Rising Threats to Undersea Infrastructure

Russia has been increasing its undersea sabotage operations against the United Kingdom, raising concerns about the security of critical infrastructure. In April, the Defence Secretary disclosed that three Russian submarines conducted a month-long surveillance operation targeting undersea cables and pipelines in northern UK waters. A British warship and aircraft were deployed to monitor the Russian fleet, ultimately ending the operation. According to John Healey, this mission was likely aimed at mapping vital infrastructure.

This particular Russian spy operation was more advanced than usual, employing distraction tactics with an Akula-class submarine to divert British forces. Experts have expressed fears that such sabotage operations are escalating, with the possibility of taking the UK offline becoming increasingly real.

As an island nation, the UK depends on approximately 60 undersea cables, which carry over 90% of daily internet traffic. There is growing concern that Russia could attempt to sever or damage these essential channels during a conflict, leading to significant political and economic disruption. A September report by Parliament’s Joint Committee on National Security Strategy highlighted the risks of attacks on the limited number of cables around the UK's outlying islands, which are prime targets for sabotage. The report cited previous damage to cables connecting the Shetland Islands, Orkney, and Banff, which caused mobile, landline, and internet issues.

The report also warned about the concentration of essential data in high-capacity subsea cables. It emphasized that the government and industry were not adequately prepared for potential attacks, noting a "strategic vulnerability in the event of hostilities." The committee expressed a lack of confidence in the UK's ability to prevent such attacks or recover within an acceptable timeframe.

Strengthening Defences: UK's Efforts

In recent years, the UK has implemented changes to bolster its defences. The Cyber Security and Resilience Bill proposes new laws for essential businesses to manage risks effectively. Additionally, the Atlantic Bastion blueprint, launched in December, aims to create a hybrid force comprising autonomous vessels, AI technologies, warships, and aircraft to defend British waters and protect undersea cables.

However, these efforts are progressing slowly and are not yet comprehensive. This month, the Defence Secretary convened telecoms companies to discuss collaboration on defence, but no public-private partnership plans have been implemented yet. Experts also stress the need for better recovery plans.

Estonia: A Model for Cyber Security

A small state in Europe’s far east could offer a model for how Britain protects its infrastructure lifelines. Estonia has revolutionised cyber security and leads in defending against Russian cable and cyber sabotage. The Estonian navy has deployed patrol ships to protect its cables, while telecoms companies have duplicated their connections to avoid being fully cut off during attacks. Estonia can also utilise other sea or land cables through neighbouring Latvia.

Estonia's approach to cyber security is broad and deep, referred to as e-Estonia. The country has pioneered a digital society, with the Republic of Estonia’s Information System Authority report on cyber security 2026 stating that "cyber security should be layered, like a millefeuille," embracing both the protection of cables and wider connections in case of failure.

Bordering Russia, Estonia faces constant threats from Moscow. Like Britain, Estonia and its NATO neighbours have dealt with attacks on undersea cables in the Baltic Sea, which they share with Russia. With over 35 cables in the shallow body of water, the region is particularly vulnerable. Since Russia’s full-scale invasion of Ukraine in 2022, there have been numerous reports of damage to cables and gas pipelines, including those connecting Finland and Estonia, Sweden and Estonia, and Sweden and Lithuania. In one instance, a fifth of Lithuania’s internet capacity was reduced due to a cut cable.

The threat to Baltic Sea infrastructure is significant given Russia’s geopolitical ambitions. The Baltic states—Lithuania, Latvia, and Estonia—were annexed by the Soviet Union in 1940, although this was not recognised by the West. Recently, Ukraine has warned that these tiny states might face a Russian attack to regain influence in the east.

Lessons from Estonia's Cyber Defence

Estonia was the first nation to face cyber warfare and sabotage attacking an entire country. By the early 2000s, it had become a leader in cyber capabilities after restoring its independence in 1991, prompting digital modernisation. However, in 2007, a series of devastating attacks on government, banking, and media websites occurred. These coincided with a disagreement with Russia regarding the relocation of a Soviet-era grave marker. Online services faced blackouts, with cash machines brought down, emails disrupted, and spam disseminated. The attacks peaked on 9 May, Victory Day in Russia.

After this, Estonia embraced cyber security as a necessity. The defence ministry developed a cyber security strategy—one of the first in the world—which promoted cooperation between the public and private sectors, awareness of cyber threats, and improvement in cyber training. Cyber security programmes were launched at universities in Tallinn and Tartu, and a NATO-accredited Co-operative Cyber Defence Centre of Excellence was established. A Cyber Defence Unit of the Estonia Defence League was also created in 2010, consisting of IT professionals who practice cyber defence by modelling attacks and networking between the public and private sectors.

Estonia has also developed blockchain-based technology to protect its digital infrastructure, ensuring that any alterations to information are detectable. This technology enables the government to handle large amounts of data quickly. Estonia operates the world’s first “data embassy” in Luxembourg, allowing backups of data in case of an attack.

Estonian public services are now 100% online, 24/7, making cyber security essential. Despite its small size and the threat of war, Estonia’s model offers valuable lessons for the UK. The Estonian recognition of threats from the government, along with the rapid implementation of nationwide protection plans—including innovations in technology and defence, public-private collaboration, and recovery plans—are what the UK needs to protect its essential cables. Britain’s current approach, as experts warn, is too slow in implementation and too limited in focus. A widespread awareness of dangers and a cross-government approach are necessary to ensure valuable resources are protected.