The second volume of Hybrid CoE’s Handbook on maritime hybrid threats presents the range of legal measures available for countering hybrid threat activity in the maritime domain.
Stylianos Tzimis, Hybrid CoE’s Deputy Director of the Community of Interest on Vulnerabilities and Resilience, describes the Hybrid CoE Paper as a practical and user-friendly tool for policymakers, practitioners, researchers, and anyone interested in understanding the legal dimensions of maritime hybrid threats.
Challenges of a maritime hybrid threat environment
The handbook is timely, as coastal states are grappling with legal uncertainties in stopping shadow fleet vessels and preventing other maritime hybrid threats. States have hesitated to act, even when vessels were suspected of damaging subsea cables or launching attack drones.
Tzimis says maritime hybrid threats pose a triple dilemma for affected states:
- Who was really behind the damage or disruption?
- Was it an accident, an isolated deliberate act or part of a broader hostile campaign?
- How should states respond without overreacting or escalating the situation?
This dilemma allows hybrid threat actors such as Russia and China to deny responsibility, create confusion, practise intimidation, and avoid consequences.
Countering a high-intensity hybrid operation
A deeper problem arises when multiple hybrid attacks occur simultaneously in different locations, attacks accumulate in the same region, or when both cases are combined. These incidents should not be evaluated in isolation but as part of a broader pattern of coastal activity.
“Everyone can imagine what happens if thirty ships drag their anchors in selected vulnerable places,” says Jukka Savolainen, Hybrid CoE’s Director of the Community of Interest on Vulnerabilities and Resilience. He stresses that during such a high-intensity hybrid operation attribution and enforcement should come swiftly.
In four escalating scenarios and accompanying legal scans the handbook’s second volume asks how states can combine different bodies of international law to address complex and evolving maritime hybrid threats.
Critical undersea infrastructure (CUI) disruptions
The first scenario concerns attacks on subsea cables, power interconnectors and offshore infrastructure. It features a ship suspected of breaking cables, escalation with helicopters and fighter jets, and multiple disruptions to maritime infrastructure.
Dr Henrik Ringbom, Professor of Maritime Law and the Law of the Sea at Åbo Akademi University, highlights the extent of non-flag state jurisdiction as a particular area of contention in assessing these cases.
“We’ve seen case law evolving around issues where two courts differ on what the Law of the Sea Convention’s reference to incidents of navigation covers.”
Regardless of these differing views, scholars increasingly agree that a flag state’s exclusive right to adjudicative jurisdiction cannot extend to acts of deliberate sabotage.
Drone interference
In another scenario drones are launched from nonmilitary vessels acting as floating platforms for hybrid threat operations.
According to Dr Terry Gill, Professor Emeritus of Military Law at the University of Amsterdam, drone interference has become a pervasive form of hybrid activity in recent months, from the Baltic to the North Sea.
“Some of these violations are inadvertent as a result of countermeasures diverting drones from their course,” he says. “Some are clearly deliberate and form part of a strategy to undermine confidence in the state’s ability to react to these threats.”
Fishing boat disruption
In the third scenario a state sends its fishing fleet into another state’s exclusive economic zone, forming massive floating barriers around a disputed area.
Dr Valentin Schatz, Junior Professor of Public Law, European Law and Public International Law at Leuphana University of Lüneburg, connects the scenario with recent events involving concentrations of fishing fleets in certain locations. The handbook examines whether this form of obstacle is a violation of international law.
“It also asks whether this concerted obstruction of navigation could be classified as use of force or even as an armed attack under international law,” Schatz adds.
Shadow fleet operations
The final scenario focuses on shadow fleet operations. Dr James Kraska, Charles H. Stockton Professor of International Maritime Law at the U.S. Naval War College, says that the shadow fleet is often described as a sanctions problem, involving ageing tankers, opaque ownership and breaches of restrictions.
Analysing these cases generally concerns two questions: the right to board stateless vessels under Article 110 of the United Nations Convention on the Law of the Sea; and where the Convention deprives a stateless vessel of flag state protection.
Kraska notes that there is some variation in state practice concerning what to do with stateless vessels: “There’s a more restrictive view that confines jurisdiction to matters within the scope of the visit itself, but also a broader view that the state conducting the boarding may assert all its laws over a stateless vessel.”
Several options for enforcement
The above scenarios describe maritime hybrid threat activity that is challenging to enforce under international law, especially when state actors use legal grey zones to infringe other states’ rights. Fortunately, this activity does not happen in a legal vacuum.
While the handbook acknowledges that significant gaps remain in protection against maritime hybrid threats, it also demonstrates that considerably more legal options are available to states than is commonly thought.
More flags to prevent military escalation
As coastal states develop their responses, the handbook identifies two major risks in the current environment: a sudden and coordinated attack against critical underwater infrastructure; and a planned escalation against a single nation that avoids triggering NATO’s Article 5.
To build preparedness for such incidents, states should focus on common interpretations of international law, coordinated multi-flag operations and shared situational awareness.
Savolainen notes that the best way to protect against hybrid threats aimed at undermining Article 5 is for several NATO nations to be involved in the same operation.
“When the situation seems to be escalatory, don’t continue before you have more flags on site.”
Handbook on maritime hybrid threats, volume II: Contemporary scenarios (published September 2026)
- Follows the first volume of the handbook on maritime hybrid threats, published in March 2023
- Provides updated insights and further explores the evolving maritime hybrid threat landscape
- Examines recent developments through escalating scenarios and accompanying legal scans
- Addresses CUI disruptions, drone interference, fishing boat disruption, and shadow fleet operations
- Highlights the growing importance of common interpretations of international law, coordinated multi-flag operations and shared situational awareness.
