Lithuania and Latvia Warned in July of Possible Russian Attacks on Energy and Transport Links; NATO Allies Report Foiling an Arctic Cable Operation
Baltic and Polish leaders cited intelligence about possible strikes on infrastructure, Moscow called the warnings a pretext for NATO buildup, and Western officials say submersibles were confronted near Svalbard in the spring.
Two Presidents, One Warning, No Target
On Wednesday, July 15, 2026, Lithuania's president, Gitanas Nausėda, said something specific enough to matter and vague enough to be almost unfalsifiable. Intelligence, he said, showed Russia was planning possible attacks on energy and transport facilities in the Baltics or Poland. The planning, he added, was happening "at the highest level, effectively in Moscow"[1]. He did not say where. He did not say when[2].
Latvia's president, Edgars Rinkēvičs, spoke the same day. His warning went further in one way: Russia might not need a war to hurt NATO. It might just need to "indirectly test Article 5," the treaty clause that says an attack on one member is an attack on all[1][10].
The Kremlin's answer came fast. Spokesman Dmitry Peskov called the warnings scare stories, "designed to continue brainwashing the population and preparing it for further militarisation," meant to justify more NATO troops near Russia's border[3][4].
That's the whole shape of the story: a warning with no proof the public can check, a denial that doesn't address the things that are proven, and two months of new events since that make both sides sound more right.
What Nobody Disputes
Start with what's actually on the record, because it's substantial. On July 13, 2026, two days before the presidents spoke, the European Union and the United Kingdom issued their first-ever joint cyber sanctions. They blamed a unit of Russia's FSB security service, called Center 16, for a December cyberattack on a Polish power plant[7].
That plant supplies heat and electricity to roughly 500,000 people, and the attack happened in winter, when losing heat isn't just inconvenient — it's dangerous[7]. The EU named nine people and four entities. Britain added 24 more names to its own sanctions list[7].
Go back further and the pattern gets longer. In November 2025, Poland accused Russia of blowing up a rail line, calling it an "act of state terror"[7][13]. In December 2024, an undersea power cable between Finland and Estonia was cut, along with four telecom lines — though a Finnish court later threw out the case against the tanker crew accused of doing it, for lack of clear proof[15]. And in September 2025, about 23 Russian drones crossed into Polish airspace. Poland responded by invoking Article 4, which just means "let's talk" — not Article 5[14].
Then, on September 10, 2026, Reuters reported the newest chapter: British, Norwegian and U.S. forces say they tracked and confronted Russian deep-sea submersibles near Svalbard, the Arctic island chain, in the spring. Officials say the vessels were rehearsing how to cut undersea cables[5][6].
Why a Cut Cable Isn't a "Real" Attack — And Why That's the Whole Point
Here's the mechanism the entire dispute turns on: Article 5 only fires if NATO's members agree that what happened counts as an "armed attack." A missile is easy to classify. A cyberattack on a power plant, a mysteriously exploded rail line, or a severed cable at the bottom of the sea is not.
The 1949 treaty that created NATO wasn't written with any of that in mind. So when something happens that clearly hurts a member but doesn't look like a tank crossing a border, the alliance has to decide, case by case, whether to treat it as war. Poland's choice in 2025 — talk it over under Article 4, rather than invoke Article 5 after the drone incursion — is now the reference point everyone uses[14].
That gap is exactly what officials in the Baltics and Poland say Russia is exploiting. Cut a cable, plant some malware, fly a drone near a border: each act does real damage while staying just deniable enough to argue about. Proving who did it, and why, is far harder underwater or in computer code than it is on an open battlefield[15]. The Finnish court's collapsed case over the Estlink cable is the clearest proof the method works[15].
Two Governments With Very Different Reasons to Talk About This Publicly
Lithuania, Latvia, Estonia and Poland argue that treating each incident on its own — the cable, the rail line, the drones, the plant — is exactly how you miss that they add up to a campaign[7][13][14][15]. Nausėda's underlying point is that Russia can't currently invade NATO outright, but it doesn't need to. A smaller, deniable strike is arguably the harder problem precisely because it's built to stay below the line that would trigger a unified response[1]. Rinkėvičs frames the real target as NATO's decision-making itself — the goal isn't seizing land, it's making the alliance argue about whether an incident counts[1][10]. There's also a practical case for going public: saying the warning out loud raises the political cost of acting on it, and lets power and rail operators harden their sites in advance.
