The Hidden Backbone of the Internet: Subsea Cable Security with Alex Botting
Season 2 Episode 48 •Show Notes
Undersea cables quietly carry almost all global internet traffic yet rarely feature in security debates. This episode explains how subsea infrastructure underpins the global economy, data flows, and modern military operations while facing frequent “accidental” disruptions and growing geopolitical risk. Listeners hear why chokepoints, island dependencies, and hotspots from the Red Sea to the Taiwan Strait keep national security officials up at night. The conversation also explores how redundancy, smarter investigations, and faster permitting can harden this hidden backbone against both negligence and sabotage. Frank and Alex close by looking at AI, quantum, fiber sensing, and satellite backups as the next frontier for cable resilience and deterrence.
Main Topics Covered
- Subsea cables as the physical backbone of global internet and finance.
- How outages happen, from ship anchors to suspected sabotage.
- Strategic chokepoints, island dependencies, and contested regions like the Red Sea.
- Building resilience through redundancy, permitting reform, and trusted infrastructure partners.
- New monitoring tools: fiber sensing, AI, and quantum for cable security.
- How governments and industry share intelligence and fund resilient capacity.
Key Quotes:
“Subsea cables carry the vast majority of Internet traffic around the world… Estimates vary from 95 to 99% of Intercontinental data traffic. So when you think about the Internet, subsea cables are the basis of the Internet.”
“Redundancy is our biggest defense… We have 100 cables coming into the US and therefore it makes it very hard to do anything meaningful in a short time frame to actually impact it.
“Do I think our adversaries would want to do this [tap cables]? Yes… Do I think they can do it? Possibly. Do I think the juice is worth the squeeze? No, I don’t.”
“There were more cable cuts in the Taiwan Strait in January of this year than either 2024 or 2023 in total. That is a sharp uplift at a time when we know that hostility in that part of the world is rising. I would be shocked if none of those incidents were knowingly done.”
“The entire Starlink… global capacity is equivalent to [only a few] subsea cable[s]… So when you talk about truly replacing [subsea cables], it’s not there.”
Relevant Links and Resources
Alex Botting paper “Shoring Up Subsea Security” for the Center for Cybersecurity Policy and Law.
Alex’s Podcast: Distilling Cyber Policy
Guest Bio: Alex Botting is the Senior Director of Global Security & Technology Strategy at Venable. His career has focused on shaping policies at the intersection of security, technology & telecoms in more than 50 countries and multilateral organizations around the world. In November he testified before the House Homeland Security Committee about threats to the subsea cable infrastructure.
Transcript
1
00:00:00,000 –> 00:00:01,000
Alex Botting [00:00:00]: Subsea cables carry the vast majority of Internet traffic around the world. Estimates vary from 95 to 99% of Intercontinental data traffic. So when you think about the Internet, subsea cables are the basis of the Internet.
2
00:00:01,000 –> 00:00:02,000
Frank Cilluffo [00:00:17]: Welcome to Cyber Focus from the McCrary Institute, where we explore the people and ideas shaping and defending our digital world. I’m your host, Frank Cilluffo, and this week I have the privilege to sit down with Alex Botting to discuss a topic that doesn’t often grab headlines and when it does, look out, but is so essential to our economy, our national security and our way of life. And we’re talking about undersea cables, an issue that probably doesn’t get the attention it deserves. And really looking forward to an illuminating discussion from one of the premier experts on this, Alex, who is currently at Venable, where he is leading a group looking at national security and technology, and his whole career has sort of been at the intersection of security and technology. Recently authored a paper that I recommend everyone read for the center for Cybersecurity Policy and Law on shoring up subsea security, and most recently testified before the House Homeland Security Committee on this topic. So, Alex, really good to sit down with you.
3
00:00:02,000 –> 00:00:03,000
Alex Botting [00:01:20]: Thanks for having me in, Frank. And I’ll make sure my mum listens to that intro.
4
00:00:03,000 –> 00:00:04,000
Frank Cilluffo [00:01:24]: Well deserved. So, truth is, it is, I mean, and I think it’s important we actually go to the basics and ultimately why undersea cables matter how the system really works. And I think just the scale and importance surprises a lot of people. So how would you explain this to your mom?
5
00:00:04,000 –> 00:00:05,000
Alex Botting [00:01:47]: That’s a good, good, good place to start.
6
00:00:05,000 –> 00:00:06,000
Alex Botting [00:01:51]: Subsea cables carry the vast majority of Internet traffic around the world. So when we think of sending something from here to maybe somebody down in California, you’re not necessarily going across the terrestrial networks to get there. The way that the Internet’s routed, it could go via New Zealand to get there. In order to achieve that, you need cables that cross the ocean. We’ve been doing this for over 100 years, laying cables that can transmit messages, whether it was audio or bits and bytes, across the Oceans. There are 597 of those today.
7
00:00:06,000 –> 00:00:07,000
Frank Cilluffo [00:02:27]: Wow.
8
00:00:07,000 –> 00:00:08,000
Alex Botting [00:02:29]: And they carry, estimates vary from 95 to 99% of Intercontinental data traffic. So when you think about the Internet, subsea cables are the basis of the Internet.
9
00:00:08,000 –> 00:00:09,000
Frank Cilluffo [00:02:41]: So it really is the underpinnings of our economy today. Right? And our modern societies writ large and, and has significant security implications too. What, what comes top of mind there?
