Regulation

On October 22, 2026 the UK government published a White Paper, "Critical Undersea Infrastructure Security and Resilience" (CP 1683), with a 12-week consultation that closes at 23:59 on January 14, 2027. It proposes new offences for damaging or interfering with undersea telecoms cables, power cables, interconnectors and pipelines, with up to 14 years in prison for intentional conduct, 10 years for reckless conduct and two years for gross negligence, and unlimited fines in every tier. It would replace the Submarine Telegraph Act 1885. None of this is law yet: legislation will follow "when parliamentary time allows", with no date given.

Two later chapters matter more for how networks are run: statutory security and resilience duties for subsea telecoms cable providers, and a power for the Secretary of State to direct cable operators and repair ship operators on national security grounds, backed by fines of up to £17 million or 10% of global turnover. If your business moves data in or out of the UK, its traffic rides these cables: the government says they carry about 99% of the UK's international data traffic, and undersea pipelines supply 74% of its gas.

What the current law misses

Section 3 of the 1885 Act makes it an offence to break or injure a submarine cable "unlawfully and wilfully, or by culpable negligence" in a way that could interrupt telegraphic communication. Wilful damage carries up to five years; culpable negligence carries up to three months and a fine. The White Paper lists the gaps: the offence refers only to "telegraphic" communications, so its reach over modern fibre-optic cables is uncertain, it does not cover pipelines at all, and its application to power cables and interconnectors is untested.

The National Security Act 2023 already carries life imprisonment for sabotage, but only where prosecutors can prove a foreign power was involved; otherwise prosecutors may be left with the 1885 Act. The White Paper notes that deliberate interference can be hard to tell apart from an accidental anchor drag.

How the proposed offences work

The core offence is conduct that causes a "security compromise" to a subsea data or energy system. The term comes from the Communications Act 2003 as amended by the Telecommunications (Security) Act 2021, and covers loss of availability, performance or functionality, unauthorised access or interference, and compromise of data or signals. That brings remote electronic interference and cyber attacks into scope alongside physical cuts.

The offence would also catch conduct that is intended, planned or attempted, or likely to cause a compromise. The White Paper says this is meant to reach someone who maps, surveys or positions equipment against a cable in preparation for an attack, even before any outage, and it applies whether the vessel or vehicle is crewed, remotely operated or autonomous.

Three supplementary offences, each up to two years, cover obstructing or significantly impeding repair operations, falsifying or failing to preserve navigational, operational or vessel data, and ignoring lawful directions from law enforcement. Companies could be liable for corporate decisions or failures of oversight, and inadvertent damage during repair work would be a defence where all necessary precautions were taken. The government is also asking whether a life sentence should be available where conduct risks loss of life or serious harm to national security.

Duties on cable providers

Chapter 4 proposes four duties for providers of subsea data systems: manage the risk of a security compromise, respond to and recover from one, notify the government and a designated regulator of any compromise "including cable faults and outages, as soon as reasonably practicable", and tell direct users about significant risks, with mitigation steps and a point of contact. A designated regulator, not named in the text, could fine up to £10 million or 10% of qualifying worldwide revenue, whichever is higher.

The duties apply to those who own, operate or control the cable system. The White Paper says they are not aimed at "downstream connectivity services that use subsea routes incidentally", so an enterprise buying an international circuit counts as a user and carries none of these duties. Energy operators sit outside the duties and the direction power; the government is handling energy separately.

The direction power and what it does to repairs

The Secretary of State could direct cable providers and providers of repair capability, including the vessels and equipment used to lay and fix cables, when a compromise or threat creates a national security risk. Examples include handing over routing, capacity and fault data, giving public bodies access to cable landing stations, rerouting traffic or isolating systems, prioritising connectivity for essential services, prioritising repairs "where continued disruption would have the most serious national impacts", and delaying repairs where fixing the cable straight away would prejudice an investigation or attribution.

A direction may carry a non-disclosure requirement, and could apply along the full length of a UK-connected cable, beyond the 12 nautical mile territorial sea. Breaching one could cost up to £17 million or 10% of global turnover, plus up to £100,000 a day; failing an information or inspection request, or breaking a non-disclosure requirement, up to £10 million plus £50,000 a day. In practice, if a cable carrying your traffic is damaged in suspicious circumstances, its repair could be held back or queued behind other cables, and your carrier may not be allowed to tell you why.

A separate chapter proposes screening for fibre-optic sensing such as Distributed Acoustic Sensing (DAS), which uses the cable's own fibre to detect vessel traffic nearby. Operators would notify the government at least six months before a permanent deployment on an existing cable.

What to do

Map which circuits ride which cables

For every international circuit (private WAN links, internet transit, dedicated internet access, private cloud interconnects), ask the carrier in writing for the cable systems and UK landing stations it uses on the primary and backup paths. The White Paper counts 64 active subsea telecoms systems landing in the UK, 45 international and 19 domestic, so the answer is a short list of names.

Check that route diversity is real

Two circuits from two carriers can still share one cable system or one landing station. If both appear on the same line of your map, a single fault takes out both. Fix it with a carrier or route that lands elsewhere. Add island sites to the map too, since the 19 domestic cables connect the mainland to offshore islands.

Reread the contract

Look at the repair time commitment, service credits and force majeure clause for each subsea route. Ask the carrier how a government direction to delay or reprioritise a repair would be treated under the service level agreement (SLA), and who will tell you a direction exists if it is under non-disclosure. Under the proposed duty to inform users, ask now for the named contact who would send a risk notice.

Test the failover

In a maintenance window, fail the primary international path and measure latency and throughput on the backup, then check delay-sensitive traffic such as replication and voice. The White Paper notes satellite links "cannot replicate the capacity and speed" of subsea systems, so do not plan on them carrying full load.

Respond to the consultation

Responses go through an online questionnaire of 72 questions, plus a separate cost impact survey. Large users have a stake in Q14 (the four duties, including user notification), Q15 (a provider register) and Q34 (what a direction can require, including delayed repairs). Back answers with facts and figures, and submit before 23:59 on January 14, 2027.

If you want help mapping which of your services depend on single routes, or testing that failover works under load, see our platform and cloud engineering and compliance and audit readiness services. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: GOV.UK press release, GOV.UK consultation page, White Paper CP 1683 (PDF), Submarine Telegraph Act 1885, section 3, The Record, TelecomTV, UK Defence Journal, Help Net Security.