Stay informed with free updates
Simply sign up to the Cyber Security myFT Digest — delivered directly to your inbox.
The writer is a senior fellow at the Atlantic Council and advises Gallos Technologies
A string of mysterious undersea cable incidents is spooking governments and Nato. But they should spook another group too: the financial services industry. If several cables connecting Britain or the US east coast were severed, the City of London and Wall Street would face colossal disruption and losses. Both London and New York should prepare for it.
On Christmas Day last year, the Cook Islands-flagged tanker Eagle S hit five cables in the Gulf of Finland. Had the Finnish Border Guard not boarded the tanker, which belongs to Russia’s so-called shadow fleet, the destruction could have been even worse. The cables’ operators closely followed the developments — and so did Jaakko Weuro, the head of Finland’s Financial Stability Authority (RVV).
RVV, established in 2015 to protect taxpayers from the effects of financial crises and to prevent financial crises, is not in charge of undersea infrastructure. But money travels through the world’s more than 500 data cables — some $10tn of it every single day.
Weuro knew that if the Eagle S had hit more cables before the Border Guard intervened, Finland’s financial stability could have been shaken. Since 2022, Finland has been working to set up a rudimentary system ensuring payments in case of a blackout.
But most other countries don’t even have a Finnish-style backup. “We need the cables,” Weuro told me. “We can’t replace them with satellites.” Compared to undersea cables, satellites are costly and cumbersome. No wonder the workhorses of the ocean carry 99 per cent of all internet traffic, including virtually all financial transactions.
If the cable system fails, what do we do? There is no clear answer. London and New York, too, are profoundly dependent on the cables. The coasts off these two cities just happen to be hubs for the cables connecting the UK with Europe and the east coast of the US with Europe, which makes them even more attractive for sabotage.
Undersea cables use a redundancy model: if one cable is damaged, its “twin” automatically takes over its traffic. But what would happen if a whole string of cables were damaged at the same time? Even a disruption of a few minutes would cause massive damage to financial institutions.
Who would pay for the loss if, say, a £100mn transaction were halted because a mysterious ship hit the cable executing the transaction and the backup cable had been damaged too? Under the best of circumstances, repairing a data cable takes several days.
Banking bosses in London and New York should demonstrate preparedness for a cable outage much as they prepare contingency plans for a major cyber attack or another global financial crisis. We stress-test for the latter two; the Bank of England conducts the industry-wide SIMEX exercises involving infrastructure faults demanding a reset, and the US Sheltered Harbor allows banks to maintain basic operations after a cyber incident.
But in the event of a subsea cable outage, we would — so to speak — be at sea. “Money affected by a cable outage might not be ultimately lost, but it could distort the market,” Weuro reflected. “There would be winners and losers. What if a bank loses so much money that it imperils the viability of the country’s financial system? And because we don’t have experience with such an event, we don’t know how long it would take to recover and how to plan for such an event.” In the meantime, he continues to build Finland’s Plan B.
Planning how to respond to such devastation in both hubs of the global financial system is essential. It would have to involve not just banks but governments, cable operators, underwriters and cable-repair firms too. Those who prepare will be better off than those who don’t.