The next attack on Australia’s submarine cables may not come from a ship dragging its anchor, but from a keyboard thousands of kilometres away. Cyber risks to this critical infrastructure are at least as serious as physical ones, yet they receive a fraction of the attention.
The security of submarine telecommunication networks – which transmit approximately 99% of Australia’s international digital traffic – is increasingly a priority for governments across the Indo-Pacific. In late-May, Australia’s Deputy Prime Minister and Minister for Defence Richard Marles warned that the seabed was becoming a ‘battlefield,’ noting that Australia has been ‘slow … to recognise [submarine cables] as the strategic targets they have become.’ Functioning submarine cable networks are vital to enable our economy and increasingly digitised society.
The images that dominate this debate are of ships dragging anchors across the seabed, as vessels in the Baltic Sea and around Taiwan are suspected of doing in several high-profile incidents since 2023. But anchors are not the only issue. Cyber vulnerabilities represent a separate domain of potential threats to submarine cable systems. Our recent report ‘Connected & Protected: Building Australia’s Submarine Cable Resilience’ finds that cyber threats to the uninterrupted operation of submarine cables are at least as serious as physical ones, and receive far less attention.
Cyber Attacks, Physical Consequences
Unlike physical attacks, which can be difficult to undertake and may carry greater risks of provoking retaliatory action, cyber-attacks can be conducted more covertly and remotely, potentially making these tactics an attractive option for states seeking to disrupt the transmission of data across subsea cable infrastructure. They could also be used to disable key service providers such as cable maintenance vessels. For an adversary weighing its options, that could make cyber a lower-risk path to a similarly severe outcome.
While submarine cables share the cyber vulnerabilities of other telecommunications assets, the stakes are higher. A small number of cable systems carry almost all of a country’s international data traffic, so disrupting even one has outsized and highly visible effects.
Submarine cable systems share characteristics with other critical infrastructure that allows digital control of operational technology, making them vulnerable (in insecure network architectures) to attacks that cause physical harm through digital means. The Stuxnet worm, which used software to destroy industrial centrifuges, showed that this kind of attack is not theoretical.
A cyber intrusion that allows an attacker the control to disable access to a submarine cable system, or manually override safe operating procedures or built-in safeguards, causing the physical destruction of large parts of the system, would cause a prolonged outage, far longer than the weeks it typically takes a repair ship to locate and fix a conventional cable fault.
There are three main cyber risks to submarine cable systems – those that compromise confidentiality, integrity, or availability of data. That is, an adversary can seek to intercept and collect the data; manipulate, divert, or undermine trust in the data; or damage the system and disrupt the service and flow of data.
One of the few publicly reported examples of a cyber-attack on a submarine cable system to date occurred in April 2022, when the US Government revealed it had thwarted an attack on a telecommunications company managing a trans-Pacific submarine cable linking Hawaii. This attack was enabled by a credentials-related breach. It is likely that there are other cases of cyber-attacks on submarine cable networks that have not been publicly reported.
The Risks of Remote Access
Submarine cables require onshore equipment to transmit and receive optical signals and power the system. This equipment is centrally monitored and controlled by a software platform known generally as a network management system. Historically, these networks were isolated from the Internet and accessed locally via secure enterprise networks.
Today, for greater efficiency and due to work-lifestyle changes, engineers often manage these global networks remotely by accessing enterprise networks over the Internet. While the network management system is usually segregated from broader corporate systems, this shift to remote access significantly expands the attack surface for unauthorised access. The cyber-attack on Viasat’s KA-SAT satellite network on the first day of the 2022 invasion of Ukraine is one example of a remote access breach allowing access into a trusted management network that resulted in destructive ‘wiper’ malware being applied to the managed equipment.
For commercial cable networks, it is also common industry practice for third-party vendors to have remote access to the network to carry out software updates on equipment. This practice has caused issues in the past as any change to systems or human interaction with the system comes with risk. It is not unheard of for cable system outages to be triggered by software updates, such as a planned system upgrade on the Southern Cross Network in 2012 that caused a 70-minute outage.
