1st Report - Subsea telecommunications cables: resilience and crisis preparedness

The UK’s strategic reliance on subsea cables will likely continue for the foreseeable future. The cable industry provides a commendable and commercially efficient repair service, which ensures good resilience against moderate damage. We do not believe there is an imminent threat to the UK’s national connectivity. (Conclusion, Paragraph 14) Threat picture

The Government’s resilience assessments must take greater account of the worsening security environment over the next 5–10 years. The National Security Strategy and Strategic Defence Review set out serious preparations for future crises. However, the Minister for Data Protection and Telecoms suggested that exploring the risks of a co-ordinated attack on subsea infrastructure was unhelpfully “apocalyptic”. We disagree. Focusing on fishing accidents and low-level sabotage is no longer good enough. The UK faces a strategic vulnerability in the event of hostilities. Publicly signalling tougher defensive preparations is vital, and may reduce the likelihood of adversaries mounting a sabotage effort in the first place. (Conclusion, Paragraph 37)

We also found sceptical views in some parts of the cable industry about the risks of co-ordinated attacks. We agree that resilience across the sector is generally robust, major disruption is unlikely, and hype is unhelpful. But we caution against adopting ‘business as usual’ industry views to determine national security risk: individual operators have few financial incentives to prepare for a crisis that may never come. The Government, by contrast, has a duty to prepare competently for low-likelihood, high-risk scenarios. The lessons of 9/11, the financial crash, Covid-19 pandemic and the war in Ukraine are reminders that such events do happen. (Conclusion, Paragraph 38) 62

The Government should update its public and private risk scenarios to cover extensive co-ordinated sabotage to subsea and terrestrial internet infrastructure, including onward connections to Europe. (Recommendation, Paragraph 39) System vulnerabilities

Many cable landing stations are vulnerable to attack. The Government and operators must take the risk of state-backed sabotage seriously, including against targets in Europe. (Conclusion, Paragraph 47)

The National Protective Security Authority (NPSA) and National Cyber Security Centre should require all UK landing stations to be target-hardened to sufficient levels to deter state-backed sabotage. They should require landing station operators to develop within 12 months an emergency ‘good enough’ repair plan to recover from co-ordinated attacks. The NPSA should also conduct a similar exercise with European counterparts for relevant landing stations on the continent. (Recommendation, Paragraph 48)

To help mitigate risks around the clustering of high value targets, the Government should encourage subsea cable providers to connect to landing stations, terrestrial routes and data centres outside high-concentration points. (Recommendation, Paragraph 49)

The Government’s resilience concept focuses too much on ‘having lots of cables’. This pays insufficient attention to the network’s actual capacity to absorb shocks and does not account for onshore vulnerabilities and long-term trends towards a more brittle system. There is also limited understanding of much damage the system can sustain before data stops rerouting properly, triggering temporary systemic connectivity failure. This does not appear to feature as a serious consideration in the Government’s contingency planning. (Conclusion, Paragraph 62)

The Government’s resilience plans should focus in more detail on the level of immediately available capacity in the cable system during a security crisis. The Department for Science, Innovation and Technology should request operators to provide regular updates on the scale and type of data each cable carries, short notice rerouting capacity and their ability to prioritise critical services. It should further develop detailed contingency plans for rerouting data through the Channel Tunnel, including in scenarios where high-concentration terrestrial routes are temporarily disabled. (Recommendation, Paragraph 63) 63 Repair vulnerabilities

The UK needs more confidence in access to cable repair vessels: the current fleet is ageing, and erstwhile UK businesses have been acquired by foreign entities. (Conclusion, Paragraph 71)

The Government should acquire a genuinely sovereign cable repair ship by 2030. This could be leased to industry on favourable terms during peacetime and made available for Government use in a crisis. The Government should set out a timetable for this in response to this Report. (Recommendation, Paragraph 72)

The Royal Navy should establish a cadre of reservists and serving personnel to learn cable repair skills on commercial repair vessels. These could be called on in periods of heightened tension. (Recommendation, Paragraph 75) Moderate and catastrophic impacts

The UK has particular vulnerabilities around outlying islands, the financial sector and military communications cables. These should be a key focus for contingency planning. (Conclusion, Paragraph 81)

The impacts of catastrophic disruption from a co-ordinated attack remain speculative, but are almost certainly highly damaging. We estimate they would include payment and supply chain failures, some degraded communications, overstretched emergency responses, and unexpected cascading issues—all at a time of crisis. We are not convinced there are currently adequate sector-by-sector assessments of reliance on subsea cables, or sufficiently detailed plans for handling cascading consequences if data rerouting stops working properly. We are pleased the Government is starting to address this, with a particular focus on the finance sector. (Conclusion, Paragraph 98)