10
00:00:09,000 –> 00:00:10,000
Alex Botting [00:02:54]: Oh, that’s a good question. We like to think of this kind of through the, the CIA triad. Confidentiality, integrity, availability.
11
00:00:10,000 –> 00:00:11,000
Frank Cilluffo [00:03:03]: Not Central Intelligence Agency.
12
00:00:11,000 –> 00:00:12,000
Alex Botting [00:03:05]: Correct. The other CIA. Yeah, I think availability is my biggest concern.
13
00:00:12,000 –> 00:00:13,000
Alex Botting [00:03:12]: These cables cross vast expanses of territory. Of those 597 cables I mentioned, on average there’s 150 to 200 outages per year. The vast majority of those are caused by physical, accidental, and I’m going to put that in air quotes. We can get into that point later. Accidental disruption, which accounts for about 70% of it. That’s fishermen or ships accidentally drop an anchor, they sever a cable. The rest is a combination of natural events, you know.
14
00:00:13,000 –> 00:00:14,000
Alex Botting [00:03:52]: You know, there was an, there was a mudslide which caused some damage underwater in West Africa a couple of years ago. Knocked out two or three key cables there, that kind of thing. And then there are, you know, as with any technology, technology fails. And so every now and again you’ll have certain incidents that are really just pure technology failure, not caused by anything external.
15
00:00:14,000 –> 00:00:15,000
Alex Botting [00:04:14]: The frequency of that concerns me a little bit. You’re talking about, on average a cable once every three years is going to get cut.
16
00:00:15,000 –> 00:00:16,000
Alex Botting [00:04:23]: Contrast that with the confidentiality piece. I think a lot of people jump in and say, well, these things traverse a lot of territory. Be real easy to tap those cables.
17
00:00:16,000 –> 00:00:17,000
Alex Botting [00:04:34]: It can be true. I think at cable landing stations in certain territories, that’s probably true. I think trying to tap a cable in the middle of the ocean and siphon off all of that information from, say, a new cable, quite difficult to do. And happy to get into why. But to your question…
18
00:00:17,000 –> 00:00:18,000
Frank Cilluffo [00:04:52]: And I do want to pull that thread.
19
00:00:18,000 –> 00:00:19,000
Alex Botting [00:04:54]: It’s an interesting one to think through. And actually as, I mean, you will know from having developed white papers like this in the past, you go in with preconceived biases around these things. That was one where actually I changed my mind during the process of saying, do I think our adversaries would want to do this? Yes, very much so. Do I think they can do it? Possibly. Do I think the juice is worth the squeeze? No, I don’t.
20
00:00:19,000 –> 00:00:20,000
Frank Cilluffo [00:05:20]: It’s very hard. Yeah. Yeah. So let me ask though, how redundant is the current system? And I know it’s a hard, hard to quantify a qualifying sort of question, but do we have redundancy?
21
00:00:20,000 –> 00:00:21,000
Alex Botting [00:05:36]: I think of this at a global level and a localized level. At a global level, yes, currently. But if you think about the amount of data that we are using and the trajectory of that, we have to keep laying cables to make sure we stay ahead. We can’t stand still. AI, most obvious driver. Right? At a localized level, it depends. The US is about as well insulated as you could hope to be. We have almost 100 cables that land on the east or west coast.
22
00:00:21,000 –> 00:00:22,000
Alex Botting [00:06:07]: That is more than any other country. They land across, I think it’s somewhere in the range of 30 or 40 different landing sites. So again, you’ve got that diversity of landing point which reduces the possibility of a single incident wiping out a large amount of capacity.
23
00:00:22,000 –> 00:00:23,000
Alex Botting [00:06:26]: And beyond that, you’ve got, Canada’s got more than a dozen landings as well, and we’ve got terrestrial links there as well. So we are pretty well diversified. If, for instance, we looked at some of our allies in Asia Pacific, I believe Taiwan has 12 to 14 cables. A lot.
24
00:00:23,000 –> 00:00:24,000
Frank Cilluffo [00:06:44]: You know we’re gonna pull the thread on Taiwan.
25
00:00:24,000 –> 00:00:25,000
Alex Botting [00:06:46]: I would be sad if we didn’t.
26
00:00:25,000 –> 00:00:26,000
Alex Botting [00:06:49]: They’re in a very different circumstance and they have a smaller landmass. So inherently they can’t space out in the way that a large country like the US can. And then if you get into some of the Pacific island countries that are either just allies of ours or in certain cases we may have military capabilities which are dependent upon those territories. In certain cases, those islands may have one cable. And obviously having global redundancy doesn’t help you if your one cable cuts out.
27
00:00:26,000 –> 00:00:27,000
Frank Cilluffo [00:07:19]: Yeah. So for a layman, in the end, we have choke points, landing points and island dependencies. Anything else we need to be thinking there, and obviously undersea itself.
28
00:00:27,000 –> 00:00:28,000
Alex Botting [00:07:32]: Absolutely. The other thing I would just think about is where are setting aside the idea of sabotage, are you in a region which is naturally a hotspot anyway? And a hotspot doesn’t necessarily mean geopolitical. It could. A hotspot could just be, you have a ton of ships going through this territory and therefore accidents are going to happen.
29
00:00:28,000 –> 00:00:29,000
Frank Cilluffo [00:07:51]: I thought you said the other S-H-I-T, but that’s okay.
