vessel Eagle S incident—as they occur. This capability moves NATO from a “forensic” response to a “preventative” one, utilizing automated interceptors to escort suspicious vessels away from critical nodes before damage is sustained.
Finally, NATO should institutionalize friction-as-deterrence by centralizing command authority and multi-domain surveillance within MARCOM. Russia’s irregular tactics thrive on the organizational seams between the Baltic and Arctic theaters; closing these gaps requires resourcing MARCOM to function as the singular operational hub for the Northern Flank. Under the 2025 Alliance Maritime Strategy, MARCOM should be empowered to fuse its recognized maritime picture with real-time data from the NATO Commercial Space Strategy and “Digital Ocean” uncrewed sensors, allowing the Alliance to immediately out-signal Russian electronic interference and GPS jamming. By utilizing high-intensity exercises like Freezing Winds 2025 to wargame integrated, rapid-response ICAD counter-tactics, NATO ensures that every Russian hybrid act is met with an immediate, pre-authorized operational pushback. This centralized posture shifts the burden of escalation back to the Kremlin, forcing Moscow to choose between a conventional naval confrontation it cannot win or a strategic retreat from a monitored and controlled maritime gray zone.
This is already happening in Hong Kong of all places, where Finland has pressured China to detain and prosecute civilian ship Captain Wan Wnguo, accused of dragging one of the ship’s anchors across several underwater cables in 2023 and causing $41 million in damage. Ironically, the ship had just completed the first run from China to Kaliningrad along the Northern Sea Route, a potent symbol of Russian and Chinese cooperation. China has cooperated with Finland to date, and the trial is set for this month.
Conclusion
Russia’s expansion of maritime irregular statecraft in the Baltic Sea Region is a compensatory strategy born of weakness, not strength. As Russia’s conventional naval power has eroded, accelerated by maritime losses in the Black Sea and NATO’s expansion, Moscow has turned to deniable, low-cost, maritime subversion to protect its economic lifelines, pressure NATO, and shape escalation dynamics without triggering open war.
Russia’s activities in the Baltic are best understood as a holding action by a constrained power. It enables disruption and delay but not control. These ICAD tactics at sea might provoke below thresholds of war, but they say more about managing decline, protecting lifelines, and shaping escalation in a world where ambiguity is shrinking, not increasing as gray zone proponents claim. While disruptive and tactically clever, these methods cannot compensate for declining conventional power and become less effective as NATO improves attribution, coordination, and resilience. This in turn will frustrate Russia’s ability to play a weak hand as it prioritizes provocative tactics over creating an effective strategy to improve its strategic and economic position in a post-Ukraine War future.
Joseph P. Durigan is a Surface Warfare Officer in the United States Navy and a recent graduate of the Naval Postgraduate School in Monterey, California. His master’s thesis was titled “The Gray Zone Surge: Russian Maritime Subversion in the Baltic Sea.”
Craig Whiteside is a professor of National Security Affairs for the US Naval War College resident program at the Naval Postgraduate School. His recent book is titled Nonstate Special Operations: Capabilities and Effects and he has written on the strategic failures of the gray zone concept.
Featured Image: Baltic Sea Exercise 2023 (courtesy U.S. Navy)
Discover more from Center for International Maritime Security
Subscribe to get the latest posts sent to your email.