These four governments also have an obvious interest in keeping Washington's attention on their border. That interest sharpened this year: a roughly 700-strong U.S. Army brigade, part of the 101st Airborne Division, is rotating out of Romania and not being replaced[11]. Polish and Lithuanian officials say they haven't been told of any similar pullback affecting their own countries[11]. A public intelligence warning is one of the few levers a small country has to keep a much larger ally focused on it.
Moscow's strongest argument isn't that it's innocent of everything — it's about what counts as proof. Peskov's position is that an unpublished intelligence assessment, naming no target and no date, can't be checked or challenged by anyone outside the governments that made it[3][4]. He argues Western states "need to create the image of an enemy" to keep public support for military buildups[3]. Russia has also denied involvement in the Svalbard cable episode, calling sabotage accusations "Russophobia"[5]. Its broader case is that NATO forces moving closer to Russian territory are the actual provocation — that Russia is the one being encircled, not the one encircling.
A Small Number That Both Sides Read Differently
Inside Washington, the fight has become as much about the Romania drawdown as about the Baltic warning itself. The administration's position is that European states are wealthy enough to defend their own territory, and that trimming one rotating brigade from a roughly 4,700-strong presence is a modest rebalancing, not a retreat[11]. Officials have said a full review of troop posture in Europe won't be finished until early next year[11].
Congressional critics, including some Republicans, argue the timing is what matters, not the raw number[12]. Their point: even a small, symbolic drawdown can read in Moscow as a signal about how committed the U.S. really is — regardless of what the number actually represents. Both sides in this argument agree the figure is modest. They disagree entirely on what a modest figure signals[11][12].
What the Coverage Left In, and What It Left Out
How this story got told varied more by omission than by outright falsehood. The Associated Press hedged its headline with "could" and "warn," but still led with the claim itself as the news, ahead of any verification[2]. Reuters described NATO allies as having "foiled" a sabotage "plot" near Svalbard — language that states an outcome as fact, even though the sourcing was two anonymous officials describing what looks like an intercepted training exercise, not a live attack[5]. Lithuania's own public broadcaster, LRT, led instead with Moscow's denial, giving Peskov's quote the headline[3].
RT, the Russian state broadcaster, put "horror stories" in scare quotes and never mentioned the EU-UK sanctions naming FSB Center 16, the Polish rail explosion, or the Estlink cable cut — the specific, documented attributions that make the Baltic case in the first place[3][7][13][15]. A U.S. defense-focused outlet, National Security Journal, fused Nausėda's infrastructure warning and Rinkėvičs's separate Article 5 comment into a single claim that Russia was "preparing to strike," language neither president used[1][10].
The Two Questions Worth Keeping Separate
Two things are true at once, and they don't cancel each other out. Governments have formally attributed a real, growing list of sabotage acts to Russia — a cyberattack on a Polish power plant serving half a million people, a rail explosion, submersibles near a NASA-linked satellite station in the Arctic[5][7][13]. None of that is in serious dispute.
What remains unverified in public is the specific claim made on July 15: that a deliberate strike on Baltic or Polish infrastructure is being planned right now. No government has published a location, a date, or a named target[2]. The physical stakes are real regardless — Lithuania's link to Europe's power grid runs through a handful of vulnerable substations, and the cables near Svalbard carry data for the world's largest satellite ground station[1][2][5]. What isn't settled is whether the next incident in this list is already being planned, or whether the warning is doing its job just by being said out loud.
Summary
On Wednesday, July 15, 2026, the presidents of Lithuania and Latvia said intelligence showed Russia was planning possible attacks on critical infrastructure in the Baltic states or Poland[1][2]. Lithuanian President Gitanas Nausėda named energy and transport as the likely targets, and said the planning was happening 'at the highest level, effectively in Moscow'[1]. He also said the intelligence did not identify a specific place or time[2]. Latvian President Edgars Rinkēvičs said Russia may try to 'indirectly test Article 5' — NATO's mutual defense promise — without launching a full war[1][10].
Moscow rejected the claim. Kremlin spokesman Dmitry Peskov called it 'simply the latest batch of scare stories designed to continue brainwashing the population and preparing it for further militarisation,' and said the aim was to justify more NATO deployments in the Baltics[3][4].