30
00:00:29,000 –> 00:00:30,000
Alex Botting [00:07:55]: We’ll save that for the explicit version.
31
00:00:30,000 –> 00:00:31,000
Frank Cilluffo [00:07:59]: But, but, but you do see in geopolitical hotspots, whether it’s the Baltic Sea, whether it’s the Red Sea, whether it’s the Straits of Taiwan and Southeast China, you’re starting to see all sorts of hemming and hawing. And one of the points that you brought up in your testimony that I think is so important that underscores a blind spot is that of the incidents that we are seeing and how many were there again per year?
32
00:00:31,000 –> 00:00:32,000
Alex Botting [00:08:28]: About 150 to 250.
33
00:00:32,000 –> 00:00:33,000
Frank Cilluffo [00:08:31]: Vast majority of those are accidents. But we don’t investigate all of those accidents, do we? So it’s hard to discern what is and what isn’t.
34
00:00:33,000 –> 00:00:34,000
Alex Botting [00:08:41]: Yes, 100%. So I think there were two big findings that came out of our paper and that was one of them.
35
00:00:34,000 –> 00:00:35,000
Alex Botting [00:08:50]: Was, there, we need to get better at investigating those incidents and there are a number of benefits to doing so. One of those benefits is if we can spot patterns like with cyber threat intelligence, we can better protect ourselves against those.
36
00:00:35,000 –> 00:00:36,000
Frank Cilluffo [00:09:03]: So it’s not one off incidents, it’s pattern analysis.
37
00:00:36,000 –> 00:00:37,000
Alex Botting [00:09:06]: Correct.
38
00:00:37,000 –> 00:00:38,000
Frank Cilluffo [00:09:07]: Which took us a while to figure out in cyber too, right?
39
00:00:38,000 –> 00:00:39,000
Alex Botting [00:09:09]: 100%.
40
00:00:39,000 –> 00:00:40,000
Frank Cilluffo [00:09:09]: We were reacting to whatever we just saw and then we’re marching into the future backwards.
41
00:00:40,000 –> 00:00:41,000
Alex Botting [00:09:15]: That’s a great way of putting it. And in addition, we can potentially, if there has been serious negligence here, punish those who are responsible. You put in place an incentive structure for benign actors to be more careful around subsea cables. They’re meant to do it already. They’re meant to use tracking devices on these ships which could be used to give them a warning when they’re over a cable, not to drop their anchor. Many vessels turn those devices off even in violation of IMO, International Maritime Organization requirements. Even in areas, so Australia had an example where they created this cable protection zone. They took a model that said we’re going to put all these cables through a narrow area and then we’re going to police that area. And that’s better than just kind of spreading them out. Australia, as you know, also has concentrated population centers.
42
00:00:41,000 –> 00:00:42,000
Alex Botting [00:10:09]: So it made sense.
43
00:00:42,000 –> 00:00:43,000
Frank Cilluffo [00:10:10]: Yeah, yeah.
44
00:00:43,000 –> 00:00:44,000
Alex Botting [00:10:11]: An incident happened there a few years ago. By all accounts it was accidental, but nevertheless, you could argue negligence because they were right by the cable protection zone and they ended up going through it. They didn’t prosecute them. And we’ve got this problem in the space right now where there’s no disincentive to engage in reckless behavior. That has to change. The final one is if you do that and you investigate the incidents, you punish, you reduce the number of incidents that occur overall, that’s great for redundancy, less cable downtime. It’s also great if you believe somebody might come to try and sabotage your cables in the future because there’s less cloak of plausible deniability that they can hide behind.
45
00:00:44,000 –> 00:00:45,000
Frank Cilluffo [00:10:52]: And I think there is some of that and we’ll talk about that in a minute. But before I leave the topic, you did mention in your testimony that espionage is less likely, as you touched on here earlier. What do you think it means though with the advent of quantum technology, AI.
46
00:00:45,000 –> 00:00:46,000
Frank Cilluffo [00:11:13]: I mean, so I’ve come to conclude that often the vacuuming of data, it’s about the data. It’s almost irrelevant as to whether or not it’s targeted signals intelligence or communications intelligence or you name it. But the data itself, at some point though, it is about the data there too, isn’t it?
47
00:00:46,000 –> 00:00:47,000
Alex Botting [00:11:31]: Yeah, I think it’s a fair point. And actually one thing I didn’t want to come across in my testimony as saying is just like, oh, don’t bother.
48
00:00:47,000 –> 00:00:48,000
Frank Cilluffo [00:11:38]: Don’t dismiss it, of course, and you didn’t.
49
00:00:48,000 –> 00:00:49,000
Alex Botting [00:11:39]: I think it is very technically difficult to implement. So just to walk you through the calculus here, so a modern cable will carry 420 terabits per second. That’s the Grace Hopper cable is currently the fastest that’s in action. Huge amount of data. In one year that will surpass the amount of entire Internet mobile data used globally by every single person on the planet. Huge amount of data.
50
00:00:49,000 –> 00:00:50,000
Frank Cilluffo [00:12:08]: Wow.
