Securing Europe’s Subsea Data Cables

Introduction

More subsea data cables connect to Europe than to any other continent around the world. But it was not until 2022 that European policymakers began to pay significant attention to the security of these cables. Russia’s invasion of Ukraine, as well as a subsequent series of incidents resulting in damages to European undersea infrastructure, raised alarm bells in Brussels and beyond. The Nord Stream explosion in fall 2022 and the Balticconnector gas pipeline incident just over one year later illustrated the glaring vulnerability of Europe’s undersea infrastructure to sabotage. The involvement of a Hong Kong–flagged vessel in the October 2023 Balticconnector incident also sparked awareness among Europeans of China’s potential interest in physically damaging undersea infrastructure in and near Europe. Most recently, in mid-November 2024, two undersea data cables—connecting Finland and Germany and Sweden and Lithuania, respectively—were damaged due to “external impact.”¹

In addition to the physical threats to Europe’s undersea infrastructure, subsea cable systems and the data that flow through them are vulnerable to hacks, espionage, and other cyber risks.² Militaries fear a range of threats: backdoors could be installed during the cable manufacturing or repair process; cable-landing stations, where subsea cables connect to terrestrial networks, could become targets to cyber attacks, especially as control over these centers is being shifted to remotely controllable network management systems; and rapid advances in subsea technology might even allow adversaries to tap cables at sea.³

The North Atlantic Treaty Organization (NATO), the European Union (EU), and individual European governments have over the last three years initiated a flurry of initiatives that aim to bolster the physical security and cybersecurity of cables and other undersea infrastructure. Yet information sharing and resourcing often remains insufficient. Approaches also vary from country to country. There is not a single regulatory regime for protecting subsea data cables.⁴ Instead, there are many different regimes, national agencies, authorities, and international entities involved in the protection of this critical infrastructure, complicating a joint European approach.⁵

Fierce competition between the United States and China over subsea cables is also forcing a debate in Europe about cable ownership and integrity, especially with regard to cybersecurity and espionage concerns.⁶ Partly in response to U.S. warnings, European policymakers are becoming increasingly wary of subsea cables supplied by vendors they consider high risk—chiefly those based in China.⁷ The U.S. government is keen to expand its cooperation with Europeans to better expand, protect, and repair trusted subsea cable networks.⁸

At the same time, however, competition between U.S. and European firms is complicating a more joint transatlantic approach. There is some concern in Europe over the emerging dominance in new cable investment by a few U.S. “hyperscalers,” or large-scale cloud providers such as Google and Meta, and what this new market dynamic might mean for European telecommunications firms. Absent a more strategic approach to building out its own digital network and providing the adequate resources to do so, Europe risks losing out in the competition between Washington and Beijing under the world’s seas.

This paper’s first section briefly maps the economic significance, strategic vulnerabilities, and key players of Europe’s undersea cable infrastructure. It also outlines the recent evolution of the European debate on the physical and economic security and cybersecurity of subsea cables, sketching the European perspective on the activities of Russia, China, and the United States in this field. The second section describes European countries’ steps—taken through NATO, the EU, and other multilateral groupings—to protect their subsea cable networks and increase their global competitiveness. The final section identifies shortcomings of current approaches and offers a list of policy recommendations to lawmakers in Europe, with a view to improving the physical security, cybersecurity, and resilience of their undersea data cables.

To obtain a clearer picture of their assets and vulnerabilities, Europeans should work together to map and review critical undersea infrastructure and improve their information-sharing mechanisms and stakeholder exchanges. To improve the security of their cables, Europeans should also invest in developing new undersea infrastructure protection technology, allocate more resources to support Europe’s market leaders in subsea cable installation and repair, and work with partners to ensure secure and trusted end-to-end supply chains. Looking to the future, Europeans should strengthen digital connectivity in regions of strategic importance and creatively build out diplomatic relations with partner countries through the construction and repair of new and existing cables.

Despite the global focus in recent years on U.S.-China competition over subsea data cables, Europe possesses several advantages in this realm.⁹ As the contest between China and the United States ramps up and Russia becomes ever more emboldened in its attacks on European infrastructure, Europeans must invest more to leverage these advantages and protect the competitiveness, resilience, and security of their subsea cable infrastructure.

The European Subsea Cable Ecosystem and State of Debate

Europe is home to several global industry leaders in subsea cable installation and repair. At the same time, the continent lacks peer competitors to U.S. hyperscalers that are becoming increasingly relevant in new cable investments. As incidents of cable damage and potential sabotage occur more frequently in European waters, governments across Europe are beginning to recognize the risks posed by geopolitical competitors, including China and Russia, to their critical undersea infrastructure.¹⁰ Debates across Europe have shifted from whether more needs to be done to protect subsea cable systems to what should be done and by whom. The latter question is especially salient. Subsea data cables are vital for connectivity across the entire European continent, but they only connect to a small number of coastal states. In addition, a wide range of stakeholders are involved in the cables’ functioning, but information sharing is challenging.

Economic Significance, Strategic Vulnerabilities, and Key Players

Individuals across Europe rely on the internet daily to communicate with each other and make financial transactions.¹¹ Of the approximately 250 active cables that ensure the EU is connected to the global internet, two-thirds are submarine cables.¹² Thus, Europe’s dependence on digital connectivity is also a dependence on submarine cables. Globally, it is estimated that $10 trillion worth of financial transactions travel through these cables every day. David Cattler, a former NATO assistant secretary general for intelligence and security, rightly labelled undersea cables an “economic lynchpin.”¹³ In a speech at the European Parliament, Commission President Ursula von der Leyen called on European leaders to better protect the undersea cables that connect their citizens and companies to the world.¹⁴

