Latvia Guards Its Gas Lifeline

Armed guards are now patrolling a hydroelectric dam upstream from Riga and the underground caverns at Inčukalns, where Latvia keeps its natural gas reserves. The government raised security at both sites after intelligence pointed to a possible Russian threat. Prime Minister Andris Kulbergs told Reuters he had asked NATO for more air-defence assets and for allied troops to be positioned closer to energy infrastructure (UNN, Devdiscourse).

There has been no attack. But Latvia’s response puts a practical question on the table for every European government, Malta included: when intelligence says a civilian energy site may be in danger, who takes command of its defence, who pays for it, and how quickly can military support reach a private operator?

A threat the Baltics take literally

NATO deters. The EU writes the rules. The daily protection of power stations, gas storage sites and cables remains with national governments and the companies that run them. Latvia has now treated that responsibility as an operational matter, putting guards on the ground and asking allies for reinforcement.

Lithuania has received similar warnings. President Gitanas Nausėda cited intelligence about possible Russian sabotage against infrastructure in the Baltics and Poland, although no public evidence identifies a specific target or date (Demócrata, Anews). Lithuania’s response combined bureaucracy with visible security: a government commission reviewed electricity resilience while the Public Security Service took over protection at several energy sites (Obzor). The defence minister added one important limit: there was no visible Russian troop build-up at the border. The concern is sabotage, or disruption that can be denied, rather than invasion.

Latvian intelligence has separately warned that Russia was preparing provocations meant to show that support for Ukraine carries a domestic cost (Fox News). Moscow has accused all three Baltic states of helping Ukraine strike Russian oil terminals. All three rejected the claims as disinformation (Euronews).

Denmark sent up to 170 troops to NATO’s brigade in Latvia at short notice (Berlingske). Danish soldiers strengthen NATO deterrence. They are not the ones standing guard at Latvian gas caverns.

Laws on paper, gaps on the ground

The EU already has a rulebook for this. Its Critical Entities Resilience Directive, known as CER, is the bloc’s physical-protection law. It requires member states to identify critical energy companies and impose duties on them: risk assessments, resilience planning and incident reporting (EUR-Lex). Denmark was due on 17 July to decide which companies qualify as “socially critical” under CER. Those companies then have ten months to prepare risk analyses and emergency plans (BT, KPMG). Ten months is a long time if the threat is already moving.

Germany shows the gap between having a law and having protection. Its version of NIS2, the EU’s cybersecurity directive, sets registration deadlines and fines. But smaller water and energy operators do not always have the capacity to comply, and information still moves slowly between authorities and the companies actually running the systems (BR).

For Malta, this should sound familiar. We are not managing Baltic gas caverns, but we do depend on a small number of critical links: the interconnector to Sicily, fuel logistics, water and electricity systems, ports, data infrastructure and the private operators around them. In a micro-state, the line between public responsibility and private operation is often thin. Everyone knows who owns what, but that does not automatically answer who commands what in a crisis.

Finland makes the distinction sharply. Where the chain of authority is clear, as with border closures, the state can act quickly (Finlex). Where infrastructure is privately owned, underwater or spread across several locations, the state coordinates while operators do the repairs. After a suspected anchor-drag cut the Balticconnector gas pipeline in 2023, repairs took months. A Nordic analysis of that incident found that common physical-protection standards and emergency-repair frameworks are still missing across the region (shattered.io).

NATO’s deputy secretary general told the European Parliament in July that responses to sabotage, cyberattacks or deniable disruption remain political choices, not automatic triggers for collective defence under Article 5, NATO’s pledge that an attack on one ally can be treated as an attack on all (NATO). The EU adopted its largest-ever cyber-sanctions package against Russia in the same month (Estonian MFA). Sanctions punish after the fact. They do not guard a dam.

Latvia has put guards in place, asked NATO for air defence and named the threat openly. Much of Europe’s critical energy infrastructure still sits behind compliance timetables. The real question is more concrete than any directive: who commands site defence when a warning arrives, who funds physical protection at privately owned facilities, and how quickly can military support reach a civilian operator under threat. Governments and operators need those answers before an incident supplies them.