51
00:00:50,000 –> 00:00:51,000
Alex Botting [00:12:08]: In order to do anything meaningful with that, you need to first of all tap the cable physically. So you need to be in a place where you’re not going to be detected by satellite. You’re also, your device has to not set off an anomaly. I mean it will set up off an anomaly but you hope nobody notices it. At that point, you need then to attach another subsea cable and these things cost hundreds of millions to lay, right? And take it to somewhere presumably, let’s say it was China. You’re going to take it to mainland China. You’ve then got to build data centers and we estimate, just for one year’s worth of data somewhere around the order of two or three Central Parks, maybe up to as much of a third of the size of Manhattan of data center square footage. In order to store that data just for one year, then you’ve got to decrypt it and make sense of that amount of data. Like do something meaningful with the one useful piece of intelligence in amongst gigabytes.
52
00:00:51,000 –> 00:00:52,000
Frank Cilluffo [00:13:10]: Signal to noise issue. Yeah.
53
00:00:52,000 –> 00:00:53,000
Alex Botting [00:13:11]: Exactly. You’ve got a real needle in a haystack problem. And they’re, they’re pretty good at cyber security espionage and they’re pretty, you know, they’re, they’re…
54
00:00:53,000 –> 00:00:54,000
Frank Cilluffo: [00:13:23]: There are easier ways to do this.
55
00:00:54,000 –> 00:00:55,000
Alex Botting [00:13:24]: Yeah, exactly. So I, you know, our rough estimate is it would take in the order of tens of billions of dollars investment to tap one cable, one cutting edge cable. I don’t think that currently represents a good return on investment for what they might be looking to achieve. All of that said to your point, Frank, I think a quantum breakthrough in China reduces the cost. Rising AI capabilities to maybe be able to sift through those capabilities maybe shifts the cost.
56
00:00:55,000 –> 00:00:56,000
Alex Botting [00:13:52]: But it’s the same as anything else in risk based approaches. Right? You’re constantly looking at the issue, reassessing. And if the intel community were to come to the private sector and say here is some information that would shift your calculus on that, I’ve no doubt the private sector would shift.
57
00:00:56,000 –> 00:00:57,000
Frank Cilluffo [00:14:08]: 10-4 on that. Yeah. And I agree fully with the analysis and the assessment. But we can never discount the unknowns is the reality there. And with sort of that in mind and the blind spots in terms of accidents, why don’t we investigate more often?
58
00:00:57,000 –> 00:00:58,000
Alex Botting [00:14:30]: It’s a good question. I think, think the, the ultimate answer is downtime of a cable is more costly than repairing the cable.
59
00:00:58,000 –> 00:00:59,000
Frank Cilluffo [00:14:38]: Yeah, sounds like the energy issue, right?
60
00:00:59,000 –> 00:01:00,000
Alex Botting [00:14:40]: Correct. And so companies look at this and say both from a redundancy of the global ecosystem, we want uptime.
61
00:01:00,000 –> 00:01:01,000
Alex Botting [00:14:49]: And for the most part, if you come from a paradigm of the most of the history of subsea cables is that nobody was looking to cut their cables both because it was incredibly difficult to do, particularly going back decades and because we weren’t particularly in an adversarial state with a major power that would have those kind of resources to do it for the most part. And we weren’t so reliant on these subsea cables in the pre Internet era. So it is a lot of, one of the most interesting things about researching this area is a lot of the structures of the industry have been there for 100 plus years and there’s no need to change it immediately. There’s no crisis sitting there. And so I think that coupled with as I say, the, the incentive to get cables up and running, it’s just easier to say move out the way, let me repair my cable. And unless you’re doing this to me every day, there’s no reason for me to suspect anything.
62
00:01:01,000 –> 00:01:02,000
Frank Cilluffo [00:15:46]: And you know, I, I don’t mean to go into a deep rabbit hole, but it is amazing how sometimes how much we know in the physical land, space. Seems like undersea is still uncharted territory. There’s so much excitement and understandably for exploration in space and just how important that is, especially with new economies and new countries. But how much of the world’s population, the world’s geography is ocean a big chunk, right?
63
00:01:02,000 –> 00:01:03,000
Alex Botting [00:16:19]: Yeah, that was my realization when I learned to scuba dive. You go down there and you’re like, wow, a whole nother world that you never, never noticed.
64
00:01:03,000 –> 00:01:04,000
Frank Cilluffo [00:16:26]: Yeah, yeah. And then when you look at where all the collection. It just seems like there’s more, more we need to be thinking about in that environment. Let’s talk about some of the patterns. Let’s talk about sort of the Baltic Nordic, Red Sea at critical times and, and, and also Taiwan. And what comes to, and again, it’s hard to disprove double negatives, but timing is suspect on some of these and location is clearly suspect. So what are some of your thoughts there?
65
00:01:04,000 –> 00:01:05,000
Alex Botting [00:16:59]: Very much so.
66
00:01:05,000 –> 00:01:06,000
Frank Cilluffo [00:17:00]: In the clustering, like the shadow fleets and what have you.
67
00:01:06,000 –> 00:01:07,000
Alex Botting [00:17:02]: Completely. It is, it is a tough one because it’s just we have struggled to prove anything. Clearly part of the reason those incidents hit the headlines is the timing and location look suspect.
68
00:01:07,000 –> 00:01:08,000
Alex Botting [00:17:19]: On the one hand, I would say, look, there’s a lot of traffic through the Baltic Sea. There’s a lot of traffic through the Red Sea, There’s a lot of traffic through the Taiwan Strait. Is it impossible that these were just coincidental? No, it’s, but again, whenever you have plausible deniability, that’s, that’s the plausibly deniable part. Right?
