Blog
8 October 2025
Why Denmark's Drone Problem is a Shadow Fleet Problem
by Léa Allonier
Drones hovering over Denmark have captured headlines in recent weeks. Yet while we focus narrowly over anti-drone technology, we miss the policy failures that have led us here. Mainly the failure to control sanctioned tankers and Russia affiliated vessels sailing through our waters daily. These vessels are capable of carrying military technology, such as drones and pose a potential danger every time they pass through our waters
The Shadow Fleet connection
In the recent Danish drone incidents, no conclusive evidence links ships to the attacks, though several suspicious vessels were present in the area: the sanctioned PUSHPA sailing under a false Benin flag, the Russian-flagged ASTROL 1 zigzagging in the Kattegat, and a Norwegian-flagged cargo ship with Russian crew and possible paramilitary personnel near Copenhagen. The presence of Russian affiliated vessels next to our coastlines should concern us much more than the drones. Since Denmark refrains from inspecting these ships, we have little control or knowledge of their purpose, crew or capabilities. If this time they carried and operated the drones, one day they could be transporting far heavier military equipment.
This mirrors a broader pattern: commercial vessels with obscured ownerships have long been tied to covert activity in the Baltic, from cutting undersea cables and making pipeline damage to more recent suspicions of surveillance, as seen when Dutch authorities inspected the HAV DOLPHIN. Had these ships been Russian navy ships, they would have been watched closely by authorities, however as commercial cargo ships, they sailed through our waters without any scrutiny.
Provocation by design
This shows why the shadow fleet is dangerous: it is not only linked to sabotage and potentially espionage, but just like the drones, it functions as a constant provocation and imminent security risk. In the modern world a cargo ship carrying drones can pose the same threat as an aircraft carrier and the Russians know this.
59 instances of drone-based provocations have been recorded in Europe since 2022, and never more than this September with incidents in Poland, Estonia, and Romania and now Scandinavia. These overflights do not aim to solely deliver intelligence, but are also testing systems and resolve to inform military planning.
The shadow fleet works the same way. These vessels provide mobile platforms for sabotage and carry out tasks previously designated for the military. Above all, these vessels are instruments of coercion exploiting complex legal grey zones to expose indecision, lack of capabilities and coordination.
Hiding in the shadows
As commercial vessels, the shadow fleet provides a great tool for Russia to carry out grey zone attacks with plausible deniability. As ownership of the vessels are obscured in complex and fast-evolving structures of shell companies, and the ships are often registered to dubious flags, it is often impossible to put responsibility on anyone with direct ties to Russia.
If Russian navy ships had cut undersea cables and launched drones over Copenhagen Airport the reaction would have been different and considered close to a declaration of war. However, when such acts are carried out by commercial vessels, we in Denmark and elsewhere refrain from blaming Russia and make it a matter of tedious criminal investigations and technological gaps, rather than a diplomatic incident.
Patchwork of responses
Baltic states have shown they are willing and able to act when pressured. NATO and the Joint Expeditionary Force launched Baltic Sentry and Nordic Warden patrols in January 2025, expanding presence and surveillance. Estonia and Denmark temporarily stopped tankers on grounds of navigational safety, while Finland is prosecuting officers of the EAGLE S for cable sabotage. Perhaps most telling, the EVENTIN has been detained for months in Germany with millions in oil demonstrating that detentions achieve more than symbolic signalling: they are costly.
Yet none of these actions halted the shadow fleet. They remain exceptions rather than a strategy. The Gabonese‑flagged JAGUAR incident in May underscored the risks: when the tanker refused inspection in Estonia’s exclusive economic zone, a Russian Su‑35 violated Estonian airspace in an apparent attempt to shield it. The confrontation ended without escalation, but it highlighted how Moscow uses these encounters to probe legal and military boundaries and how fragile regional deterrence looks when responses are ad-hoc.
