Strengthening Cybersecurity and Resilience in Subsea Cable Infrastructure (A Critical Imperative)

The sudden disruption of two vital undersea cables in the Baltic Sea has revealed a glaring vulnerability in Europe’s critical infrastructure. The C-Lion 1 cable, which directly connects Helsinki (Finland) and Rostock (Germany), and the BCS East-West link, which connects Gotland (Sweden) to ?ventoji (Lithuania), are essential for regional and European connectivity and communications. These incidents, under investigation for potential external interference, highlight a pressing need to rethink cybersecurity and resilience strategies, especially in the face of growing hybrid warfare threats and geopolitical instability.

?-?C-Lion 1 Cable: A Critical Link at Risk

The C-Lion 1 cable, often referred to as the "Northern Digital Highway”, the only direct subsea connection between Finland and Central Europe, underscores the risks of relying on a single point of failure. Spanning nearly 1,200 kilometers across the Baltic Sea, the cable connects northern Europe data centers[1] with the broader European network and features eight optical fiber pairs with a combined capacity of 144 terabits per second. A disruption here does not only affect routine internet traffic but could also impact critical services across the region. Alternative land-based routes can mitigate total disconnection, but the trade-off is a significant increase in round-trip times (RTT), leading to latency that could critically impact services such as financial systems and real-time communications. This disruption exemplifies why subsea cables must not just be seen as secondary routes but as integral components of a resilient infrastructure[2].

?A key point of concern, however, is the low depth at which these cables are laid on the seabed. In the case of C-Lion 1, some areas are relatively shallow, which makes the cable more susceptible to physical damage, whether accidental or intentional. Given that cable runs alongside or uses existing critical infrastructures, including the Nord Stream gas pipeline, the risk of coordinated sabotage or damage increases.

There is a growing suspicion that military or non-state actors, including potentially Russian forces, could target such cables, either directly or through proxy means. The shallow depth and proximity to other vital assets make these cables particularly vulnerable to targeted attacks, such as those conducted by vessels or remotely operated underwater vehicles (ROVs) designed to cut or damage fiber-optic lines.

-??Hybrid Warfare and Geopolitical Instability

?The disruption of these cables also brings into focus the broader geopolitical landscape. Following Russia’s invasion of Ukraine, Finland and Sweden have taken significant steps to bolster their security, including joining NATO. In this context, the Baltic Sea has emerged as a flashpoint for geopolitical tension. The likelihood of intentional interference with subsea infrastructure, especially through hybrid warfare tactics, has risen. Hybrid warfare involves a blend of conventional military activity, cyberattacks, and covert actions such as sabotage. The attacks on these cables are being investigated for potential links to these tactics, as noted by officials from Finland and Germany, who have openly raised the possibility of "hybrid warfare."

In this environment, the possibility of undersea cables becoming intentional targets of sabotage has been underscored by U.S. officials. The U.S. has warned of increased Russian military activity around critical undersea cables, believing that these cables are high-priority targets for potential sabotage operations. Adding to these concerns, a joint investigation by Scandinavian broadcasters found evidence of Russian spy vessels[3] operating in the Nordic region, likely with the purpose of surveilling and possibly damaging key infrastructure such as subsea cables and wind farms.

-??The Role of SMART Cables in Enhancing Resilience

?Given these emerging threats, there is an urgent need to rethink how subsea cables are protected. One promising solution is the integration of SMART cables. These cables are designed not only to transmit data but also to function as sensor-equipped monitoring systems. SMART cables are capable of detecting a range of physical conditions, including seismic activity, underwater movement, and even anomalous vibrations that could indicate intentional interference or sabotage. This technology could act as an early warning system, allowing authorities to respond quickly to potential threats and reducing the damage caused by disruptions.

?The role of SMART cables could be expanded further to include sensors specifically tailored to detect interference or damage caused by external factors such as ship anchors, fishing nets, or other physical forces. This proactive approach could provide real-time monitoring and, in some cases, preemptive action to protect the infrastructure. Furthermore, by connecting data from SMART cables to advanced information-sharing platforms, authorities would have a comprehensive view of the health of subsea networks, enabling them to act swiftly in response to potential threats.

?-??Integrating Data for Stronger Cybersecurity

?To strengthen the cybersecurity and resilience of subsea infrastructure, the integration of data from multiple sources is critical. Modern cybersecurity platforms that prioritize interoperability are essential in creating a unified picture of the security landscape. By consolidating data from SMART cable sensors, Automatic Identification Systems (AIS), satellite imagery, and maritime charts, authorities can better assess risks to critical infrastructure and take immediate action. These platforms must also be equipped with strong security measures to prevent malicious actors from exploiting them, ensuring the integrity of the data used to guide decisions.

?This integrated approach can enhance situational awareness, enabling quick identification of threats such as unusual ship movements or potential sabotage activities. In the case of the Baltic Sea incidents, such platforms could help to pinpoint the origin of disruptions and assess whether they are accidental or intentional, guiding appropriate responses.

?-??Strengthening National and International Cyber Defense - A Call for Action

?The disruptions to the C-Lion 1 and Lithuania-Sweden cables highlight the urgent need for enhanced national and European cybersecurity defense strategies. These strategies should not only focus on preventing cyberattacks but also on safeguarding physical infrastructure from attacks like sabotage or targeted damage. Nations must enhance their monitoring capabilities and intelligence-sharing initiatives, collaborating with international allies, particularly within NATO, to protect these vital systems from hybrid threats.

?Furthermore, it is not enough to respond reactively to incidents. The growing complexity of hybrid warfare demands a proactive, forward-looking approach. National strategies must evolve to integrate offensive and defensive cyber capabilities, ensuring that states can both deter and respond to threats in real time. Strengthening cooperation across European nations, is essential for creating a collective security framework that can withstand emerging threats to critical infrastructure.

[1] The C-Lion 1 cable leverages Finland's favorable climate and low electricity prices, which can be advantageous for data center operations. It also provides low-latency connections, benefiting organizations looking for fast, reliable data throughput.

[2] The challenge of mitigating disruption via land routes stems from the Baltic region's geography and infrastructure. Alternative terrestrial links significantly increase latency and may not support the huge bandwidth that C-Lion 1 provides. For data centres that rely on ultra-low latency connections, especially for applications such as financial trading or real-time communications, this will cause serious operational disruption.

On the other hand, these subsea routes such as C-Lion 1 need redundancy, such as the use of satellite-based backup systems for critical data. However, these options are often insufficient in terms of speed and capacity, which makes the loss of this submarine cable particularly impactful.

[3] Espionage is not limited to the Scandinavian Sea. Consider the case in Portugal last weeks.

The Portuguese Navy detected several vessels from the Russian Federation in Portuguese waters over the past fifteen days, including a spy ship specialized in intercepting radio emissions and the electromagnetic spectrum.

According to a statement shared on social media, the Navy has conducted "an intensive operation of monitoring and tracking several ships from the Russian Federation over the past two weeks, involving eight Portuguese Navy ships, five of which operated simultaneously at sea.

?