{{item.videoDuration}}
{{item.title}}
{{item.text}}
{{item.videoDuration}}
{{item.title}}
{{item.text}}
Share this article
By Zoe Thompson
This month, an important critical infrastructure initiative was unveiled by Australia and the US, aiming to fortify the security of crucial submarine cables linking Pacific Island nations. This will be a positive step forward to securing a resilient internet infrastructure.
On October 25 2023 Australian Prime Minister Anthony Albanese and United States President Joe Biden announced a significant national security initiative that included an investment into the protection of a set of critical infrastructures that most people use every day but have never heard of. The 'Joint Leaders Statement Building an Innovation Alliance’ contained a number of expected announcements consistent with achieving better technology and supply chain security. Key to the announcement was:
“The US Government, working with the US Congress, and Australia through the Australian Infrastructure Financing Facility for the Pacific, intend to provide $65 million to finance future submarine cable connectivity for Pacific Island countries, to assist access to global markets and realization of regional connectivity goals. We plan to work collaboratively with commercial cable providers Google and Hawaiki Nui, in partnership with Pacific Island countries, to provide branching units for Federated States of Micronesia, Kiribati, Marshall Islands, Nauru, Papua New Guinea, Solomon Islands, Timor-Leste, Tuvalu, and Vanuatu. Building on existing support to the region, this work will position all Pacific Island countries to achieve primary connectivity and for countries with existing access to secure options for critical redundancy.”
The strategic directions of the US and Australia are twofold. Firstly, it binds Australia and the Indo-Pacific region more closely into an interoperability paradigm with the US, and secondly, in doing so, it acts to support the communications infrastructure security of the Indo-Pacific nations and Australia.
What do submarine cables have to do with communications infrastructure security and why are they important to national security? It all has to do with the internet.
What is the Internet?
Figure 1: Partial map of the Internet based on data from November 24 2003. 2
Figure 2: A map of the subsea cables that are the “tangible” internet 3
Figure 2 shows a map of the internet; internet exchanges and subsea cables currently operating that are conduits for all data in the world.
Subsea cables are typically made of hybrid fibre coaxial. The distance the cables convey data over requires dense wavelength division multiplexing (DWDM) to ensure wavelength (data integrity) is not lost over distance. A dividend of DWDM is the need to prevent crosstalk (interference) which supports eavesdropping as it limits many security features – including eavesdropping. This becomes important later.
How Terrain and Geo-Politics Influence the Internet
The current estimate is that 98% of the world's data is transacted over subsea cables. Given this – it’s not surprising how dependent we are on this public infrastructure - anyone here who has ever had to shift servers because of a bushfire in Hawaii or noticed degradation in other platforms because of trunk outages will understand this problem. If we think about geopolitics and conflict - how much impact would it have if a large economy no longer had access to the internet, for sales, people management, work, superannuation funds and bank accounts? Some examples are in:
Cuba: the cost of being excluded from the internet is clear in the case of Cuba, only recently connected via subsea cable to the internet. Cuba, subject to sanctions has not been able to access the bandwidth required to run a modern economy was trapped for a long time in a late 90’s economy as a result.
Tonga: in an example of what happens when the internet is removed from an otherwise connected nation the explosion of the Hunga Tonga-Hunga Ha'apai submarine volcano exploded in 2022. Tonga had just in the last decade completed a program requiring a $15 million dollars to connect to Fiji and then to Australia to connect them to the internet. Satellite systems supported re-connection after 5 days - the cable repair has been challenged by changes to the sea floor as a result of the explosion.
Given the significance of impact – subsea cables are consequently an attractive target. Almost all international communication eventually goes over a few cables and some strategic coordinated degradation activity would present canalisation options, especially at strategic points and/or where cables are subject to branching or trunking. These events already occur routinely either by accident or design.
Disruptions to internet infrastructure
The truth is, the internet is often broken and despite its infrastructure remaining mostly resilient - there are exceptions and their outcomes significant. These ‘high impact’’ attacks or events are routinely perpetrated by the following top threat actors;
Accidental cable disruptions as high impact as direct attacks
On 28 March 2011 a standard woman scavenging for copper in Georgia sliced through one of these cables lying adjacent to a railway resulting in the total disruption of services to neighbouring Armenia. We know that the price of copper has soared in recent times – those of you who have experienced travel disruptions in Melbourne and Sydney lately have been impacted by organized crime gangs stealing copper out of the railway lines in the same way this little old lady was. Where do we run our own optic fibre cables terrestrially? The same place Georgia does - along the railway.
Another example is the outage of Basslink in Tasmania on 2 March 2022 where – in a series of extremely unfortunate events – both cables were damaged almost simultaneously by tradesmen operating drills.
Readers will notice that these prior examples are not ‘attacks’ per se. They are mistakes, incidents and errors.. That said - it’s obvious that achieving a capability to disrupt, degrade, canalise or exploit subsea cables would convey a significant advantage in conflict.
What a direct attack looks like
The Zimmerman telegram is remembered as the document which possibly prodded the US into joining the WW1 effort. The telegram contained a treaty military alliance offer from the German government to Mexico promising the return of territory to Mexico if they allied with Germany against the US. This document was collected by the British Government and enabled them to shame the US into the war effort. Collection on the cable was enabled because all but one of the German communications cables had been severed - allowing total collection by Britain on the remaining network and the collection of the cable.
APEC assessments of the cost of being even temporarily disconnected from the global submarine cable network are approximately 8% of GDP for a developed nation - that's 8% of 1.63 trillion USD taking South Korea as an example. Scaling this back - removing or degrading connectivity would impose a less but still significant cost of hundreds of millions. The cost of the infrastructure for these cable types is typically in the hundreds of millions. For our region, key regional partners with subsea cable agreements in place or underway with commercial entities include Papua New Guinea, Nauru, Guam, Palau, Timor-Leste, Thailand, Singapore and Indonesia.
