Subsea sabotage should spark review of critical infrastructure security

In late December 2024, Finnish forces seized a Russia-linked ‘spy ship’ after it dragged its anchor across several subsea internet cables, damaging them. The incident follows the severing of two undersea cables in the Baltic Sea in mid-November 2024, which ignited alarm in European capitals, fearing sabotage. Germany, Sweden, and Finland all suspected that a vessel near the cables, the Chinese-flagged Yi Peng 3, was involved in the stoppages.

Troubling patterns

What is most worrying about this episode is that it fits an unsettling pattern of more frequent targeting of critical undersea infrastructure. This type of sabotage seems to have become an integral component of Russia’s hybrid warfare in the Baltic Sea and the High North. The most famous incidents are the Nord Stream 1 and 2 pipeline explosions in 2022. But they are not the only ones. The Balticconnector gas pipeline was ruptured in October 2023, and two data cables linking Finland and Estonia also stopped working in the same month. There have also been reports of undersea cables being severed near Svalbard, and Russian spy ships have allegedly surveyed wind farms in the North and Baltic Seas for vulnerabilities. In November 2024, first, the 1,172-kilometre cable that connects Finland to Central Europe via Germany, the ‘C-Lion1’, stopped working, then, a few hours later, a new cable connecting Sweden to Lithuania also stopped transmitting.  

The Yi Peng 3’s suspected involvement in the November cable damaging hints at troubling development: private Chinese assets being incorporated into the Russian state’s hybrid warfare. The Balticconnector incident also involved a Chinese-flagged vessel, the Hong Kong-registered Newnew Polar Bear.This might reflect an emerging loose partnership between Beijing and Moscow in carrying out subversive activities that blur the line between state and non-state action.

Critical infrastructure

The urgency of addressing the vulnerabilities of undersea cables cannot be overstated. They carry 95% of international communications and are the backbone of the modern digital revolution. Spanning 1.2 million kilometres across the world’s oceans, they are as critical to global connectivity as advancements in computing power and artificial intelligence. The ownership, operation, and manipulation of these cables can grant states geopolitical power by giving them access to trade and military secrets. This is why they have increasingly become targets in hybrid warfare, as evidenced by the recent cable disruptions in Europe. 

However, just as cybersecurity has evolved from the unrealistic goal of achieving zero attacks to focus on resilience instead, the cable industry must similarly abandon the myth of total security. To this end, a practical approach that emphasises redundancy, rapid recovery, and strategic deterrence is essential.

Protecting undersea cables

Policy and regulation will be central to any long-term solution. The European Union’s efforts to enhance cybersecurity, such as the Network and Information System 2 (NIS2) Directive and the Digital Operational Resilience Act (DORA), provide a model for securing undersea infrastructure. These frameworks mandate rigorous risk management, operational safety standards, incident reporting, and executive accountability, creating a standard that can be adapted to the specific challenges of cable security. 

The goal must be to harmonise undersea cable security amongst like-minded nations to minimise the risk of sabotage. Initiatives such as NATO’s Hybrid Space/Submarine Architecture Ensuring Infosec of Telecommunications (HEIST) and the joint naval patrol in the Baltic Sea, which was announced two weeks ago, are certainly an important step in the right direction. 

However, international law should also hold private shipping companies – and their executives – liable for negligence, given that apparently private vessels were involved in the recent sabotage incidents. The EU should sanction both individuals and entities for non-compliance with agreed procedures, processes, and regulations. Failure to comply must result in bans, financial penalties, and the suspension of licences to operate in certain geographies. In this way, aligning the cable industry with existing cyber resilience measures will bolster defences and ensure accountability across the sector.

International cooperation is equally important. Governments, private stakeholders, and regional bodies must come together to develop and, more importantly, enforce strategies for protecting these vital assets. Telecommunications giants, technology firms, and even insurers have a role in this effort. The underlying objective should be to develop a simple yet comprehensive framework for protecting cables. Such a framework would define and allocate responsibilities based on the stakeholders’ capabilities. It would also establish a clear coordination mechanism and a structure for exchanging best practices. In an ideal scenario, a binding international treaty would be the preferred option. However, the prospect for doing so is, and will likely remain, slim in today’s geopolitical climate, as evidenced by the lacklustre progress on establishing a global treaty on cyber warfare. 

Expanding the number of undersea cables is a logical next step. More infrastructure is needed to meet rising demand and ensure that disruptions can be swiftly addressed. As digital economies expand and technologies like cloud computing and the internet of things continue to grow, the volume and strategic value of global data cables are set to increase significantly. Global data traffic grows at a rate of roughly 20% annually, while global bandwidth doubles every 18 months, consistently pushing existing networks to their limits. 

Compounding this dynamic are rising geopolitical tensions and climate change. Both factors increase the likelihood of damage to undersea cables, necessitating access to alternative cable routes. Initiatives such as the EU-Japan collaboration on an Arctic cable project to connect Asia with Europe or Meta’s ‘around the world subsea cable’ exemplify the types of forward-thinking partnerships and projects required to enhance resilience in this area. These projects will bypass conflict-prone areas in their drive towards more redundancy and use the latest technologies to increase situational awareness around these cables. 

Creative uses of cutting-edge technology, such as remote sensing techniques, would also play a crucial role in securing undersea infrastructure. Distributed acoustic sensing (DAS) on subsea cables enables real-time monitoring by detecting acoustic, thermal, and vibration disturbances, significantly enhancing operators’ ability to identify anomalies and threats. This method is not risk-free. For instance, increased reliance on ‘smart’ cables would inevitably increase these networks’ vulnerabilities to cyberattacks and hacking. 

But, a more widespread deployment of advanced remote sensing systems along critical cable routes can go a long way in facilitating quicker responses to sabotage. The mere presence of these sensors, moreover, could act as a potential deterrent by eliminating would-be attackers’ anonymity. Currently, the lack of advanced warning and monitoring capabilities allows saboteurs to go undetected.

Strategic assets

The Baltic Sea incidents are a stark reminder that undersea cables are not merely technical hardware but strategic assets central to national security, economic stability, and global connectivity. As geopolitical tensions rise and hybrid threats become more frequent and sophisticated, resilience must become the guiding principle. Expanding infrastructure, leveraging technology, fostering collaboration, and enforcing robust regulations are no longer optional; they are imperative. In an era where insecurity is the new normal, the goal must shift from the illusion of invulnerability to the pursuit of uninterrupted operations and, thus, practical resilience.