Armed guards patrol Latvia’s gas storage

Armed guards now patrol a hydroelectric dam upstream from Riga and the underground caverns at Inčukalns where Latvia stores its natural gas. The government tightened security at both sites after intelligence pointed to a possible Russian threat, with Prime Minister Andris Kulbergs telling Reuters he had asked NATO for more air-defence assets and allied troops near energy infrastructure (UNN, Devdiscourse).

No attack has happened. But Latvia's response exposes a question most European governments have left unanswered: when intelligence says a civilian energy site may be targeted, who commands its defence, who pays, and how fast can military help reach a private operator?

A threat the Baltics take literally

NATO deters. The EU writes rules. Day-to-day protection of power plants, gas storage and cables stays with national governments and the companies that run them. Latvia has now treated that responsibility as operational, posting guards and requesting allied reinforcement.

Lithuania has heard similar warnings. President Gitanas Nausėda cited intelligence about possible Russian sabotage against Baltic and Polish infrastructure, though no public evidence names a specific target or date (Demócrata, Anews). Lithuania's response mixed paperwork with guards: a government commission reviewed electricity resilience while the Public Security Service took over protecting several energy sites (Obzor). The defence minister added a caveat: no Russian troop build-up was visible at the border. The concern is sabotage or deniable disruption, not invasion.

Latvian intelligence warned separately that Russia was preparing provocations to demonstrate that supporting Ukraine carries a domestic price (Fox News). Moscow has accused all three Baltic states of helping Ukraine strike Russian oil terminals; all three rejected those claims as disinformation (Euronews).

Denmark deployed up to 170 troops to NATO's brigade in Latvia on short notice (Berlingske). Danish soldiers reinforce NATO deterrence. They do not stand watch at Latvian gas caverns.

Laws on paper, gaps on the ground

The EU has a rulebook for this. Its Critical Entities Resilience Directive (CER, the bloc's physical-protection law) requires member states to identify critical energy companies and impose risk assessments and incident-reporting duties (EUR-Lex). Denmark was due on 17 July to designate which companies qualify as "socially critical" under CER; those companies then have ten months to produce risk analyses and preparedness plans (BT, KPMG). Ten months of planning assumes the threat waits.

Germany shows why legislation is not protection. Its version of NIS2 (the EU's cybersecurity directive) sets registration deadlines and fines. But small water and energy operators lack the capacity to comply, and information flows between authorities and the companies running the systems stay slow (BR).

Finland draws the sharpest line. Where authority chains are clear, as with border closures, the state acts fast (Finlex). Where infrastructure is privately owned, underwater or dispersed, the state coordinates while operators do the fixing. After a suspected anchor-drag severed the Balticconnector gas pipeline in 2023, repairs took months. A Nordic analysis of that incident found that common physical-protection standards and emergency-repair frameworks are still missing across the region (shattered.io).

NATO's deputy secretary general told the European Parliament in July that responses to sabotage, cyberattacks or deniable disruption remain choices for political leaders, not automatic triggers for collective defence under Article 5 (NATO's pledge that an attack on one ally can be treated as an attack on all) (NATO). The EU adopted its largest-ever cyber-sanctions package against Russia the same month (Estonian MFA). Sanctions punish. They do not protect a dam.

Latvia has posted guards, asked NATO for air defence and named the threat aloud. Most of Europe's critical energy infrastructure still sits behind compliance calendars. The unanswered question is concrete: who commands site defence when a warning arrives, who funds physical protection at privately owned facilities, and how quickly military support reaches a civilian operator under threat. National governments and private operators owe those answers before an incident delivers them.