This article has multiple issues. Please help improve it or discuss these issues on the talk page . (Learn how and when to remove these template messages)
|
Submarine internet cables, also referred to as submarine communications cables or submarine fiber optic cables, connect different locations and data centres to reliably exchange digital information at a high speed.
They are significant providers of internet connection globally: 99% of international communications go through submarine fibre optic cables, [1] as well as US$10 trillion of financial transactions every day. [2] The European Union (EU), in particular, has a strong need for connection, since 87% of EU citizens were internet users in 2021. [3]
In May 2023, the EU has direct connections with: [4]
The EU is also highly connected to the United Kingdom (UK), as 23 undersea cables connect the two. [4] In 2016, the EU lost a considerable number of connections because of Brexit, especially with North America. However, it does not represent a danger to EU connectivity, because there is a strong collaboration and the EU infrastructure remains able to do without the UK. [5]
In May 2023, the EU has 39 undersea cables that connect Member States exclusively. [4] 3 are being installed (Digital E4, Eastern Light Sweden-Finland II, Ionian). These cables mostly connect Island States (such as Malta) or States around the Baltic Sea.
The law ruling submarine internet cables is UNCLOS. The creation of the internet and of the physical infrastructure that underlies it only happened in 1986, after UNCLOS was signed, [6] but the research had been progressing in the 1970s, pushing the industry to give an interest in this framework's elaboration. Laying cables is part of the "freedom of the seas" (article 87). The location of submarine cables was considered a core element of negotiations. It established delimited areas such as the EEZ. [7] It is therefore authorized everywhere except in territorial waters, where Coastal states edict their own rules. It is assumed that this freedom also applies to maintaining and repairing cables. [6] However, States that would like to lay a cable must do it in consideration to other infrastructure that might be already installed. In addition, if it is in another State's EEZ, it must take into consideration the exclusive rights the coastal State possesses in this zone (economic resources, etc.) (article 79). [7]
Submarine internet cables are privately owned, mostly by telecommunications companies. [8] However, tech companies have started investing in the cable business as well (such as Meta and Google). Most cables are owned and managed by consortiums of companies. [8] In UNCLOS, owners are liable for damages that could happen to the cables (article 114). These regulations only apply to nationals. They must also be able to compensate ships and fishermen in cases where they would have damaged their fishing gear or anchor to avoid hurting submarine cables (article 115). [6] Finally, States have the obligation of making damages to submarine internet cables a punishable offence (article 113), except if it is unavoidable with lives or ships at stake. [6] With the growing discussions following climate change and environmental issue, submarine cables' sustainable protection ought to be a priority. Human actions on oceans are difficult to assess. [7] There are already measures taken such as data collection of ocean temperatures, ocean water pressure and its salinity. [9] However, there is no clear mandatory rule within the UNCLOS to enforce those actions. [7]
In the EU, the regulation of cyberspace and internet infrastructure was originally left to private companies themselves. Internet was thought of as a "free" place, which was reflected in the internet governance. The US were at its core. [10] This changed when large cyberattacks targeted European governments, Estonia in 2007 and Georgia in 2008, following disagreements with Russia. States – and the EU – started to get involved in regulating the internet. Indeed, with five of its Member States (France, Denmark, Italy, Portugal and Spain) as the core contributors to the continent connectiveness to the world, the EU comprehended its importance. [11] It is only recently that the interest to submarine internet cables came to be considered a strategic and geopolitical stake. The Russo-Ukrainian War, and especially the Nord Stream attack, massively boosted the interest given to internet and energy infrastructure.
