GRC

UK white paper puts security duties on subsea cable operators

DCMS plans 14-year jail terms for cable sabotage, cyber-inclusive offences, risk duties for subsea operators and emergency direction powers.

Stylised network of subsea cables around the UK with the headline New law to protect UK subsea cables

The government wants to replace a Victorian telegraph law with a modern regime for the cables and pipelines on the seabed around Britain, covering criminal offences, regulatory duties and emergency powers. For the first time, subsea cable operators would answer to a regulator for how they manage risk, including cyber risk.

What happened

On 22 October 2026 the government published a white paper, Critical Undersea Infrastructure Security and Resilience: Proposals for modernising the UK’s legislation, with a public consultation that runs until 14 January 2027. Telecoms minister Ian Murray and energy minister Michael Shanks put their names to it. It responds directly to the Joint Committee on the National Security Strategy, which had told ministers that the law protecting subsea infrastructure had fallen badly behind.

The main offence for damaging a seabed cable today is still found in the Submarine Telegraph Act 1885, which talks about “telegraphic” communications and says little about energy assets. The white paper proposes four changes: a new criminal regime, legal risk-management obligations on subsea telecoms providers, a national security direction power, and screening for sensing technology fitted to fibre-optic cables.

The government links the timing to the threat picture. It points to Defence Secretary John Healey’s disclosure in April that UK and allied forces had tracked Russian submarines surveying cables. It also repeats that cables carry about 99% of the UK’s international data traffic, and that pipelines supply 74% of the country’s gas.

The detail

Criminal offences. A single core offence would cover conduct that causes a “security compromise” to subsea data or energy systems. That covers attempts, planned acts and conduct likely to cause a compromise, not only damage that has already happened. The definition deliberately reaches remote electronic interference and cyber activity, as well as preparatory work such as mapping or surveying a cable for a later attack. Penalties would scale with culpability: a maximum of 14 years where conduct is intentional, a decade where it is reckless and two years for gross negligence; fines would be unlimited throughout. The 1885 Act caps negligence at three months. Ministers also ask whether the offences should reach beyond territorial waters.

Provider duties. Operators of subsea data systems serving the UK would have to:

  • manage the risk of a security compromise with proportionate measures;
  • respond to, mitigate and recover from incidents as quickly as reasonably practicable;
  • report compromises, faults and outages included, to government and the regulator promptly;
  • warn directly affected users about significant risks.

A registration duty is also floated. The design copies the Telecommunications (Security) Act 2021: broad duties in primary legislation, detailed requirements in regulations, and technical guidance in codes of practice. The white paper does not yet name the designated regulator. Breaching the duties could cost the greater of £10 million or a tenth of qualifying worldwide revenue.

Directions. Where a specific compromise or threat creates a significant national security risk, the Secretary of State could order cable providers and repair firms to act or to stop acting. Example orders include allowing public bodies into cable landing stations, rerouting traffic, preserving evidence, delaying repairs to protect an investigation, and removing or disabling specified equipment. Directions could be kept confidential. Ignoring one could cost the greater of £17 million or a tenth of global turnover, plus daily penalties. That is the source of the two different cash figures in press coverage: £10 million applies to the ordinary duties, £17 million to directions.

Key figures from the UK critical undersea infrastructure white paper: data share, cable systems, jail terms, fines and consultation deadline

Why it matters for UK organisations

Most UK businesses will never own a cable, but almost all depend on one. Cloud, SaaS, card payments and overseas offices all ride on a few dozen international systems. The white paper counts 64 active systems landing in the UK, 45 of them international. Duties on operators should, in time, mean more consistent risk management at that layer, and an incident-reporting route that gives government a clearer view when something breaks.

The proposals also fit a wider pattern. The direction power is modelled on the one in the Cyber Security and Resilience Bill, which is due to reach Lords report stage on 26 October. With the critical third parties regime for suppliers to the financial sector, the pattern is clear: statutory duties are arriving at each layer of the digital supply chain that firms once covered by contract and hope.

For operators, investors and repair firms, the costs are immediate. The white paper admits that consortium ownership makes it hard to say who is accountable. A nominated lead member would not relieve the others of their duties.

Expert view

The most significant line in the paper, for me, is that the offence explicitly covers cyber activity and reconnaissance. Subsea security is usually discussed as a problem of anchors and trawlers, but a cable system also includes landing stations, power feed equipment, network management servers and remote access paths, and all of those can be attacked from land. In my experience, the infrastructure on shore is where the familiar weaknesses turn up: flat management networks, shared vendor accounts and monitoring links that nobody owns.

The duties are sensible but deliberately high level. Their real effect will depend on the regulations and codes of practice that follow, and on who becomes the regulator. A reporting threshold of “as soon as reasonably practicable” with no hours attached will need defining, or operators will read it in different ways. I would also like to see the consultation tackle overlap: some providers already fall under the Communications Act duties, and the government says it wants to avoid dual regulation without yet explaining how.

The secrecy provisions for directions also deserve scrutiny: confidential orders are understandable mid-incident, but oversight should be designed in from the start.

What to do now

  1. Respond to the consultation by 14 January 2027 if you own, operate, finance or repair subsea infrastructure, or rely heavily on it.
  2. Map your dependency. Ask your carriers and cloud providers which cable systems and landing points your critical services use, and whether your routes are genuinely diverse.
  3. Test the failure scenario. Add a prolonged loss of international connectivity to business continuity exercises, including how long a cable repair might take.
  4. Harden landing-site and management systems if they are yours. Apply the Cyber Essentials basics to every onshore component: firewalls and secure configuration on management networks, strict user access control with MFA for vendor access, timely patching of network management servers, and malware protection.
  5. Prepare for reporting. Operators should build incident classification and notification workflows now, consistent with the Telecommunications (Security) Act and the Cyber Security and Resilience Bill.
  6. Review sensing deployments on any fibre you control, and identify who holds and can access that data.

Bottom line

Replacing an 1885 telegraph law is overdue. Bringing cyber interference and reconnaissance inside the offence, and putting enforceable risk duties on cable operators, closes a real gap in UK critical infrastructure law. The harder part is the secondary legislation, the choice of regulator and the controls on secret directions, and the consultation is where those details will be decided.

Sources

Related Posts