A labyrinth of more than 1.3 million kilometers of fiber-optic cables anchored to the sea floor carries about 95% of telephone and internet communications around the world every day, moving massive amounts of data every second. Everything from financial transactions to military orders passes along this underwater web of more than 475 cables.
The security implications of this critical infrastructure are clear: Whoever controls the lines possesses significant power. As data has become an increasingly important strategic asset, the security risks could be substantial under certain circumstances, experts said. Although shipping and fishing operations cause most of the damage to the cables and natural events such as earthquakes, cyclones and even shark bites can interfere with operations, the prospect of intentional, malicious damage looms large, as the amount of data traversing the transoceanic cables continues to grow and reliance on cloud storage increases.
“Regarding physical challenges, the two primary concerns are that the cables might be destroyed or tapped — by either a non-state actor, as per some recent isolated incidents of piracy, or, more likely, by a state adversary like Russia,” according to Pierre Morcos, a visiting fellow with the Europe, Russia and Eurasia Program at the Center for Strategic and International Studies (CSIS) in Washington, D.C., and Colin Wall, a research associate with the same program. “There are several conceivable objectives severing a cable might achieve: cutting off military or government communications in the early stages of a conflict, eliminating internet access for a targeted population, sabotaging an economic competitor, or causing economic disruption for geopolitical purposes. Actors could also pursue several or all of these objectives simultaneously,” Morcos and Wall contend in a June 2021 article published on the CSIS website, titled “Invisible and Vital: Undersea Cables and Transatlantic Security.”
Governments, companies or organizations could also tamper with cables in more insidious ways such as exfiltrating data via backdoors inserted during the manufacturing process, stealing data from onshore facilities that connect to the undersea cables or perhaps even harvesting data at depth, Dr. Amanda Watson, a research fellow at the Australian National University, told FORUM. There is also a “general cybersecurity risk increase because you might have citizens, businesses or utilities that could be victims of cybercrime, cyberattacks, ransomware or theft of data,” said Watson, who has studied the telecommunications industry and mapped cable deployment in the Pacific islands region for more than a decade.
“The security and resilience of undersea cables and the data and services that move across them are an often understudied and underappreciated element of modern internet geopolitics,” according to a September 2021 report from the Atlantic Council, an international economic and political think tank. “The construction of new submarine cables is a key part of the constantly changing physical topology of the internet worldwide,” said the report, titled “Cyber Defense Across the Ocean Floor: The Geopolitics of Submarine Cable Security.”
Authoritarian governments, such as the People’s Republic of China (PRC), could exert control over state-run companies to route the global data to their advantage, for example, for espionage purposes, asserts report author Justin Sherman, a fellow at the council’s Cyber Statecraft Initiative. In addition to ongoing concerns about China’s largest undersea cable supplier, HMN Technologies, which until recently was called Huawei Marine, several Chinese-incorporated firms that are listed as owners of undersea cables, including China Mobile, China Telecom and China Unicom, are all state-owned, Sherman wrote. “Changes to traffic routing patterns generate profits for companies and can move new volumes of traffic through different countries’ borders. This can enable data interception and the development of technological dependence.”
Moreover, companies that manage undersea cables have introduced operational risk through network management systems to centralize control over components, according to the report. “When these cable management tools are connected to the global internet, they expose undersea cables to new risks of hacking — both for monitoring cable traffic and disrupting it altogether,” Sherman wrote.
As the technology and its deployment evolve, the risks only continue to grow. For a start, the proliferation of cloud computing has increased the volume of data flowing over the internet. This, coupled with the growth trend in remote work due to the COVID-19 pandemic, has also significantly increased the sensitivity of the data. Meanwhile, security is often not a top consideration in the planning, production, installation and maintenance of the cables because growing segments of the world’s cable infrastructure are controlled by a mishmash of private sector and state-run companies with other priorities.
Given the stakes, the undersea cable industry has become one of the latest realms of power competition between the United States and China, especially in the Indo-Pacific region. To mitigate security risks, U.S. allies and partner nations must continue to offer better alternatives to Chinese-backed cable infrastructure, experts assert. Although tensions between the U.S. and China may have delayed some cables from being installed, security protections are worth the wait, they said.
The U.S. and many of its allies and partners have been concerned for many years over the expansion of various state-owned companies or firms with Chinese Communist Party ties into the undersea cable business as a component of the PRC’s strategy to increase its global reach. “This is another vector by which Huawei gets into the infrastructure of another country,” retired Lt. Gen. William Mayville, former deputy commander of U.S. Cyber Command, told The Wall Street Journal newspaper in 2019. “Failing to respond to Huawei Marine cedes space to China,” he said. “The U.S. and its partners must meet and compete.” In June 2020, the U.S. Commerce Department placed Huawei on its Entity List, which restricts the sale of U.S. goods and technology to the company, and within months added most of Huawei’s subsidiaries, including Huawei Marine.