Despite this turnover in attention, the EU has not been actively setting the protection of submarine cables as a top priority. Maritime security authorities give priority to other issues such as piracy, people smuggling, and environmental protection. [12] Fishery, which represents, in certain EU countries such as Spain, Italy and Greece, up to 62% of employment, [13] is closely linked to submarine cables protection. However, it has been often deemed an irrelevant issue to fishery organizations. [5]
Most generally, the task of cables' care falls in the jurisdiction of national governments. In its 2023 report, the European Union Agency for Cybersecurity (ENISA) describes the different regulatory regimes present in the EU:
Internet cables were not considered a European critical infrastructure in the 2008 European Programme for Critical Infrastructure Protection. [16] The 2013 update however underlines that new technologies have developed and that cyberspace should start being taken into account. [17] Today, submarine internet cables are considered a critical infrastructure by the European Union, as part of the category "information and communication systems". [18]
Submarine internet cables are subject to threats and damages of different kinds, to which the EU is more or less vulnerable. Three categories can be distinguished: natural causes, unintentional human causes and intentional human causes.
The first kind of damages to internet cables are natural hazards. Overall, they account for less than 10% of all submarine internet cables damages. [19] Natural hazards comprise:
Climate change could constitute a new threat to undersea cables. It is characterised by its uncertainty – scenarios are only assumptions –, and its uneven consequences across the world. First, climate change creates more frequent and more intense storms and hurricanes. [24] These, as well as changes in precipitations, could make the seabed more unstable, which would influence currents and sediments movements. Cables would then be more vulnerable to erosion. [19] However, buried cables would be less or not impacted, if they are buried deep. Second, global warming increases seismic activities, [25] so the EU and its network could become more vulnerable to earthquakes and tsunamis. Last, cable landing stations are also threatened by climate change. Rising sea level will expose them (as well as a part of onshore cables) to floods, while hurricanes could increase power outages. [26] Northwest Europe is among the most exposed landing location to storm surges. However, the EU coastline is one of the least exposed to sea level rise, with sea level at landing stations even projected to lower by 2052. [27]
The biggest cause of submarine internet cables damage is fishing, which accounts for 44.6% of cable faults over 1959–2006. [21] The EU represents 3% of the fisheries and aquaculture production of the world and ranks as its fifth largest one. [28] The most widely used method of fishing, which is also the most damaging to submarine cables, is bottom trawling. It is extremely intense in the English Channel, the Strait of Dover, and the Skagerrak. [29] When the fishing gear is on the sea bottom, it can move the cable or get stuck underneath, eventually breaking it or damaging the waterproof protection and causing court-circuits. [30] This situation is also prejudicial to the fishermen, as such a collision often means loss of fish, time, and damage on their fishing gear. [31] Another damage caused by ships is anchoring, which was responsible for 14.6% of cable damages over 1959–2006. [21] This happens when ships drop anchor right on a cable. Overall, these damages happen in areas where the EU has a really high linkage, so data can easily be circumvented through another route.
Undersea cables are also vulnerable to targeted attacks conducted by humans. Three categories can be distinguished: blue crime, terrorism, and state-sponsored attacks.
Blue crime refers to “serious organised crimes or offences that take place transnationally, on, in or across the maritime domain and cause or have the potential to inflict significant harm”. [32] It is close to the notion of transnational organised crimes at sea. The only aim of blue crime is monetary profit. One form of criminal activity against submarine cables is cable theft. An example is the cable between Singapore and Indonesia, which was partly robbed in 2013: 31,7 km and 418 tons of cables were removed. [33] Another scenario is a criminal group threatening to harm cables if no ransom is received. Last, cables could be damaged to cover an unrelated criminal attack, as it would diminish surveillance capacities. [34]
Terrorism is close to blue crime, except that its aim is political and not monetary. For now, no terrorist attack against submarine cables have been recorded. [35] Attacks could consist in targeting landing stations, [34] or dragging an anchor on the seabed in an area of high cable density. [35] However, the probability of a blackout in the EU or in one of its Member States is low, as it would require precision and coordination. Besides, terrorists themselves rely on internet cables to communicate, and to spread terror to the public, [34] so it is not in their interest to damage the whole network. Risks are higher for remote islands with less connectivity, such as EU Member States’ naval bases abroad (like in Djibouti), EU Islands, or Member States’ oversea territories (like La Réunion, which possesses 3 submarine cables [4] ).
