UK “too timid” in defending vulnerable Internet cables from attack

The document argues for “more muscular deterrence” measures, with punitive consequences for malicious damage. Recommendations include scaling up monitoring schemes, speedier data sharing with law enforcement, legal sanctions and a greater focus on “direct physical interdiction and prosecution” of suspicious vessels and crew.

Further, the Committee suggests that “an assertive approach might yield some success” (while also highlighting the risk of retaliation).   

The Committee concludes that the cable industry offers “commendable” resilience against moderate damage and there is “no imminent threat to the UK’s national connectivity”. However, it also cautions against adopting industry’s business-as-usual views to determine risks to national security. It notes the challenge that Russian aggression can escalate much faster than UK resilience measures could be upgraded: “we can no longer rule out the possibility of UK infrastructure being targeted in a crisis. We are also not confident that the UK could prevent such attacks or recover within an acceptable time period.”

Vital infrastructure

Undersea cables are a hidden, but vital element of the global Internet infrastructure. Around 570 cables, usually run by private companies, carry 95%-99% of the world’s intercontinental telecommunications data. There has been growing concern about malicious reconnaissance and sabotage, including a recent incident involving the Russian spy ship Yantar loitering over UK subsea infrastructure.  

The UK is a global hub for Internet traffic, and almost entirely reliant on subsea cables to transmit its data to the outside world. A small number of high-capacity cables are expected to carry a growing proportion of Internet data, driven by large technology firms seeking supply routes for their services. The report goes on to highlight concerns that these trends are creating a small set of high-value targets.

There are particular vulnerabilities around the UK’s outlying islands, military cables and the financial sector. While sabotaging these links may not cause national disruption, it would be “costly, provocative and hard to prevent”. The Committee estimates the impacts of more extensive attacks would cause catastrophic disruption, including failures in payment systems and supply chains, degraded communications, overstretched emergency responses and unexpected cascading issues as online authentication applications are disrupted.

The report calls for more robust resilience plans, particularly so in the financial sector, and updated contingency planning scenarios to account for damage to onshore landing stations.

The Committee also recommends that the Government acquires a cable repair ship by 2030 to address the lack of genuinely sovereign repair capacity. This vessel would be leased to industry during peace time, but made available to Government in a crisis.

Further, the report calls on the Royal Navy to establish a cadre of reservists and serving personnel who would learn cable repair skills to ensure that cables could be repaired in a conflict scenario.

Invisible backbone 

Matt Western, chair of the Joint Committee on the National Security Strategy, said: “Undersea cables are the invisible backbone of the Internet. Everything from everyday WhatsApp messages to financial transactions worth billions are carried through this network. As such, the scale of the UK’s strategic reliance needs to be taken more seriously.”  

Western continued: “While our national connectivity doesn’t face immediate danger, we must prepare for the possibility that our cables can be threatened in the event of a security crisis. Putin has shown every sign of wanting to test the soft underbelly of the NATO alliance. Our cables are sufficiently vulnerable to make them a target.”

According to Western: “Competent and farsighted preparation is essential. The past 25 years show that unlikely events can happen with surprising speed and frequency. Unintended escalation is a particular concern given events in Ukraine.”

Western concluded: “The Government must raise its gaze. Focusing on fishing accidents and low-level incidents is no longer good enough. We need stronger physical protections, better options to impose genuine costs for malicious activity and more comprehensive recovery plans. It’s conceivable that the UK’s national resilience will be tested in the coming years. We need to be ready.”