Protecting critical undersea infrastructure under hybrid threats: A public-source governance framework for surveillance, attribution, redundancy, and continuity in the Nordic–Baltic region

Critical undersea infrastructure links digital communication, energy supply, economic activity, military mobility, and alliance coordination. Under hybrid-threat conditions, disruptions create not only physical damage but also uncertainty over cause, responsibility, and appropriate response. This study examines how public-source evidence can be used to compare security and defence governance for protecting undersea infrastructure. A structured corpus of forty-three public sources on the Nordic–Baltic region and connected European Union/North Atlantic Treaty Organization (EU/NATO) policy spaces was converted into 101 coded documentary governance observations and twelve contextual incidents or policy milestones. Coding distinguished surveillance, attribution, redundancy, and continuity of service while recording broader governance categories, actor type, scope, coordination interfaces and uncertainty. Descriptive frequencies, cross-tabulations, heatmaps, and a temporal comparison were produced through a reproducible Python workflow. Publicsource visibility is uneven. Resilience planning, a cross-cutting mechanism, surveillance, and international coordination are documented more frequently than attribution and redundancy. Government, NATO, and EU actors dominate the public record; private operators and military organisations appear more selectively as primary actors. The Baltic Sea is the most visible subspace, and more than half the observations contain partial, verification-required, or disputed information. The four-function framework shows that undersea infrastructure protection is a layered security and defence governance problem rather than a purely technical or naval task. Public evidence can reveal institutional posture, coordination, and continuity priorities without disclosing operationally sensitive details. The framework is intended for comparative application elsewhere, but findings concern the Nordic–Baltic case.