69
00:01:08,000 –> 00:01:09,000
Alex Botting [00:17:38]: I think in reality, if you look at aggregate data, for instance, Taiwan had, there were more cable cuts in the Taiwan Strait in January of this year than either 2024 or 2023 in total. That is a sharp uplift at a time when we know that hostility in that part of the world is rising. I would be shocked if none of those incidents were knowingly done.
70
00:01:09,000 –> 00:01:10,000
Frank Cilluffo [00:18:04]: You know, we had the CEO of United Launch and he said, first shots are going to be in space. They could just as equally be undersea. Right?
71
00:01:10,000 –> 00:01:11,000
Alex Botting [00:18:13]: They could. And you know, I go back to the, the adage recently that, you know, all wars start with cybersecurity these days. Right? They could, if I can put an optimistic view to you, though, on it.
72
00:01:11,000 –> 00:01:12,000
Frank Cilluffo [00:18:25]: Please. I’m always looking for optimism.
73
00:01:12,000 –> 00:01:13,000
Alex Botting [00:18:28]: Realistically, if the primary focus of a future conflict were to say, you know, we’re talking Taiwan, a US China paradigm, I don’t think either would be able to, both sides would struggle to do anything significant enough in a timely fashion to have an end outcome. I.E. to state that a bit more clearly, you would have to cut an awful lot of cables going into the US to even slow the Internet slightly.
74
00:01:13,000 –> 00:01:14,000
Frank Cilluffo [00:18:57]: But what about Taiwan?
75
00:01:14,000 –> 00:01:15,000
Alex Botting [00:18:59]: With Taiwan, I think it could be entirely feasible.
76
00:01:15,000 –> 00:01:16,000
Frank Cilluffo [00:19:04]: Do you feel that they’re testing proof of concept or is it just.
77
00:01:16,000 –> 00:01:17,000
Alex Botting [00:19:11]: I’m careful to caveat anything with, I don’t know anything that’s not in the public domain.
78
00:01:17,000 –> 00:01:18,000
Frank Cilluffo [00:19:15]: You and me both.
79
00:01:18,000 –> 00:01:19,000
Alex Botting [00:19:16]: But I, Yes, I would not be shocked.
80
00:01:19,000 –> 00:01:20,000
Frank Cilluffo [00:19:20]: Thoughtful analyst on all that. So, and what do you think it tells us about capabilities?
81
00:01:20,000 –> 00:01:21,000
Alex Botting [00:19:27]: I mean, China, there was a report out of the, I believe it was the SCMP, the South China Morning Post, that talked about China having the capability to cut subsea cables, I believe at the depth of 4,000 meters. There’s a question here though of if that information is coming out, is that a sign of future intent or is that a distraction? Right? I mean, this was very clearly…
82
00:01:21,000 –> 00:01:22,000
Frank Cilluffo [00:19:53]: Which is part of the fog of crisis anyway. Right?
83
00:01:22,000 –> 00:01:23,000
Alex Botting [00:19:56]: Correct. And I do think there is an element, even as I’m seeking to raise attention around this issue of raising the right kind of attention that we’re not completely panicking and over indexing. You know, one of the, the I mentioned one of the key findings of the paper. The other was a really boring one that I think will put us in good stead for the future. Redundancy is our biggest defense in depth, right?
84
00:01:23,000 –> 00:01:24,000
Alex Botting [00:20:20]: I mentioned we have 100 cables coming into the US and therefore it makes it very hard to do anything meaningful in a short time frame to actually impact it. What if we were up to 150, 200 cables? It gets harder and harder to use this as a vector and likewise in particular for our allies, right, who maybe only have 5, 10, 15 cables. How do we make it easier to lay cables? Because one of the problems in the industry at the moment is the hyperscalers are the only ones that are laying cables today because it’s so expensive, it’s so slow. And with the slow National Security review processes, you could end up with stranded investment if you don’t get the license at the end of it. And you can’t guarantee. Because of that, there are very few…
85
00:01:24,000 –> 00:01:25,000
Frank Cilluffo [00:21:06]: Your suppliers is important there too, right?
86
00:01:25,000 –> 00:01:26,000
Alex Botting [00:21:08]: 100%. So, yeah, redundancy is ultimately going to be our best defense in depth. And probably the best way to get to that is to improve the permitting processes around both laying new cables and repairing cables. Because a lot of people think cable gets cut where you just send in a ship to repair it. You, if you’re going into territorial waters, you may need all kinds of reviews. There may be local requirements to use local crews and ships and things like that who don’t know what they’re doing. Possibly in certain instances we make it very hard to build new cables and to keep them up and working. And if we shifted that, it gives us a lot more defense and depth.
87
00:01:26,000 –> 00:01:27,000
Frank Cilluffo [00:21:49]: So you said that was boring, but it’s actually really essential and regulation and law normally is. That seems like something we ought to be doubling down on.
88
00:01:27,000 –> 00:01:28,000
Alex Botting [00:22:00]: Absolutely.
89
00:01:28,000 –> 00:01:29,000
Frank Cilluffo [00:22:01]: And is that done through Five Eye, through partners, through broader organizations, or each country goes at it with a patchwork approach. How does that look?
90
00:01:29,000 –> 00:01:30,000
Alex Botting [00:22:12]: Yeah, because it’s national security, it’s probably going to end up being a patchwork. Yeah, there’s a part of it that national governments are never going to give up, rightfully so. With that said, there are things that you can do with international partners. You mentioned suppliers, for instance.