To date, no attack on submarine internet cables has been attributed to a State. However, the attack of the gas pipeline Nord Stream II in 2022, presumably State-sponsored, underlines that this kind of sabotage is possible. Overall, the shadow of these attacks is part of hybrid threats. The EU defines them as: “when actors seek to exploit the vulnerabilities of the EU to their own advantage by using a mixture of measures (i.e. diplomatic, military, economic, technological) while remaining below the threshold of formal warfare". [36] The greatest fear is hence that submarine internet cables vandalism might be used as part of a coordinate attack targeting other key infrastructures, like cyberspace. Despite Sweden and Denmark's lack of finding a culprit, Russia is often thought to have been involved in the Nords Stream sabotage due to the tensions with the EU and the presence of Russian ships around it days prior. [37] Russia has previously been associated with strategies such as the spread of fake news, [38] the sponsor of cyberattacks, [39] and navigation close to key EU infrastructures. [40] For example, in February 2022, Russia did a military exercise at the border of Ireland's EEZ, near undersea internet cables. An Irish officer notes "the intention is not to cut the cables but to send a message [to NATO] that they can cut them anytime they want". [34] However, the principle of hybrid threats is that attacks, when they happen, are non-attributable.
Another concern is China's ubiquity in the submarine internet cables network. 100 out of 400 global internet cables are managed or have been built by HMN Technologies, which also possesses 10% of market shares. [34] This gives China power over the current and upcoming infrastructure, but also gives it a potential for data interception. [41]
The EU lets the cables and fishery industries regulate themselves. It is about "talking to each other to raise awareness" or "changing the design of fishing gear". [31] However, the EU facilitates dialogue through its European Maritime Spatial Planning (MSP) platform. It is also thinking about pushing for cable routes/corridors, or developing no-anchor/no-trawl zones. [30] It could also require cables to cross shipping lanes by the shortest route possible, and/or to be buried. [31]
EU protection measures especially target intentional damage, particularly state-sponsored hybrid threats. There is however no piece of legislation from the EU that only deals with submarine internet cables.
Cables are the competency of Member States. [14] However, monitoring cables is very challenging and requires significant resources. States therefore seek for a "Union-wide coordinated approach to strengthen the resilience of critical infrastructure". [42] The EU complements their action, by upgrading risk assessments and responses. [14]
The EU has a European Programme for Critical Infrastructure Protection (EPCIP), which was last updated in 2013. Additional measures for Critical Infrastructure protection were on the EU Commission’s agenda in 2020. [43] Today, the EPCIP is complemented by other legal frameworks. Submarine internet cables protection is dealt with in the European Union Maritime Security Strategy (EUMSS). [44] The 2018 EUMSS already sought to enhance the critical infrastructures’ resilience, via risk assessment and management, and education and training. [45] The 2023 update implements common military exercises among voluntary Member States, to better address hybrid threats, both at sea and on land. The goal is to improve "both the physical and cyber resilience of critical entities and infrastructures". [46] The link between undersea cables and cyberspace is now more widely recognized. Internet cables are also mentioned in the NIS 2 directive, which deals with EU cybersecurity. It expects each State to issue a national cybersecurity strategy (which includes cable protection), and report issues to the European level. [47] In addition, by January 17, 2026, Member States should have drawn a list of critical entities for each recognized sector, and build up a national strategy for critical infrastructure protection. [48]
The EU also wants to enhance cooperation with its allies, particularly the US and NATO, in terms of information exchange and surveillance. The European Centre of Excellence for Countering Hybrid Threats is one of their knowledge-building collaboration measures, in the area of hybrid threats. An EU-NATO Task Force was also created in March 2023 to work on critical infrastructure resilience (energy, transports, digital infrastructure, and space). [49] However, “technological sovereignty” is one of EU Commission President Ursula von der Leyen’s top priorities for her mandate (2019–2024). [10] The EU will aim at being ore independent from its allies such as the USA. The 2013 leak of pieces of US intelligence revealed that the USA were spying on their allies, while at that time 80–85% of data traffic between the EU and Latin America was going through North America. [50] Brazil and the EU created EllaLink because of this event.
