Securing the Subsea Cable Landings: The Vulnerable Chokepoints of Global Data

The Problem Hiding in Plain Sight

Every morning, trillions of dollars in financial transactions, military communications, streaming video, cloud-computing instructions, and government correspondence travel through roughly 400 active undersea fiber-optic cable systems that span the ocean floor. According to data maintained by TeleGeography, those systems carry approximately 95 percent of international data traffic. For all the sophistication of the firewalls, intrusion-detection systems, and zero-trust architectures that organizations have layered over their digital operations, the fundamental physical substrate of the global internet arrives at land through a collection of facilities that are, by any serious physical-security standard, underprotected.

These facilities are called cable landing stations. They sit at beaches, harbor approaches, and coastal industrial zones. They are the points where the subsea cable transitions from the ocean floor to terrestrial fiber networks, typically running through a buried conduit called a beach manhole and then into a shore station building that houses the power-feed equipment, amplifiers, and cross-connect infrastructure that keeps the cable system operational. Some of these buildings are indistinguishable from ordinary utility structures. Few carry prominent perimeter fencing adequate to deter a determined adversary. Fewer still have around-the-clock armed security personnel.

The thesis of this piece is precise and defensible: the international security community's investment calculus has systematically overweighted digital defenses relative to the physical protection of cable landing infrastructure, and correcting that imbalance requires a policy, regulatory, and operational response that has so far been slow to materialize.

What Recent Events Have Revealed

The November 2023 damage to the Balticconnector gas pipeline and an associated data cable running between Finland and Estonia marked a turning point in how Western governments discussed undersea infrastructure vulnerability. Finnish and Estonian authorities, along with NATO officials, assessed that the damage was likely caused by an external mechanical force, with a Chinese-flagged container vessel, the NewNew Polar Bear, identified as a vessel of interest. Finnish investigators later concluded that the anchor of that vessel had dragged across the pipeline and cable, causing the rupture. The episode demonstrated that a single surface vessel, operating in waters with considerable commercial traffic, could disable critical regional infrastructure with minimal forensic signature and, critically, with an ambiguity of intent that complicated any immediate response.

Since that event, reporting from multiple European defense and intelligence assessments, as well as statements from NATO's Maritime Centre for the Security of Critical Undersea Infrastructure, has documented a pattern of increased unidentified marine activity near communications nodes in the Baltic, North Sea, and North Atlantic. Into late 2025 and the early months of 2026, that pattern has continued, with vessel-tracking anomalies, disabled AIS transponders near cable corridors, and reported survey-type behavior near known landing-station approaches drawing renewed operational concern from alliance member states. The specific incidents remain subject to ongoing investigation, and this article does not assert confirmed attributions beyond what official sources have published.

Nevertheless, the pattern is sufficiently documented to justify treating physical cable-landing security as an active operational problem rather than a theoretical future risk.

The Governance Architecture and Its Gaps

Presidential Policy Directive 21 (PPD-21), issued in February 2013, established the United States policy framework for critical infrastructure security and resilience. The directive identified sixteen critical infrastructure sectors, including the Communications Sector, and assigned sector-specific agencies the responsibility of coordinating with private owners and operators to reduce risk. Under PPD-21, the Federal Communications Commission and the Department of Homeland Security share equity in the Communications Sector. The directive emphasizes the integration of physical and cyber security and calls for a national unity of effort across government and industry.

The framework is conceptually sound. The execution, however, reflects the political economy of infrastructure regulation: most cable landing stations in the United States are owned by private consortia of telecommunications companies, and the security standards they are required to meet involve a combination of FCC licensing conditions, classified briefings through the Team Telecom interagency review process, and voluntary best-practice guidance. The phrase "voluntary best-practice guidance" carries significant weight in that sentence. Where physical security standards for nuclear power facilities or financial exchanges involve mandatory, auditable, and enforceable controls, cable landing stations operate under a regime that is considerably less prescriptive about what physical perimeter protection, access control, and security staffing must look like.

