Silent Borders: The Emerging Role of Submarine Cable Governance in Cross-Border Data Privacy and Data Protection Compliance
- christopherstevens3
- Dec 12, 2025
- 17 min read
Executive Summary
Submarine cables quietly move almost all the world’s cross-border internet traffic, yet they remain the most overlooked component of global privacy and data protection discourse. Every day, personal and sensitive information travels thousands of miles along fiber laid on the ocean floor. It crosses borders, jurisdictions, and geopolitical zones without the awareness of most organizations responsible for safeguarding that data. Legal and regulatory debates typically focus on cloud providers, encryption, or data localization. Moreover, the physical infrastructure that enables global communication operates in a policy blind spot, leaving surveillance, interception, and governance gaps that can expose data.
Recent geopolitical tensions, advances in fiber tapping, and increasing state and non-state actor interference have transformed submarine cables into strategic assets and potential points of vulnerability. Landing stations can serve as gateways for lawful or unlawful access. International waters offer minimal enforcement, and multinational ownership structures complicate accountability. These risks intersect with modern privacy regimes that were not designed to account for the physical routes through which data flows.
This article illuminates the hidden world of submarine cable governance and its implications for cybersecurity, compliance, data privacy, data protection, and national security. It examines the infrastructure underpinning global data flows and analyzes gaps in legal and regulatory oversight. It identifies emerging threat vectors and outlines real-world risks with strategic relevance for regulators and enterprise leaders. The article concludes with policy and governance recommendations to bridge the gap between data privacy and data protection and the physical systems that enable global submarine cable connectivity.
Key Insights
Submarine cable governance has become critical, yet underexamined
dimension of global data protection. Consequently, several foundational insights help frame the issue's scope and urgency. The following key points highlight where current approaches to cybersecurity, data privacy, data protection, and physical security fall short. They discuss why a deeper examination of submarine cable infrastructure is essential (Guay, 2023).
1. Compliance frameworks focus on endpoints rather than risks created during long-distance data transit, leaving submarine cable routing largely absent from data protection impact assessments (DPIAs), transfer impact assessments (TIAs) when appropriate, and other risk assessments (Bafoutsou et al., 2023; FCC, 2025).
2. Cable landing stations serve as strategic control points where surveillance, interception, or unauthorized access can occur. They are creating significant vulnerabilities for data in transit (Paik & Counter, 2024; Runde et al., 2024).
3. Data protection laws and cross-border transfer rules seldom account for the physical pathways through which data flows. This oversight results in a legal and regulatory blind spot surrounding infrastructure-level exposure (United States Senate, 2024).
4. International waters introduce a governance vacuum in which surveillance, interference, and sabotage can take place with limited legal attribution or recourse (Aitken, 2025; Bafoutsou et al., 2023).
5. State and non-state actors actively target submarine cables to gain strategic, intelligence, or economic advantage. This activity increases the broader risks to data privacy, data protection, and national security associated with global data flows (Insikt Group, 2023; Runde et al., 2024).
Together, these insights reveal the structural, legal, and geopolitical complexities surrounding submarine cable governance. To support a deeper understanding of these issues in the sections that follow, the following key terms establish the foundational concepts used throughout the article.
Key Terms
Understanding the governance, technical exposure, and jurisdictional challenges of submarine cable infrastructure requires a precise vocabulary. The following terms establish the foundational concepts used throughout this article and help clarify how physical infrastructure, legal frameworks, and operational risks intersect to shape global data protection and cybersecurity concerns. The key terms in Table 1 underpin the subsequent analysis and ensure readers share a consistent understanding of the terminology governing submarine cable governance.