91
00:01:30,000 –> 00:01:31,000
Frank Cilluffo [00:22:28]: Trusted suppliers.
92
00:01:31,000 –> 00:01:32,000
Alex Botting [00:22:30]: Correct. We’ve worked with these trusted, untrusted, vague terminologies for a long time. What if we were to get together with partners and agree collectively upon a set of criteria that’s going to be used, possibly even going as far as having a, you know, a blacklist of companies that make it clearer. One of the hardest things when going through at national security review is it’s a black box process. So if you’re a company, when you lay a cable, you, you know, do all sorts of things in terms of like mapping the seabed of the potential route and figuring out how you’re going to route something globally and, and things like that. And then you get to the point where you’re going to present that to get your license to lay your cable. And when it goes into that process, they may come back and say nope. And you’ll say, well, why? And they’ll say, can’t tell you.
93
00:01:32,000 –> 00:01:33,000
Alex Botting [00:23:19]: And so you go back and you change one part of it and you think you fixed it. Nope, can’t tell you why. This creates a slow process to the point where I believe in the US average times for national security reviews have gone from around a year, just, just under 12 months to three years now, just for the National Security Review. We could work with partners to ease that process.
94
00:01:33,000 –> 00:01:34,000
Frank Cilluffo [00:23:42]: And, no that’s, that’s a good set of recommendations there. And is this part of the CFIUS process in particular or no? It’s actually more broad.
95
00:01:34,000 –> 00:01:35,000
Alex Botting [00:23:53]: It’s team telecom runs the process. So yeah, you’ve got your folks who aren’t aware, you’ve got your DOJ in there, you’ve got DHS, FCC and others.
96
00:01:35,000 –> 00:01:36,000
Frank Cilluffo [00:24:05]: And you brought up the importance of resilience and redundancy. And quite honestly, there’s a lot of lessons we’re learning in the cyber environment that I think are applicable to this set of issues. We’re never going to stop everything, everywhere, all the time, from every perpetrator and every modality of attack. But we can bounce, the intent is hopefully to not just bounce back, but bounce forward. Is there, is that what you’re thinking is? And, and what about AI, what about all the data, the boom in data centers? How does this impact where we’re going in this environment?
97
00:01:36,000 –> 00:01:37,000
Alex Botting [00:24:42]: Yeah, it’s, it’s an interesting one. And we’ve been thinking about this in the context of the AI, the RFI that’s open at the moment on the AI promotion strategy. To me, one big thing that was missing from that was connectivity. There was a great phrase used by one of my colleagues at the testimony who said a data center without connectivity is just a warehouse. And it’s, it’s, it’s true.
98
00:01:37,000 –> 00:01:38,000
Frank Cilluffo [00:25:06]: Yeah.
99
00:01:38,000 –> 00:01:39,000
Alex Botting [00:25:06]: You know, it’s fundamental. Particularly as the demand for data grows, what you’re finding is because of the strain on local resources, energy, water and so on, you’re actually having campuses of data centers where they’re slightly spread out from one another in order to move data back and forth between them, but not concentrate the energy risk in one place. That needs rapid connectivity.
100
00:01:39,000 –> 00:01:40,000
Frank Cilluffo [00:25:33]: Energy and security. I mean it’s, it’s double edged sword, right?
101
00:01:40,000 –> 00:01:41,000
Alex Botting [00:25:35]: Absolutely. And then you know, obviously you consider that data is going to need to move across borders for that as well. So subsea cables come in there. So it is, it’s going to be an essential piece of the puzzle. You know, increasingly you’re looking to land cables close, closer and closer to where the data centers are for kind of reducing latency and things like that.
102
00:01:41,000 –> 00:01:42,000
Frank Cilluffo [00:25:57]: But in terms of deterrence, in terms of signaling, it seems like some of the economic instruments and redundancy and more is better. Right? Am I right about that or?
103
00:01:42,000 –> 00:01:43,000
Alex Botting [00:26:10]: Absolutely, absolutely.
104
00:01:43,000 –> 00:01:44,000
Frank Cilluffo [00:26:11]: Because it’s still difficult to get a smoking equivalent of a keyboard or a gun in all of this. Right? Cause we’re still not investigating enough.
105
00:01:44,000 –> 00:01:45,000
Alex Botting [00:26:21]: It is.
106
00:01:45,000 –> 00:01:46,000
Frank Cilluffo [00:26:22]: But if we did more of that, would our deterrence level go up?
107
00:01:46,000 –> 00:01:47,000
Alex Botting [00:26:25]: Absolutely.
108
00:01:47,000 –> 00:01:48,000
Alex Botting [00:26:28]: It would both for, again, those who genuinely accidentally cut cables, but possibly do it recklessly or negligently.
109
00:01:48,000 –> 00:01:49,000
Frank Cilluffo [00:26:38]: And what would that look like? I have a hard time understanding that. That’s a trawler that’s going around, just doesn’t want to pick up?
110
00:01:49,000 –> 00:01:50,000
Alex Botting [00:26:44]: So the Red Sea was an example. And I’m, I’m not going to say the Red Sea was negligent because actually I think the crew did, from what I understand as the facts, they did the right thing. Their ships getting shot at, what’s the first thing that you do under your requirements? You drop an anchor. Now in that case there’s potential loss of life or things like that. So they absolutely did the right thing, but they just happened to drop the cable in such a place as when the ship started moving, it sliced a whole bunch of cables in a key global artery for this. So there was ton of work being done behind the scenes to reroute via terrestrial and other pathways. But it’s not uncommon for ships to just drop an anchor somewhere.
