Undersea cables for Internet: A major strategic challenge
Undersea cables for Internet are a true strategic issue because they transport 95% of global Internet traffic. Conference moderator Jérôme Saiz cites a British think tank: underwater cables for Internet are a "vital infrastructure with ambiguous international legal protection that can be damaged by unsophisticated and non-military means".
We depend totally on these cables in 2019, since Internet can be cut to an entire small country, as was the case in Algeria when a fishing vessel severed a cable, depriving 90% of the country of its network.
There are also economic risks. Today, operators no longer lay the cables. Instead, GAFAM ("Web giants", i.e. Google, Apple, Facebook, Amazon and Microsoft) lay their own cables. Does this mean they are entitled to define their own content management rules?
To address all these issues, General Didier Tisseyre, leader of French cyber forces; Garance Mathias, attorney; and Raphael Marichez, who works for the Prime Minister, spoke at this round table which was held at Les Assises de la Sécurité et des Systèmes d’Information last October in Paris.
The links between law and undersea cables for Internet
The first undersea telecommunications cables were laid in 1851 between France and England, mainly to send stock market news. Later, further cables were laid in the Atlantic and Pacific Oceans by nations seeking to control their colonial empires.
There is currently one billion kilometres of undersea cables for Internet laid and managed by operators. However, content creators like Netflix want to control the media transmitting their content.
When does the law intervene, and how?
By default, the law defends national sovereignty. The laws regarding these networks facilitate the economy. To facilitate trade and important exchanges, these laws have an extraterritorial scope. Today, the issue focuses on the control of information and data, areas that are covered by public international law.
Historically, undersea law inspired the construction of cyberspace law. Installing a cable in national and international waters requires knowledge of the licenses in force, identifying the country of origin, the area concerned, etc.
Another question concerns undersea and cyberspace laws: can the owner of the cable (i.e. the one investing in its installation) decide what content will pass through it? These owners are often conglomerates of 20 or 30 different investors that derive a clear return on investment from these systems.
After installing undersea cables for Internet, the right of use applies: the owners can do what they want with what they lease, but they are responsible for it.
How can we qualify the threat against undersea fibre?
Are the risks affecting undersea networks physical, economic or logical? If the cables were to be cut between Britain and the rest of the world in an act of sabotage (physical threat) in the United Kingdom, the country would run an existential risk, in the concrete meaning of the term: the country’s very existence would be threatened.
What about France? Are France’s undersea cables for Internet mapped? In any event, nations or entities might do well to voluntarily split undersea cables. This would be easy, since a disabled oil tanker in Sicily cut six or seven cables in 2007-2008. Three zones are concerned:
- In coastal areas, surveillance is too strong to allow sabotage.
- In deep areas, advanced means would be required to reach undersea cables for the Internet.
- Only intermediate areas are sensitive and could therefore be sabotaged.
Is the physical threat stronger than the cyber threat?
The answer may be geographical: an isolated island will more easily suffer a physical threat, while continental nations are at greater risk of suffering an IP routing attack.
Currently, infrastructures are not designed to be open. Still, data transport is being virtualised on a static network. Like a rail network or power grid, the undersea network is insufficiently protected. When nations automate data transport for the sake of efficiency, they open a vulnerability bottleneck. Automatisms can be challenged easily.
As mentioned, 95% of global traffic passes through undersea cables. The remaining 5% are transmitted by satellites. These transmission modes are used by military or civilian bodies and depend on a protocol. They are truly autonomous, but expensive. Only natural disasters can sometimes lead to satellite networks being used. However, the rest of the world traffic cannot be deviated to them, for a lack of means.
In the event of sabotage or accident, insurance law applies
Whether the incident is intentional or not, insurance contracts come into play, raising a number of difficulties. Like any type of claim, fault and cause must be demonstrated. However, evidence is difficult to obtain in the case of undersea equipment.
Indirect damage is covered by specific contracts and involves restoration costs or personnel expenses. Under the law, this is indirect damage. Finally, the risk is managed primarily financially. In international law, NATO does not consider damage to a cable that cuts off a country’s network to be an act of war. NATO Article 5 does not apply, although some countries demand that it be.
Cyberspace is a theatre of operations comprising several circles: civilian, army and infrastructures. These different strata are all activated at the same time in the event of an attack. The cable is the vector of this whole system. At the same time, GAFAM own their own networks and do not hide their sometimes geopolitical ambitions.
This is the case of Google that is creating its network in South America. Who governs it? Can nations maintain economic and military sovereignty without using expensive satellites, or are they forced to use private undersea structures?
Whatever the future of ownership of undersea cables for Internet, nations have a strong interest in maintaining autonomy. There has to be transparency on the conglomerates and other infrastructure owners.
Speakers: Didier Tisseyre, Ministry of the Armed Forces; Garance Mathias, Cabinet Mathias and Raphaël Marichez, DINSIC