Table 1: Key Terms
Term | Definition |
Cable Governance Regime | The collection of international treaties, national laws, regulatory requirements, technical standards, and operational practices that shape how submarine cables are constructed, owned, maintained, secured, and overseen across jurisdictions (FCC, 2025; Paik & Counter, 2024; United States Senate, 2024). |
Data in Transit Risk | The risk that personal, sensitive, or strategic data may be intercepted, altered, or exposed while traversing network pathways, including long-distance cable segments that carry most global internet traffic (Bafoutsou et al., 2023; Insikt, 2023). |
Fiber Tapping | A surveillance or interception technique that extracts optical signals from fiber-optic cables, often without causing detectable service disruption, poses significant risks to confidentiality (Bafoutsou et al., 2023; Runde et al., 2024). |
International Waters | Maritime zones beyond national jurisdiction, where legal authority is limited and enforcement is difficult, permit cable interference, surveillance, or sabotage with reduced oversight (Aitken, 2025; Bafoutsou et al., 2023). |
Landing Station | A terrestrial facility where submarine cables connect to land-based telecommunications networks. These stations serve as critical control points and may present opportunities for lawful access, surveillance, or unauthorized interception (FCC, 2025; Paik & Counter, 2024; Runde et al., 2024). |
Resilience Redundancy | The degree to which submarine cable networks incorporate backup routes, diverse landing points, and rapid repair capabilities to maintain connectivity and mitigate disruptions caused by accidents, natural events, or hostile interference (Bafoutsou et al., 2023; Insikt Group, 2023). |
Submarine Cable | High-capacity fiber optic cables laid on the seabed carry most of the intercontinental data traffic. They form the physical backbone of global digital communication and are essential to cross-border data flows, cloud services, and modern economic activity (Bafoutsou et al., 2023; United States Senate, 2024). |
Source Note. Definitions in this table are synthesized from established analyses of submarine cable governance and security published by Bafoutsou et al., (2023), Paik & Counter (2024), the Federal Communications Commission (2025), the United States Senate Committee on Commerce, Science, and Transportation (2024), Runde et al. (2024), Insikt Group (2023), and Aitken (2025). These sources provide authoritative descriptions of cable infrastructure, associated risks, and the regulatory and geopolitical factors shaping global subsea cable governance.
With these foundational terms established, the discussion now turns to the current state of global submarine cable infrastructure. Understanding how these systems are built, operated, and exposed is essential for evaluating the privacy, security, and governance challenges explored in later sections.
Current State of Submarine Cable Infrastructure
Submarine telecommunications cables carry most intercontinental data traffic and support global finance, cloud computing, public services, and digital communication (United States Senate Committee on Commerce, Science, and Transportation, 2024). More than four hundred operational cables connect regions worldwide, and these systems rely on advanced fiber-optic technology to transmit large volumes of data with low latency (Bafoutsou et al., 2023). Federal research further emphasized that the global cable network is a critical component of national infrastructure. It noted that cable faults, routing decisions, and maintenance operations have direct implications for economic stability and national security (Gallagher, 2022). Additionally, national resilience and data security depend heavily on submarine cables. However, these systems remain vulnerable to surveillance, interference, and operational disruption, creating significant risks to the confidentiality and integrity of the data they transport (CCDCOE, 2019).
The cable industry has changed in recent years. Traditional carriers once dominated construction and ownership, but major technology companies now finance or control many routes. This shift has increased concerns about strategic dependence and foreign influence in critical communication systems (Brookings Institution, 2024). Analysts also warn that concentrated ownership can magnify security and privacy risks when operational control is linked to foreign intelligence interests or when transparency is limited (Insikt Group, 2023).
Cable installation and repair require specialized ships, trained technical crews, and detailed coordination among multiple countries. Cables pass through regions affected by earthquakes, shifting seabed conditions, and powerful currents (Bafoutsou et al., 2023). Many faults result from fishing activity, ship anchors, or maritime construction. These disruptions demonstrate the system's physical fragility and the difficulty of maintaining stable global connectivity (England, 2021). Repairs can take days or weeks when weather, vessel availability, and government permits delay recovery operations (Aitken, 2025).
