Norway, long seen as a quiet NATO frontline state, is sounding the alarm about a rapid shift in maritime security. Intelligence and security services in Oslo say the country’s waters have become a key arena for so‑called hybrid operations, with foreign actors quietly mapping, watching and testing critical infrastructure far from public view.
Norway rings the loudest alarm since World War II
In early February, three of Norway’s most powerful security bodies stepped onto the same stage: the Police Security Service (PST), the foreign intelligence service (Etterretningstjenesten) and the National Security Authority (NSM). Together they delivered a stark message: the security situation facing Norway is now the most serious since the Second World War.
Their joint threat assessment for 2026 puts the sea at the centre of concern. The waters around Norway, from the Barents Sea down to the North Sea, are no longer viewed only as shipping lanes and fishing grounds. They are also a discreet laboratory for intelligence gathering, digital probing and potential sabotage planning.
The Norwegian services describe a heavily contested maritime space, where routine traffic can mask hostile intelligence activity.
Russia is singled out as the main state actor expected to intensify operations in and around Norwegian waters. The officials stress that these activities are not limited to naval vessels. Civilian ships, often sailing under third-country flags, are highlighted as a tool for what they call “discreet maritime intelligence”.
Civilian ships under scrutiny along the Norwegian coast
According to the assessment, ordinary-looking merchant ships, research vessels or service boats could be used to gather information along the coast. From the outside, they blend into busy commercial traffic. On board, teams can quietly observe offshore platforms, map military sites or track activity around ports.
Officials describe this as “patient espionage”. Instead of dramatic incidents, the focus is on slow collection of data over months or years:
- Watching offshore oil and gas installations and shipping routes
- Noting locations and layouts of allied military facilities
- Monitoring patterns of port traffic and security routines
- Testing how quickly Norwegian authorities react to unusual behaviour
Over time, this builds a detailed picture of where Norway and its NATO partners are strong, and where they might be vulnerable in a crisis. The concern is not only what is seen above the waterline.
Undersea cables and pipelines seen as the weakest link
For Norwegian planners, the most fragile part of this maritime puzzle sits on the seabed. The country’s prosperity and security lean heavily on a dense network of undersea infrastructure:
➡️ From perovskite to fusion: the energy breakthroughs finally leaving the lab in 2026
➡️ Informant told FBI that Jeffrey Epstein had a ‘personal hacker’
➡️ Tesla invests $2 billion in Musk’s xAI and reiterates Cybercab production starts this year
➡️ China Has Planted So Many Trees It Has Changed The Water Cycle
➡️ Expanding AI Career Access Through Skills Based Evaluation
| Type of infrastructure | Main role |
|---|---|
| Submarine communication cables | Carry internet, financial data and military communications |
| Gas pipelines | Supply Europe with Norwegian gas, replacing much of Russian output |
| Power and control cables | Connect offshore platforms and wind farms to shore |
Norway’s security services warn that foreign actors could spend years mapping these systems: locating key junctions, understanding maintenance schedules, and watching patrol patterns around them. Suspicious survey trips, unusual loitering by vessels or unexplained equipment on the seabed are all treated with growing concern.
Any detailed mapping of cables and pipelines today could become a playbook for disruption during a future crisis.
Several recent incidents in European waters, including mysterious damage to gas pipelines and data cables, have already shown how vulnerable the seabed has become. Norway, now one of Europe’s main gas suppliers, knows it sits at the heart of this strategic contest.
Restrictions on Russian ships and tighter port security
Faced with this worsening picture, Oslo has tightened access for Russian vessels. Norwegian ports remain largely closed to Russian ships, with only narrow exceptions, such as specific civilian or scientific visits under strict conditions.
The logic is straightforward: fewer Russian-flagged ships in port means fewer chances to observe facilities up close or to stay for long periods near sensitive infrastructure. But the government also acknowledges that threats can arrive under any flag.
