2026-06-24 - Submarine Cables: Global Vulnerability and the European Response
The network that underpins the Internet is not a diffuse cloud: it is a physical geography of cables, landing points, and maritime straits. Where multiple routes converge in the same corridor, a local incident can produce cross-regional effects. This premise changes how news about submarine cables should be read: not as isolated technical episodes, but as manifestations of a systemic, global vulnerability — one to which the European Union is responding with a resilience design of its own.
The invisible geography of the Internet
Submarine communication cables carry roughly 99 percent of intercontinental Internet traffic. Behind the abstraction of the “cloud” lies a material infrastructure. According to the ITU, more than 500 telecommunication cable systems, active or planned, connect continents, markets, and communities today. Other industry estimates cited by the European Commission describe a network of around 600 systems, extending up to 1.5 million kilometers on the seabed. Alongside them run submarine electricity cables, which integrate energy markets and bring offshore renewable generation ashore.
The critical point is not only the quantity but the distribution. Global connectivity is concentrated in a few routes and a limited number of landing points and maritime straits. It is an uneven geography: some corridors carry a disproportionate share of the world’s traffic, and where many routes converge in the same passage, redundancy thins out. Understanding this concentration is a prerequisite for correctly assessing the risk.
Why the system is vulnerable
Most causes of failure are accidental: the ITU reports an average of around 200 faults per year globally. It identifies fishing and anchoring as the main sources of damage, followed by natural hazards — earthquakes, underwater landslides, and tsunamis — as well as wear and the aging of the infrastructure. Drawing on ICPC data, the ITU notes over 170 repairs in 2025, the equivalent of almost four faults per week.
To this physiology, a new dimension has been added: the suspicion of deliberate damage and of hybrid warfare. The incidents recorded in the Baltic Sea in recent years have shifted the issue from routine maintenance to security, fuelling fears that cables could become targets of hostile acts. The risk concentrates above all in geographic chokepoints, where the convergence of many routes amplifies the effect of a single event.
Main corridors and concentration points of global submarine connectivity. Original conceptual elaboration; context sources: ITU and TeleGeography. The highlighted chokepoints show how geographic redundancy remains uneven.
Red Sea and Bab el-Mandeb, the Suez Canal, the Strait of Malacca, the Luzon Strait and the Taiwan area, the Strait of Hormuz, the Baltic Sea: these are the passages where damage — or even the mere threat of it — can propagate well beyond the breakage point. In these areas, the physical security of cables is inseparable from the geopolitics of maritime routes.
The problem of real resilience
The network is designed to absorb shocks: when a cable fails, routing protocols divert traffic onto alternative paths. But redundancy is uneven. Countries with many routes and several landing stations can absorb shocks without significant disruption; regions with few connections, remote archipelagos, and some secondary routes remain exposed to disproportionate impacts.
Then there is the question of repair times. The physical intervention is rarely the most complex part; often, what is harder is obtaining permits and licenses, especially when an incident involves overlapping jurisdictions. Added to this are the scarcity of repair vessels in some areas, unevenly distributed maintenance and repair capacity, and the growth in the total length of cable installed — driven also by hyperscaler operators — which absorbs a significant share of the available repair resources. The result is a system robust on average but fragile at the edges.
The Red Sea is today the most telling case that the risk is not theoretical. In March 2024, damage to four cables in the region affected — according to estimates cited by the ITU — around 25 percent of data traffic between Asia and Europe, forcing the rerouting of flows onto alternative paths and highlighting the dependence on that corridor. In September 2025, fresh cuts from Jeddah degraded connectivity across the Middle East and Asia, with increased latency observed even on a major cloud platform. At the opposite extreme, episodes such as Tonga’s prolonged isolation after a cable break show how a single point of failure can leave an entire territory offline.
The European case: the Union’s response
It is within this global picture that the European action should be read. On 23 June 2026, the European Commission announced a twofold intervention: €5.8 million to establish the first two Regional Cable Hubs, in the Baltic Sea and the Mediterranean Sea, and the launch of a €40 million call to increase European capacity to repair submarine communication cables. The two measures implement the EU Action Plan on Cable Security of February 2025.
The instruments must be kept distinct. The funds for the two hubs are allocated under the cybersecurity actions financed by the Digital Europe Program and managed through the European Cybersecurity Competence Center (ECCC). Separate is the €40 million call (identifier CEF-DIG-2026-CABLE-REPAIR-CAPACITIES-WORKS, the “Works” strand), funded by the Connecting Europe Facility – CEF Digital and managed by the European Health and Digital Executive Agency (HaDEA). Of the €5.8 million total, the Baltic hub receives €2.5 million (coordinated by Finland with Denmark, Germany, Estonia, Latvia, and Sweden), and the Mediterranean hub receives €3.3 million (coordinated by Italy with Greece, Cyprus, and Malta).