Security research continues to document exposure to confidentiality, integrity, and availability risks. Deep-sea segments are difficult to monitor, and near-shore routes can allow surveillance or unauthorized access when security practices are weak (Atlantic Council, 2024). National security reports emphasize that landing stations represent significant points of vulnerability because they connect global undersea routes to domestic networks and can enable interception or manipulation of data traffic (FCC, 2025; Runde et al., 2024).
Legal and operational challenges increase in international waters. The United Nations Convention on the Law of the Sea (UNCLOS) provides limited protection for submarine cables and offers few practical mechanisms for enforcement. Scholars note that jurisdictional and accountability gaps create opportunities for deliberate interference or covert activity with minimal legal consequences (Bhatt, 2025; Petty, 2022). Recent assessments also indicate that adversaries may exploit these gaps through shadow operations or intelligence collection that remain difficult to detect or attribute (Aitken, 2025; Insikt Group, 2023).
Global resilience remains uneven. Some regions benefit from diverse cable routes, while others depend on one or two lines that can fail without warning. Service disruptions in these regions can isolate entire countries and interrupt essential services (Bafoutsou et al., 2023). Policy analysts stress that infrastructure growth has not been matched with improved security standards or coordinated international protection measures, leaving the cable network advanced in design but fragile in practice (Brookings Institution, 2024; Sherman, 2021).
The current state of submarine cable infrastructure, therefore, reveals a critical system that supports the global economy yet operates with significant legal, operational, and security weaknesses that modern data privacy and data protection frameworks seldom acknowledge (Guay, 2023). The vulnerabilities in the current infrastructure create conditions that enable hostile actors to exploit weaknesses in both deep-sea routes and landing stations. The following section examines how state actors and non-state groups exploit these conditions and why their activities pose increasing risks to global data security.
Leading State and Non-State Actor Threats
Submarine cables remain vulnerable to activities by state actors and non-state groups seeking strategic advantage, intelligence access, or operational disruption. These actors view undersea infrastructure as an attractive target because control over these routes can influence surveillance potential, geopolitical leverage, and national resilience (Brookings Institution, 2024; Guay, 2023; Insikt Group, 2023).
1. State Actors: State actors possess advanced maritime capabilities, intelligence services, and technical resources that allow them to operate near or along cable routes with limited detection. These states may map routes, monitor landing stations, or interfere with infrastructure during periods of tension. The fragmented international governance facilitates such activities in areas with limited oversight (Bhatt, 2025; Petty, 2022). Table 2 summarizes the primary state actors that present risks to submarine cable infrastructure and the specific activities associated with their involvement.
Table 2: State Actor Threats
State Actor | Identified Threats |
People’s Republic of China | Policy research identifies suspected surveillance activity by state-linked vessels and a growing presence in cable construction and servicing firms. China also exerts influence in regions such as the South China Sea and the Asia-Pacific, raising concerns about the risk of routing influence and infrastructure exposure (Brookings Institution, 2024; Runde et al., 2024). |
Russian Federation | Russian naval units have been reported near sensitive maritime routes in the Baltic Sea, Arctic passages, and the North Atlantic. These activities include route mapping and potential interference, which align with broader patterns of strategic pressure and intelligence collection (Paik & Counter, 2024; Sherman, 2021). |
Other Geostrategic States | Some states seek influence through cable landing approvals, regulatory authority, or infrastructure partnerships. These actions may enable access to routing data, maintenance operations, or surveillance opportunities when transparency and governance standards are weak (Brookings Institution, 2024; Guay, 2023). |
Source Note. Information in this table is based on documented assessments of state activity related to submarine cable surveillance, interference, and strategic control. Key sources include analyses from Paik & Counter (2024), Brookings Institution (2024), the Center for Strategic and International Studies (2024), the Council on Foreign Relations (Sherman, 2021), Aitken (2025), and legal and policy scholarship addressing jurisdiction and state behavior in international waters (Bhatt, 2025; Petty, 2022).