Recently, debates have risen regarding access to communication. Arguments state that the world has become too connected and dependent on internet to avoid needing it. Internet is important for emergency issues, to be able to communicate if something happens. [51] It is compared to other rights under the United Nations Declaration of Human Rights such as freedom of speech and, most importantly, the right to health and to communicate emergencies. [51] Protection of cables are, then, not just a duty to protect access to internet but one to protect Human Rights. [51] With 8% of the population with no access to internet in 2021, the rapid development of internet is an act to protect those rights. [52]
The GIUK gap is an area in the northern Atlantic Ocean that forms a naval choke point. Its name is an acronym for Greenland, Iceland, and the United Kingdom, the gap being the two stretches of open ocean among these three landmasses. It separates the Norwegian Sea and the North Sea from the open Atlantic Ocean. The term is typically used in relation to military topics. The area has for some nations been considered strategically important since the beginning of the 20th century.
Critical infrastructure, or critical national infrastructure (CNI) in the UK, describes infrastructure considered essential by governments for the functioning of a society and economy and deserving of special protection for national security. Critical infrastructure has traditionally been viewed as under the scope of government due to its strategic importance, yet there's an observable trend towards its privatization, raising discussions about how the private sector can contribute to these essential services.
SAT-3/WASC or South Atlantic 3/West Africa Submarine Cable is a submarine communications cable linking Portugal and Spain to South Africa, with connections to several West African countries along the route.
A cybersecurity regulation comprises directives that safeguard information technology and computer systems with the purpose of forcing companies and organizations to protect their systems and information from cyberattacks like viruses, worms, Trojan horses, phishing, denial of service (DOS) attacks, unauthorized access and control system attacks. While cybersecurity regulations aim to minimize cyber risks and enhance protection, the uncertainty arising from frequent changes or new regulations can significantly impact organizational response strategies.
Maritime security is an umbrella term informed to classify issues in the maritime domain that are often related to national security, marine environment, economic development, and human security. This includes the world's oceans but also regional seas, territorial waters, rivers and ports, where seas act as a “stage for geopolitical power projection, interstate warfare or militarized disputes, as a source of specific threats such as piracy, or as a connector between states that enables various phenomena from colonialism to globalization”. The theoretical concept of maritime security has evolved from a narrow perspective of national naval power projection towards a buzzword that incorporates many interconnected sub-fields. The definition of the term maritime security varies and while no internationally agreed definition exists, the term has often been used to describe both existing, and new regional and international challenges to the maritime domain. The buzzword character enables international actors to discuss these new challenges without the need to define every potentially contested aspect of it. Maritime security is of increasing concern to the global shipping industry, where there are a wide range of security threats and challenges. Some of the practical issues clustered under the term of maritime security include crimes such as piracy, armed robbery at sea, trafficking of people and illicit goods, illegal fishing or marine pollution. War, warlike activity, maritime terrorism and interstate rivalry are also maritime security concerns.
Being part of the Kingdom of Denmark, the foreign relations of Faroe Islands are handled in cooperation with the Danish government and Government of Faroe Islands.
HSPD-7 was revoked by the Presidential Policy Directive 21 (PPD-21) on Critical Infrastructure, Security and Resilience on February 12, 2013. PPD-21 states that "Plans developed pursuant to HSPD-7 shall remain in effect until specifically revoked or superseded." Multiple changes came out of PPD-21, including a six actions with specific deadlines. One of those actions was to update the National Infrastructure Protection Plan within 240 days.
Arctic cooperation and politics are partially coordinated via the Arctic Council, composed of the eight Arctic states: the United States, Canada, Iceland, Norway, Sweden, Finland, Russia, and Denmark with Greenland and the Faroe Islands. The dominant governmental power in Arctic policy resides within the executive offices, legislative bodies, and implementing agencies of the eight Arctic countries, and to a lesser extent other countries, such as United Kingdom, Germany, European Union and China. NGOs and academia play a large part in Arctic policy. Also important are intergovernmental bodies such as the United Nations and NATO.
