Sicherheitsrisiken für Unterseekabel – Neue Studie für EU-Parlament mit Beteiligung von PEASEC

(long English version below)

Eine neue Studie für das EU-Parlament zum Unterseedatenkabelnetz der EU mit Beteiligung der Forschungsgruppe Wissenschaft und Technik für Frieden und Sicherheit (PEASEC) bietet einen systematischen Überblick über aktuelle Sicherheitsbedrohungen für diese Infrastruktur und gibt eine Reihe von Empfehlungen, wie die Resilienz des Kabelnetzes verbessert werden kann.

Das globale Unterwasser-Datenkabelnetz ist eine wichtige kritische Infrastruktur. Bis zu 99 % der weltweiten digitalen Kommunikation laufen über dieses Netz – Weltwirtschaft und digitale Dienste sind vollständig von ihm abhängig. Das Datenkabelnetz der EU ist für die globale Konnektivität von entscheidender Bedeutung, aber auch angreifbar. Da die Kabel auf dem Seegrund und über nationale Grenzen hinweg verlaufen und oft zusätzlich unter der Erde verborgen sind, wurden sie bislang häufig bei Risikobewertungen ausgeblendet und von politischen Entscheidungstragenden kaum beachtet. Ausgelöst durch die russischen Marineaktivitäten seit 2014 und die geopolitischen Erschütterungen, die der Krieg in der Ukraine 2022 ausgelöst hat, erfährt die Anfälligkeit der maritimen Infrastrukturen nun eine wachsende öffentliche und politische Aufmerksamkeit.

Eine neue Studie des Fachgebiets PEASEC am Fachbereich Informatik der TU Darmstadt zusammen mit Forschenden der Universität Kopenhagen und der Sciences Po Paris im Auftrag des Europäischen Parlaments bietet einen systematischen Überblick über die aktuellen Sicherheitsbedrohungen für unterseeische Kommunikationskabel und -infrastrukturen sowie über Akteur*innen, von denen diese Bedrohungen ausgehen. PEASEC-Wissenschaftler Jonas Franken kommentiert:

„Aus sicherheitspolitischer  und regulativer Sicht wurden maritime Kommunikationsinfrastrukturen lange Zeit zu wenig erforscht, obwohl der Alltag und Wohlstand in Europa in hohem Maße vom Internet abhängig sind. Unsere gemeinsame, eingehende Analyse wirft ein Licht auf das enorme noch ungenutzte Potenzial der Kabelsicherheitspolitik auf EU-Ebene und darüber hinaus.“

Auf der Grundlage von Berichten und Expertenbeiträgen wird eine Bestandsaufnahme der derzeitigen Sensibilisierungs-, Bereitschafts- und Reaktionsmechanismen sowohl auf EU-Ebene als auch auf Ebene der Mitgliedstaaten vorgenommen. Eine Reihe von Empfehlungen zeigt auf, wie die Widerstandsfähigkeit des Kabelnetzes konkret verbessert werden kann. Außerdem wird in dem Bericht vorgeschlagen, dass das Europäische Parlament die Debatte lenkt, indem es das Bewusstsein für die Risiken schärft und die Kommission und den EU-Außenbeautragten auffordert, Initiativen sowie Maßnahmen für die Koordinierung, Überwachung und Außenbeziehungen zu entwickeln.

Der Studie zum Unterseedatenkabelnetz der EU steht auf der Think-Tank-Seite des Europäischen Parlaments zum Download bereit:

Christian Bueger (Universität Kopenhagen), Tobias Liebetrau (Sciences Po Paris),  Jonas Franken (TU Darmstadt): Security threats to undersea communications cables and infrastructure – consequences for the EU, 2022. URL: https://www.europarl.europa.eu/thinktank/en/document/EXPO_IDA(2022)702557

Die Studie über Sicherheitsbedrohungen für unterseeische Kommunikationskabel und -infrastrukturen wurde vom Unterausschuss für Sicherheit und Verteidigung (SEDE) des Europäischen Parlaments in Auftrag gegeben. Er basiert in Teilen auf einem vorherigen Artikel von Jonas Franken, Thomas Reinhold, Lilian Reichert und Prof. Dr. Christian Reuter (Forschungsgruppe PEASEC), der zur Veröffentlichung im International Journal for Critical Infrastructure Protection angenommen wurde. Der Beitrag von PEASEC zur Studie für das EU-Parlament und deren Vorarbeiten wurde vom Bundesministerium für Bildung und Forschung und dem Hessischen Ministerium für Wissenschaft, Forschung und Kunst im Rahmen der gemeinsamen Förderung des Nationalen Forschungszentrums für Angewandte Cybersicherheit ATHENE und von der LOEWE-Initiative (Hessen, Deutschland) im Rahmen des emergenCITY-Zentrums gefördert.

Security threats to undersea communications cable and infrastructure – PEASEC co-authored study requested by the European Parliament published

PEASEC-researcher Jonas Franken co-authored a study on security threats to undersea communications cables and infrastructure requested by the European Parliament together with Prof. Dr. Christian Bueger (University of Copenhagen, Denmark) and Dr. Tobias Liebetrau (Sciences Po Paris, France), which has now been published. It is partially based on an article by Jonas Franken, Thomas Reinhold, Lilian Reichert and Prof. Dr. Christian Reuter, accepted for publication in the International Journal for Critical Infrastructure Protection.