2. Non-State Actors: While state actors pose significant strategic risks, they are not the only groups that threaten submarine cable security. Non-state actors vary in capability and intent, but they can still create substantial risks to cable integrity. Their activities range from intentional interference to accidental damage, and many incidents exploit weak oversight at landing stations or during maintenance operations (England, 2021). Submarine cable systems face ongoing surveillance attempts, route interference, and accidental disruption, underscoring the broader risks that state and non-state activity pose to confidentiality and availability of data (Bueger et al., 2022). Table 3 examines non-state actors whose activities also create data privacy, data protection, and operational risks.
Table 3: Non-State Actor Threats
Non-State Actor | Identified Threats |
Criminal Groups | Criminal groups may attempt to intercept data for financial theft, extortion, or unauthorized access. They rely on compromised insiders and weak physical security controls near landing stations (Guay, 2023; Insikt Group, 2023). |
Environmental Operators | Fishing vessels, dredgers, and construction ships frequently cause accidental breaks or disturbances. The resulting outages create operational and security challenges during recovery (Bafoutsou et al., 2023). |
Private Maintenance Contractors | Contractors without strong oversight may introduce surveillance tools or provide unauthorized access during maintenance, particularly in regions with weak regulatory standards (England, 2021). |
Shadow Fleets or Disguised Vessels | Ships with unclear ownership may conduct anchor dragging, route monitoring, or covert interference. These actions are difficult to attribute because many occur in areas with limited jurisdictional authority (Aitken, 2025; Petty, 2022). |
Source Note. Information in this table is derived from security assessments, industry reports, and legal analyses that document non-state activity affecting submarine cable systems. Key sources include Insikt Group (2023), Bafoutsou et al. (2023), Bueger et al. (2022), England (2021), Aitken (2025), Guay (2023), and related policy commentary on infrastructure exposure and unauthorized access.
State and non-state actors, therefore, pose a sustained threat to the confidentiality, integrity, and availability of data transmitted via submarine cables. Attribution remains difficult because many operations occur in remote regions or international waters where enforcement is limited. These governance gaps allow covert activity, surveillance, and interference to continue with minimal accountability (Bhatt, 2025; Sherman, 2021). Additionally, these threat patterns highlight the need to examine whether current data privacy and data protection laws and regulations adequately address the risks posed by data traversing submarine cable systems.
Applicable Global Data Privacy and Data Protection Laws and Regulations
Submarine cable governance intersects with a wide range of data privacy and data protection laws and regulations. These frameworks govern international transfers and organizational responsibilities, but none directly address the physical movement of data across undersea routes. Table 4 summarizes several global data privacy and data protection laws and regulations that shape cross-border data governance and highlights remaining gaps in the protection of data in transit.
Table 4: Global Data Privacy and Data Protection Laws and Regulations Possibly Relevant to Submarine Cable Governance
Framework or Law | Summary of Relevance | References |
Brazil General Data Protection Law | Regulates international transfers and applies to processing involving individuals located in Brazil. LGPD does not address risks associated with submarine transit or exposure during undersea routing. | Guay, 2023 |
China Personal Information Protection Law | Requires security assessments for cross-border transfers and localization for critical sectors. PIPL does not assess cable path risks or exposure during maritime transit. | Bhatt, 2025 |
European Union General Data Protection Regulation | Governs transfers through adequacy, contractual safeguards, and risk assessments. GDPR does not address physical data routing and does not require identifying transit states or cable paths. | Bafoutsou et al., 2023; United States Senate, 2024 |
India Digital Personal Data Protection Act | Establishes authority to designate restricted jurisdictions for transfers. DPDPA does not regulate cable route exposure or risks during transit or in international waters. | Petty, 2022 |
International Agreements (OECD Guidelines, Convention One Hundred Eight Plus, APEC CBPR) | Promote accountability and international cooperation. These agreements do not include requirements for evaluating cable security, physical routing, or maritime transit risk. | Brookings Institution, 2024 |
United Kingdom Data Protection Act, United Kingdom GDPR, United Kingdom Data and Use Act | Mirror GDPR principles and impose strict transfer and accountability obligations. These laws do not address the physical path data takes through undersea systems. | Paik & Counter, 2024 |
United States Federal and State Privacy Laws | Regulate storage, access, and processing. These laws do not govern data in transit over undersea cables and do not require evaluating infrastructure exposure. | FCC, 2025; Sherman, 2021 |
Source Note. The information in this table is synthesized from legal analyses, regulatory reviews, and policy research examining the limits of global data protection frameworks. Key sources include Bafoutsou et al. (2023), Paik & Counter (2024), the United States Senate (2024), the Brookings Institution (2024), Guay (2023), Bhatt (2025), Petty (2022), FCC (2025), and Sherman (2021). These sources document how major privacy regimes regulate international transfers while leaving the physical movement of data through undersea cables outside their scope.