Two things have happened since. On July 13, 2026, the EU and Britain issued their first simultaneous cyber sanctions, formally blaming the FSB's Center 16 for a December operation against a Polish combined heat and power plant that could have cut heat and power to about 500,000 people in winter[7]. And on September 10, 2026, Reuters reported that Britain, Norway and the United States tracked and confronted Russian deep-sea submersibles near Svalbard in the spring, as the vessels rehearsed disabling undersea cables[5][6]. Britain's Defence Ministry had publicly noted attempted Russian covert activity in and near its waters on April 9[5].
The genuine dispute is not whether Russia conducts sabotage in Europe. Several acts have been formally attributed by governments and courts are involved in others. The dispute is whether a deliberate, damaging strike on NATO infrastructure is actually being planned — a claim resting on intelligence that has not been published, with no named target, no date, and no independent way for the public to check it[2][3].
The Event
On Wednesday, July 15, 2026, Lithuanian President Gitanas Nausėda and Latvian President Edgars Rinkēvičs each said intelligence assessments indicated Russia was considering attacks on critical infrastructure in the Baltic states or Poland[1][2]. Nausėda said energy and transport facilities were the concern, including sites tied to Lithuania's link to the European electricity grid, and that no specific location or timing had been identified[1][2]. He said Lithuania had increased physical protection of those facilities[1]. Kremlin spokesman Dmitry Peskov rejected the warnings the same week, calling them scare stories intended to justify NATO's buildup[3][4].
Undisputed Facts
- Nausėda and Rinkēvičs made the warnings on Wednesday, July 15, 2026 — roughly two months before September 11, 2026[1][2].
- Nausėda said the intelligence did not name a specific site or a specific date for any planned attack[2].
- The Kremlin publicly denied the claims, with Peskov describing them as scare stories aimed at justifying NATO deployments in the Baltics[3][4].
- On July 13, 2026, the EU and the UK imposed coordinated sanctions blaming the FSB's Center 16 for a December operation against a Polish combined heat and power plant; the EU listed nine people and four entities, and Britain added 24 names[7].
- In November 2025, Poland accused Russia of an 'act of state terror' after a rail line was blown up; two Ukrainian nationals said to be working with Russian services were accused[7][13].
- In December 2024 the Estlink 2 power cable between Finland and Estonia was cut along with four telecom lines; a Finnish court later dismissed the case against the seized tanker's crew for lack of clear attribution evidence[15].
- On September 9-10, 2025, an estimated 23 Russian drones entered Polish airspace and Poland invoked NATO's Article 4 for consultations, not Article 5[14].
- On September 10, 2026, Reuters reported that British, Norwegian and U.S. forces tracked and confronted Russian GUGI submersibles near Svalbard in the spring; the UK and U.S. have both sanctioned GUGI[5][6].
- The United States is not replacing a roughly 700-strong 101st Airborne Division brigade rotating out of Romania; Polish and Lithuanian officials said they had not been informed of any comparable drawdown in their own countries[11].
The Pressure
Strip away the moralizing and blame. What structural realities persist regardless of which narrative wins?
- Below-the-threshold pressure
- Russia's advantage is ambiguity. Cut a cable, seed malware, fly a drone — each act imposes cost while staying arguable. The Estlink prosecution collapsing in a Finnish court for lack of clear attribution shows why the method works[15]. Proving intent at sea or in code is much harder than proving it on a battlefield.
- The attention economy of small allies
- Lithuania and Latvia have small militaries and cannot defend themselves alone. Public intelligence warnings are one of the few tools they have to keep Washington and Brussels focused on their border, especially while a roughly 700-strong U.S. brigade is leaving Romania without replacement[11]. This does not make the warnings false. It does explain why they are made publicly rather than through alliance channels alone.
- Article 5 is a political decision, not an automatic switch
- The treaty's guarantee only fires if members agree an 'armed attack' happened. Sabotage of a cable or a heat plant sits in a gap the 1949 text did not anticipate. Poland chose Article 4 consultations after 23 drones crossed its airspace in 2025, not Article 5[14]. That precedent is now the reference point for every side.