The EU’s subsea data cable network is both vital for global connectivity and vulnerable. This study provides a systematic review of the current security threats, as well as the actors at the origin of these threats. Building on reports and expert input, the paper takes stock of current awareness, preparedness and response mechanisms, both at the EU and Member State levels. A number of recommendations suggest how to improve the resilience of the cable network. Proposals build on the need to enhance EU-wide awareness, improve coordination and share information across EU institutions and Member States. In addition, surveillance capabilities must be advanced, response and repair mechanisms strengthened, and the topic mainstreamed across external action.

The global subsea data cable network is a vital critical infrastructure. As much as 99 % of the world’s digital communications transit through the network, and the global economy and digital services are fully dependent on it. Since cables lay out at sea, across national borders and are often hidden underground, they have frequently been forgotten and received limited attention from policymakers. Sparked by Russian naval activity since 2014 and the geopolitical shockwaves sent by the 2022 Ukraine war, the vulnerability of maritime infrastructures is now receiving growing public and policy attention. Yet, as this report shows, European governance of cable protection and resilience still lags behind and needs improvement. The EU and its Member States will have to address the vulnerabilities of European digital connectivity. The report proposes several measures that the EU could implement and provides recommendations to the European Parliament on how it can steer this development.

The report is available for download at the European Parliament’s Think Tank page: https://www.europarl.europa.eu/thinktank/en/document/EXPO_IDA(2022)702557

• Chapters 1 and 2 detail the scope and methodology of the report and discuss how important the cable network is in global connectivity, the digital economy, and military operations.
• Chapters 3 and 4 provide an in-depth analysis of the EU’s
  dependencies on the cable network and the vulnerabilities that the EU faces. They also offer an introduction to the key legal and technical features of the network. The authors conclude that the EU has growing redundancy, which means that the impact of minor damages can be managed well, yet a number of very vulnerable sites exist.
• Chapter 5 analyses the threats to the EU from Russia, China and other states, as well as from extremist groups and transnational crime networks. It highlights that several states have both the capabilities and the intent to potentially cause harm to EU connectivity. While the authors evaluate the risk of a major breakdown as low, considering it could equate to an act of war, symbolic attacks on cable connections are to be expected. Attacks and sabotage by extremists and criminal groups are equally probable.
• Chapter 6 reviews the awareness and measures available to EU Member States. It shows that cable protection is an issue of growing concern in public debates and in national security strategies in countries such as France, Portugal and Ireland. In other states, government awareness is rather limited. States have advanced different models of how they govern cables. In states such as France and Portugal, cable security is a key issue for naval forces. Others, such as Malta, rely on governance systems under civilian leadership. Yet, in others, such as Denmark, the governance of cables is led by the industry. The fact that cables often cross different mandates, responsibilities and jurisdictions poses a significant trans-European governance challenge. This calls for an intra-EU dialogue on best practices governing and protecting cables at a state level.
• Chapter 7 surveys the awareness and programmes at the EU level. Cables protection is an issue in maritime security, cyber security, ocean governance and infrastructure policies. This implies that several Directorates and technical agencies have a role in ensuring cable protection and resilience (including EMSA, EFCA, Frontex, and ENISA). While cables and other maritime infrastructures are frequently mentioned in EU strategies, hardly any actions and programmes address the issue directly. A similar picture arises in relation to external action, where the European External Action Service and EDA run relevant programmes, which, however, only address the issue tangentially. Cable resilience is also a key issue in EU-NATO relations and for future relations with the UK.
• Chapter 8 provides a range of recommendations for taking steps towards better cable resilience that need urgent attention.

The recommendations include:

1. Awareness of the issue must be increased. The update of the EU Maritime Security Strategy (EMSA) and the review of the mandate of EMSA provide key opportunities here. But the lack of awareness also calls for other dedicated measures.
2. Information sharing on cable governance, incidents, and suspicious activity needs to be improved. Bueger, Liebetrau and Franken recommend installing a cable resilience coordination group in the Commission that would include cable industry representatives.
3. Additional measures are needed to strengthen the surveillance of cables at the EU level. Partially, the technology is already in place, yet, EMSA does not have the respective mandate, and cable surveillance does not feature in CISE yet. Technological advancements in subsea surveillance that could be steered through EDA on subsea surveillance systems are also an important option.
4. Since cable connections are transnational and key in developing global digital connectivity and the economy, external action must take the issue more seriously. Dedicated ‘cable diplomacy’ and capacity building programmes are needed.

In summary, the report recommends that the European Parliament steers the debate by increasing awareness and inviting the Commission and the HRVP to develop initiatives and actions for coordination, surveillance and external action. Jonas Franken commented, “Maritime communication infrastructures have long been under-researched from a security and policy perspective, even though everyday life in Europe is wholly dependent on the internet. Our joint in-depth analysis sheds light on the enormous remaining potential of cable security policies at the EU level and beyond.”

PEASEC’s contribution to this research and its groundwork was funded by the German Federal Ministry of Education and Research and the Hessian Ministry of Higher Education, Research, Science and the Arts within their joint support of the National Research Center for Applied Cybersecurity ATHENE and by the LOEWE initiative (Hesse, Germany) within the emergenCITY centre. Dipl.-Inf. Thomas Reinhold provided valuable advice and support.

Underlying research/Zugrundeliegende Forschung :