111
00:01:50,000 –> 00:01:51,000
Alex Botting [00:27:22]: In some parts of the world, illegal fishing is still very prevalent. So they will turn off their tracking device so that they can’t see where they’re fishing and they’ll drop an anchor. And they’re not paying attention to the fact that they’re sitting on top of a key artery. The problem is if they’ll always do that unless there’s some enforcement and some disincentive to doing it. When I look at disincentives for sabotage, I think it’s both parts of that. Which is on the one hand, does the potential of penalties being imposed upon you rise from today? It has to. We have to have a diplomatic toolbox for responding. And do we have so much slack in the system? Do we have so much redundancy? It’s not going to achieve anything.
112
00:01:51,000 –> 00:01:52,000
Alex Botting [00:28:08]: Why would you do something that’s going to get a bunch of sanctions or whatever the deterrent is against you for something that’s going to have no impact?
113
00:01:52,000 –> 00:01:53,000
Frank Cilluffo [00:28:16]: But when you think of like Australia, it is an island so you need, it’s essential to everything, right? So, and so is the Americas for that matter. But, but point being, do think we need red lines in this because, because I come back to this issue and, again, in my slow head comes back to sort of the cyber physical convergence set of issues. Whether you’re disrupting through cyber means or a cyber enabled means or a well placed IED or whatever else. The impact is the impact. The outcome is the outcome. To me when I think about just how big this is in terms of, it, it’ll make your head hurt. And from a security standpoint, it’s not like you can have cameras on every mile or kilometer of sea cable undersea. Right? So how do we go about doing this? How do we have the surveillance? How do we get the rich picture? I’m not sure.
114
00:01:53,000 –> 00:01:54,000
Alex Botting [00:29:19]: So there is a technique or a capability called fiber sensing. There’s two types of it. Yeah. So one is the actual cable itself. You’re sending light down that cable. Along the way, there are all kinds of things that happen to obviously disrupt that light, physical things that are touching the cable. And so there are, there’s a process along the way of correcting that to make sure there’s a pure signal when you get to the end. From the data of correction, you can reverse engineer that to look at what is going on around the cable in different parts. Right?
115
00:01:54,000 –> 00:01:55,000
Alex Botting [00:29:58]: We, any cable owner has that data. They just haven’t been using it.
116
00:01:55,000 –> 00:01:56,000
Frank Cilluffo [00:30:02]: False positives high?
117
00:01:56,000 –> 00:01:57,000
Alex Botting [00:30:04]: Possibly. I think it was just more, again, if you believe we live in a world of benign intent, then why, why bother investing in it? Now with the onset of machine learning capabilities you’ve got these rich data sets which can potentially tell us a lot about what’s going on around it. Now you mentioned false positives. One of the other things that you can do is attach, and this comes with cost, acoustic sensors along the cable as well. And what those two data sets together can do is paint a pretty rich picture.
118
00:01:57,000 –> 00:01:58,000
Frank Cilluffo [00:30:37]: Yeah.
119
00:01:58,000 –> 00:01:59,000
Alex Botting [00:30:38]: I have heard, again, not verified, but as part of the interviewing for the paper to the point of even individual vessels almost having kind of a fingerprint. We’ll see whether that can be proved out in practice. But it would be a very useful tool for understanding what’s going on around cables. There is however a governance question mark. Within a country’s territorial waters, an individual country can authorize you to do that. I believe in Portugal they have a live test going on.
120
00:01:59,000 –> 00:02:00,000
Alex Botting [00:31:10]: When you get into international waters though, yeah, those cables are protected under international treaties as being telecoms cables. Once you start attaching sensors to them, are they, is it a CCTV device at the bottom of the ocean or is it a telecoms cable? There’s ambiguity there. I think either that needs to be resolved or fully thought through before we start talking about putting it across transoceanic.
121
00:02:00,000 –> 00:02:01,000
Frank Cilluffo [00:31:31]: Fascinating. Fascinating. And then that’s going to lead to an obfuscation game for the those that are actually in for malign intent. But fascinating set of issues. Alex, I’m going to go to a quick lightning round. So what’s the one thing government, whether in the US case executive branch, legislative branch. What’s the one thing government should be doing right now?
122
00:02:01,000 –> 00:02:02,000
Alex Botting [00:31:54]: Yeah. So I’m actually going to diverge from what I said at my testimony because that was very DHS specific. When we’re looking US Government…
123
00:02:02,000 –> 00:02:03,000
Frank Cilluffo [00:32:01]: It’s the right committee, you better remember who you’re testifying, know your audience. Yeah.
124
00:02:03,000 –> 00:02:04,000
Alex Botting [00:32:05]: I think reforming the approvals process for cables, and that doesn’t, DHS will have a role through team telecom, but as will DOJ and FCC. Whomever leads that, it’s got to get quicker, it’s got to get easier to lay new cables because ultimately that is our best resilience mechanism is just having redundancy in the system.
125
00:02:04,000 –> 00:02:05,000
Frank Cilluffo [00:32:25]: And that’s both an executive branch action and a legislative.