The United Nations Convention on the Law of the Sea (UNCLOS), to which the United States is a non-party but which it largely observes as customary international law, contains provisions in Articles 113 through 115 that obligate signatory states to criminalize the willful or negligent breaking or injury of submarine cables and to hold responsible parties accountable. UNCLOS creates a framework for prosecution after an event. It does not establish an affirmative security posture or a deterrence architecture around the landing infrastructure itself. The gap between ex-post legal accountability and ex-ante physical deterrence is precisely where adversarial actors can exploit the current arrangement.

The Center for Strategic and International Studies has produced several assessments of maritime security and undersea infrastructure vulnerability, including work through its International Security Program that frames the problem in terms of the mismatch between the strategic value of cable infrastructure and the resources devoted to its protection. CSIS analysts have noted the difficulty of attributing subsea damage events in ways that satisfy the legal and political thresholds needed to trigger a military or diplomatic response, which creates a structural incentive for adversaries to operate in the gray zone of deniable interference.

The Physical Attack Surface at the Landing Station

Understanding what is actually at risk requires a brief examination of what a cable landing station is and what threatens it. The typical landing station consists of several components: the submarine cable system itself approaching the shore through buried or armored conduit; a beach manhole or vault at or near the waterline where the cable transitions to land-based conduit; one or more shore-station buildings housing line-terminating equipment, power-feed equipment, and network management systems; and terrestrial fiber connections linking the station to regional network exchange points.

The beach manhole is the most physically exposed element. It sits at or just above the waterline, often in a publicly accessible coastal area, and is protected by a locked vault cover and little else. Access from the water side requires only modest maritime capability. Access from the land side requires even less. The shore station building typically benefits from perimeter fencing and electronic access control, but staffing models vary considerably, and many facilities do not maintain continuous human presence.

Physical attack scenarios include direct cable severance at the beach manhole using cutting equipment delivered by a small vessel or a diver; damage to or destruction of the shore station building and its power-feed equipment through fire, explosion, or forced entry; and interference with the terrestrial fiber connections linking the station to the broader network. Any of these scenarios could remove a major cable system from service for weeks to months, given the specialized repair vessels and equipment required to restore undersea cable infrastructure. The disruption would reach past internet traffic into the financial settlement systems, communications networks, and military command-and-control channels that depend on the affected cables.

For redundant cable systems serving major metropolitan markets, the impact of losing a single cable might be absorbed through route diversity. For regions served by one or two cable systems, the consequences would be acute. Island nations, smaller economies, and some military theaters operate with very limited cable redundancy, making their landing stations disproportionately consequential targets.

Resilience Standards and the Business-Continuity Dimension

ISO 22301, the international standard for business continuity management systems, provides a framework for organizations to identify critical dependencies, assess the consequences of disruption, and maintain recovery capabilities. For telecommunications operators and the enterprises that depend on them, the standard's logic applies directly to cable landing infrastructure: organizations that have mapped their critical processes to specific cable systems, assessed their exposure to a landing-station outage, and developed contingency routing arrangements are better positioned to manage a disruption event than those that have not.

The problem is that ISO 22301 compliance, however rigorous at the organizational level, does not substitute for the physical security measures that would prevent or deter an attack in the first place. Business-continuity planning is a resilience tool; it presupposes that some disruptions will occur and builds recovery capacity around that assumption. Deterrence and prevention require a different set of investments: hardened physical perimeters, continuous security staffing, maritime surveillance of the approaches to landing stations, coordination with coast guard and naval assets, and intelligence-sharing arrangements that can identify anomalous vessel behavior before an incident occurs.

The distinction matters because the policy conversation in much of the industry and in regulatory forums has tended to treat resilience and recovery as adequate substitutes for prevention. They are not. A cable that has been cut at the beach manhole will take weeks to repair regardless of how well the affected operator has planned for continuity. The economic, operational, and reputational damage accumulates throughout that window, and in a conflict scenario, the damage may be compounded by simultaneous attacks on multiple systems.

