The question
In the first hours and days after an incident, decision-makers have to act on fragments. A ship may have dragged its anchor across a pipeline, or drones may have been seen over an airport, and the cause is unclear. This project asks what could be known at each point after three such incidents, which explanations the evidence supported, and how long it took before an accident could be told apart from an attack.
The cases
- Balticconnector, October 2023. The gas pipeline and data cables between Finland and Estonia were damaged, and an anchor was later recovered from the seabed near the pipeline.
- Estlink 2, December 2024. The power cable between Finland and Estonia was damaged on 25 December, and the Finnish authorities detained the tanker Eagle S, which they described as part of Russia’s shadow fleet.
- Drones over Danish airports, September 2025. Drone sightings closed Copenhagen Airport for several hours on 22 September, and further sightings followed over Aalborg Airport and military sites in the days after.
Why it matters
Ambiguity is the point of hybrid activity. An incident that can plausibly be explained as an accident gives the responsible actor deniability and leaves the target unsure how to respond. For authorities, operators of critical infrastructure and insurers, the practical question is which early signs separate an accident from an attack, and which only appear to.
Approach
Each incident is reconstructed as a timeline of what was publicly known and when, from official statements, investigation and court documents, ship tracking data and news reporting. Three explanations are then tested against the same evidence with Analysis of Competing Hypotheses: an innocent explanation, deliberate action by a state, and action through a proxy. A Key Assumptions Check and a deception assessment test whether the evidence could have been arranged to mislead.
What the full analysis will contain
- A timeline for each incident, marking what could be known at each stage.
- The matrix of competing hypotheses for each case, with the evidence that proved diagnostic.
- Probability judgements on the competing explanations, with confidence levels.
- A set of early indicators that separate an accident from an attack, for use in future incidents.
Full analysis on request
The full analysis is prepared for organisations on request. Write to contact@counterriskinsights.dk to receive it when it is finished, or to discuss the work in progress.