126
00:02:05,000 –> 00:02:06,000
Alex Botting [00:32:28]: Sorry, yeah. On the legislative side I think establishing a single point of contact, again, for that it’s probably DHS that can do better. Two way threat intelligence sharing with the private sector is incredibly important because as we talked about with the encryption example, if circumstances change and the government’s sitting on valuable information, you’ve got to communicate that to the people who are operating these cables so that they can shift their security posture accordingly.
127
00:02:06,000 –> 00:02:07,000
Frank Cilluffo [00:32:59]: What about with allies and the international community? What’s the one thing you would argue there?
128
00:02:07,000 –> 00:02:08,000
Alex Botting [00:33:06]: So I’m split. Can I have two?
129
00:02:08,000 –> 00:02:09,000
Frank Cilluffo [00:33:07]: Two, yep.
130
00:02:09,000 –> 00:02:10,000
Alex Botting [00:33:08]: All right. One is, in our interest, we need to get rid of regulations which inhibit the ability to repair cables quickly. The amount of countries that still have some form of taxing the repair components or cabotage requirements that you have to use local crew and vessels or slow permitting processes that can slow down repairs for months. We’ve got to fix that. This is a, you know, we’re talking about critical public infrastructure. You’ve got to get it up and running.
131
00:02:10,000 –> 00:02:11,000
Alex Botting [00:33:38]: And so that would be one, educating and advocating for reforms there. The second one would be, again, to go back to the trusted vendor issue and possibly even broader threat information sharing. They’re seeing things when we’re not. We’re seeing things they’re not. If they are close and trusted allies, it is in both of our interests to help one another. We got to get better at sharing.
132
00:02:11,000 –> 00:02:12,000
Frank Cilluffo [00:34:00]: And I think that’s the key word is allies there. Which I’m sure compound complicates things but that’s where I would be most comfortable. What’s the one thing private sector should be doing if you could give them one thing to do right now?
133
00:02:12,000 –> 00:02:13,000
Alex Botting [00:34:12]: Oh goodness. I will say one of the things I learned through doing the white paper was, was quite how in actually impressive the, the security is in this space, particularly the thinking around it, right?
134
00:02:13,000 –> 00:02:14,000
Frank Cilluffo [00:34:24]: It’s essential. It’s literally our backbone.
135
00:02:14,000 –> 00:02:15,000
Alex Botting [00:34:26]: Correct. I, I think continuing to invest in new cables which are as I say, slow, very costly to lay, at the moment, we are reliant hugely on hyperscalers for giving us that new capacity. It seems like they are still willing to invest in expanding that future capacity, but frankly it would be great to see whether it’s private equity, whether it’s telecoms companies getting back into the game. New players that are willing to invest in expanding this capacity would be great as well.
136
00:02:15,000 –> 00:02:16,000
Frank Cilluffo [00:35:00]: And what’s the one emerging technology that you think will matter most as pertains to subsea cables?
137
00:02:16,000 –> 00:02:17,000
Alex Botting [00:35:08]: So we’ve talked about fiber sensing. I think that’s a key one. A final thought on satellite, because a lot of people talk about satellite as an alternative. The reality is satellite is not a direct alternative in that, as I understand it, the entire Starlink global capacity is equivalent to one subsea cable, the Grace Hopper cable. So when you talk about truly replacing it, it’s not there. But if you talk about what is Taiwan going to do if its cables get cut, or some of our Pacific Islands allies, satellite is absolutely the alternative. So I do think it can’t replace subsea cables, but it’s a great supplement.
138
00:02:17,000 –> 00:02:18,000
Frank Cilluffo [00:35:48]: It almost reminds me of alternatives to GPS. It’s yes, yes, and yes. Right?
139
00:02:18,000 –> 00:02:19,000
Frank Cilluffo [00:35:54]: Alex, finally, what questions didn’t I ask that I should have?
140
00:02:19,000 –> 00:02:20,000
Alex Botting [00:35:57]: Oh, my goodness. I probably would have gone with the satellite one, but I’ve just scooped myself on that.
141
00:02:20,000 –> 00:02:21,000
Frank Cilluffo [00:36:01]: That’s a great issue.
142
00:02:21,000 –> 00:02:22,000
Alex Botting [00:36:03]: I think, what would ring alarm bells? And I think for me, if we were able to start reducing the frequency of accidental disruptions and we were to better investigate and to suddenly find real sabotage taking place today, I think that would shift our calculus as to what needs to be done going forward. So, yeah, watch out if something like that is proven in a court of law. But it’s not easy.
143
00:02:22,000 –> 00:02:23,000
Frank Cilluffo [00:36:37]: Alex, thank you so much for spending so much time with us. Thank you so much for what you’re working on. It’s really important. I learned a lot. Read this paper. It’s available on the Internet. Really appreciate it. And let me leave you with a token of our appreciation, both figuratively and literally, our coin.
144
00:02:23,000 –> 00:02:24,000
Frank Cilluffo [00:36:55]: And thank you for joining us.
145
00:02:24,000 –> 00:02:25,000
Alex Botting [00:36:57]: That’s very kind. Thanks, Frank.
146
00:02:25,000 –> 00:02:26,000
Frank Cilluffo [00:36:58]: Thank you, Alex. That was great. Thank you for joining us for this episode of Cyber Focus. If you liked what you heard, please consider subscribing. Your ratings and reviews help us reach more listeners. Drop us a line if you have any ideas in terms of top topics, themes, or individuals you’d like for us to host. Until next time, stay safe, stay informed, and stay curious.