While human error can cause significant outages, more concerning is the possibility that threat actors can exploit these legitimate access methods to interfere with, steal data from, or cripple the systems of a network operator. In a worst-case scenario, threat actors could breach the networks of multiple cable operators and pre-position themselves for a coordinated attack on multiple carriers simultaneously.
The risk of cable disruption through hacking may be magnified by poor security practices from cable operators or equipment vendors. Many remote network management systems run on widely used operating systems such as Linux or Microsoft Windows – a double-edged consideration since although these platforms benefit from regular update patches and large security communities, their ubiquity also makes them familiar territory for malicious actors.
Highly specialised or obscure operating systems offer less attacker familiarity, but also a smaller community to scrutinise its security. Additionally, the mechanisms through which vendors update and can control systems once deployed on the customer end may introduce other kinds of risks into this part of the cable supply chain.
Cable maintenance vessels may also be the target of cyber-attacks. Indeed, the headquarters of one of the leading international cable maintenance groups has been the subject of a distributed denial-of-service attack. While ship owners are required by the International Maritime Organization to incorporate maritime cyber risk management into safety management systems, it is up to ship owners to properly implement this mandate, and relevant expertise is scarce.
Taken together, these risks span the whole cable system including network management systems, cable landing stations and the vessels that maintain them. They warrant at least the same policy attention as physical sabotage.
Strengthening Australia’s Cable Security
Our research identifies several key actions that could help mitigate the risk of cyber exposure of our submarine cable networks. First, we recommend designating the Australian Signals Directorate as the lead technical agency for the cyber security of submarine cable systems, providing threat intelligence, advice and incident response support directly to cable operators.
Second, we advocate for requiring, through the Security of Critical Infrastructure (SOCI) Act framework administered by the Department of Home Affairs, that all new submarine cable systems landing in Australia are built secure-by-design, closing the current gap in the SOCI regime. Moreover, the regime should mandate regular cyber security exercises and vulnerability assessments for cable systems designated as Systems of National Significance.
Third, we assert that developing guidance for cable operators on securing remote network management systems, including network segregation, access controls, vendor management, and software update protocols would partly mitigate these challenges.
Public scrutiny of submarine cables has focused on sabotage and physical damage. Cyber security deserves at least equal weight. After all, fibre-optic cables are useless without the myriad components, equipment, management systems and software that send and receive the bits that our modern digital society relies on.
Jocelinn Kang is the founder of Nodalys, a boutique technology and national security consultancy that aims to strengthen digital resilience through research, advisory and training.
Dr David Brewster is a Senior Research Fellow with the ANU National Security College. He is one of Australia’s leading experts on Indian Ocean maritime security and is the author of many books, reports, and papers on that subject.
Dr Samuel Bashfield is Research Fellow at the La Trobe Centre for Global Security, where he studies geopolitics and defence trends.
Mike Constable is a senior executive with 30 years in the submarine cable industry, having held prominent leadership roles in both investment and supplyside sectors. He is founder of Infra-Analytics, a strategic advisory consultancy and serves as Vice Chairman of the UN Joint Task Force on SMART cables.
Dr Anthony Bergin is an Expert Associate at the ANU National Security College. He was formerly the Research Director and Deputy Director at the Australian Strategic Policy Institute. He holds a doctorate on the law of the sea.
This piece is adapted from the Occasional Paper ‘Connected & Protected: Building Australia’s Submarine Cable Resilience’ published by the Australian National University’s National Security College, and supported by funding from the Australian Department of Defence through a Strategic Policy Grant. All views expressed are solely those of the authors.
This article is published under a Creative Commons Licence and may be republished with attribution.
Photo: “Submarine Cable” by ~~ ItsJegh ~~, CC BY 2.0