What a More Adequate Security Posture Looks Like

Several components of a more adequate security posture can be identified from existing frameworks and from the lessons of recent events, and they deserve serious implementation rather than continued deferral.

First, physical security standards for cable landing stations should be formalized and made auditable. The voluntary guidance model that currently governs most landing-station security is insufficient for infrastructure of this strategic significance. The FCC, working with DHS and the intelligence community through the Team Telecom process, should develop mandatory minimum physical security standards covering perimeter protection, access control, surveillance systems, and security staffing requirements. The analogy to the mandatory physical security standards applied to bulk-power system facilities under NERC CIP regulations is instructive: a comparable level of regulatory specificity is warranted for cable landing infrastructure.

Second, maritime domain awareness in the immediate approaches to cable landing stations needs to be treated as a standing intelligence requirement. The pattern of anomalous vessel behavior documented near Baltic and North Atlantic cable corridors in 2023 through 2026 suggests that adversarial reconnaissance of this infrastructure is ongoing. Coast guard and naval assets should maintain persistent awareness of vessel activity near known landing-station coordinates, with protocols for investigating vessels exhibiting anomalous behavior. Allied navies have begun moving in this direction, but the effort remains episodic rather than systematic.

Third, the private owners and operators of cable landing stations should be required to integrate their security posture with government intelligence and law enforcement agencies in a structured, continuous manner. The Team Telecom process addresses some of this coordination at the licensing stage, but a more dynamic and ongoing information-sharing arrangement is needed to respond to the tempo of current threat activity.

Fourth, the international legal framework needs to be strengthened. The UNCLOS provisions on cable protection are a starting point, but a multilateral agreement that establishes clearer obligations for states to actively protect landing infrastructure within their territory and territorial waters, rather than merely prosecuting damage after it occurs, would close a significant governance gap. NATO's existing work through the Maritime Centre for the Security of Critical Undersea Infrastructure represents a promising foundation for such an arrangement among alliance members.

For organizations operating private-sector security functions near coastal infrastructure, the practical implication is that landing stations and their immediate surroundings warrant the same disciplined, professionally staffed security presence applied to other high-value facilities. The physical footprint of these sites is modest. The cost of adequate security staffing and perimeter protection is not disproportionate to the asset value at risk. The gap between what is currently provided and what is warranted is a policy and management choice, and it remains available to correct.

The Stakes of Continued Inattention

The global digital economy has been constructed on the assumption that its physical substrate is, if not invulnerable, at least not the most likely point of failure. That assumption has informed investment priorities, regulatory frameworks, and security spending allocations for decades. The events of 2023 through the present have provided concrete evidence that the assumption deserves revision.

A sustained campaign of interference with cable landing infrastructure, coordinated across multiple geographic theaters, would represent a form of strategic disruption with consequences extending well beyond internet service outages. Financial markets, military communications, emergency services, and the basic transactional infrastructure of commerce all depend on the continuity of the cable systems that terminate at these largely unguarded beachheads. The legal frameworks governing their protection were designed for a different threat environment. The physical security standards applied to them have not kept pace with their strategic importance.

Correcting this requires regulatory action, investment, and the kind of serious institutional attention that has, until recently, been directed almost exclusively toward the digital surface of the same infrastructure. The physical landing station deserves a place in that conversation that reflects its actual position in the architecture of global communications: a critical chokepoint, modestly protected, and increasingly in the crosshairs of state and state-aligned actors who have demonstrated both the capability and the willingness to exploit exactly that gap.

---

USPA Nationwide Security provides professional security services for critical infrastructure facilities, commercial properties, and high-value assets across the United States. For inquiries about infrastructure security staffing, contact USPA at (800) 214-1448 or visit uspasecurity.com/contact.