## 1 Introduction  
Recently, there have been a growing number of incidents involving the deliberate damage of subsea infrastructure in the Baltic Sea. This issue primarily concerns telecommunications cables, power lines, and gas pipelines, the networks which connect the countries of Northern and Central-Eastern Europe. The damage is both physical and informational in nature, as it disrupts the transmission of data, electricity, and gas, thereby posing a threat to national security, destabilizing the economy, and undermining the integrity of critical infrastructure. Examples of such incidents continue to occur regularly. In October 2023, the commercial vessel New Polar Bear damaged the Balticconnector gas pipeline and the EE-S1 fiber-optic cable between Estonia and Finland. In December 2024, the vessel Eagle S was suspected of severing the Estlink 2 cable and several communication links in the Gulf of Finland. Subsequent incidents involving vessels such as Yi Peng 3, Vezhen, and Silver Dania indicate a pattern of systematic activity--carried out covertly, often exploiting AIS gaps, transmitting false data, or operating in areas with limited surveillance. The consequences of these incidents are both local and strategic. Disruptions in the transmission of energy or data between EU (European Union) and NATO (North Atlantic Treaty Organization) member states may impact the stability of energy systems, military communication, and the functioning of essential civilian services. Political tensions are also rising due to the difficulty of clearly attributing responsibility for acts of sabotage, which limits the scope for international response. In response to these threats, technologically advanced detection and prevention systems are being implemented. In the field of information technology and artificial intelligence, AIS data analysis is being used to identify anomalies in vessel behavior. These systems monitor, among other things, sudden stops, drifting, position signals, or anchor deployments in critical infrastructure zones. The integration of satellite data (e.g., synthetic aperture radar), sonar, and hydrographic information is becoming increasingly widespread, enabling the detection of vessels operating with transponders turned off or engaging in underwater activities. Complementing these approaches are hydroacoustic solutions, which utilize sonar networks, autonomous underwater vehicles or remotely controlled vehicles (AUVs/ROVs), and seabed-type sensors. These systems can detect characteristic acoustic signatures associated with sabotage operations, as well as analyze water turbidity and changes in seabed structure. Additionally, continuous monitoring of signals transmitted through both electrical and optical cables is employed to identify anomalies indicative of damage or interference. Despite technological advances, significant systemic gaps remain. Currently, there is no coherent international early warning system for underwater sabotage. Data sharing between states is often fragmented, and many sections of subsea infrastructure remain beyond the reach of monitoring systems. There is also a lack of coordinated procedures for responding to suspicious activities by civilian vessels, especially in the context of legal loopholes related to hybrid operations conducted by third-party states under the guise of legitimate shipping. To improve detection and counteraction capabilities, several solutions have been proposed: the integration of AIS, sonar, and satellite data within a unified analytical platform; the expansion of acoustic sensor networks along key cable routes; and the training of machine learning algorithms on real-world incident patterns. Simultaneously, political and legal actions are necessary: the development of a common maritime policy for the protection of subsea infrastructure, the harmonization of vessel control mechanisms, and the establishment of interoperable monitoring systems across the Baltic Sea region.