- Hardening is permanent and expensive
- Once a warning is issued, guards stay posted. Poland and the three Baltic states are now securing dams, power stations and gas infrastructure on a standing basis[9], and NATO runs Baltic Sentry patrols[15]. These costs continue whether or not any attack occurs, which is part of what pressure below the threshold is designed to achieve.
Material realityA small number of physical points carry enormous load. Lithuania's connection to the European electricity grid runs through a handful of substations and interconnector sites[1][2]. Two fiber-optic cables 1,400 km long, lying as deep as 2,700 meters, carry satellite data from the SvalSat ground station — the world's largest, and part of NASA's Near Space Network[5]. The Polish combined heat and power plant named in the EU-UK sanctions serves about 500,000 customers, and the operation against it took place in winter, when losing heat is dangerous rather than inconvenient[7]. None of these can be guarded the way a border can. Cables sit on the seabed in international water; grid control systems sit on networks. Meanwhile the war in Ukraine continues, a roughly 700-strong U.S. brigade is leaving Romania without replacement while Polish and Lithuanian officials say they haven't been told of a similar drawdown in their own countries[11], and no published intelligence names a target or a date for the attack the Baltic presidents described[2]. Both things are true at once: the documented record of Russian sabotage in Europe is real and growing, and the specific claim made on July 15 remains unverified in public.
Narrative as a weaponThree actors are shaping how this is read. The Baltic and Polish governments want you to see a single connected campaign — cyber, rail, cable, drone — building toward a deliberate strike, because a pattern justifies allied presence in a way that separate incidents do not. The Kremlin wants you to see an unfalsifiable claim manufactured to justify NATO's buildup, and it argues this by attacking the evidence standard rather than by explaining the attributed incidents. A slice of the U.S. commentary, on both left and right, is using the story as ammunition in an argument that is really about the European troop drawdown, not about Baltic intelligence. Readers should hold two separate questions apart: whether Russia conducts sabotage in Europe, where governments have made formal, sanctioned attributions, and whether a specific attack on Baltic or Polish infrastructure is being planned right now, which rests on intelligence nobody outside those governments has seen.
How Each Side Sees It
Each major actor’s view — how it frames things, its underlying incentive, and how it’s materially affected. Tap a side to read it.
Frames it asThese governments argue the pattern is already the evidence. A Polish power plant was targeted by cyber means and the EU and UK put that in writing with sanctions[7]. A rail line was blown up[13]. Cables in the Baltic Sea have been cut[15]. Drones flew over Poland[14]. Their case is that treating each as an isolated accident is how you miss a campaign. Their second argument is about the threshold. Nausėda's point is that Russia is not able to invade NATO right now, but is able to do something small and destructive — and that a small attack is the harder problem, because it is meant to sit just below the level that would trigger a collective response[1]. Rinkēvičs frames the target as the alliance's decision-making itself: the goal is to make NATO argue about whether something counts, rather than to take territory[1][10]. Their third argument is that warning publicly is itself a defense. Saying it out loud raises the political cost of doing it, and lets utilities and rail operators harden sites before rather than after.
WhyKeep U.S. and allied forces on the eastern flank at a moment when Washington is not replacing a roughly 700-strong brigade rotating out of Romania[11], and keep EU money and NATO attention flowing to infrastructure protection[9]. Domestically, a credible external threat also sustains high defense spending in small economies.
Impact on themThese four states carry the physical exposure. Lithuania's power system is newly tied to the European grid rather than the old Soviet-era one, which makes a handful of substations and interconnector sites disproportionately important[1][2]. They have added guards and monitoring at dams, power stations and gas facilities, which costs money continuously whether or not an attack ever comes[9].
Frames it asMoscow's strongest argument is about proof and motive, not innocence in general. Peskov's claim is that the warnings are unfalsifiable: an unpublished intelligence assessment, with no target and no date, cannot be checked or rebutted, and conveniently arrives while NATO expands deployments on Russia's border[3][4]. His framing is that Western governments 'need to create the image of an enemy' to sustain public support for militarisation[3]. Russia also points to the Estlink case as its evidence: Finland seized a tanker and prosecuted the crew, and a Finnish court dismissed the case because attribution was not clear[15]. Moscow's reading is that this shows how fast an accident becomes an accusation. On Svalbard, Russia has denied interfering with undersea cables and called sabotage accusations 'Russophobia'[5]. Its underlying position is that NATO infrastructure moving toward its borders is the provocation, and that it is the party being encircled.