Huawei Marine, founded in 2008 as a Huawei subsidiary, built or repaired more than 90 of the world’s undersea cables before being sold to Shanghai-based Hengtong Optic-Electric in 2019. “But the sale failed to alleviate national security concerns: Hengtong’s director and founder is a Chinese government official,” explained Nadia Schadlow, a senior fellow at the Hudson Institute, in a July 2020 article in Defense News. In 2020, Huawei Marine rebranded itself as HMN Technologies but is still subject to U.S. Commerce Department restrictions, Reuters reported.
HMN Technologies, with a roughly 10% market share, has emerged as the fourth-largest undersea cable provider after Alcatel Submarine Networks, based in France; SubCom in the U.S.; and NEC in Japan. However, content providers, such as Amazon, Facebook, Google and Microsoft, are expanding their market presence, owning or leasing at least half of the global undersea bandwidth. Facebook and Google, for instance, revealed in 2021 that they plan to lay two underwater cables to connect the U.S. to Indonesia and Singapore, increasing the capacity for data transfer between North America and Southeast Asia by 70%, Reuters reported. Most Southeast Asian internet users access via mobile data, so new undersea cables will improve bandwidth. Only about 10% of Indonesia, for example, has access to broadband internet, according to a 2020 survey by the Indonesian Internet Service Providers Association.
Content providers’ entry into the market, however, has complicated security risks, experts said. Partnerships or arrangements with the already powerful tech companies could grant governments access to information that flows through their cables. Conversely, content providers could restrict access to information to gain leverage over governments. As it is, laws governing undersea cables and their ownership are not fully developed.
Pacific Islands Progress
The Pacific islands region has been an epicenter of undersea cable competition in recent years, as governments and citizens have sought better internet connections to advance their economic development. In 2007, only four Pacific islands nations and territories were connected by undersea cables, but almost all Pacific islands nations are poised to connect within the next several years, according to the U.N.’s International Telecommunication Union.
In this region, allies and partner nations have fended off several Chinese bids to install cables given the security risks. The Federated States of Micronesia announced in early September 2021 that it would rely on U.S. funding to build a cable between Kosrae and Pohnpei, rejecting a Chinese-led bid due to security concerns, Reuters reported. The World Bank declined to award the project in June 2021 after the U.S. objected to the contract being awarded to HMN Technologies. The original project would have also connected the Pacific islands nations of Nauru and Kiribati, according to Reuters.
In 2017, Australia blocked a plan by Huawei Marine to link Sydney with the Solomon Islands via a 4,000-kilometer cable. In the end, Australia funded construction of the cable known as the Coral Sea Cable System, which connects Port Moresby in Papua New Guinea and Honiara in the Solomon Islands to Sydney, CNN reported. “The concern was China could have an ability to in-build security vulnerabilities,” an Australian security official told The Wall Street Journal in 2019. “It really mirrors the issues with 5G,” he said.
“That was seen as a red line that Australia would not cross and so we jumped in with a better deal providing the cable as a grant that would be implemented with a procurement partner of Australia’s choosing — that wouldn’t be Chinese,” Jonathan Pryke, director of the Lowy Institute’s Pacific Islands Program, told Australia’s ABC News in June 2021. Australia has also been discussing plans to connect Nauru to the Coral Sea Cable System, Reuters reported.
“One key difference between arrangements with China and with other countries is China’s offers had to be through loans where Australia and similar countries tend to give gifts,” Australia National University’s Watson told FORUM. As more cables continue to be installed in the region, Watson would like to see a more holistic strategy emerge from partner nations, such as Australia, Japan, New Zealand and the U.S., to meet the needs of Pacific islands nations.
Australia is also working with Pacific island nations to improve the reliability of existing networks by increasing resiliency and redundancy. In January 2022, for example, a volcanic eruption damaged Tonga’s main undersea cable, which connects to Fiji, highlighting the vulnerability of the technology. Hopefully, additional cables will be installed to avoid extensive outages in the future, security officials said.
Chinese firms, meanwhile, often submit bids at a lower cost, but the quality is also lower, according to Pryke. Nations in “the Pacific are wising up to China. They do recognize a lot of the quality of infrastructure they’ve received has been lackluster from China, so they are putting more pressure on Chinese businesses to put in reasonable bids,” he told ABC News. Huawei Marine built a domestic undersea cable for Papua New Guinea that has had ongoing technical issues and is largely viewed as an investment failure, according to ABC News.
Analysts have watched similar scenarios play out in other parts of the developing world from South Asia to Africa under the PRC’s so-called digital silk road initiative that entails building undersea cables and terrestrial and satellite links as a component of China’s One Belt, One Road infrastructure scheme. Although host nations may benefit somewhat from the construction, most of the projects are being built, financed and controlled by the PRC, placing many countries at a high risk of debt distress, according to the International Monetary Fund. This can lead to loss of sovereignty and enable the PRC’s power projection globally.
