The Cables Beneath the Sea: Submarine Infrastructure Vulnerability and the Coming War for the Internet's Physical Foundation
On 18 November 2024, two submarine cables in the Baltic Sea were severed within hours of each other: the BCS East-West Interlink, running between Lithuania and Sweden, and the C-Lion1 cable connecting Finland to Germany. A Chinese bulk carrier, the Yi Peng 3, was identified by maritime tracking systems as having been in the vicinity of both cuts, and Danish and Swedish authorities spent weeks attempting — ultimately without success — to board the vessel for inspection as it anchored in international waters under Chinese flag protection. The incident produced diplomatic protests, NATO maritime patrols, and a flurry of commentary about undersea infrastructure vulnerability. It produced no criminal prosecution, no international mechanism for accountability, and no change in the legal framework governing submarine cables — a framework built on conventions last substantially updated in 1884.
The Yi Peng 3 incident was not an isolated event. In October 2023, the Balticconnector gas pipeline and a telecommunications cable between Finland and Estonia were damaged by anchor drag, attributed by Finnish investigators to a Chinese vessel with a high degree of confidence but, again, unprosecuted. In February 2022, cables connecting the Shetland Islands to the Scottish mainland were severed days after Russia's invasion of Ukraine, in an incident that British authorities declined to officially attribute. The pattern suggests not a series of accidents but a campaign of ambiguous infrastructure pressure — actions calibrated to damage without crossing the threshold that would trigger Article 5 of the NATO treaty or equivalent collective response mechanisms, exploiting the legal grey zone between peacetime sabotage and armed attack that submarine cable infrastructure currently occupies.
The political economy of undersea cable infrastructure — who owns it, who can repair it, who governs access to it — is among the least examined and most consequential questions in contemporary technology geopolitics. Its examination reveals an infrastructure layer that was built largely by private corporations, is governed by a nineteenth-century legal framework, and has become a contested terrain in the same great-power competition that is reshaping semiconductor supply chains and platform regulation.
The Physical Map of Internet Dependency
The global submarine cable network comprises approximately 550 active cables totalling over 1.4 million kilometres of fibre-optic infrastructure, carrying an estimated 95 to 99% of international data traffic. This includes virtually all international internet traffic, international telephone calls, and the cross-border financial transactions that underpin the global economy. Satellite internet — most prominently SpaceX's Starlink constellation — provides meaningful redundancy for end-user connectivity in areas without cable access, but cannot replicate the bandwidth capacity of undersea fibre: a single modern cable system can carry 200 terabits per second across an ocean; Starlink's entire constellation currently delivers a fraction of that capacity across all users globally.
The physical geography of the cable network creates specific chokepoints where large volumes of international traffic are concentrated in physically accessible locations: the Suez Canal and Red Sea corridor, through which cables connecting Europe to Asia and East Africa must pass and which has experienced repeated interference; the Luzon Strait between Taiwan and the Philippines; the Strait of Malacca; and the English Channel. These chokepoints are known to every intelligence service and naval planning staff in the world. They are, in principle, protected by the UN Convention on the Law of the Sea, which designates cable sabotage in international waters a criminal offence — but UNCLOS provides no enforcement mechanism, no standing to bring claims, and no rapid-response authority. The gap between the legal framework and the physical vulnerability is not incidental but structural: the rules were written by states that had not anticipated using cable sabotage as a sub-threshold geopolitical instrument.
The ownership map of the cable network has itself become a geopolitical contest. American hyperscalers — Google, Meta, Amazon, Microsoft — now own or co-own a majority of new cable capacity being deployed, displacing the traditional telecoms carriers that built the Cold War-era network. China's state-backed entities — HMN Technologies (formerly Huawei Marine), and the cable arms of China Telecom and China Unicom — have been progressively excluded from projects connecting to American or allied territory following the FCC's revocation of landing licences for Chinese state telecoms carriers in 2021 and 2023. The result is an emerging bifurcation of the physical cable network along geopolitical lines: an American-hyperscaler-dominated web connecting Western markets and allied regions, and a Chinese-state-backed alternative serving Belt and Road partner countries.
The Attribution Problem and the Grey Zone Advantage
The strategic value of submarine cable interference as a geopolitical instrument lies precisely in its attribution difficulty. Anchors drag; ships lose their course; cables fail from ship strikes that are genuinely accidental with sufficient frequency that a deliberate strike can plausibly be presented as an accident. The technical capacity to definitively attribute a cable cut to deliberate action by a specific vessel exists but requires underwater forensic investigation that must occur before cable repair — a window of typically seventy-two hours between the cut and the arrival of a cable repair ship, during which the "evidence" at the seafloor is degrading and the responsible vessel has often departed the area.