The global subsea cable supplier market is dominated by four major companies, of which one is European: France’s Alcatel Submarine Networks (ASN). It competes with the United States’ SubCom, Japan’s Nippon Electric Company (NEC), and China’s HMN Technologies (or HMN Tech, formerly called Huawei Marine Networks). As of 2024, ASN is the current market leader among these major players, both in terms of new systems installed and total kilometers of cable produced from 2020 to 2024.¹⁵ ASN also leads its competitors in the number of planned systems by supplier.¹⁶ Other notable European subsea cable suppliers include the United Kingdom’s Xtera, which produces cables and cable parts but does not provide installation or maintenance services, and Telecom Italia’s Sparkle subsea cable unit. In recent months, the Italian government has shown interest in acquiring Sparkle, placing a new bid for the company after its first offer was rejected in early 2024.¹⁷ If the offer is accepted, both the French and Italian governments would own globally prominent submarine cable suppliers (ASN and Sparkle), underscoring the increased focus placed within European capitals on these systems.¹⁸

While ASN is an industry leader in undersea cable installation in Europe, the continent lacks a competitor to the U.S. hyperscalers dominating new cable investment and construction. The heightened presence of these large actors threatens to push out smaller European telecommunications firms in terms of future cable planning and investment.¹⁹ What is more, the margins of cable manufacturers such as ASN remain relatively low despite new orders pouring in from new players. In 2021, ASN’s profits were approximately €4 million (nearly $4.5 million), despite its revenue doubling to just under €1 billion (or just over $1 billion) since 2018.²⁰

Approximately eighty ships around the globe are responsible for laying, maintaining, and repairing the cables that run along the ocean floor. Only five companies possess seven or more ships in their cable fleet, and three of these companies are headquartered in Europe (see Figure 1).²¹ France’s telecommunications firm Orange and the United Kingdom’s Global Marine Systems Limited are the current global leaders in cable ship ownership, each with nine ships. SubCom owns eight ships and France’s ASN and Malaysia’s Optic Marine Services each have a fleet of seven ships. Companies with slightly smaller fleets include China’s S.B. Submarine Systems with six ships, the UAE’s E-marine with five ships, and Japan’s Nippon Telegraph and Telephone World Engineering Marine (NTT WE Marine) with four ships. Although there is a concentration of cable ship companies with headquarters in Europe, their vessels are sprawled across the world, either laying new cables or maintaining or repairing cables.²²

For most of Europe, sufficient digital connectivity redundancies exist to prevent widespread internet outages or delays. If one subsea or land cable is damaged, enough alternative links exist to reroute bandwidth and ensure continued coverage.²³ A total internet blackout scenario is far-fetched for most, if not all, Europeans. War games conducted by the Center for a New American Security in 2021 found that Russia would be unable to quickly cut the many cable links between NATO allies in Europe and North America.²⁴ Nevertheless, European island countries such as Cyprus, Ireland, or Malta, or islands off the coast of the European mainland, are more vulnerable to attacks against their limited number of subsea cables. Below the threshold of a complete outage, adversaries can use cable sabotage—causing delays or temporary loss in connectivity—as a low-cost way of unnerving societies by undermining their sense of security and preparing the ground for a broader attack. And even a modest disruption in internet connectivity that would be a minor nuisance to the general public could have drastic consequences for European and global financial markets, which rely on rapid information flows to optimally perform.²⁵

Finally, repair capabilities within Europe are limited.²⁶ What is more, the depots from which repair vessels operate are vulnerable to attacks. In the event of a coordinated strike against both cables and repair vessels, the resulting damage could be extensive and enduring. This challenge is especially true for cables that run through particularly challenging terrain. For instance, despite warming waters, one key challenge that remains vis-à-vis the construction and repair of future Arctic cable systems is the lack of cable ships with icebreaking capabilities. Currently, no Western cable-laying or repair ships can operate autonomously in areas with heavy sea ice.²⁷

In 2021, the U.S. government entered into an agreement with SubCom to establish the Cable Security Fleet, whereby the United States has continuous access to two SubCom cable repair vessels in case of a national emergency for $10 million annually ($5 million per ship).²⁸ But if a conflict were to break out that involves both the United States and Europe, it is unlikely that two U.S.-flagged vessels would have either the capacity or the mandate to lay, service, and repair any cables of strategic importance in Europe’s immediate vicinity—regardless of NATO Article 5 commitments.

An Evolving European Debate on Cable Security and Sovereignty

Recent developments, including damage to subsea cables in the waters near Estonia, Finland, Germany, Norway, and Sweden, have forced Europeans to pay attention to the risk of state and nonstate actors being able and willing to sabotage European underwater infrastructure. The remote nature of most undersea infrastructure and the lack of proper surveillance tools make attribution a challenging task.²⁹ In the case of undersea infrastructure protection, deterrence is closely intertwined with resilience, as European militaries can only patrol so much area at a given time. To further complicate the picture, civilians can easily be deployed to damage cables in shallower waters near coastlines, blurring the lines between state and nonstate action.

In addition, existing international legal regimes do not adequately protect subsea data cables from intentional damage, nor do they effectively hold perpetrators of such damage accountable.³⁰ The 1884 Convention for the Protection of Submarine Telegraph Cables (hereafter referred to as the “1884 Cable Convention”)—of which several European countries are party to—labels willful or culpably negligent damage to subsea cables a punishable offense.³¹ Under Article 21 of the 1982 United Nations Convention on the Law of the Sea (UNCLOS), signatories are also allowed, but not obligated, to adopt necessary laws and regulations to protect subsea cables within their territorial waters.³² Yet few states in Europe and around the world possess sufficient domestic laws and regulation to specifically protect cables against sabotage within their territorial waters.³³

Article 113 of UNCLOS also requires signatories to adopt legal instruments to punish ships flying under their flag that are engaged in the willful or culpably negligent damage of subsea cables in areas outside of coastal state sovereignty (more than twelve miles from a nation’s seabed).³⁴ However, there are at least two issues with this provision. First, several UNCLOS signatories have simply not implemented their duties under Article 113. If they have, they are often simultaneously carrying out their 1884 Cable Convention obligations, meaning the measures and associated penalties are outdated and, as one scholar notes, “woefully inadequate.”³⁵ Second, the jurisdiction under Article 113 applies solely to authorities of a country whose flag a ship is flying under—not the countries connected to a particular cable and thereby most directly impacted by any damages. While well-intentioned, the current provisions under international law aimed at protecting subsea cables are not suited for an era of hybrid aggression. But amending UNCLOS to either extend jurisdiction beyond flag states for intentional cable damage on the high seas or require parties to penalize cable sabotage in their territorial waters is unlikely to happen; the amendment process is onerous and has not been attempted. A more likely alternative would be the introduction of a separate treaty instrument for cable protection and security. Perhaps it could be established under UNCLOS, like the recently adopted High Seas Treaty.³⁶ The EU, as a body inherently focused on the resilience and significance of international legal regimes, could lead the push for such a new instrument.

