C-Lion1 breaks in the Baltic Sea, no evidence of intentional damage

Details: By Winston Qiu; Category: C-Lion1; 19 November 2024

Cinia, the state-owned operator of Finland, announced on Monday that a fault has been detected in the C-Lion1 submarine cable connecting Finland and Germany. Earlier on Sunday, Telia reported a fault in its BCS East-West Interlink between Lithuania and Sweden’s Gotland island. Both breaks occured in the Baltic Sea. The details of the faults are yet not known, no evidence of intentional damage.

C-Lion1 Submarine Cable Fault in the Baltic Sea

Launched for service in 2016, C-Lion1 is a submarine telecommunications cable between Finland and Germany with a length of 1173 km. It is the only one submarine cable directly connecting Finland with Western Europe, other links go through Sweden and/or Denmark.

Cinia said the C-Lion1 submarine cable was interrupted after 4 am (GMT 0200) on Monday 18th November, 2024. The details of the fault are yet not known and are currently being investigated. Corrective measures have been initiated and the repair vessel is getting ready to go on the site. The exact repair time is not yet known, but typically the repair time for submarine cables is between 5 and 15 days. Finland's international telecommunication connections are routed via multiple routes and the impact of a single cable failure depends on the resilience of the service providers' connections.

The site of the C-Lion1 break was discovered four hours later - it is about halfway along the cable, in the Baltic Sea east of the island of Oland in Sweden's special economic zone. Cinia has not yet been able to verify whether the breakage is the result of sabotage. Possible causes of the incident could be bottom trawling while fishing or emergency anchor dropping.

The BCS East-West Interlink spans 218km (135-mile) linking between Lithuania with Sweden’s Gotland island, operated by Arelion (formerly Telia). The cable went out of service at about 0800 GMT on Sunday, according to Lithuania’s Telia Lietuva, part of Sweden’s Telia Company group.

According to Lithuanian National Radio and Television (LRT), the BCS East-West Interlink cable "was cut on Sunday morning, at around 10:00. The systems immediately reported that we had lost the connection. Further investigation and clarification took place, and it turned out that it was damaged,” Telia Lietuva’s Chief Technology Officer Andrius Šemeškevičius told the LRT TV Important Hour programme. Telia transmits the internet connection to Lithuania through three cables, the internet connection was restored to users by bypassing the fault.

The Foreign Ministers of Finland and Germany released a joint statement on the severed undersea cable in the Baltic Sea, saying

We are deeply concerned about the severed undersea cable connecting Finland and Germany in the Baltic Sea. The fact that such an incident immediately raises suspicions of intentional damage speaks volumes about the volatility of our times. A thorough investigation is underway. Our European security is not only under threat from Russia‘s war of aggression against Ukraine, but also from hybrid warfare by malicious actors. Safeguarding our shared critical infrastructure is vital to our security and the resilience of our societies.

The reasons of both faults are yet not known and are currently being investigated. It is irresponsible, misleading, and hysterical to point the incidents to sabotage or intentional damage, done by biased media and hysterical politicians.

Updates:

On Thursday 21 November, European Subsea Cables Association (ESCA) joined SubmarineNetworks.com to share professional view on the incidents of these two cable cuts. ESCA said there is no evidence to make any conclusive statement, and speculation on the cause of fault at a very early stage can lead to misinformation being shared.

Reports by RIPE NCC in Europe as well as Cloudflare and Kentik in the US show the damage of two cables in the Baltic Sea resulted in minimal impacts on Internet in the region.

The BCS East-West Interlink between Lithuania and Sweden’s Gotland island was repaired and restored services on Thursday, November 28.

The break in Cinia's C-Lion1 submarine cable has been repaired on Thursday 28th of November 2024 at 9 pm (EET), and the direct submarine cable connection between Finland and Germany is back online and fully operational. Cinia said the cable outage caused minimal disruption to Finnish society and Cinia's clients thanks to alternative routes and rapid repair processes, and the cause of the cable damage remains under investigation.

Media reports

C-Lion1 Cable Break

Update: 20 November

Helsingin Sanomat: A Chinese ship has moved near cable damage in the Baltic Sea in recent days,

Helsingin Sanomat (HS), the largest subscription newspaper in Finland and the Nordic countries, reported Tuesday A Chinese ship has moved near cable damage in the Baltic Sea in recent days, saying a Chinese vessel named Yi Peng 3 was moving in the vicinity of both broken communication cables at the same times when their faults were discovered.

The failure of the submarine cable between Sweden and Lithuania was discovered on Sunday, November 17, around 10 a.m. Finnish time. The Yi Peng 3 vessel moved near the cable a little before ten o'clock, according to the data of the Marinetraffic service, which monitors ship traffic.

The same Chinese vessel passed near the C-Lion1 submarine cable running between Germany and Finland on Monday morning, November 18 at 4:04 am. A fault in the cable was discovered around the same time.

