FROM OBSERVER TO ENFORCER ⟩ Estonia’s Recent Maritime Showdown with a Russian Shadow Fleet Tanker Might Have Been Part of an Ongoing NATO Operation in the Baltic Sea

At the start of the operation, NATO's naval headquarters in Northwood, United Kingdom, stated that it was not merely a surveillance mission (although improved situational awareness is an important goal), but that NATO forces are genuinely prepared to prevent attempts to attack critical infrastructure. Besides naval vessels, aircraft and underwater drones are also involved in the operation, with daily operations managed from Rostock, Germany.

Dutch Commodore Arjen Warnaar, commanding NATO’s Baltic Sea naval group, explained the operational logic to Naval News: NATO ships identify suspicious vessels and report them to coastal states, which then intervene. 

Upon announcing Operation Baltic Sentry, NATO Secretary-General Mark Rutte emphasized that “ship captains must understand that potential threats to our infrastructure will have consequences, including possible boarding, impounding, and arrest.”

The Estonian Defense Forces explained to the media that contact with Jaguar was initiated because there was concern about a threat to the Estlink 1 cable, towards which the tanker was approaching. 

If this explanation is accurate and if the intervention indeed prevented another cable sabotage, last week's naval operation could be seen as a successful episode within the broader NATO cable-protection mission in the Baltic Sea. NATO is extremely secretive about the details of its ongoing operations, which might explain the silence and apparent ambiguity from Estonian officials so far.

The broader question raised by the recent incident is whether Estonia and Finland have done too much and been overly active, or if other Baltic Sea countries have done and risked too little, allowing order in our home waters to slip away silently.

At the Baltic Sea foreign ministers' meeting on May 16, Lithuanian Foreign Minister Kestutis Budrys expressed to the Estonian media that NATO's Operation Baltic Sentry should also expand its mission from merely protecting underwater infrastructure to addressing the broader issue of Russia’s shadow fleet.

In this context, the critical question is how NATO’s Baltic Sea fleet as a whole will respond to Russia’s demonstrated willingness to militarily protect — or at least secure — suspicious vessels. Russia’s goal is to reestablish the situation from a year ago, where other coastal nations remained passive observers rather than active interveners (which Russia finds inconvenient). 

If someone again drops anchor in a sensitive area to damage something on the seabed, intervention must continue, perhaps with a slightly improved communication plan compared to this recent incident. 

In Estonia, explanations for the incident by the authorities have been late and confusing. For the third time in recent years, Estonian authorities relinquished initiative, and the Estonian public learned about maritime infrastructure sabotage or sabotage attempts through foreign media. 

This time, information reached the Estonian public via Polish media. Thus, once again, the government surrendered the narrative initiative, allowing Russians to successfully propagate their version of events.

When a small nation undertakes a maritime interdiction operation alone, it can easily become isolated both in the information space and operationally. If the recent tanker incident was part of NATO's broader Baltic Sentry operation, it would be possible to adjust future operational planning so that interception of suspicious vessels isn't attempted by just a single coastal nation but rather by at least two allies acting together. 

Additionally, during the next interdiction operation (regardless of which coastal state initiates it), we're likely to see the presence of allied fighter jets, especially since fighters scrambled from Ämari to intercept Russian Su-30s violating airspace theoretically wouldn't have arrived simultaneously with the Russian aircraft anyway.

Both in the recent Jaguar incident and more broadly in Baltic maritime operations, it is essential to address the air domain equally alongside maritime considerations. During Russia’s full-scale aggression in Ukraine, NATO has sent confusing signals to the Russians regarding its air defense stance. 

There have been repeated reports from Romania where NATO air policing fighters escorted Russian attack drones intruding into Romanian airspace—sometimes even until they re-entered Ukrainian airspace. Last September, NATO air policing aircraft failed to react to a Russian attack drone that intruded into Latvian airspace and crashed there. Poland’s foreign minister has publicly expressed frustration that NATO has not provided the green light for intercepting missiles passing through Polish airspace.

If at sea NATO employs deterrence by denial (as exemplified recently by the pursuit of Jaguar), while in the air domain it adopts a surprisingly tolerant posture, it becomes clear why Russians choose to behave arrogantly in the airspace. They closely monitor our reactions and draw conclusions based on these observations for future actions.