“The Russians have already started to prepare the framework. The re-establishment of the Leningrad Military District restored a military command structure facing Finland, Estonia and the wider Baltic region. Russian official and military-adjacent commentary presents this not as preparation for aggression, but as a defensive answer to NATO enlargement and the militarisation of the Baltic Sea. This narrative matters because it gives Moscow a ready-made explanation for almost any future incident. If Russian vessels move more aggressively, it is ‘deterrence’. If border traffic is disrupted, it is ‘security’. If agents or criminal intermediaries are used, it is ‘counter-provocation’,” the source told Field.
A think tanker added that, “The political message is simple. Russia claims to be surrounded and therefore reserves the right to act first. The recent signals fit this pattern. Moscow has created new friction around railway border crossings with Finland, Estonia and Latvia. Formally, such measures can be presented as technical or administrative. Strategically, they add controllable disruption to the Baltic border space. Every interruption forces local authorities to choose between treating the incident as routine bureaucracy or as part of a wider pressure campaign.”
At sea, the “signals” are sharper. A retired naval officer told Field that “The appearance of weapons and improvised defensive positions on a Russian civilian LNG vessel supplying [the Russian enclave of] Kaliningrad blurs the line between merchant shipping and state power. This is not naval escalation in the classic sense. It is more useful as a grey-zone signal: a civilian vessel made just military enough to complicate inspection, attribution and response”.
A European diplomat in Brussels told us that “the Baltic states have quietly adopted a doctrine of controlled restraint. Minor sabotage, symbolic intrusions or low-level damage to infrastructure may deliberately go unanswered in public. The purpose is not [Baltic] passivity but escalation control. Moscow should not be given the visible overreaction it may be trying to provoke.”
This creates a dangerous paradox, the think tanker told Field. “Deterrence requires convincing Russia that NATO will respond. Crisis management requires not responding too early. Moscow can exploit the space between the two.”
Russian Telegram channels are already shaping that space. “Военный обозреватель” claimed Russian naval forces were operating in the narrowest part of the Baltic Sea to prevent “provocations” by hostile regional states. “Рыбарь” is one of the most influential Russian military-analytical outlets. It has framed Baltic and North Sea measures against Russian shipping as systematic legal pressure and has repeatedly described NATO activity in the region as preparation for blockade or escalation.
Russian military-adjacent information channels are also contributing to shaping the narrative. Their message is simple and defensive: the Baltic Sea is being turned into a NATO lake, Russian shipping is being harassed and the Baltic states are no longer independent actors but forward positions for Western escalation. The think tanker added, “These are not policy documents. They are preparation narratives. They make a future Russian ‘response’ sound defensive before anything happens.”
The more serious layer is clandestine. A Scandinavian intelligence officer told us that the Baltic services are watching individuals believed to have entered as Ukrainian refugees using false documents, with suspected GRU links.
The same source says Ukrainian organised-crime figures in the Baltic states are being monitored for contacts with Russian citizens or previously quiet intermediaries. The concern is that such networks could be activated on a “Day X” for sabotage, intimidation, targeted killings or attacks designed to look criminal rather than state-directed.
The Baltic states therefore face the test before NATO does. If the Baltics absorb too much, Moscow learns that low-level disruption is cost-free. If they react too sharply, Moscow learns that Article 5 politics can be manipulated. The intelligence officer concluded that “The likely Russian move is not a dramatic territorial strike. It is a chain of deniable incidents across rail, sea, border and migrant channels, each debatable on its own, but together forcing the real question: when does NATO stop arguing over attribution and start imposing costs?”