Critical undersea infrastructure is difficult to govern because its strategic value is produced by interdependence. A cable, pipeline, or electricity link is not important only as an asset; it is important because services, institutions, and users depend on it. Undersea systems also operate within broader networks, so the consequences of disruption depend on substitution possibilities, repair capacity, market balancing, and cross-border assistance. Research on submarine cables has shown how infrastructure can remain politically hidden until disruption makes its strategic role visible (Bueger and Liebetrau, 2021). Later work on critical maritime infrastructure similarly emphasises that protection involves multiple sectors, authorities, and threat environments rather than a single maritime-security instrument (Bueger and Liebetrau, 2023).

System-of-systems research treats resilience as an interaction among functions, processes, assets, and stakeholders rather than asset hardening alone (Godzimirski, 2022; Sellevåg, 2022). The relevant unit is the governance arrangement that identifies priority functions, allocates responsibility, and preserves essential services. Economic and societal resilience thus become parts of comprehensive defence (Constantinescu, 2023; Gasztold and Akrap, 2022).

Hybrid threats exploit the space between routine competition and overt armed conflict. They combine political, informational, economic, cyber, intelligence, and military instruments while preserving uncertainty about sponsorship, intent, or threshold. In the maritime environment, the same physical outcome may initially be consistent with accident, poor seamanship, criminal conduct, or hostile action. The governance challenge is therefore sequential: authorities must detect an event, protect evidence, coordinate legal and intelligence processes, maintain services, and communicate without allowing uncertainty to become paralysis. NATO’s strategic, resilience, and summit documents place critical infrastructure within deterrence and defence because disruption can impose strategic costs below the threshold of conventional attack (NATO, 2022, 2023b, 2024a, 2024b).

Attribution is central but constrained. Legal proof, intelligence confidence, political judgement, and public communication operate according to different standards. The discontinued Swedish Nord Stream investigation and continuing reporting around Balticconnector and later cable damage show that incidents can remain strategically salient even when legal responsibility is unresolved or jurisdictionally fragmented (Reuters, 2023, 2025b; Swedish Prosecution Authority, 2024). This study therefore codes attribution separately from threat framing, and records uncertainty rather than treating every disruption as sabotage.

The actors who own, monitor, regulate, investigate, and defend CUI are not identical. Operators hold technical knowledge and repair resources; governments hold legal and diplomatic authority; armed forces and coast guards contribute maritime awareness, deterrence, and protective presence. NATO adds alliance security and military integration, while the EU supplies maritime-security, market, cyber, transport, and resilience instruments (European Commission and High Representative of the Union for Foreign Affairs and Security Policy, 2023; European Commission and NATO, 2023; European Maritime Safety Agency, 2024; Monaghan et al., 2023).

National and regional strategies place CUI protection within comprehensive-security and total-defence thinking. Denmark, Estonia, Finland, Germany, Latvia, Lithuania, Norway, and Sweden increasingly connect national security with civil preparedness, infrastructure resilience, cyber risk, and hostile-state activity (Federal Government of Germany, 2023; Ministry of Defence of Denmark, 2023; Ministry of Defence of Latvia, 2023; Ministry of National Defence of Lithuania, 2021; Riigikogu and Government of Estonia, 2023; Security Committee of Finland, 2025). Work on Latvia’s strategic defence documents also shows an increasing but uneven role of private sector in critical infrastructure, cybersecurity, and continuity (Juberte Krūmiņa, 2024). Industry facing analyses identify divergent public–private risk models, fragmented regulation, and policy instability around long-lived infrastructure projects (Channer, 2024). The International Cable Protection Committee (n.d.) recommends operator consultation, cross-agency coordination, and a single governmental point of contact for installation, repair, and protection.

Technology can expand surveillance options, as Pająk (2025) shows for artificial intelligence (AI)-driven naval drones, but its value still depends on mandates, information sharing, evidence handling, operator coordination, and escalation management. This study therefore focuses on the governance functions and interfaces revealed in public documents.