For state-based actors, the capability to disrupt, degrade, cannulise or exploit submarine cables and leverage their impact during conflict may be an attractive proposition. It is however one that requires sophisticated maritime capabilities. This means attacking critical internet infrastructure is both harder and easier than first expected. Let’s look at why this is:
Hard Options: Attacks with the objective of data exploitation or intercept is hard for two main reasons.
- Access: achieving access can be difficult, this could occur at an internet exchange, data centre or cable landing site and these places typically have significant physical and cyber security protections. For example, the cable is heavily armoured as it leaves the landing station and enters into the littoral area. After the cable is in the open ocean, it is not heavily armoured nor has monitoring or protections. This might suggest it is more vulnerable to exploit - however preventing crosstalk is an important consideration - also known as Dense wavelength division multiplexing (DWDM).DWDM limits the use of many monitoring capabilities as these defeat the integrity of the signal. So if access is achieved the signal is disturbed.
- Scale: capabilities do exist for the exploit of data without interference and these are typically the preserve of state governments. Once data is accessed, the difficultly then arises due to the scale of data being accessed and the need to analyse it. Understanding and identifying what data is of use would be a significant undertaking.
Easy Options: Attacks designed to simply destroy the cable do not need to consider either of the above complexities.
The geopolitics of subsea cables
Let’s consider the fact that almost none of these cables are owned and operated by governments except for cables operated by Hengtong Optic-Electric and Huawei Marine. Because most cables are laid by companies their success measure includes value (profit) as well as reliability. Cables are laid in the shortest or easiest route between any two points on the Earth’s surface. This means they are typically laid along specific geographic locations that allow easy placement, which is why many cables are clustered in choke points. Egypt is an example where at least 16 cables combine as it’s the shortest point to cross from north to south of the African continent rather than going all around the outside (some do this). Because of this, Egypt has a huge influence on the connectivity for most of the world and the revenue collected from licensing fees and the soft power for negotiation of cable passage positions. Egypt is a hugely influential player for the future of critical infrastructure security. Other nation states are similarly interested in increasing their leverage in contested arenas including the Indo-Pacific.
Choke points are a common problem for supply chain security where the shortest/cheapest pathways are most used. For Australia, this includes the northern approaches via Singapore, Indonesia and East Timor. There’s an enormously vulnerable single connection from Oman for the west coast via the Indian Ocean and the eastern coast feeds from the South Pacific Ocean connections - all of which pass through Hawaii with the exception of two which run via Papua New Guinea.
Reasonable people might now be thinking about redundancies in place for failure of these cables and the potential use of satellite coverage instead. Due to the significant comparative cost of satellites vs cables very few companies have sufficient fail over volume rates for satellite redundancy. This means they will choose to buy volume in adjacent cables rather than use satellites. This behaviour supports canalisation and total disruption if alternates are not available due to attacks on cable trunks. The opportunities for signature management by taking out surveillance and communications functions are therefore significant.
The alternative is to achieve greater diversity i.e., build more cables - this is precisely what will happen as an outcome of the Joint Leadership Statement and the corresponding work by Google to build the South Pacific Connect Initiative. This creates greater redundancy, especially assuming it will be paired with a sovereign capability to repair cables. Cable repair requires specialised vessels, there are around 60 of these in the world currently, many of these vessels are old, with less than 10% being less than 18 years old and one as old as 52 years. Below is a map of the subsea cable repair facilities globally.
Figure 3: Map of global cable repair centres 5
Notable is the very small number of repair facilities and the distance they are from Australia. Also notable is the fact that vessels will need to travel from these locations to the area of the damaged cable. This could take several days or weeks.
Opportunities for a more secure and equitable internet
The internet is not a universal human right - yet. The Australian Human Rights Commission identifies several legislative acts which enshrine the right to access the internet for various parts of society but doesn’t necessarily go so far as to identify that the ability to access the internet is a human right. This paper recognises the requirement to secure internet access for national security and economic viability and for Australians as a collective, on this basis three recommendations are made;
commercial subsea cable diversification to be prioritised for cyber security and noted in the cyber security strategy,
subsea cable repair and supply capabilities be considered by Government as area necessitating investment to build capability within Australia, and
attacks on internet critical infrastructure be identified as non-normative offensive actions and identified in international forums as being unacceptable.
1 The White House United States - Australia Joint Leaders Statement - https://www.whitehouse.gov/briefing-room/statements-releases/2023/10/25/united-states-australia-joint-leaders-statementbuilding-an-innovation-alliance/
2 Vasiliauskaite, Vaiva & Rosas, Fernando. (2020). Understanding complexity via network theory: a gentle introduction.
3 The SubSea Cable Map from TeleGeography as found at https://www.submarinecablemap.com/ accurate as of 03 May 2023.
4 Data Centre Dynamics Report https://www.datacenterdynamics.com/en/analysis/the-cable-ship-capacity-crunch/#:~:text=However%2C%20the%20global%20supply%20of,small%3A%20just%2060%20ships%20worldwide.
5 The International Cable Protection Committee – “Critical Infrastructure – submarine telecommunication cables” presentation found at https://www.iscpc.org/publications/ as of 03 May 2023.
{{filterContent.facetedTitle}}
{{contentList.dataService.numberHits}} {{contentList.dataService.numberHits == 1 ? 'result' : 'results'}}
{{contentList.loadingText}}
{{contentList.loadingText}}