Europe’s security begins at sea: It’s time to counter Russia’s shadow fleet
The threat from Russia no longer appears only at the front lines in Ukraine or in European airspace. Increasingly, it moves along Europe’s shipping lanes, from the Baltic and North Seas to the chokepoints feeding Europe’s energy markets.
Russia’s shadow fleet, consisting of hundreds of ageing and obscurely registered tankers and cargo vessels, has become a central pillar of Moscow’s hybrid strategy. It funds the Kremlin’s war machine, disguises intelligence activities and exploits every weakness in the maritime governance system on which Europe depends. What was once a sanctions-evasion problem has evolved into a full-spectrum security threat.
Estimates place the fleet at 600–1,400 vessels, many with falsified identities, minimal inspections and rapid ‘flag-hopping’ through permissive registries. These zombie vessels mask or cycle their identities in ways that frustrate tracking and undermine Europe’s ability to hold flag-states accountable.
This fleet operates across Europe’s waters under layers of shell ownership that obscure who controls the vessels and what they carry. Their mission is to move Russian oil and high-risk cargoes, avoid scrutiny and profit from the sanctions gap. The risks, however, fall on European states, which now face unsafe ships near their coasts and increased evidence that some of these vessels are gathering intelligence, serving as GPS-jamming platforms or conducting clandestine operations.
Recent incidents underscore this threat: Russia-linked vessels have been implicated in drone incursions, cable disruptions and reconnaissance of critical infrastructure. The Eagle S severed undersea cables after cycling through multiple flags, and Estonia’s attempted interdiction of the Jaguar crude oil tanker prompted the scrambling of Russian fighter jets – proof that Moscow sees this fleet as a strategic asset and is willing to protect it. Europe cannot afford to let these incidents pass unanswered.
The good news is that Europe already possesses the legal and operational tools needed to push back. The United Nations Convention on the Law of the Sea (UNCLOS) grants coastal and port states more authority than they have exercised to disrupt unsafe or suspicious shipping. The International Convention for the Prevention of Pollution from Ships (MARPOL) and International Convention for the Safety of Life at Sea (SOLAS) obligations provide lawful avenues to inspect, detain or deny port access to vessels that fail to meet basic safety standards. These frameworks, combined with national laws, give member states significant room to act. The obstacle is not the law, but the fragmented and hesitant way it is applied.
Europe should approach this challenge through deliberate, coordinated lawfare, using every legal instrument available to identify, detain, immobilise and de-register vessels that violate rules designed to keep people and infrastructure safe. Port-state control inspections should become far more assertive, focusing on insurance irregularities, false registries and mechanical deficiencies that are endemic across the shadow fleet.
Coastal states can interrupt bunkering, provisioning and repair networks when such activities fall within their jurisdiction. Member states can establish designated holding areas for detained or immobilised vessels, ensuring inspections and evidence collection can proceed safely and without disrupting commercial ports.
Member states should jointly pressure permissive flag registries that enable rapid flag-hopping and fictitious identities. Since many of these vessels repeatedly shift between registries, they could be seen as ‘using two flags’ and therefore as effectively stateless under international law. This would expand the scope for interdiction, inspection and immobilisation, allowing member states to act more decisively within their jurisdiction. Since Russia has used military force to deter enforcement against its shadow fleet, close coordination with NATO to manage possible escalation will be vital.
Europe must also improve its maritime intelligence picture. Maritime domain awareness is one area where EU defence structures can contribute the most, yet the current information-sharing system is geographically limited and strained by low numbers of naval assets. What Europe lacks is a fused picture integrating European External Action Service (EEAS), European Maritime Safety Agency (EMSA), EU Satellite Centre (SATCEN), national coastguards, NATO’s Shipping Centre and the EU’s naval missions. Thus, it’s time to finally meet the long-standing call for an EU Maritime Security Centre with global reach. Such a capability could form the backbone of any serious attempt to track a global network of rogue vessels that constantly shift identity and transit multiple jurisdictions.
Finally, Europe needs an operational framework that maximises its reach and effectiveness. In this case, the Coordinated Maritime Presence principle of a Maritime Area of Interest could be applied thematically vice regionally – to enable the integrated response this threat requires. It would allow member states to synchronise actions, share intelligence on suspect ships and coordinate actions with partners such as the United Kingdom and Canada.
Russia’s shadow fleet will not disappear on its own. It represents a structural vulnerability Moscow will exploit as long as enforcement remains inconsistent. If Europe wants to protect its maritime infrastructure, uphold sanctions and constrain Russia’s war financing, it must act decisively to end the shadow fleet’s impunity.
Chris Kremidas-Courtney is a Senior Visiting Fellow at the European Policy Centre.
The support the European Policy Centre receives for its ongoing operations, or specifically for its publications, does not constitute an endorsement of their contents, which reflect the views of the authors only. Supporters and partners cannot be held responsible for any use that may be made of the information contained therein.