The framework distinguishes four functions that are analytically separate but operationally interdependent. Surveillance is the detection and monitoring of risks and disruptions through maritime domain awareness, patrols, sensors, information sharing, and related measures. Attribution is the establishment or communication of cause, responsibility, or plausible culpability through investigation, forensics, intelligence, legal action, and political judgement. Redundancy is the availability of alternative capacity, reserve systems, repair resources, or substitute routes that reduce dependence on a single element. Continuity of service is the maintenance or restoration of essential functions through rerouting, balancing, emergency procedures, repair, and organisational recovery.

The four functions were selected because they represent distinct governance problem domains: awareness of disruption, establishment of cause and responsibility, availability of alternative capacity, and preservation or restoration of essential service. Their selection is conceptual rather than frequency-based. Resilience planning is treated as a cross-cutting governance mechanism because it can enable all four functions rather than constitute a separate functional outcome. Coordination, information sharing, deterrence, crisis response, and legal action are likewise treated as mechanisms or interfaces that enable, connect, or shape the four core functions. Supplementary Table S2 summarises the category-type mapping used in the analysis.

The distinction matters because resilience can otherwise become an undifferentiated label. Surveillance without attribution may improve awareness while leaving accountability and response uncertain. Attribution without redundancy may identify responsibility but fail to preserve service. Redundancy may exist technically, yet without continuity arrangements it may remain difficult to mobilize. Continuity without adequate surveillance may remain reactive. The four functions are connected through civil–military, public–private, and international interfaces, but each raises a different question of governance and produces different types of public evidence. Table 1 summarises their definitions, public-source indicators, and security significance.

The framework measures public-source governance visibility, not hidden capability. That distinction is both methodological and substantive. Public documents signal priorities, justify spending, communicate deterrence, define expectations, and support democratic accountability, but they also omit classified, commercially sensitive, or operationally risky details. Visibility is therefore a partial indicator of institutional posture. It is valuable when interpreted as evidence about how the problem is constructed and coordinated publicly, not as a complete inventory of what can be done by states and operators.

The study uses structured public-source documentary analysis. Its purpose is to compare visible governance functions without reconstructing operational plans or technical vulnerabilities. The design treats documentary visibility as an empirical object: what institutions publicly identify, prioritise, coordinate, and report. This approach is appropriate for a field in which classified intelligence, commercial contingency plans, and detailed surveillance arrangements cannot be expected in open sources. It also responds to the need for transparent, reproducible security research that does not increase the vulnerability of the systems under study.

The corpus contains forty-three public sources, 101 coded documentary governance observations, and twelve contextual incidents or policy milestones. It spans 2021–2026, with most observations from 2022 onward; selected 2021 entries provide doctrinal baselines and 2026 entries fall within the update window. The empirical scope includes the Baltic Sea, wider Nordic–Baltic region, the North Sea, and the High North when directly relevant, together with connected EU and NATO policy spaces. Sources include alliance, EU, national, operator, academic, think-tank, and selected reporting.

For analytical clarity, the revised presentation refers to “geographic or institutional scope” rather than “maritime area.” The scope variable distinguishes physical maritime spaces (Baltic Sea, North Sea, and High North), combined or multi-state regional frames (Baltic Sea–North Atlantic, Baltic Sea–North Sea, and Nordic–Baltic region), national frames (Finland and Norway), institutional policy spaces (EU and NATO/transatlantic), and global comparative frames. EU and NATO are therefore not treated as seas. Where a source explicitly linked more than one setting, a combined label was retained. Supplementary Table S1 provides the operational definitions.

A coded documentary governance observation is a discrete and traceable statement or passage in a public document that records a governance function, mechanism, actor configuration, coordination interface, or uncertainty condition. It is a documentary coding unit, not an in-person or field observation. For example, NATO’s public announcement of Baltic Sentry illustrates surveillance coding, whereas operator notices confirming restoration of C-Lion1 and Estlink 2 illustrate continuity-of-service coding (Cinia, 2025; Fingrid, 2025; NATO, 2025). A single policy document can contain several analytically distinct observations, while a high-profile incident may provide only contextual evidence. The source register preserves the link between each observation and its origin. Table 2 summarises the corpus components and their analytical roles.