Consider China’s installation of an Asia-Africa-Europe undersea cable, funded by the China Construction Bank, to connect with Hong Kong, Vietnam, Cambodia, Thailand, Malaysia and Singapore, then onward to Myanmar, India, Pakistan, Oman, the United Arab Emirates, Qatar, Yemen, Djibouti, Saudi Arabia, Egypt, Greece, Italy and France. Several of the undersea cable’s landing stations are located where the PRC also has invested heavily in infrastructure it has or intends to militarize, such as in Djibouti, which faces a high risk of debt distress and where the PRC opened a naval base in 2017. “In Pakistan, the cable network will land in Gwadar, a port China is developing as part of Belt and Road and where U.S. officials believe Beijing wants to open a naval facility, which China has denied. The cable is planned to connect to a land-based link with China,” according to The Wall Street Journal. Several sections of the Asia-Africa-Europe cable experienced technical difficulties throughout 2021, BenarNews reported.
South China Sea Contest
Perhaps nowhere are the security stakes higher than in the South China Sea. As the PRC has sought to seize control of the region through the construction and militarization of artificial islands, it has also begun laying undersea cables to expand its 5G networks and potentially increase its control of data flowing to nearby Southeast Asian countries, according to analysts.
The PRC has been spotted laying cables in the South China Sea on several instances. In 2020, using commercial satellite imagery, Radio Free Asia (RFA) and BenarNews documented such activities in the Paracel Islands, which are claimed by Taiwan and Vietnam. In 2017, China Telecom laid fiber-optic cables in the Spratly Islands between Fiery Cross, Subi and Mischief reefs, state media reported. The PRC was also observed laying underwater cables in 2016 to connect the city and military base at Woody Island to the PRC’s island of Hainan, Reuters reported. The People’s Liberation Army has operated its own cable-laying ships since 2015, RFA reported.
Vietnam objected to the PRC’s cable activities in the Paracels in June 2020. “Vietnam has sufficient historical evidence and legal grounds affirming its sovereignty over the Hoang Sa (Paracel) and Truong Sa (Spratly) archipelagoes in accordance with international law,” Foreign Ministry spokeswoman Le Thi Thu Hang told reporters, according to the state-run Vietnam News Agency. “Therefore, any activity relating to the two archipelagoes conducted without Vietnam’s permission are violations of its sovereignty and of no value,” she said.
The fiber-optic connections between such Chinese-occupied features are likely meant for military purposes, James Kraska, a professor at the U.S. Naval War College, told RFA. Kraska said the cables are probably for encrypted military communications between China’s various outposts and will connect to the undersea cable system already installed along the PRC’s east coast.
PRC control of emerging undersea networks in the South China Sea could enhance its grip on the region in the longer term, analysts warn. “The danger with China’s case, however, is the way they are attempting to circumvent international regulations and norms. By annexing islands in the South China Sea, they can claim that it is within their sovereign territory,” explained Helena Martin in a 2019 article in The McGill International Review, a daily online publication. International bodies would have less control of new cables if the PRC’s claims go unchallenged. The PRC “would technically be operating within their rights even though their operations would affect all of the Southeast Asian countries.” Violations of international regulations and norms through currency and market manipulation or even environmentally damaging practices would also be more difficult to sanction, Martin wrote.
Meanwhile, several commercial cable installations to connect Southeast Asia to the U.S., such as the Pacific Light Cable Network funded by Facebook and Alphabet, the parent company of Google, have also been delayed for security concerns. The line would have linked the Philippines, Taiwan and the U.S. with Hong Kong, which U.S. officials feared could provide sensitive global data to the PRC given its crackdown on the territory. A Facebook project to link California to Hong Kong was also scuttled in 2021 for the same reason.
Market dynamics may further complicate security issues as tech companies continue to look to Southeast Asian users for expansion. “Submarine cables go hand-in-hand with the exponential growth of cloud [computing] services,” Claude Achcar, managing partner of Actel Consulting, told Nikkei Asia in April 2021. “The smart thing for countries is not to pick sides. Indonesia and fellow ASEAN [Association of Southeast Asian Nations] nations are better off welcoming tech firms from both China and [the] U.S.,” Achcar said.
The advantages of increasing access to broadband internet and the fast flow of information must be carefully weighed against security concerns for the long term, other analysts contend. “It’s really a matter of regret to see those geopolitics descending right down the stack into the physical layers of the internet,” Emily Taylor, a cyber policy analyst and fellow in security at Chatham House, told Bloomberg in March 2021. “What we’re all going to have to come to terms with is this: How do we try to keep as many doors open as we can without laying ourselves open to national security threats?”
As things stand, undersea cables will be entangled with security risks for the foreseeable future. For this reason, allies and partner nations must work with the private sector to push for better intelligence sharing, risk assessments, security standards, monitoring and repair capabilities and contingency planning, and for stronger protections in international law to safeguard the world’s undersea cables and ensure their resilience, analysts recommend.
“As the White House increasingly focuses on cybersecurity threats to the nation and the global community, including from the Chinese and Russian governments, it must prioritize investing in the security and resilience of the physical infrastructure that underpins internet communication worldwide,” Sherman concluded in his Atlantic Council report. “Failing to do so will only leave these systems more vulnerable to espionage and to potential disruption that cuts off data flows and harms economic and national security.”