The Department for Science, Innovation and Technology should ensure all lead departments have detailed sector-by-sector technical impact studies on areas most likely to be affected and response plans—notably finance, maritime and air traffic, communications, defence and supply chains including food and fuel. We suggest such assessments are handled securely given their value to hostile actors. We note that some cascading impacts may not be immediately obvious—it may therefore be helpful to begin with an underpinning assessment of internet failure modes and how this would affect critical systems. The Cabinet Office resilience teams could usefully help to co-ordinate and audit these assessments. (Recommendation, Paragraph 99) 64

Emergency services should ensure their business continuity plans highlight any areas of critical reliance on foreign internet servers, and account for temporary internet disruption in the event of a security crisis. (Recommendation, Paragraph 100) Legal Responses

The legal provisions for responding to malicious cable damage are weak. It is encouraging that the Government has identified the forthcoming Defence Readiness Bill as a potential legislative vehicle to implement changes. We would like to emphasise the urgency of making progress internationally too: legal developments can be slow, and the matter is pressing. The UK should use its strong credentials in order play a leading international role on this topic. (Conclusion, Paragraph 113)

The Government’s review of legislation must pay particular attention to strong deterrents, such as major fines and criminal liability, that can be applied to private actors suspected of working for or on behalf of foreign states. (Recommendation, Paragraph 114)

The Government should explore new options for taking a more robust approach to interdicting suspicious vessels—for example applying piracy provisions to cables that land in the UK or seeking a limited extension of domestic criminal law jurisdiction. It should commission a legal opinion on options and risks, and publish this within six months for consultation with industry and international partners. The Government should, however, remain cautious about the risks of reciprocal action from adversaries and we do not endorse any particular option at this stage. (Recommendation, Paragraph 115)

The Foreign, Commonwealth and Development Office and the Department for Business and Trade should apply diplomatic and economic pressure to press for adequate investigations from flag states and states where vessels suspected of cable damage enter port. The Government should also work with partners, particularly the International Maritime Organization, to make greater use of port state controls as a deterrent—for example by expanding mechanisms to share data on vessels’ behaviour at sea and ensuring these are then thoroughly integrated into port inspections. (Recommendation, Paragraph 123) 65 Military and monitoring responses

The Government should support the subsea cable industry in rolling out more extensive cable monitoring technology and should explore incentives to encourage such investment. This could include Government commitments to make better use of existing measures and data—for example more proactive identification and investigation of vessels switching off Automatic Identification Systems. We also encourage industry to engage closely with the Ministry of Defence to ensure underwater monitoring does not unduly compromise defence activity. (Recommendation, Paragraph 135)

The UK’s military deterrence concepts are too timid. They need to place greater emphasis on prevention and punitive consequences that go beyond private or public attribution. Otherwise, aggressors that are content with ‘implausible deniability’ can cause damage with minimal risk to themselves. The Government should work with NATO to ensure that monitoring schemes are designed to enable speedy data sharing with law enforcement authorities—which in turn should support timely investigations, and more direct physical interdiction and prosecution where needed. (Recommendation, Paragraph 141)

In a heightened threat scenario, we are uncertain about the Royal Navy’s ability to protect vulnerable cable regions and escort repair ships without undermining commitments to other NATO tasks. We admire the Minister for Armed Forces’ optimism that the problem can be solved with Atlantic Bastion’s future set of autonomous vessels and monitoring systems. We think there are still quite a few questions to address. (Conclusion, Paragraph 146)

The Ministry of Defence should work with international partners to ensure there are viable plans to escort cable ships without degrading wider NATO taskings. This plan could usefully include heightened surveillance of suspicious vessel activity, rules of engagement enabling a low threshold for physical interdiction of civilian and autonomous vessels, and input from industry. The Royal Navy should also practice live escorting exercises with cable repair ships to build confidence about their deployment in a security crisis. (Recommendation, Paragraph 147) 66 Governance and planning

We commend the Government’s efforts to improve co-ordination, particularly the establishment of the Subsea Infrastructure Response Group and Subsea Communications Cables Industry Group. We accept that changing governance structures for the sake of it is not helpful. Equally, however, there is evidence that improvements to oversight and co- ordination would benefit day-to-day work and crisis response. (Conclusion, Paragraph 162)

The Government should seek to provide a joined-up subsea cables function providing a centralised point of contact for industry and international partners. This body should co-ordinate, not duplicate, cross-government work—bringing together departments and agencies covering subsea infrastructure operations, policy, security, resilience and contingency planning. In the first instance this could involve upgrading the Subsea Infrastructure Response Group into a formal, standing co-ordination and oversight body, reporting into an inter-ministerial group jointly led by the Department for Science, Innovation and Technology and the Ministry of Defence. (Recommendation, Paragraph 163)

We support the Crown Estate’s ambitions to improve long-term spatial planning via the Marine Delivery Route Map. We urge those involved to ensure that plans prioritise a diversity of cable routes to avoid creating areas of concentrated targets. (Conclusion, Paragraph 168)

The Government should further explore cable protection zones for critical areas of cable concentration, policed by early warning indicators and heightened monitoring and response capabilities. This would require close co-operation with European partners, given the need to manage other maritime activities proportionately. (Recommendation, Paragraph 169) 67