Sources were included when they provided traceable evidence relevant to CUI risk, surveillance, attribution, redundancy, continuity, coordination, or resilience. Official national, NATO, EU, regulatory, and operator materials were prioritised. Academic and think-tank sources were used to frame concepts and institutional roles. Selected public reporting was retained when official information remained incomplete or when a report documented a contextual incident, but such entries received lower or verification-required confidence where appropriate. The corpus excludes unattributed claims that could not be traced to a stable source.

The analysis deliberately excludes precise cable routes, coordinates, access points, sensor locations, patrol patterns, repair vulnerabilities, and other details that could facilitate harm. It also avoids inferring classified capabilities from general statements. These exclusions limit operational description but do not prevent analysis of governance functions, institutional responsibilities, or public strategic communication.

The codebook records source identifier, year, geographic or institutional scope, country or actor, actor type, infrastructure type, threat type, governance category, governance mechanism, military role, civil–military interface, public–private interface, international coordination, legal or policy basis, evidence location, confidence, and uncertainty. “Governance category” is used when the field includes both the four core functions and broader cross-cutting mechanisms. Each observation retains a short evidentiary trace. Confidence categories reflect source status, specificity, and traceability; uncertainty flags distinguish settled public information from partial, verification-required, or disputed claims.

Coding was conducted by the author, and no independent inter-rater reliability statistic is claimed. Subjectivity was constrained by predefined values, source-level traceability, observation-level evidence, and explicit uncertainty coding. Ambiguous cases followed four decision rules: suspected sabotage did not count as attribution unless the source communicated cause, responsibility, or plausible culpability; redundancy required explicit alternative capacity, routes, reserves, or repair resources rather than generic resilience language; continuity required maintenance, rerouting, restoration, or recovery rather than backup capacity alone; and incomplete or disputed statements retained an uncertainty flag rather than being assigned the strongest category. Thus, restoration notices were treated as continuity evidence, while unresolved suspicion remained threat framing rather than attribution. These procedures support auditability but do not substitute for future independent recoding. Supplementary Table S3 summarises these coding decision rules.

For the coordination-interface matrix, “absent” means that the interface is not identified in the coded passage; “weak” indicates a general or limited mention with little role specificity; “moderate” indicates identifiable coordination or role sharing with some documentary detail; “strong” indicates explicit and structured coordination; and “unclear” indicates that the public source does not permit a defensible classification. These labels describe documentary visibility, not the actual quality of coordination. Supplementary Table S4 summarises the coordination-interface visibility levels.

The Python-based workflow checked duplicate identifiers and missing required fields, calculated frequency distributions, produced cross-tabulations by geographic or institutional scope and actor type, generated heatmaps for governance categories and coordination interfaces, and plotted temporal visibility. The analysis is descriptive-comparative rather than causal or inferential. Counts indicate how often categories are represented in the coded public corpus; they do not estimate the prevalence or effectiveness of hidden operational practice. Interpretation therefore focuses on patterned visibility, institutional location, and documentary asymmetry.

The anonymised replication package contains analytical dataset, codebook, source matrix, notebook, exported figures, and supplementary tables. The study uses public documentary sources only and involves no human participants or private personal data. The package excludes operationally sensitive details. This combination of transparency and restraint is central to the research design: reviewers can inspect how claims were produced without receiving information that could increase infrastructure vulnerability.

The 101 coded documentary governance observations form a governance record spanning four core functions and a broader set of cross-cutting mechanisms and contextual categories. Resilience planning is the most frequent cross-cutting mechanism, with seventeen observations, followed by surveillance with thirteen and international coordination with twelve observations. Public–private coordination appears in nine observations; information sharing and continuity of service each appear in eight observations; and deterrence appears in seven observations. Crisis response, civil–military coordination, and legal response each appear five observations. Among the four core functions, surveillance is most visible, followed by continuity of service, while attribution and redundancy each appear four observations. Theoretical framework, risk management, and policy analysis occur less frequently. Figure 1 presents the full distribution.

The distribution reveals an asymmetry in public documentation. Institutions frequently describe preparedness, monitoring, and cooperation, while attribution and backup capacity are less often made visible. This pattern cannot establish that attribution and redundancy are weak in practice. Attribution may remain legally or diplomatically constrained, and redundancy information may expose commercial dependencies or contingency design. The result is instead a finding about the public governance record: the core functions most closely associated with accountability and alternative capacity are among the least documented categories.

