The study applies state protection measures for submarine cables to a resilience model. This model helps states and operators determine how prepared they are for disruptions to their submarine cables. The model helps identify weak points systematically and take targeted protective measures.

Submarine cables transmit nearly 99 percent of global data traffic between continents, and fast, reliable internet connections depend on them. These cables are frequently damaged by fishing nets or ship anchors, but also by deliberate acts of sabotage, as was suspected in recent cases in the Baltic Sea. To better protect these cables, more countries are classifying them as critical infrastructure (KRITIS). The UNIDIR study, “Achieving Depth: Subsea Telecommunications Cables as Critical Infrastructure,” shows how states can classify submarine cables as KRITIS and what this classification means in practice. The study was written by doctoral student Jonas Franken, among others. Franken conducts research at the Research Group Science and Technology for Peace and Security (PEASEC) at TU Darmstadt and at the National Research Center for Applied Cybersecurity ATHENE.

There are three categories for submarine cable protection.

For the study, specific protection measures from different countries around the world were collected, and a resilience model was developed based on these measures. This model divides the measures into three categories. The first category is absorptive capacity, or how well the protection system prevents damage. Australia, for instance, has a preventive approval system for laying submarine cables. Cables are only permitted to land in designated protected areas, significantly reducing risks associated with fishing and shipping activities. France has a central cybersecurity office that monitors critical infrastructure, including submarine cables, and coordinates with the military.

The second category is restorative capacity, or how quickly and effectively a submarine cable can be repaired after being destroyed. Several submarine cables were destroyed in Japan after the severe earthquake that led to a tsunami in Fukushima in 2011. Thanks to regional coordination of cable ships and agreements with international companies, the damage was repaired quickly. Another example is Singapore, which has laid many redundant cables. If one fails, data traffic automatically reroutes via other cables.

The third category comprises adaptive capacities, or how quickly one learns from incidents and implements new rules or technologies for better protection. The study cites the EU as an example, noting that it adapted its strategies after several incidents, including those in the Baltic Sea. The EU then introduced the NIS2 Directive, a cyber resilience law, as well as joint risk analyses. New platforms for coordination between countries and operators of submarine cable infrastructure are also emerging. Since Brexit, for example, the United Kingdom has been developing its own cable protection guidelines and promoting new technologies, such as deep-sea sensors, to detect attacks or incidents as early as possible.

Systematically strengthening submarine cables

The aim of this systematic approach is to make submarine cable infrastructures safer and more robust internationally against failures. The model helps states and operators identify weak points and implement additional measures. Therefore, the study represents an important step towards a comprehensive “Cable Security Toolbox,” as called for by the European Union and others. The study also contains general recommendations on how to make submarine cables more secure.