Maritime domain awareness (MDA) is defined by the International Maritime Organization as the effective understanding of anything associated with the maritime domain that could impact the security, safety, economy, or environment. MDA is said to work as a ‘key enabler’ for other maritime security issues, such as anti-piracy patrols, in the way that in order to do effective patrols you need to have the ability of conducting effective MDA. The maritime domain is defined as all areas and things of, on, under, relating to, adjacent to, or bordering on a sea, ocean, or other navigable waterway, including all maritime-related activities, infrastructure, people, cargo, and vessels and other conveyances.
The Arctic Policy of the Kingdom of Denmark defines the Kingdom's foreign relations and policies with other Arctic countries, and the Kingdom's strategy for the Arctic on issues occurring within the geographic boundaries of "the Arctic" or related to the Arctic or its peoples. In order to clearly understand the Danish geopolitical importance of the Arctic, it is necessary to mention Denmark's territorial claims in areas beyond its exclusive EEZ in areas around the Faroe Islands and north of Greenland covering parts of the North Pole, which is also claimed by Russia.
An Information Sharing and Analysis Center(ISAC) is an organization that provides a central resource for gathering information on cyber and related threats to critical infrastructure and providing two-way sharing of information between the private and public sectors.
Offshore installation security is the protection of maritime installations from intentional harm. As part of general maritime security, offshore installation security is defined as the installation's ability to combat unauthorized acts designed to cause intentional harm to the installation. The security of offshore installations is vital as not only may a threat result in personal, economic, and financial losses, but it also concerns the strategic aspects of the petroleum market and geopolitics.
The European Union Maritime Security Strategy is a maritime security strategy of the European Union. It was unanimously adopted by EU member states in June 2014. The EUMSS provides a framework for the EU's actions within maritime security in order to promote broader and more coherent approaches to identified maritime security challenges. Maritime security strategies have been adopted by a number of countries like France, India, United Kingdom and United States of America. Such strategies are used to organise a country or region's actions within maritime security by identifying maritime security challenges and relevant actors.
Operation Sea Guardian was launched as a maritime security operation by the North Atlantic Treaty Organization (NATO) during the Warsaw Summit in July 2016, aiming to expand NATO's role within the Mediterranean Sea.
Seabed warfare is undersea warfare which takes place on or in relation to the seabed.
The European Union is one of the main anti-piracy actors in the Gulf of Guinea (GoG). At any one time, the EU has on average 30 owned or flagged vessels in the region. The piracy in the Gulf of Guinea is therefore a threat towards the EU, and as a response the organization adopted its strategy on the Gulf of Guinea in March 2014. The Strategy on the Gulf of Guinea is a 12-page document with the scope of the problem, what have previously been done, responses and the way forward with four strategic objectives. The EU's overriding objective are:
The Global Commission on the Stability of Cyberspace was a multistakeholder Internet governance organization, dedicated to the creation of diplomatic norms of governmental non-aggression in cyberspace. It operated for three years, from 2017 through 2019, and produced the diplomatic norm for which it was chartered and seven others.
The Multi-Role Ocean Surveillance Ship (MROSS) is a type of research and surveillance ship in development since 2021 for the United Kingdom's Royal Fleet Auxiliary. The first ship, RFA Proteus, is a commercial ship converted to the role which entered service in October 2023. The second ship is planned, potentially as a new build vessel. Both ships are to be used by the RFA to research and protect critical undersea national infrastructure, such as undersea cables and gas pipelines, in both British and international waters.
Gregory Falco is an American inventor and researcher. Falco is a professor at Cornell University. He is a pioneer in the field of cybersecurity research and its aerospace applications. Falco is the founding chair of IEEE's Standard for Space System Cybersecurity and the NATO Country Project Director for the NATO Science for Peace and Security effort to reroute the internet to space.