This attribution gap is not a failure of intelligence; it is a designed feature of the grey zone strategy that has elevated ambiguous infrastructure pressure to a central instrument of competition below the threshold of armed conflict. Just as export control evasion is calibrated to extract maximum capability while remaining below the threshold that triggers escalatory response, cable interference is calibrated to impose infrastructure costs and signal capability while remaining below the threshold of an armed attack that would trigger collective defence obligations. The asymmetry is significant: a NATO member whose cable is severed must prove attribution, demonstrate intent, and secure consensus for a collective response — a process that takes months — while a state actor has already achieved its objective of demonstrating that critical infrastructure can be disrupted with impunity.
The public-private infrastructure investment gap is directly relevant to the repair capacity question. Cable repair is performed by a small fleet of specialised vessels — approximately forty globally, operated by a handful of companies — with a repair timeline of two to eight weeks for a deep-water cut. This fleet is entirely private, often contracted under frameworks that do not provide for priority routing in response to state-actor sabotage. NATO's announcement in late 2024 of a Baltic Sea cable protection coordination centre, and its placement of a maritime surveillance asset, the NATOShield vessel, in the Baltic, represents a belated public investment in infrastructure security that the private-sector model of cable governance had not anticipated.
Data Sovereignty and the Cable Chokepoint
The submarine cable question intersects directly with the data sovereignty debate in a way that has not been adequately addressed in either the infrastructure security literature or the data governance literature. When a cable owned by an American hyperscaler carries data between, say, Nigeria and the United Kingdom, it passes through infrastructure subject to American legal jurisdiction — including the FISA Section 702 authority that permits the NSA to compel cable landing station operators to provide access to international traffic. The "transit intelligence" that the Snowden revelations documented, in which GCHQ and the NSA tapped submarine cables at landing stations on the British coast to harvest intercontinental traffic, was an exercise of the physical control that cable ownership confers.
The emerging bifurcation of the cable network along geopolitical lines does not solve this problem; it replicates it with different beneficiaries. A cable connecting an African country to internet infrastructure owned by Chinese state telecoms carriers is subject to Chinese legal jurisdiction at the landing station and potentially to Chinese intelligence access through mechanisms that Chinese law does not require to be disclosed. For countries in the Global South seeking genuine data sovereignty — the ability to determine who accesses communications flowing across their territory — the choice between American-hyperscaler cable infrastructure and Chinese-state cable infrastructure is a choice between two forms of dependency, not a choice between dependency and sovereignty.
Genuine data sovereignty for the Global South would require cable infrastructure owned by institutions accountable to those countries — a form of digital non-alignment that the current political economy of cable investment makes structurally difficult. The capital requirements for deep-sea cable projects (typically $200 to $500 million per system) exceed the institutional capacity of most individual developing countries, and the multilateral development bank framework has been slow to treat digital infrastructure as the strategic priority that physical transport infrastructure has historically received.
Stakes: The Internet's Physical Foundation Is a Contested Commons
The submarine cable network is the most important physical infrastructure in the world that most people have never considered. It is the substrate on which the global digital economy runs — the layer beneath the data centres, the cloud services, the AI systems, the financial transactions, and the communications that define modern economic and political life. Its vulnerability to deliberate interference is not a hypothetical scenario; it is an established pattern of activity that has occurred with increasing frequency across the Baltic, the Red Sea, and the Pacific, and that existing legal and governance frameworks are structurally inadequate to address.
The appropriate framework for thinking about submarine cables is not merely cybersecurity or even infrastructure protection; it is the broader question of who governs the physical commons on which digital society depends. The cable network was built by private capital under the assumption that its physical security would be maintained by the international legal order — an assumption that the grey zone strategies of contemporary great-power competition have invalidated. Reconstructing the governance framework that can protect cable infrastructure requires sustained, mission-oriented public investment and multilateral institution building of the kind that created the post-war international economic order — and requires treating the Global South's cable access and data sovereignty as legitimate interests in that framework, rather than afterthoughts to a great-power security negotiation.
The cables are there. The question of who controls them, who repairs them, who governs access to the data they carry, and who is accountable when they are severed is the question of who controls the physical foundation of the digital world. That question is being answered, at this moment, by the geopolitical actions of a small number of state and corporate actors — largely without democratic deliberation, and largely without the participation of the majority of the world's people who depend on what those cables carry.
The Monexus tech desk covers submarine infrastructure as a sovereignty and governance story, not merely a security thriller — because the cables beneath the sea determine whose voice reaches the world.