Norway is trying to close the gaps between several types of security work that used to run in parallel:
- Coastal surveillance, including radar, satellite tracking and patrols
- Physical port security, from access control to camera systems
- Cyber defence of port systems, vessels and offshore operators
The 2026 assessment underlines that maritime security can no longer be separated from digital risk. A ship close to an offshore platform is not only a physical presence; it can also host tools aimed at probing networks, intercepting communications or jamming signals.
Hybrid operations at sea: more than ships and submarines
Norwegian officials frame this as a textbook case of hybrid operations: a blend of military, economic, cyber and information tools, applied in a way that stays below the threshold of open conflict. At sea, that mix might include:
- Intelligence gathering disguised as commercial or research activity
- Cyber intrusions against shipping companies, ports or energy firms
- Information campaigns aimed at sowing doubt about safety or reliability of Norwegian exports
- Unexplained outages or “accidents” that are hard to attribute
Each action alone can be dismissed as a misunderstanding, a technical issue or bad luck. Taken together over time, they start to look like a strategy designed to unsettle both Norway and its partners in Europe.
Why Norway’s warnings matter far beyond Scandinavia
For readers outside the region, this might sound like a distant Arctic concern. In reality, several factors make Norway’s waters a global security test case.
First, Norway provides a large share of the natural gas that keeps European homes heated and factories running. Any disruption to its pipelines or export terminals would be felt quickly across EU energy markets.
Second, key data cables off Norway connect Europe to North America and to critical sites in the Arctic. A cut cable can slow financial transactions, degrade military coordination or knock out services many people barely realise rely on undersea lines.
Third, Norway hosts regular NATO exercises and supports surveillance of Russian activity in the High North. Any attempt to intimidate or undermine Norway sends a message to the entire alliance.
Norway’s coastline acts as both an energy lifeline and an early-warning sensor for the wider West.
What hybrid threats at sea might look like in practice
To grasp the stakes, defence planners often use scenario-based thinking. One frequently discussed pattern starts subtly. A research vessel, chartered through a shell company, spends several weeks performing “oceanographic studies” near gas pipelines. Data buoys and sensors are placed on the seabed, officially for scientific reasons.
Months later, a cyberattack hits a shipping company that supplies maintenance crews to those same pipelines. Their schedules, routes and access codes leak online. Around the same time, a series of GPS glitches affects navigation in the same region, making it harder for authorities to track who is where.
Finally, during a broader political crisis, a pipeline section suddenly shows a drop in pressure. Damage is found at a location that matches the earlier “scientific” survey. No one claims responsibility, and the technical cause remains officially “undetermined”. Energy prices spike, and public confidence in infrastructure security takes a hit.
Norwegian officials stress that this kind of scenario is not science fiction. It combines activities already observed in various forms across European waters: unusual mapping, cyber incidents, navigation interference and unexplained infrastructure damage.
Key terms and practical takeaways for readers
Two expressions shape much of this debate. “Hybrid operations” refers to the mix of tools used by states to pressure rivals without open war: cyberattacks, economic leverage, covert action and manipulation of information or infrastructure. These tools are designed to be deniable and hard to respond to with traditional military means.
“Critical maritime infrastructure” covers the assets at the centre of Norway’s warning: undersea cables, gas and oil pipelines, offshore platforms, port facilities and power cables to wind farms. Many are privately owned but carry services governments rely on every day.
For businesses linked to shipping, offshore energy or data services, the Norwegian assessment suggests a few practical points. Attention to unusual vessel patterns near infrastructure, robust cyber hygiene in ports and on ships, and close contact with national authorities are no longer niche concerns. They form part of a broader security picture that stretches from boardrooms to the seabed.
For ordinary citizens in Europe and North America, the debate in Oslo offers a reminder: when you send a message, turn on the lights or check a bank balance, there is a fair chance some part of that action quietly passes through the cold, dark waters off Norway. That is the space Norwegian authorities say is now under the heaviest scrutiny since the 1940s.