The context of the war in Ukraine has naturally led European governments and militaries to initially focus on the threat from Russia against their undersea infrastructure. But warnings from the United States, the increasingly blatant Chinese involvement in Russia’s war, and recent Chinese involvement in cable-cutting incidents in the Baltic Sea have led Europeans to include China in their risk assessments of undersea cables. Meanwhile, as U.S.-based hyperscalers are disrupting the undersea cable market, some Europeans worry about the competitiveness of European firms and the future of European sovereignty over undersea cables.

Russia: An Acute Threat

Russia has carried out underwater military exercises at depths of more than 6,000 meters. Its attention to transatlantic subsea cables has increased in recent years. In 2023, NATO stated that Russia was “actively mapping” the critical subsea infrastructure of Ukraine’s allies.³⁷ NATO commanders also went on record in April 2023 confirming that they had observed an increase of suspicious Russian activity over and around undersea cables in the Baltic Sea.³⁸

These claims have been corroborated by various incidents involving Russian actors in the vicinity of European critical underwater infrastructure. In spring 2023, four Russian commercial and military vessels were monitored sailing through Ireland’s Exclusive Economic Zone, rousing suspicion that they could be mapping or interfering with subsea cables off the Irish west coast. Such cables transfer data between the United States and Ireland.³⁹ More recently, in November 2024, the Irish navy escorted the Russian Yantar research vessel out of Irish-controlled waters after it was found patrolling an area where subsea data cables and energy pipelines connect Ireland with Great Britain.⁴⁰ Closer to Norway, crew on a Russian vessel that is believed to have been involved in prior damages to subsea cables were caught steering a motorboat near a military garrison in restricted Norwegian waters.⁴¹ These examples have led U.S. officials to the conclusion that “Russia’s decision calculus for damaging U.S. and allied undersea critical infrastructure may be changing.”⁴²

Russia could carry out attacks against undersea infrastructure via its Directorate of Deep-Sea Research, also known as GUGI, which maintains a fleet of quasi-military ships and submarines.⁴³ Russia’s Yantar intelligence ship, the same vessel recently escorted out of Irish waters, is equipped with unmanned submarines that could destroy undersea cable infrastructure.⁴⁴ Russia is known to use ostensibly civilian scientific research ships to map the Baltic seabed, and such vessels could become involved in cable tampering or sabotage.⁴⁵

Europe has recently experienced several such murky cases. On January 7, 2022, an undersea fiber optic cable connecting the Norwegian archipelago Svalbard to the mainland was severed. Although Russian trawlers were known to be sailing near the damaged cable at the time of the break, there has been no conclusive findings as to what—or who—ultimately caused the damage.⁴⁶ Another cable connected to Norway’s Evenes Air Station was cut in April 2024. Similar to the Svalbard incident, no suspects have been identified, but Norwegian authorities have declared the damage to be “intentional and calculated.”⁴⁷

In November 2024, two cables in the Baltic Sea were severed. The first cable, C-Lion1, which connects data centers in Finland and Germany, is Finland’s only undersea data cable to run from the Nordic country directly to central Europe.⁴⁸ A second cable connecting Sweden’s Gotland Island and Lithuania was also damaged. Authorities suspect the cables to have been damaged by a Chinese-flagged cargo ship, the Yi Peng 3, but European lawmakers and intelligence officials have also hinted at Russian involvement.⁴⁹ In a joint statement, the foreign ministers of Germany and Finland wrote, “Our European security is not only under threat from Russia’s war of aggression against Ukraine, but also from hybrid warfare by malicious actors.”⁵⁰ One day after that statement was released, German Defense Minister Boris Pistorius told reporters, “No one believes these cables were cut accidentally.”⁵¹ Taken together, NATO defense planners are beginning to consider these incidents a test that demonstrates NATO’s potential wartime vulnerabilities.⁵²

China: A Newer Risk

In 2020, the U.S. Senate expressed concern to European partners regarding the construction of the Pakistan and East Africa Connecting Europe (PEACE) Cable, a 25,000-kilometer project that connects Singapore to Marseilles, France, with many landing points in South Asia, Africa, and the Middle East in between.⁵³ PEACE, which went online in March 2022, was installed by HMN Tech, China’s leading cable installer (formerly owned by Huawei Technologies).⁵⁴ The United States has long advocated against the usage of Chinese components in telecommunications systems, from 5G infrastructure to subsea cables, both domestically and in partner and allied countries.⁵⁵

While Europeans did not share the same risk assessment as the United States in 2020 regarding Chinese involvement in telecommunications equipment, there is much closer alignment today, especially at the EU level.⁵⁶ Under von der Leyen, Europe has begun to broadly reevaluate Chinese access to and influence over European critical infrastructure, such as ports, emerging technologies, critical minerals and metals, and telecommunications systems—including undersea cables.⁵⁷ In January 2024, the European Parliament also passed a resolution on the security implications of Chinese influence on EU critical infrastructure, in which the body expressed “grave concern over the undersea data cable systems operated by Chinese company HMN Technologies.”⁵⁸ The resolution labelled HMN Tech a “PLA [People’s Liberation Army] cyber intelligence–affiliated entity” and gave particular emphasis to the cybersecurity vulnerabilities associated with cables installed and operated by the Chinese company, including data collection, gathering of intelligence, and underwater surveillance. Since the installation of the PEACE Cable, no subsea cables connecting to Europe have been installed by HMN Tech.

