Armed Guards Patrol Latvian Gas Site

The guards are now visible at places most Latvians would rather not have to think about: a hydroelectric dam upstream from Riga, and the underground caverns at Inčukalns where the country stores its natural gas. Latvia tightened security at both sites after intelligence pointed to a possible Russian threat, with Prime Minister Andris Kulbergs telling Reuters he had asked NATO for more air-defence assets and allied troops near energy infrastructure (UNN, Devdiscourse).

No attack has taken place. But the Latvian response puts a practical question in front of Europe: when intelligence says a civilian energy site may be in Russia’s sights, who is actually in charge of defending it, who pays for that defence, and how quickly can military help reach a private operator?

A threat the Baltics take literally

NATO deters. The EU legislates. The daily job of protecting power plants, gas storage sites and cables falls to national governments and the companies that run them. Latvia has now moved that responsibility from the page to the perimeter, putting guards on the ground and asking allies for reinforcement.

Lithuania has received similar warnings. President Gitanas Nausėda has cited intelligence about possible Russian sabotage against infrastructure in the Baltics and Poland, though no public evidence has identified a specific target or date (Demócrata, Anews). Lithuania’s answer combined administration with force: a government commission reviewed electricity resilience, while the Public Security Service took over protection at several energy sites (Obzor). The defence minister added the important qualification: there was no visible Russian troop build-up at the border. The worry is sabotage, or disruption that can be denied, rather than invasion.

Latvian intelligence has separately warned that Russia was preparing provocations designed to show that support for Ukraine carries a domestic cost (Fox News). Moscow has accused all three Baltic states of helping Ukraine strike Russian oil terminals; all three dismissed the claims as disinformation (Euronews).

Denmark sent up to 170 troops to NATO’s brigade in Latvia at short notice (Berlingske). Danish soldiers strengthen NATO deterrence. They are not standing guard at Latvian gas caverns.

Laws on paper, gaps on the ground

The EU has a framework for this. The Critical Entities Resilience Directive, known as CER, is the bloc’s physical-protection law for essential infrastructure. It requires member states to identify critical energy companies and make them carry out risk assessments and report incidents (EUR-Lex). Denmark was due on 17 July to designate which companies qualify as "socially critical" under CER; those companies then have ten months to produce risk analyses and preparedness plans (BT, KPMG). That timetable assumes the threat is willing to wait.

Germany shows the difference between law and protection. Its version of NIS2, the EU’s cybersecurity directive, creates registration deadlines and fines. But smaller water and energy operators often lack the capacity to comply, and the flow of information between authorities and the companies running the systems remains slow (BR).

Finland draws the distinction most clearly. Where the chain of authority is straightforward, as with border closures, the state can act quickly (Finlex). Where infrastructure is privately owned, underwater or scattered across wide areas, the state coordinates while operators carry out the repairs. After a suspected anchor-drag cut the Balticconnector gas pipeline in 2023, repairs took months. A Nordic analysis of that incident found that common standards for physical protection and emergency repair are still missing across the region (shattered.io).

NATO’s deputy secretary general told the European Parliament in July that responses to sabotage, cyberattacks or deniable disruption remain political decisions, not automatic triggers for collective defence under Article 5, NATO’s pledge that an attack on one ally can be treated as an attack on all (NATO). The EU adopted its largest-ever cyber-sanctions package against Russia the same month (Estonian MFA). Sanctions punish. They do not defend a dam.

Latvia has put guards in place, asked NATO for air defence and said clearly what it fears. Much of Europe’s critical energy infrastructure is still being protected through compliance calendars and preparedness plans. The question is not abstract: who commands the defence of a site when a warning arrives, who pays for physical protection at privately owned facilities, and how fast can soldiers reach a civilian operator under threat? National governments and private companies need those answers before an incident supplies them.