Empty Promises lead to failed deterrence
In June 2025, authorities promised tougher flag and insurance inspections, alongside common guidelines. These measures should work: when the UK briefly enforced them it disrupted shadow fleet routes significantly. While patrols seem to continue and inspections are conducted with reportedly high rates of compliant behaviour but with little effect in proving illegal activity or stopping it. The response is opaque as well, authorities have failed to be transparent and take stock of their successes. In practice, false-flagged vessels continue to transit the straits, while data shows numerous sanctioned vessels moving oil daily through Baltic chokepoints with impunity.
Russian drones and the shadow fleet serve the same purpose: to harass, test defences, and expose vulnerabilities. The fleet also generates huge profits for Russia’s war chest. By treating these as isolated technical issues instead of a coordinated campaign of maritime provocation, Denmark and its allies fragment their response and cede the narrative.
The real challenge is asserting control over both waters and skies through joint detection and enforcement. Responses must be publicized, coordinated, and impose real costs on shadow fleet transit, even if they risk Russian reactions.
Hope on the horizon
France has inspected the tanker Pushpa (ex-Kiwala) for suspected violations of flag state documentation and refusal to comply with authorities, marking one of the first attempt since the June 2025 declaration on falsely flagged vessels. Estonia’s earlier failed detention of the same vessel mentioned above triggered retaliatory Russian action, including the detention of an Estonian ship, underscoring the risks of enforcement. After 48 hours, France unfortunately released the vessel. While links to drone activity around Denmark remain unconfirmed, there is hope that these investigations signal a growing willingness among Western states to test legal avenues against shadow fleet operations, where even delays and uncertainty impose costs.
Sources
France 24, Denmark drone incursions: All signs point to Russia (26/09/2025)
Danwatch, Droneangreb: Norsk skibsejer samarbejdede med russisk paramilitær gruppe (26/09/2025)
IISS, Russian Sabotage Operations Against Europe’s Critical Infrastructure (19/08/2025)
Follow the Money, Schepen verdacht van inzet Russische spionagedrones boven Noord- en Oostzee (10/06/2025)
Meduza, An invisible maritime menace (17/6/2025)
ACLED, Testing the waters: Suspected Russian activity challenges Europe’s support for Ukraine (22/05/2025)
IISS, The paradox of Russian escalation and NATO’s response (26/9/2025)
IISS, Russia’s Shadow Fleet and Sanctions Evasion (01/2025)
Brooking/Craig Kennedy, Making the Baltic a ‘Shadow-free’ zone (05/2025)
RUSI, Countering Shadow Fleet Activity through Flag State reform (02/09/2025)
Financial Times, NATO to build up defence against Baltic Sea sabotage (14/01/2025)
RAND, Countering Russia’s Shadow Fleet (16/01/2025)
Danwatch, several ships detained after Danish efforts against dark fleet (22/08/2025)
News ERR, Russian 'shadow fleet' tanker Kiwala cleared to leave Estonian waters (26/04/2024)
CBS News, Authorities investigate possible Russian ‘hybrid warfare’ after oil tanker cuts undersea cables (28/09/2025)
Friends of Europe, Tanker Wars: Russia’s new strategy against Europe (24/01/2024)
Der Spiegel, Zoll beschlagnahmt Schiff aus russischer Schattenflotte (21/03/2025)
Danwatch, Skyggekrigen i Finskebugten (27/05/2025)
Government Offices of Sweden, Joint Actions to Further Counter the Shadow Fleet (19/06/2025)
Lloyd’s List, Shadow fleet scrutiny thought to be behind English Channel diversions (02/07/2025)
The Irish Times, Why is a Russian Shadow fleet using Irish waters? (21/07/2025)
Lloyd’s List, More than 90% of shadow fleet ships are producing insurance certificates when challenged (11/07/2025)
Lloyd’s List, Massive fraudulent flag operation (25/07/2025)
Christian Panton @sketchy.boats
The Guardian, ‘There are hundreds in the Baltic’: tracking Russia’s ‘shadow fleet’ of oil tankers (13 September 2025)
Initiate paid promos, with FAP accounts supporting promoted posts.