In early October 2023, undersea cables running between Estonia and Finland and Estonia and Sweden were damaged, along with the Balticconnector gas pipeline. The perpetrator was quickly thought to be the Newnew Polar Bear, a Hong Kong–flagged, Chinese registered vessel that travelled over all three damage sites at the time of the incidents.⁵⁹ The Chinese government later admitted the vessel was responsible for damaging the pipeline and cables, but called the incidents accidents.⁶⁰ Finnish and Estonian officials are conducting their own respective investigations into the incident, though have yet to release their findings.⁶¹ During a visit to Beijing in November 2024, a senior diplomat from Estonia noted that Estonian authorities are still waiting on their Chinese counterparts to “complete the procedures concerning Newnew Polar Bear and its crew, so that we can end the investigation.” ⁶²

One key difference between the 2023 and 2024 Baltic Sea cable cuts is the fate of the suspected vessel immediately following the cable damage. In October 2023, the Newnew Polar Bear continued sailing after having damaged two subsea data cables and the Balticconnector pipeline in the Baltic Sea, ultimately returning to port in Tianjin, China. Estonian and Finnish authorities attempted to contact the Hong Kong–flagged vessel but could not forcibly stop or detain the ship without flag state–consent.⁶³ By comparison, the Yi Peng 3 has remained at rest in the Kattegat strait, with naval and coast guard vessels from Denmark, Germany, and Sweden in close proximity. Both Danish and Swedish authorities have confirmed that their vessels are present near the Yi Peng 3, although they have not revealed whether the ship is officially detained or has been boarded by authorities.⁶⁴

Article 10 of the 1884 Cable Convention allows military vessels under signatories’ flags to demand the captain of a nonmilitary vessel, suspected of intentionally damaging subsea cables, to provide evidence of the vessel’s nationality.⁶⁵ Denmark is a signatory to the 1884 Cable Convention, while Estonia and Finland are not. In its nearly century-and-a-half history, Article 10 has only publicly been invoked once, when crew of the USS Roy O. Hale boarded a Soviet trawler believed to have damaged several transatlantic subsea data cables.⁶⁶ But if instances of damage and sabotage to undersea infrastructure continue to rise, it is possible that countries will be more willing to use this clause as part of their toolkit in response.

The ongoing inner-European reevaluation of the risks emanating from China has been accompanied by transatlantic policy discussions through the U.S.-EU Trade and Technology Council (TTC), established in June 2021. At the council’s first meeting in September of that year, one of the ten TTC working groups was dedicated to “ensuring security, diversity, interoperability, and resilience across the ICT [information and communication technology] supply chain, including . . . undersea cables.”⁶⁷ In subsequent meetings in 2022 and 2023, this working group discussed the development of alternate cable routes connecting Asia, Europe, and North America, as well as supplier diversification.⁶⁸ At least the United States, however, was not satisfied with the outcome of these discussions. In a recent review on U.S.-Europe cooperation on China, the Senate Foreign Affairs Committee assessed that the TTC has delivered no concrete results on subsea cables.⁶⁹

Most recently, the EU—along with Finland, France, the Netherlands, Portugal, and the United Kingdom—endorsed a U.S.-led joint statement in September 2024 on undersea cable security and resilience, emphasizing the importance of “secure and verifiable subsea cable providers for new cable projects.”⁷⁰ In the document, officially titled The New York Joint Statement on the Security and Resilience of Undersea Cables in a Globally Digitalized World, the signatories agree to nine nonbinding principles aimed at improving cable protection, resiliency, and redundancy. While China is not mentioned explicitly in the text, the principles are clearly directed at Beijing and against the rapid rollout of China’s subsea cable industry.⁷¹ In November 2024, only one day after two undersea cables were cut in the Baltic Sea, Norway announced its endorsement of the joint statement.⁷²

Although there has been a transatlantic convergence on China with regard to critical infrastructure, EU member states continue to differ with the United States, with each other, and with the European Commission on assessing various risks related to China.⁷³ European countries vary in their economic dependencies vis-à-vis China and are keen to preserve an independent, national assessment of economic and security vulnerabilities, rather than delegate this responsibility to Brussels.⁷⁴ Nevertheless, the Balticconnector incident and the November 2024 cable cuts in the Baltic Sea have opened eyes across Europe to the physical and cybersecurity threat that China could pose to undersea cables connected to the continent. Europeans are also aware that the incoming U.S. administration will likely be less willing to support Ukraine if they perceive Europe as being lenient toward China—contributing another factor to the debate in Europe on security threats posed by Beijing.

United States: A Partner and Competitor

The United States and European governments have been engaged in close discussions on subsea cables, including through the TTC. But close collaboration is complicated by the fact that companies on both sides of the Atlantic also are direct competitors. For example, an EU-backed Arctic cable initiative was withdrawn as part of the TTC agreement after a U.S.-supported cable constructed by a different company took a similar route.⁷⁵ Moreover, European actors are concerned with the emerging dominance of a select few U.S. companies in new cable investment and construction. These hyperscalers, namely Amazon, Google, Meta, and Microsoft, accounted for nearly a quarter of cable systems that began operation between 2019 and 2023 and have flipped the traditional subsea cable investment model on its head.⁷⁶ While Europe is home to ASN, the global market leader in subsea cable installation, it lacks a peer competitor to the hyperscalers that are shaping the future of cable investment. Initiatives such as Gaia-X, conceived to create a European cloud platform able to compete with the U.S. hyperscalers, have failed to get off the ground.⁷⁷ As U.S. hyperscalers continue to occupy a larger market share, the chances rise that they push out European telecommunications firms, or other traditional investors in cables, in the process.

Certain observers in Europe, and especially in France, have taken issue with this consolidation in the submarine cable market, arguing that a small number of U.S. tech companies now possess “unlimited power over the sector.”⁷⁸ Others have taken a more resigned approach, including former Italian prime minister Mario Draghi, who recently wrote in his report on European economic competitiveness that “it is too late for the EU to try and develop systematic challengers to the major U.S. cloud providers.”⁷⁹ In the context of subsea cables, Europeans are aware of their dependencies on both U.S. firms and Chinese firms, particularly when it comes to main investors in cables, but are unable to easily rid themselves of these dependencies.