WhyDeter further NATO force buildup on its western frontier, split allied opinion about whether hybrid incidents warrant a military response, and avoid formal attribution that could trigger Article 5 debate. Ambiguity is the asset — actions that cannot be firmly pinned carry pressure without cost.
Impact on themAttribution has real costs. The July 13, 2026 EU-UK package was the first simultaneous cyber sanctions action by the two, and named FSB Center 16 directly[7]. Washington and London have both sanctioned the GUGI undersea directorate[5]. Each formal attribution narrows Russia's room to operate below the threshold.
Frames it asNATO's argument is that deterrence at sea and on land requires presence, not statements. It stood up Baltic Sentry, a multinational patrol operation, after the 2024-2025 run of cable incidents, alongside the UK-led Nordic Warden[15]. The Svalbard episode is the alliance's best current exhibit: allies say they detected the activity, went out, and stopped the rehearsal before it finished[5][6]. The deeper problem NATO faces is definitional. Article 5 says an armed attack on one is an attack on all — but a severed cable in international water, or malware in a heat plant, does not obviously read as an 'armed attack.' Poland's own choice in September 2025 shows the caution: after 23 drones crossed its border, it invoked Article 4 consultations, which only requires members to talk, rather than Article 5[14]. Allies argue that leaving the line vague is itself a deterrent, because Moscow cannot be sure where it sits.
WhyHold 32 members to a common answer on what counts as an attack, without being dragged into a war by a single ambiguous incident — and without letting repeated small incidents erode the guarantee by going unanswered.
Impact on themThe cables near Svalbard are not symbolic. Two fiber-optic lines run 1,400 km to mainland Norway, as deep as 2,700 meters, and carry satellite data from SvalSat, the world's largest satellite ground station and part of NASA's Near Space Network[5]. Cutting them would degrade a facility the U.S. civil space program relies on.
Frames it asThe administration's case is that Europe is rich enough to defend its own territory, and that U.S. forces are needed elsewhere; the roughly 700 troops of a 101st Airborne Division brigade leaving Romania without replacement are a modest rebalancing, not abandonment[11]. Officials have said a full posture review would not report until early the following year[11]. Congressional critics, including Republicans, argue the timing is the problem: trimming presence while allied intelligence services are warning about infrastructure attacks reads in Moscow as a signal about American staying power, regardless of the actual numbers[12]. Both sides agree the number is small; they disagree on whether a small number carries a large message.
WhyThe administration wants burden-shifting to European capitals and freedom to move forces. Critics want the tripwire intact. Both are also managing a domestic audience that has limited appetite for new commitments in Europe.
Impact on themU.S. troops are the practical content of Article 5 in the Baltics. Allied governments describe their concern as a 'security vacuum' — the worry is not that 700 soldiers would stop an invasion, but that their removal changes how Moscow calculates risk[11].
Like this article?
The Bias Ledger average rating 4.9
The same story, as framed by outlets across the spectrum, ordered least to most biased. The bias score (1 = straight, 10 = heavily spun) is an AI assessment of that framing — click an outlet to see its track record. The tell is the word choice or omission that reveals the angle.