The absence of routing-specific obligations across these frameworks exposes a significant gap in global privacy protection. This gap creates conditions in which data in transit remains vulnerable to monitoring, interception, or foreign influence. The following section examines the governance challenges posed by these limitations and the risks they present to cable security.
Governance Challenges and Risks
Legal fragmentation, enforcement gaps, complex ownership structures, and limited recognition of the risks inherent in international transit shape submarine cable governance. These challenges weaken global resilience and create persistent vulnerabilities across the entire cable ecosystem. Submarine cable networks shape digital sovereignty because states can exert influence over routing, infrastructure control, and access conditions. This dynamic creates governance tensions when geopolitical interests intersect with the need to secure cross-border communication systems (Ganz et al., 2024). Table 5 summarizes the central governance and operational risks identified in research, policy analysis, and security assessments.
Table 5: Governance Challenges and Risks for Submarine Cable Infrastructure
Challenge or Risk | Description of Issue | References |
Compliance Blind Spots | Organizations often fail to assess physical routing in risk reviews, and privacy programs seldom consider undersea transit within DPIAs or transfer assessments. | Guay, 2023; Insikt Group, 2023 |
Geopolitical and Supply Chain Exposure | Ownership structures, foreign vendor involvement, and service dependencies can introduce surveillance, espionage, or control risks. | Brookings Institution, 2024; Runde et al., 2024 |
Infrastructure Sabotage | Cable cuts and targeted interference can disrupt essential services, affect entire regions, and delay restoration. | Aitken, 2025; Paik & Counter, 2024 |
International Waters and Enforcement Gaps | Limited jurisdiction and weak enforcement frameworks allow covert operations, tapping, or interference without clear accountability. UNCLOS provides only minimal protection for submarine cables and leaves significant ambiguity in enforcement, which allows interference and surveillance to occur in international waters, with few practical remedies | Bhatt, 2025; Petty, 2022; Shvets, 2021 |
Jurisdictional Fragmentation and Landing Station Control | Varying national laws governing landing stations may permit access by domestic authorities or other actors, thereby compromising privacy. | Bafoutsou et al., 2023; FCC, 2025 |
Limited Legal Recognition of Data in Transit Risks | Global data privacy and data protection laws and regulations regulate processing and storage, but do not address submarine cable routing or undersea exposure. | Guay, 2023; United States Senate, 2024 |
Resilience and Repair Limitations | Limited vessel availability, weather, geopolitical restrictions, or conflict conditions may delay restoration. The international legal system does not provide effective mechanisms to prevent or respond to cable interference, particularly in areas beyond national jurisdiction, a concern that remains unresolved. | Aitken, 2025; Davenport 2015; England, 2021 |
Surveillance and Eavesdropping | Landing stations and cable segments can be tapped, and entire data streams may be collected without detection. | Bafoutsou et al., 2023; Runde et al., 2024 |
Comments