Any comparison of global competitiveness in the field of subsea cables must look at all levels of the subsea cable supply and investment chain. Table 1 shows the relative dominance of Chinese, U.S., European, and Japanese companies in different links of the chain. Even though China’s HMN Tech has emerged in the international subsea cable supplier market at an impressive pace, its total market share is still quite small compared to ASN and SubCom. From 2020 to 2024, ASN and SubCom supplied approximately 34 percent and 19 percent of new subsea cable systems built, respectively, while HMN Tech was responsible for 10 percent.⁸⁰ Efforts led by the United States to limit the reach of subsea cables built by Chinese suppliers also appear to be working. Whereas HMN Tech provided an estimated 10 percent of new kilometers of subsea cables entering service between 2010 and 2023, that number is only 4 percent for systems planned through 2026.⁸¹

As Europeans recognize the geopolitical importance of undersea cables, they might consider ways to ensure that ASN remains globally competitive, especially as the United States and China are investing in their own national champions. American policymakers, too, should want the companies of their close allies in Europe to remain viable market players. EU state aid regulations generally prohibit an individual company from receiving government support “unless exceptionally justified.”⁸² However, with the reelection of von der Leyen as European Commission president, it appears that attitudes toward state aid, particularly in strategically significant domains, might be shifting. Indeed, von der Leyen has instructed newly appointed European Executive Vice President for Clean, Just, and Competitive Transition Teresa Ribera to “modernise the EU’s competition policy to ensure it supports European companies to innovate, compete and lead world-wide.”⁸³

Emerging European Responses

NATO, the EU, and certain European governments have all increased their efforts to better protect existing subsea cable infrastructure in a heightened threat environment. Effectively protecting subsea cables against all forms of attack and sabotage would ideally require surface and undersea surveillance along the entire length of the cables. But beyond the technical difficulties of such an approach, undersea cables cross territorial waters, exclusive economic zones, and the high seas, further complicating total surveillance from a regulatory perspective. One significant challenge is coordination: private operators, policymakers, militaries, police, and coast guards all share some responsibility for securing undersea cables, but the distribution of this responsibility varies from country to country.⁸⁴ Even close to their own shores, governments struggle to acquire a fully integrated operational picture of activity below and above water.⁸⁵

Securing, Protecting, and Repairing Europe’s Cables

As Europe’s leading military alliance, NATO has long been aware of vulnerabilities to member states’ critical undersea infrastructure but has only recently placed focus on protection strategies, including subsea surveillance.⁸⁶ The alliance has ramped up its air and naval patrols and exercises in the North and Baltic Sea, where Russian ships are increasing their own activities.⁸⁷ NATO has also tasked its Joint Force Command Norfolk with undersea threat monitoring and subsea infrastructure protection; and, at its summit in Vilnius, Lithuania, in July 2023, NATO established a Maritime Centre for the Security of Critical Undersea Infrastructure in the United Kingdom.⁸⁸ In October 2023, NATO defense ministers endorsed a new Digital Ocean Vision, an initiative aimed at enhancing maritime situational awareness and surveillance “from seabed to space.”⁸⁹ The alliance has incorporated the initiative in recent joint exercises, testing maritime unmanned systems during the Dynamic Messenger 23 exercise in September 2023 and the REPMUS 24 exercise in September 2024.⁹⁰ And in November 2024, Polish Prime Minister Donald Tusk proposed a new Baltic Sea maritime patrol program.⁹¹

Some larger European countries are exploring ways to improve their own undersea surveillance capabilities. Since releasing a Seabed Warfare Strategy in February 2022, France has invested in the development of undersea drones and surveillance infrastructure.⁹² In October 2024, the French Navy ordered an autonomous underwater vehicle capable of operating as deep as 6,000 meters below the surface.⁹³ Italy has similarly increased its undersea surveillance capacities following the Nord Stream explosions.⁹⁴ In 2021, the United Kingdom announced the launch of two multirole surveillance ships, designed to support various underwater operations, including undersea surveillance and cable protection.⁹⁵ The first of the two ships, the RFA Proteus, formally entered service in October 2023.⁹⁶

Regarding the cybersecurity of Europe’s subsea data cables, at a meeting in Nevers, France, in March 2022, EU telecommunications ministers released a statement, the Nevers Call to Reinforce the EU’s Cybersecurity Capabilities (hereafter referred to as the Nevers Call), in which they labelled telecommunications networks as “prime target[s]” for cyber attacks.⁹⁷ Shortly after the release of the Nevers Call, in December 2022, the EU adopted a new directive on cybersecurity, known as the NIS2 Directive, urging member states to, among other actions, include the cybersecurity of undersea communications cables in their national security strategies, map for potential cybersecurity risks, and deploy mitigation measures.⁹⁸ In its June 2023 Final Assessment Report, the EU-NATO Task Force on the Resilience of Critical Infrastructure recommended the promotion of best practice exchanges between civilian and military actors on implementing relevant cyber-related policies and legislation.⁹⁹ In February 2024, the European Commission released its first Recommendation on Secure and Resilient Submarine Cable Infrastructures, which included the need for more frequent risk assessments and stress tests on the cybersecurity and physical security of subsea cable systems.¹⁰⁰ The 2024 recommendation also calls for enhanced information sharing between member states and better cable maintenance and repair capabilities. Finally, the 2024 New York Joint Statement, of which the EU is a signed party, calls for signatories to build and maintain their subsea cable infrastructure, “incorporating cybersecurity best practices that safely facilitate international communication.”¹⁰¹ But the effectiveness of these measures depends on national capitals’ willingness to cooperate and to effectively and quickly implement them.  

