Leggi in ItalianoWhen we think about espionage targeting submarine cables, the first image that comes to mind is often a submarine conducting a delicate operation on the ocean floor. It is an evocative image, but perhaps it directs our attention to the wrong place. One of the most interesting observations in ENISA’s July 2023 report, Subsea Cables – What Is at Stake?, is precisely this: the most accessible places to intercept communications carried by submarine cables are not necessarily underwater. They are often on land.
Fibre-optic submarine cables form the physical backbone of the internet: according to the European Commission, they carry approximately 99% of intercontinental internet traffic. The 2023 ENISA report draws an important distinction between two scenarios that are often conflated in public debate: disrupting a connection and covertly acquiring the data flowing through it. Sabotage may render a cable unusable; espionage, by contrast, requires access to the signal while preserving, as far as possible, the continuity of service.
Intercepting a modern optical cable on the seabed is technically very demanding. On pages 19-20, in its discussion of espionage, ENISA regards such an operation as highly unlikely. Depth is not the only obstacle. Modern optical systems use sophisticated transmission and reception technologies, while an underwater interception device would have to operate without producing readily detectable anomalies and overcome the problems of power supply and the storage or transmission of vast quantities of acquired data. This does not mean interception at sea is physically impossible. It means that, in ENISA’s 2023 assessment, it was considerably less feasible than other points of access.
The first critical point is the landing route. A cable reaches the shore, passes through connection infrastructure and terminates at a cable landing station, where the submarine system is linked to terrestrial networks. Here the technical situation changes: equipment must be accessible for operation and maintenance, and the signal passes through land-based systems. ENISA explicitly notes that interception at landing points is more feasible. A September 2026 study by Jonas Franken, Luca Roth and Christian Reuter develops this analysis by distinguishing near-shore infrastructure, landing stations and the equipment connecting them to terrestrial backhaul networks. That is not evidence that those facilities have in fact been compromised: the study identifies potential attack surfaces and also acknowledges the limited public evidence about actual vulnerabilities.
The second critical point is network management. Network management systems (NMS) allow operators to supervise and administer connections, sometimes remotely. ENISA warns that unlawful access to these systems may expose network topology and traffic information and, depending on equipment and privileges, enable an intruder to monitor, disrupt or divert traffic. The 2026 study confirms that remote administration expands the potential attack surface, while noting that many management systems are isolated from public networks and that it did not establish specific vulnerabilities across all NMS deployments. The ability to view or control a network does not, by itself, mean that every communication flowing through it can be read in plaintext.
There is also a historical precedent that takes this discussion beyond hypothetical scenarios. In June 2013, drawing on documents disclosed by Edward Snowden, The Guardian reported on the British Tempora programme, through which GCHQ gained access to large volumes of data on fibre-optic links, including transatlantic connections, where they came ashore in the United Kingdom and with the involvement of telecommunications operators. These were journalistic findings based on leaked documents, not proof that identical arrangements remain in operation today. Their significance is clear: surveillance of international communications links does not necessarily require a clandestine operation on the ocean floor.
It is equally important to distinguish the interception of traffic from the ability to understand its contents. Encryption, especially correctly implemented end-to-end encryption, may prevent an observer of the underlying link from reading messages. Depending on the protocols and observation point, however, information about traffic volumes, timing, and certain endpoints or routes may remain accessible. Such metadata can itself have intelligence value. A September 2026 chapter by Gary Kessler examines this distinction between content and metadata in the context of subsea cable security.
Another concern goes beyond physical access: who designs, supplies, installs, repairs and manages these systems? A December 2024 Carnegie Endowment study discusses supply-chain risks and the possibility of unauthorised access through equipment or management tools. These are threat scenarios that merit assessment, not evidence that any particular supplier has actually installed espionage capabilities.
Meanwhile, the EU policy framework has evolved. Commission Recommendation (EU) 2024/779 was followed by the EU Action Plan on Cable Security in February 2025, an EU risk assessment published in October 2025, and the Cable Security Toolbox in February 2026. In June 2026, the Commission announced funding for regional cable-security hubs in the Baltic and Mediterranean and a new call to reinforce repair capacity. These initiatives primarily address prevention, threat detection, resilience and incident response. They are not new evidence of espionage, but they show how much the strategic understanding of these infrastructures has changed.
There is also a legal dimension that deserves attention. The law of the sea regulates the laying and protection of submarine cables in different maritime zones, but it does not settle the separate questions raised by communications surveillance. Access to data flows engages distinct issues concerning jurisdiction, intelligence powers, the right to privacy and independent oversight. In Big Brother Watch and Others v. the United Kingdom, Grand Chamber judgment of 25 May 2021, the European Court of Human Rights clarified that bulk interception is not inherently incompatible with the Convention, but requires effective safeguards throughout the process, from authorisation to selection and examination. The judgment concerned the British legal regime then in force; it did not authorise or assess every possible form of submarine-cable surveillance.
For Italy and the European Union, the lesson reaches beyond preventing sabotage. Securing connectivity requires protecting landing stations, terrestrial connections and the information systems used to manage the network; it also requires defining who may gain access to communications and under what safeguards. The internet appears immaterial only until we ask where the data travels, and who may be able to see it.