| Outlet | Vantage | Bias | How they frame it | The tell |
|---|---|---|---|---|
| Associated Press | U.S. wire, center | 2 | "Baltics and Poland warn Russia could launch limited military or hybrid provocation against NATO" — attributes the claim to the warning governments in the first three words. | Carefully hedged with 'could' and 'warn', and it includes the caveat that the intelligence named no location or timing. The framing choice is still that a government warning is itself the news event, which puts the claim in the headline before any of it is verified. |
| LRT | Lithuanian public broadcaster, state-funded, editorially independent by statute | 3 | "Moscow rejects Lithuanian claims of possible Russian attacks on Baltic infrastructure" — leads with the Russian denial. | Notable for a national broadcaster in a threatened state: it gives Peskov's quote the headline and reproduces it at length. The framing tell is subtler — the word 'rejects' positions Moscow as reacting to an established claim rather than contesting its basis. |
| Reuters | UK-based wire, center | 4 | "NATO allies foil Russian subsea cable sabotage plot" — states the foiling as fact in the outlet's own voice. | The word 'foil' asserts an outcome, and 'plot' asserts intent, but the sourcing is 'two Western officials' speaking anonymously about a training exercise, not a live attack. The corroborating public record cited is a British statement from April 9 about 'attempted covert activities'[5]. Strong reporting, but the headline carries more certainty than the sourcing does. |
| Euronews | European, pro-EU center | 4 | "Lithuanian and Latvian leaders warn Russia planning infrastructure attacks on Baltics or Poland" | Drops 'could be' — the headline says Russia is 'planning'. The body carries Nausėda's own hedges and the Kremlin denial, so the headline is firmer than the article. Its September 10 companion piece uses 'successfully thwart', again adopting the allied account as settled. |
| National Security Journal | U.S. defense-analysis outlet, hawkish | 6 | "Two Baltic Presidents Warn Russia May Be Preparing to Strike NATO Infrastructure — and Test Article 5" | Fuses two separate statements — Nausėda's on infrastructure, Rinkēvičs's on Article 5 — into one escalating claim, and adds 'Preparing to Strike', which neither president said. The Kremlin response appears late or not at all. |
| Taipei Times | Taiwanese, pro-democratic-alliance editorial line | 6 | "Poland, Baltic states fear a Russian false-flag strike" — an editorial, not a news report. | Centers the most alarming single scenario, that Moscow might use captured Ukrainian drones to disguise an attack[8][9]. Taiwan's editorial interest is in the analogy to its own gray-zone problem with China, which shapes the emphasis on ambiguity as a weapon. |
| RT | Russian state-funded | 9 | "Baltic 'horror stories' of alleged Russian threat serve as NATO build-up pretext – Kremlin" | Scare-quotes the warning and puts 'alleged' in front of the threat, while presenting the Kremlin's motive claim as the story's finding. The omission is total: no mention of the July 13 EU-UK sanctions naming FSB Center 16, the Polish rail explosion, or the Estlink cut — the specific attributions that make the Baltic case. |
References
- Lithuanian and Latvian leaders warn Russia planning infrastructure attacks on Baltics or Poland — Euronews · European broadcaster, partly EU-funded, pro-European-integration editorial line
- Baltics and Poland warn Russia could launch limited military or hybrid provocation against NATO — Associated Press · U.S. non-profit wire cooperative, center
- Moscow rejects Lithuanian claims of possible Russian attacks on Baltic infrastructure — LRT · Lithuanian national public broadcaster, state-funded
- Baltic 'horror stories' of alleged Russian threat serve as NATO build-up pretext – Kremlin — RT · Russian state-funded international broadcaster
- NATO allies foil Russian subsea cable sabotage plot — Reuters · UK-headquartered commercial wire service, center
- NATO allies successfully thwart Russian undersea cable sabotage operation — Euronews · European broadcaster, partly EU-funded
- Russia's FSB blamed for Poland grid attack as UK and EU impose first joint cyber sanctions — The Record · Cybersecurity news site owned by Recorded Future, a U.S. threat-intelligence company with government contracts
- Poland and Baltic states are preparing for possible Russian false-flag strike, says Reuters — Ukrainska Pravda · Ukrainian independent outlet, strongly pro-Ukraine
- Baltic states and Poland tighten infrastructure security over Russian 'false flag' fears — AnewZ · Azerbaijan-based international broadcaster
- The coming months will be crucial for Baltic security, Rinkēvičs warns — Baltic News Network · Latvian commercial regional news site
- The US draws down troops on NATO's eastern flank as Europe frets about a security vacuum — Associated Press · U.S. non-profit wire cooperative, center
- U.S. troop drawdown in Eastern Europe brings anxiety, and GOP rebuke — The Washington Post · U.S. daily, center-left news pages
- 2025 Russian railway sabotage in Poland — Wikipedia · Volunteer-edited encyclopedia; used here only for dated event summary
- 2025 Russian drone incursion into Poland — Wikipedia · Volunteer-edited encyclopedia; used here only for dated event summary
- Seabed zero: Baltic sabotage and the global risks to undersea infrastructure — Bulletin of the Atomic Scientists · U.S. non-profit founded by Manhattan Project scientists; arms-control and risk-reduction advocacy orientation