To sustainably ensure the physical and cybersecurity of their undersea infrastructure, Europeans must acquire a clearer picture of their assets and vulnerabilities. To that end, the European Commission wants to map and review the subsea cables connecting Europe to identify potential weak spots. EU officials are concerned that they do not possess a clear sense of who owns and operates European undersea infrastructure.¹⁰² They want a more centralized overview of private sector data in order to identify potential issues related to high-risk owners and guarantee that there is enough diversity and redundancy in Europe’s undersea infrastructure network to ensure the security of data supply. The United States has created a similar dedicated review process, intent on restricting the use of equipment by untrustworthy suppliers in cable systems.¹⁰³  

EU policymakers face several obstacles. First, it is difficult to convince member states to share information. As an institution, the European Commission is relatively new to European security and defense and has little practice with managing sensitive information. EU member states are reluctant to share details about their critical infrastructure with each other, let alone a third party such as the commission.¹⁰⁴ As a result, the commission has so far had to work mostly with public data about Europe’s subsea cables. The second challenge faced by all European policymakers is accessing and integrating data from the different private companies that operate subsea cables connected to Europe. In Europe, 80 percent of all critical infrastructure is owned or controlled by private entities, which means that it is the civilian industry that has the capacity to survey undersea cables and map vulnerabilities.¹⁰⁵ This dynamic requires a concerted focus on building robust public-private partnerships. 

With this in mind, in February 2023, NATO stood up a new Critical Undersea Infrastructure Coordination Cell in Brussels to operate as a strategic hub between NATO allies, partners, and the private sector, which held its first meeting in May 2024.¹⁰⁶ The cell convenes military and civilian officials, as well as business representatives, to map vulnerabilities and synchronize efforts between governments and the private sector. NATO-EU cooperation on subsea cable protection is critical and an obvious step: protecting critical infrastructure from threats requires an approach that merges both military and civilian measures. To this end, the two organizations have created an EU-NATO Task Force on critical infrastructure resilience.¹⁰⁷

Complementary to efforts taken at the NATO and EU levels, various constellations of European countries have also emerged to protect subsea cables against physical attacks and sabotage. The Joint Expeditionary Force (JEF), made up of the United Kingdom, the five Nordic countries, the three Baltics, and the Netherlands, agreed in June 2023 to accelerate cooperation to “detect, deter, and respond to threats against our critical undersea and offshore infrastructure.”¹⁰⁸ Months later, in December 2023, the JEF conducted a joint exercise in the Baltic Sea focused on subsea infrastructure protection.¹⁰⁹

Additionally, in April 2024, six North Sea countries (Belgium, Denmark, Germany, the Netherlands, Norway, and the United Kingdom) pledged to improve information and knowledge sharing to better protect critical undersea infrastructure from foreign interference and disruption.¹¹⁰ Individual European governments have also taken steps to strengthen public-private partnerships regarding undersea cables. For instance, after the Balticconnector pipeline incident last fall, the Norwegian government cooperated with its energy companies to first map oil and gas pipelines and then the electrical grid and subsea cables.¹¹¹

The EU and NATO can also help to incentivize the development of new technologies needed to secure and protect current and future subsea cables. For instance, EU member states Greece, Italy, Poland, and Portugal have joined forces under the union’s defense framework, Permanent Structured Cooperation or PESCO, to work on the Harbour & Maritime Surveillance and Protection project.¹¹² The aim is to develop integrated systems of maritime sensors, software, and platforms, which will fuse and process data to detect and identify potential maritime threats.  Belgium, France, Germany, Ireland, Italy, Portugal, Spain, and Sweden are also working on a project, which aims to increase the EU’s operational efficiency in the protection of critical maritime infrastructure protection.¹¹³ NATO is similarly investing in resilience by funding research into ways to seamlessly reroute internet traffic from subsea cables to satellites in the event of natural disasters or sabotage.¹¹⁴

Competing for Global Influence 

China is investing in subsea cable projects around the world not only to boost connectivity and increase redundancies in its immediate surroundings but also to deepen its geopolitical influence in strategic regions. As part of its broader Belt and Road Initiative (BRI), the Chinese government in 2015 announced its plans for a Digital Silk Road Initiative (DSRI), through which Beijing would invest vast sums of money in developing countries’ digital infrastructure.¹¹⁵ Although not explicitly part of these investment deals, the Chinese government has expected and often received political and diplomatic sway in return among recipient countries.¹¹⁶ Both the United States and the EU have each launched similar mechanisms aimed at countering Chinese influence in developing countries and regions, yet these programs fail to match the BRI or DSRI in scale.¹¹⁷

The EU’s Global Gateway initiative was launched in 2021 as an alternative offer to countries considering Chinese strategic funding of physical and digital infrastructure through BRI and DSRI. Through this €300 billion (nearly $318 billion) instrument, the EU wants to establish strategic links with developing regions—especially Africa—and avoid overreliance on geographical chokepoints, such as critical minerals sourced from China.¹¹⁸ The EU funds digital infrastructure projects under the auspices of Global Gateway, through the Connecting Europe Facility (CEF). CEF Digital was initially allocated a budget of €1.6 billion ($1.7 billion) for 2021–2027, with €389 million ($412 million) of that sum earmarked for “backbone connectivity projects,” of which the vast majority of funding has gone toward the construction of subsea cables either between EU countries or between member states and third countries.¹¹⁹ In its most recent CEF Digital call for proposals, the European Commission wrote that “CEF Digital is expected to be one of the main funding instruments for secure and resilient submarine cables reinforcing the links between Member States.”¹²⁰

Nearly halfway into the 2021–2027 funding period, Brussels has already spent or committed more than the initial €389 million set aside for these backbone connectivity projects through CEF Digital. Since 2022, after three rounds of proposals, forty-six subsea cable works and studies projects have been awarded at least partial funding under CEF Digital for a total of approximately €412 million ($436 million). The EU recently announced an additional €542 million (nearly $574 million) for backbone connectivity projects through CEF Digital for the 2024–2027 period.¹²¹ If this amount is spent in its entirety, the EU will have invested nearly €1 billion on subsea data cable projects from 2021–2027. To be sure, the amount is a drop in the bucket compared to the financial commitments made by China under its DSRI. Nevertheless, the projected increase in funding dedicated to subsea cable projects by the European Commission signifies the issue being taken more seriously in Brussels.

Despite this financial commitment, several factors indicate that this money is either not adequate or not being allocated in a strategic manner. The European Commission wishes to spread the money it spends on subsea cables across multiple projects, rather than fewer, costlier projects.¹²² This approach has led to a mismatch in financing for the projects the European Commission deemed to be most important and the total funding that these projects receive. In doing so, the commission risks partially funding projects of great geopolitical significance that do not receive enough private financing to be completed.