Threat framing reinforces the role of ambiguity. Hybrid threat is coded in fifty-two observations, sabotage in twenty-three, and suspected sabotage in thirteen observations, while accidental damage, coercion, cyber-physical disruption, and armed-conflict spillover appear less often. Hybrid-threat terminology therefore provides a dominant public frame, but a separate attribution variable prevents this frame from being treated as proof of responsibility.

The Baltic Sea accounts for forty observations, followed by the wider Nordic–Baltic region with twenty-two and EU-level policy space with nineteen observations. The North Sea, NATO/transatlantic, and national and global entries are fewer, and the High North is represented only marginally. Figure 2 presents four core functions first, followed by cross-cutting and contextual categories. The Baltic Sea contains the widest spread, including surveillance, attribution, crisis response, legal response, and resilience planning. The Nordic–Baltic category is especially visible in international coordination, civil–military coordination, and resilience planning, while EU-level documents contribute strongly to continuity of service, information sharing, redundancy, and risk management.

This distribution reflects the corpus and period rather than the intrinsic importance of one sea area. Recent incidents and alliance responses made the Baltic Sea exceptionally visible. The EU and Nordic–Baltic entries broaden the record from specific disruptions to regulatory and regional arrangements. The empirical centre is therefore regional, but the governance architecture is multi-level.

Government actors account for thirty-five observations, NATO for twenty-one and the EU for sixteen observations. Private operators appear as a primary actor in five observations and explicitly military organisations in three observations. Figure 3 presents the four core functions first and then the broader coded categories. The aggregates should not be interpreted as a marginal military role: NATO and government documents contain surveillance, deterrence, and civil–military elements, but actor type records the principal institutional author. The result is a layered field in which military relevance is frequently mediated through government and alliance structures.

The actor-category matrix also differentiates institutional comparative advantage. Government documents carry most attribution, crisis response, legal response, and resilience-planning observations. NATO is especially visible in deterrence, international coordination, surveillance, and resilience planning. EU documents are prominent in continuity of service, information sharing, redundancy, resilience planning, and risk management. Private operators are most visible where public–private coordination, redundancy, and continuity are documented. These patterns support the claim that CUI protection cannot be reduced to naval patrols or a single command chain.

Figure 4 cross-tabulates two separately coded dimensions: civil–military interface visibility on the vertical axis and public–private interface visibility on the horizontal axis. The largest cell combines moderate visibility on both interfaces, with thirty-two observations. Moderate civil–military and strong public–private visibility accounts for eighteen observations, while strong civil–military and moderate public–private visibility accounts for sixteen observations. Other combinations include twelve observations with weak civil–military but strong public–private visibility and eleven observations with moderate civil–military but unclear public–private visibility.

The matrix indicates that coordination is commonly acknowledged but less often documented as strong across both interfaces. Public sources more readily state that cooperation exists than explain how authority, data exchange, repair capacity, and crisis decisions are integrated. This is significant because private actors possess much of the technical capability needed for restoration, while public authorities carry legal and strategic responsibility.

Figure S1 covers the 2021–2026 period and shows the concentration of visibility after 2022: resilience planning and international coordination peak in 2023, deterrence and civil–military coordination rise in 2024, and surveillance and continuity become more visible in 2025 (Associated Press, 2025b; Cinia, 2025; Fingrid, 2025; NATO, 2025; Reuters, 2025a). The pattern is incident-driven but also reflects institutionalisation through NATO, EU, and national initiatives.

Uncertainty is substantial: forty-one observations have no uncertainty flag, thirty-eight contain partial information, twenty-one require verification, and one records disputed attribution. This supports treating uncertainty as a governance variable and phrasing results as documentary visibility rather than verified intent or capability.

The findings show that CUI protection is best understood as hybrid-threat governance. The problem is not simply whether an asset can be damaged; it is whether institutions can maintain awareness, manage attribution, preserve alternative capacity, and sustain essential services while intent remains uncertain. The four functions expose different failure modes. A system may monitor effectively but hesitate over legal responsibility. It may attribute an incident but lack visible backup capacity. It may restore service rapidly without clarifying whether lessons have been converted into lasting preparedness. Treating the functions separately makes resilience analytically specific rather than rhetorical.

