Insights

On March 10, 2026, the Finnish Security and Intelligence Service (Supo) released its latest National Security Overview 2026, sparking international debate by providing a nuanced interpretation of Russian "hybrid" activities in the Baltic Sea—particularly regarding Russian sabotage to critical subsea infrastructure.

In an era where undersea cable incidents are often immediately attributed to Kremlin-directed sabotage, Supo's assessment offers a more measured perspective that challenges conventional wisdom while still acknowledging the deteriorating security environment.

Who is Supo (Suojelupoliisi)

Supo is Finland's primary national intelligence agency, tasked with protecting the state from espionage, terrorism, and threats to the democratic order. Supo's mission and core functions include:

• Counter-intelligence: Historically its most vital role due to Finland's 1,340 km border with Russia. It monitors and prevents foreign state-sponsored espionage.
• Counter-terrorism: Maintains the national threat level (currently at Level 3: Elevated as of March 2026).
• Security Vetting: Conducts over 100,000 background checks annually for sensitive government and private sector roles.
• Intelligence Gathering: Unlike the Finnish Defense Intelligence Agency (which focuses on military threats), Supo is the only agency authorized to conduct civilian intelligence.

Supo's View on Subsea Cable Security

In the wake of multiple incidents involving damaged subsea cables and pipelines in the Baltic Sea, a dominant Western narrative has emerged: that these are clear acts of "hybrid warfare" orchestrated by the Kremlin to punish Europe for its support of Ukraine. However, Supo's 2026 assessment introduces a more nuanced—and perhaps controversial—interpretation that challenges this singular view.

Challenging the Sabotage Theory

According to Supo's analysis, while the Baltic Sea remains a zone of "growing tension," the agency has cast doubt on the automatic assumption that every cable fault is a deliberate act of Russian state sabotage. In a departure from some of its NATO allies, Supo suggests that these incidents may not always be part of a coordinated "hybrid" campaign.

Supo's assessment is significant as it is the first known Western document to challenge the widely held interpretation of such incidents as purely Kremlin-driven warfare. Supo's view implies that some damage traditionally attributed to state actors may actually be opportunistic, accidental, or the result of non-state actors operating in a gray zone, rather than a top-down military order from Moscow.

The agency points out a critical and often overlooked fact: undersea cables were frequently damaged even before Russia became a more aggressive actor in the region. The busy maritime traffic, heavy fishing activity, and challenging seabed conditions of the Baltic Sea have historically caused numerous cable faults through accidental anchor drags and trawler interference.

Supo says that cable damages have been a common occurrence in the Baltic Sea for decades:

The cases of damage to undersea infrastructure in the Baltic Sea have gained a lot of publicity recently, but it is not a very rare phenomenon. Ship anchors have been regularly damaging cables in the Baltic Sea throughout the 21st century, even though the incidents have not made the news. The damage has mainly occurred during the autumn and winter months. Statistically, the number of cases of cable damage in recent years is quite typical for the Baltic Sea. However, the increase in undersea infrastructure has created a situation in which it is easy for more cables to be damaged in individual cases.

Based on the recurrence of infrastructure damage, it is not possible to draw any conclusions of the intentionality of the incidents or possible state influencing, but each incident must be investigated separately. State influencing activities always have a goal and a motive, and they must somehow benefit the perpetrator. Just causing confusion is not a sufficient reason to engage in risky actions that have had negative consequences even for Russia. The incidents of ships dragging their anchors in recent years have damaged not only Western undersea infrastructure but also Russia’s own infrastructure.

Russia's Strategic Opportunism

Supo does not suggest that Russia is a benign actor. On the contrary, the agency maintains that the security situation in the Baltic Sea is deteriorating. However, Supo describes Russia's current approach as "opportunistic and diverse" rather than purely a coordinated strategy to punish the EU.

Rather than a single, fixed strategy of physical destruction, Russia is seen as seeking to:

Supo Director Juha Martelius has noted that if relations between Europe and Russia improve, "the intelligence threat posed by Russia to Finland will become more diverse, with previous operating methods complemented by methods proven effective in the current environment."

The Caution Against Over-Attribution

Perhaps most significantly, Supo warned directly about attributing too many incidents to Russia. The agency's report states that "as various events are readily attributed to Russia, Russian influencing against Finland may appear more extensive than it truly is."

This caution is critical for several reasons:

• Preserves credibility: By avoiding over-attribution, Supo ensures that when it does identify a clear case of state-sponsored sabotage, its warnings carry greater weight.
• Prevents playing into Kremlin hands: Labeling every infrastructure failure as "Russian sabotage" may actually amplify the fear and perceived reach of Russian power, which serves Russian strategic interests.
• Focuses resources: Accurate attribution allows security services to allocate resources more effectively rather than chasing false narratives.

The Dual Threat: China's Role

While Russia is the immediate neighborly concern, Supo's strategic outlook also keeps a sharp eye on China. Supo warns that China's long-term goal is to become a global leader by "exploiting others," particularly through technological and economic means.

For subsea infrastructure, this adds a layer of complexity. China's control over subsea cable manufacturing (through HMN Tech) and its presence in maritime shipping creates a "dual-threat" environment. Supo suggests that China aims to create dependencies and gain access to sensitive data, often using legitimate economic activities as a cover for long-term strategic positioning.

A New Framework for Baltic Sea Security

Supo's shift in rhetoric suggests that a more sophisticated approach to maritime security is needed—one that moves beyond simplistic "hybrid warfare" labels.

Recommendations for a Nuanced Security Posture

Beyond the "Hybrid" Label

The Finnish Security and Intelligence Service is calling for a more sophisticated understanding of maritime security. In Supo's view, the threat to subsea cables in the Baltic Sea is real and growing, but it is not a simple "hybrid war" narrative.

It is a complex, multi-actor environment where:

• Russia remains an opportunistic threat, focused on rebuilding intelligence networks and testing Western resilience.
• China remains a systemic competitor, using economic means to create dependencies and gain strategic advantage.
• Accidents and non-state actors contribute to infrastructure damage in ways that can be misattributed.

By maintaining a nuanced, evidence-based approach to threat assessment, Supo ensures that Finland—and by extension, its NATO and EU partners—can respond to actual threats effectively without being drawn into a cycle of over-reaction that serves adversary interests.