To address this problem, the commission has tasked a group of experts to identify strategic Cable Projects of European Interest (CPEIs) that the EU should invest in. This group will assist an evaluation committee in assessing EU-funded projects based on five criteria: priority and urgency, maturity, catalytic effect, impact, and quality.¹²³ Yet it remains unclear how much weight the experts’ feedback on CPEIs has on any decisions regarding CEF Digital funding compared to national and distributional interests. Each approved project must receive a score of three out of five or higher for each of the five criteria, and EU officials have labelled previous CEF Digital funding allocations as political decisions lacking in transparency.¹²⁴ Moreover, the projects that receive the highest score from the evaluation committee rarely receive their full grant requests, compared to lower-ranking applications.¹²⁵

The geographical distribution of subsea cable projects that have received EU funding thus far also raises questions about the EU’s strategic approach in expanding its undersea digital network. EU CEF subsea cable projects have largely focused on boosting redundancies in and around Europe and its outermost regions. Much fewer projects connect the EU to third countries, including African countries (especially beyond Tunisia or Morocco) and Latin American countries (beyond extending the pre-existing EllaLink cable, which connects Brazil to Portugal).

Three strategically important regions that the EU has begun to focus on regarding new subsea cables are the Arctic, the Black Sea, and South Asia, particularly India.

Regarding the Artic region, as warmer global temperatures melt ice in the Arctic Ocean, new digital connection routes are emerging. Not only would a cable laid through the Arctic that connects, for example, Europe to Asia be much shorter than existing infrastructure, reducing transmission time, but it would also avoid current chokepoints or flashpoints such as the Suez Canal and the Red Sea.¹²⁶ Moreover, the remaining ice cover grants natural protection against human tampering with cables for much of the year. The EU has already allocated some funding to separate Arctic cable projects, including the Far North Fiber and the Polar Connect cables.¹²⁷ But more can be done to see these projects to completion, including support for cable ships with icebreaking capabilities and more adequate funding for grant requests in future CEF Digital calls.

In the Black Sea, the EU intends on investing in a new undersea data cable that would connect EU member states with Georgia.¹²⁸ Not only would this cable improve Georgia’s digital connectivity, but it would also reduce the country’s dependence on cables running through Russia. In addition to this planned cable, which is still in the feasibility assessment stage, the EU has invested a small amount of money (€57,500, or around $61,000) through CEF Digital to investigate possible subsea cable landing points along Bulgaria’s Black Sea coast. Such projects are crucial in the context of protecting EU accession countries against an emboldened Russia, although it remains unclear how fast cables can currently be laid in the Black Sea with Russia’s ongoing military activity there.

Finally, the India-Middle East-Europe Economic Corridor (IMEC), announced at the September 2023 G20 Summit, includes plans for boosting connectivity between Europe and India through subsea cables, such as the Blue and Raman cable systems.¹²⁹ Blue-Raman, which is currently under construction, will connect Europe to India while bypassing Egypt—cementing the Gulf’s role as a “digital anchor” between Europe and India.¹³⁰ Google and ASN are the primary investors and cable suppliers in the Blue-Raman cable systems, introducing a potential challenge to Huawei’s digital dominance in the Gulf to date. European, Middle Eastern, and Indian participants of the IMEC will have to negotiate these tensions.

Recommendations

Europeans are beginning to act to better protect and expand upon their existing undersea cable systems. Below are a series of recommendations that identify gaps in current European strategies vis-à-vis undersea cables and provide steps to address existing shortcomings. Directed at European lawmakers, these recommendations aim to ensure that European countries maintain their edge in subsea cable installation; are better prepared to protect and repair damaged cable systems; and strategically leverage global partnerships across cables’ lifespan, from component sourcing, to route planning and installation, and finally to maintenance and repair.

Map vulnerabilities. In spite of the flurry of recent initiatives to protect and secure European subsea cables, the level of understanding and preparedness still varies from country to country. The challenge is to ensure the same level of security across European borders. The EU’s regulatory power is one useful tool to promote the uniform application of high security standards. Gathering a more complete picture of Europe’s undersea infrastructure is crucial. To this end, the EU and NATO must invest in the exchange of know-how and technologies between allied governments and between public and private actors, and earn the trust of all relevant stakeholders to pursue collective solutions.

 Invest in secure supply chains. Europeans should invest in secure supply chains for the components of subsea data cables, including metals such as steel and copper, silicon, and fiber optic components. These efforts should be done in partnership with like-minded countries, including, for instance, signatories of the New York Joint Statement. The signatories should also commit to increase information sharing about the sources of components and cable services. Such information exchanges should take place for all life stages of the cables, including during deployment, maintenance, and repair. Where possible, efforts by European actors to secure the subsea cable supply chain with strategic partners can work hand in hand with secure supply chain initiatives around the clean energy transition, such as those discussed as part of the U.S.-EU TTC.¹³¹

 Invest in infrastructure protection technology. The EU should use its defense industrial research and development funding tools, such as the European Defense Fund, to support member-state investment in technologies to protect undersea cables and landing stations. It could, for instance, fund research on better sensor technology to map the seafloor and enable the long-term monitoring of underwater infrastructure and to deter attacks or at least detect damage more easily. Any new EU-funded cables should be built with those features. The EU might also consider including a dedicated envelope in the EU budget to allow governments to invest in protecting their critical infrastructure.¹³² There is opportunity to partner with the United States, here, too—through NATO’s defense innovation funding tools, for instance.

 Stand up joint naval policing missions. In response to the November 2024 undersea cable cuts in the Baltic Sea, Polish Prime Minister Tusk urged his Baltic and Nordic counterparts to establish a joint naval policing mission to better protect their undersea infrastructure against external security threats. The program would operate in parallel to the preexisting joint Baltic Air Policing mission.¹³³ Baltic Sea region states should implement this proposal as quickly as possible and should share best practices with other NATO allies. Indeed, if this initiative is successful in the Baltic Sea, similar regional initiatives within NATO could be created to boost deterrence against threats to undersea infrastructure in the North Sea, the Mediterranean, and the North Atlantic.