The legal framework: obligations, direction, and capabilities
The security of cables does not flow from a single source. Directive (EU) 2022/2555 (NIS2) is one of the principal binding references. Still, it regulates entities, not cables as an autonomous category: entities that manage or provide electronic communication networks and services and that fall within its scope must adopt risk-management measures and report significant incidents, with measures that also cover the security of the physical environment of their systems. Alongside it operates Directive (EU) 2022/2557 (CER), which oversees the physical resilience of critical entities with an all-hazards approach. Regulation (EU) 2025/38 (Cyber Solidarity Act) enables preparedness, situational awareness, and common response, but does not specifically regulate cables. Recommendation (EU) 2024/779, non-binding, provides mapping, risk assessment, and the identification of Cable Projects of European Interest; the Action Plan is a programmatic document. It is the combination of these levels — not a single rule — that defines Europe’s posture.
Hubs, surveillance, and the contribution of AI
The hubs build a near-real-time situational picture for each basin by aggregating security data and information, strengthening national and cross-border operations centers, and enhancing information-sharing platforms. A structural element of the model is AI-based threat analysis: the hubs are funded to develop tools that turn heterogeneous data flows into operational awareness. The Mediterranean hub, under Italian coordination, combines shared procedures with a federated platform for information exchange and a coordinated response to cross-border incidents.
European repair capacity
The €40 million call does not fund generic repairs but rather a public intervention capacity: modular, adaptable equipment to be strategically positioned and installable on existing repair vessels at the request of the regional surveillance hubs or other competent authorities. The modules are designed to be hosted in ports or shipyards that can install them on board within three days of the ship’s arrival. Proposals may be submitted until 8 October 2026, 17:00 CEST. The measure follows a first €20 million pilot, opened on 5 February 2026 for the Baltic Sea.
As for the resources, they must be distinguished in time: the measures announced on 23 June (€5.8 million plus the €40 million call) sit within a broader framework, in which the CEF Digital 2024-2027 work programme allocates €533 million to cable projects, of which €186 million is already awarded to 25 projects; over 2021-2024, CEF Digital had allocated €420 million to 51 backbone connectivity projects.
As Executive Vice-President Henna Virkkunen put it, “This is Europe investing in its own security, resilience and sovereignty.”
In my view
The most important conceptual shift is the move from protecting the single asset to the geopolitical resilience of networks. The vulnerability of submarine cables is not a European problem: it is systemic and global, tied to the concentration of routes, the scarcity of repair capacity, and competition among state actors. In this contest, the European Union is a significant case study because it attempts to combine obligations for entities (NIS2 and CER), coordination among states (the Action Plan and the hubs), AI-assisted detection, preparedness instruments (the Cyber Solidarity Act), and a public repair capacity.
The underlying knots remain, which no public resource resolves on its own: the industrial sustainability of the repair fleet, the uneven redundancy of basins, the slowness of authorization regimes in contested waters. These are issues that require international cooperation — such as that promoted by the ITU and the ICPC — and a maritime legal framework rooted in nineteenth-century conventions and in UNCLOS. For Italy, coordinating the Mediterranean hub is not a mere symbolic gesture: it places the country at the center of a security function within a strategic basin. The direction is clear: the resilience of submarine cables is no longer an infrastructure issue but a component of technological sovereignty and collective security.
Sources
- European Commission, Commission funds first Regional Cable Hubs and launches €40 million call for cable repair capacity, IP/26/1429, 23 June 2026:
https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1429
— news page:
- Joint Communication, EU Action Plan on Cable Security, JOIN(2025) 9 final, 21 February 2025:
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025JC0009
- Directive (EU) 2022/2555 (NIS2):
http://data.europa.eu/eli/dir/2022/2555/oj
- Directive (EU) 2022/2557 (CER):
http://data.europa.eu/eli/dir/2022/2557/oj
- Regulation (EU) 2025/38 (Cyber Solidarity Act):
http://data.europa.eu/eli/reg/2025/38/oj
- Recommendation (EU) 2024/779:
http://data.europa.eu/eli/reco/2024/779/oj
- European Cybersecurity Competence Centre (ECCC):
https://cybersecurity-centre.europa.eu/index_en
- HaDEA, Connecting Europe Facility – CEF Digital:
https://hadea.ec.europa.eu/programmes/connecting-europe-facility_en
— €20 million pilot (5 February 2026):
- CEF Digital page:
https://digital-strategy.ec.europa.eu/en/activities/cef-digital
- ITU, Submarine Cable Resilience (data on faults, repairs and causes):
https://www.itu.int/en/mediacentre/backgrounders/Pages/submarine-cable-resilience.aspx
— ITU/ICPC Advisory Body:
https://www.itu.int/digital-resilience/submarine-cables/
- UN News, Invisible highways: The vast network of undersea cables powering our connectivity (Red Sea ~25% figure, ITU):
https://news.un.org/en/story/2026/02/1166867
- Al Jazeera, Internet disruptions in Middle East and South Asia after Red Sea cable cuts (Jeddah, 6 September 2025; SMW4 and IMEWE; Microsoft Azure latency):
- TeleGeography, Submarine Cable Map (interactive map of systems and landing stations):
https://www.submarinecablemap.com/
- NOAA, Submarine Cables — International Framework (1884 Paris Convention and UNCLOS):
Institutional sources were verified prior to publication. The figure is an original graphic elaboration and does not reproduce third-party cartography.
New to Gemini? This capsule is best read with a Gemini client, such as Lagrange.