This functional view also clarifies deterrence. Surveillance and attribution contribute to the credibility of detection and accountability, whereas redundancy and continuity reduce the strategic payoff of disruption. Together they combine deterrence by prospective response with deterrence by denial. The public record, however, is weighted towards the first part of this bundle: monitoring, alliance presence, and general preparedness are more readily disclosed because they can signal activity without revealing sensitive contingency arrangements. A mature governance architecture may therefore be stronger than its public documentation, but the asymmetry can also conceal genuine gaps.

Public-source visibility performs governance functions: official statements justify initiatives, reassure allies, signal resolve, and set expectations (Council of the European Union, 2023; European Commission, 2024; European Union, 2022a, 2022b; NATO, 2023a, 2024b, 2025; Office of the President of the Republic of Finland, 2025). Yet governments, operators, militaries, and investigators also withhold intelligence, commercial data, surveillance patterns, or legal evidence. The method therefore treats visibility as a partial governance signal, records uncertainty, and avoids equating silence with incapacity.

The function gap is substantively meaningful. Surveillance measures are often suitable for public signalling because they demonstrate attention and presence without requiring disclosure of every capability. They can reassure publics and partners while contributing to deterrence. Attribution is more difficult because evidence must travel through investigative, intelligence, diplomatic, and legal channels. Premature attribution can damage credibility or create escalation pressure. The low attribution count therefore reflects the institutional difficulty of converting suspicion into an authoritative public claim.

Redundancy is constrained for different reasons. Alternative routes, reserve capacity, repair contracts, and dependency maps may be commercially sensitive or operationally risky to disclose. Continuity of service occupies an intermediate position: operator notices can make rerouting or restoration visible after disruption, while prospective continuity arrangements remain less detailed (Cinia, 2025; Fingrid, 2025). This highlights a policy communication dilemma: authorities need to demonstrate resilience without advertising where backup arrangements remain thin. Future assessments may therefore be enhanced by combining public governance analysis with authorised expert review or classified evaluation, rather than asking the public record to carry the full evidentiary burden.

Protection is layered: NATO contributes deterrence and military coordination; the EU provides legal, market, cyber, and resilience frameworks; governments provide sovereignty, investigation, and crisis management; operators provide technical knowledge and restoration; and NORDEFCO and the Joint Expeditionary Force provide regional channels (NORDEFCO, 2024; UK Government and Joint Expeditionary Force, 2025). The core risk is a translation failure across these actors: surveillance data, legal findings, operator knowledge, and military awareness must reach the authorities able to act. Industry-facing work likewise shows that different priorities, fragmented regulation, and unstable policy can complicate cooperation (Channer, 2024; International Cable Protection Committee, n.d.).

Professional practice should consequently use the four functions as a bundle. Exercises and planning should ask who owns the relevant information, who can authorise action, what alternative capacity exists, how essential services will be sustained, and how uncertainty will be communicated. The framework can support staff education and cross-sector exercises without relying on technical exposure. It directs attention towards institutional handoffs, which are often where hybrid threats seek to generate delay, confusion, and political friction. In other words, institutional handoffs are the points at which information, authority, or operational responsibility pass between operators, regulators, investigators, governments, military organisations, and alliance structures.

Although not statistically representative, the Nordic–Baltic case addresses a global governance problem: privately operated cables and offshore energy networks cross jurisdictions and support civilian and defence activity. Other regions differ in alliances, markets, and threats but face the same questions of surveillance, attribution, redundancy, and continuity of service (Bueger and Liebetrau, 2021, 2023).

The framework can support comparison across the North Atlantic, the Mediterranean, Indo-Pacific corridors, Arctic, and offshore-energy settings when local authorities, markets, alliances, and repair access are incorporated. Its transferable contribution is procedural—decompose resilience into functions, retain uncertainty, map actors and interfaces, and trace claims to evidence—not a claim of universal institutional weakness or effectiveness. Future applications could examine whether similar functional and coordination asymmetries appear in the Red Sea, the Taiwan Strait, other Indo-Pacific corridors, or the Mediterranean (Govella, 2025; Watson, 2025).