 Reduce cybersecurity risks and vulnerabilities. European actors are aware that subsea data cables are susceptible to cyber as well as physical attacks and have on multiple occasions called on EU and NATO member states to mitigate cybersecurity risks in their subsea cable systems and exchange best practices with one another. EU member states should implement recommendations under the NIS2 Directive, with respect to both subsea data cables and cable landing stations. EU and NATO officials should also ensure that subsea cable systems are a standing agenda item for discussion in Structured Dialogues on Cyber—the first of which was held in October 2024.¹³⁴ Through its Critical Undersea Infrastructure Coordination Cell in Brussels, NATO should facilitate and deepen exchanges with private sector actors involved in cable installation and repair, as well as in network management and data security.

 Strengthen legal instruments for cable protection. All EU countries, and nearly all European NATO members (absent Türkiye), that are connected to subsea data cables have ratified UNCLOS. The same is not true of the 1884 Cable Convention. Bulgaria, Croatia, Cyprus, Estonia, Finland, Ireland, Latvia, and Lithuania all have yet to ratify the treaty and should do so immediately. It is currently only the 1884 Cable Convention—and not UNCLOS—that grants military vessels the power to stop nonmilitary ships suspected of damaging subsea cables.¹³⁵ All European countries should also review their respective criminal codes related to Article 21 of UNCLOS—which grants states permission to penalize willful damage to subsea cables in their territorial waters—to ensure they possess specific penal consequences for sabotage against subsea cables and that such consequences are of an adequate degree. These measures should be coordinated among EU and NATO members to ensure legal standardization in all European waters. Finally, EU governments should explore avenues to begin negotiations on a new treaty instrument, under UNCLOS, that addresses the current international legal shortcomings regarding cable protection and security.

 Invest in cable repair capabilities. The EU should provide funding to create its own version of the U.S. Cable Security Fleet. Alternatively, as suggested in a 2024 U.S. Senate Foreign Relations Committee report, the United States could expand its Cable Security Fleet to “work with European partners.”¹³⁶ Europeans should also work with, and offer support to, smaller partner countries who lack access to repair capacities. And they should do more to bolster their subsea cable-laying and repair capabilities for future geographically challenging cable routes, including in the Arctic. Whether retrofitting existing icebreakers with cable-laying capabilities or constructing new vessels entirely, Europe has an opportunity to take the lead in the emerging domain of subsea Arctic cable laying and repair.

 Avoid bureaucracy. The EU and NATO have important resources and regulatory and budgetary tools to support Europeans in their efforts to secure and protect their undersea infrastructure. But they should learn from their ally: in the United States, a centralized approach has led to complaints about bureaucratic delays in the process of licensing subsea cables and vetting the trustworthiness of suppliers, significantly slowing down the process for all involved stakeholders.¹³⁷ Brussels institutions becoming more involved in the issue must avoid setting up excessive bureaucratic and opaque processes. They can do so by ensuring robust dialogue takes place between European security, regulation, and industry communities in settings such as NATO’s Coordination Cell.

 Invest in Europe’s strengths. Possessing the current market leader in subsea cable installation should not encourage complacency in Europe. Drastic increases—as well as more strategic thinking—in resource allocation are still necessary if the EU wishes to compete with both China and the United States in future cable projects. Although achieving full European digital autonomy is unlikely given the lack of hyperscalers and cloud providers in Europe, there are still ample areas for the EU and individual European countries to increase investment related to subsea cable systems.

 Seek out opportunities for allied business collaboration. There will be many instances where European cable companies, such as ASN, are in direct competition with their U.S. and Japanese counterparts, including SubCom and NEC. Yet if the ultimate goal of U.S. and, to a less extreme extent, European strategy vis-à-vis undersea data cables is to restrict the rise and dominance of Chinese players such as HMN Tech, then more emphasis and attention should be given to opportunities for collaboration between U.S., European, and other allied cable construction firms. One concrete agenda item for Europeans to discuss with the incoming U.S. administration would be the establishment of technology sharing or joint venture agreements between U.S. and European cable companies, potentially through the new NATO Critical Undersea Infrastructure Coordination Cell in Brussels.¹³⁸

 Reform EU funding for cable projects. Having the EU fund subsea cable projects through CEF Digital is useful. Yet future funding calls should address the mismatch in the geostrategic significance of potential cable projects and EU-allocated money. The European Commission would put its money to better use if it provided more funding for a select number of strategically important projects, rather than continuing to spread its allocated funds wider with every new call for proposals. The EU should also include geopolitical importance as a concrete criterion by which it evaluates CEF Digital applications. Although applicants are encouraged to demonstrate that their proposal has geostrategic importance, potentially funded projects are not currently evaluated on this merit.¹³⁹

Improve cable governance. Several entities are responsible at the national, EU, and international levels for the regulation and protection of subsea cables. For example, national telecom authorities often supervise the security of public communication networks while navies, coast guards, and police forces oversee the protection of physical infrastructure.¹⁴⁰ EU member states should stand up interagency working groups dedicated specifically to subsea cable regulation and security. Each EU member state should also have a specific point of contact regarding its subsea cable infrastructure, so as to maximize efficiency and efficacy of inter-European communication on undersea cables. European governments should work to ensure that both European officials and private sector actors are well-represented in international fora related to subsea cable security and resilience.

 Expand international cable partnerships. In April 2022, the EU and India launched their own Trade and Technology Council (TTC), Brussels’ second such endeavor after its TTC with the United States.¹⁴¹ Unlike its TTC with Washington, the EU-India TTC does not have a working group that covers subsea data cables. Leaders in Brussels and New Delhi should change this, particularly as digital connections between Europe and India increase as the IMEC progresses. The EU should also leverage its expertise and market advantages in subsea cable construction and repair to provide training assistance to third countries, especially if these countries are being encouraged to either phase out high-risk vendors from their cable systems or opt for U.S. or European alternatives.

The authors would like to express their sincere thanks to Katrine Westgaard for her stellar research assistance in an early phase of this project.