On Tuesday morning, two Danish warships seem to have followed the Yi Peng 3 ship in the Baltic Sea.

Helsingin Sanomat: A ship suspected of damaging a submarine cable would not be allowed to leave the Baltic Sea

Helsingin Sanomat reported further on Tuesday, Defense Minister Antti Häkkänen (KOK): A ship suspected of damaging a submarine cable would not be allowed to leave the Baltic Sea. Häkkänen says that the authorities in the Baltic Sea region have learned from the mistakes of the Baltic Connector investigation and are prepared to stop a ship moving in the Baltic Sea if it is suspected of being involved in damaging communication cables. Häkkänen assures that the authorities of the Baltic Sea region are prepared to stop the ship if necessary. Last year, the anchor of the Chinese ship Newnew Polar Bear broke the Baltic Connector gas pipeline between Finland and Estonia. It has been suspected that the act was intentional, but there is no certainty about this. The start of the investigation into the case was badly delayed, as the ship was able to leave the Baltic Sea.

EURACTIV: Finland, Sweden plan joint investigation of possible submarine cable sabotage

Finland and Sweden plan to set up a joint team to investigate the damage done to undersea cables earlier this week, Finland’s National Bureau of Investigation (KRP) said on Tuesday amid suggestions that the damage resulted from sabotage.

According to EURACTIV,

Some conclusions have already been drawn on the German side, with Defence Minister Boris Pistorius arguing on Monday that the damage to the communication cables must have resulted from sabotage.

"No one believes that the cables were accidentally damaged. I also don't want to believe that the ships' anchors caused the damage", Pistorius said. Finnish Prime Minister Petteri Orpo (Kok, EPP) was more cautious when commenting on the damage to the communication cable between Finland and Germany.

"It is not yet possible to say whether it is sabotage. And that's why I wouldn't jump to conclusions yet,” Orpo told the media on Tuesday. He said a more detailed assessment of whether the cable damage was caused by sabotage or something else will be made after the authorities have investigated. "Then, in the next step, we will get to who did it,” he added.

Reuters: European nations denounce Russian hybrid attacks, cable cut probes launched

Reuters reported on Wednesday, European nations denounce Russian hybrid attacks, cable cut probes launched. European governments accused Russia on Tuesday of escalating hybrid attacks on Ukraine's Western allies, as Baltic nations investigated whether the cutting of two fibre-optic telecommunication cables in the Baltic Sea was sabotage. European officials have not directly accused Russia of destroying the cables. But Germany, Poland and others said it was likely an act of sabotage, while Lithuania's armed forces boosted surveillance of its waters in response.

CNN: Two undersea cables in Baltic Sea disrupted, sparking warnings of possible ‘hybrid warfare’

The United States recently warned that it had detected increased Russian military activity around key undersea cables. Two US officials told CNN in September that the US believed Russia was now more likely to carry out potential sabotage operations on these critical pieces of infrastructure.

The warning followed a joint investigation by the public broadcasters of Sweden, Denmark, Norway and Finland, which reported in April 2023 that Russia had a fleet of suspected spy ships operating in Nordic waters as part of a program of potential sabotage of underwater cables and wind farms in the region.

However, two US officials familiar with an initial assessment into the damage to the two cables told CNN Tuesday that as yet there were “no indications of nefarious activity, nor intentional damage to seafloor infrastructure” and suggested the disruption was likely caused by an anchor dragged from a passing vessel.

CNN: European officials cry sabotage after two internet cables are cut in the Baltic Sea

CNN: Accident or sabotage? American and European officials disagree as key undersea cables are cut

CNN—Investigators are trying to crack the mystery of how two undersea internet cables in the Baltic Sea were cut within hours of each other, with European officials saying they believe the disruption was an act of sabotage and US officials suggesting it was likely an accident.

The two cables – the BCS East-West connecting Lithuanian and Sweden and the C-Lion1 linking Finland with Germany – were suddenly disrupted on Sunday and Monday.

European leaders were quick to voice their suspicions. Germany’s Defense Minister Boris Pistorius said that “nobody believes that these cables were accidentally severed.”

Capacity Media: Submarine cable cuts in Baltic: Don’t rush to conclusions, says expert

Recent damage to undersea cables in the Baltic Sea has sparked fears of sabotage, but experts urge caution before assigning blame.

Julian Rawle, a submarine cable specialist and principal at Julian Rawle Consulting, advises against jumping to conclusions about the incidents, which have coincided with the detention of a Chinese vessel and suspicions of Russian involvement.

RIPE NCC: Does the Internet Route Around Damage? - Baltic Sea Cable Cuts

Two days after the Internet cable cuts in the Baltic Sea on 17 and 18 November 2024., RIPE NCC, the regional Internet registry (RIR) for Europe, the Middle East, and parts of Central Asia and headquarters are in Amsterdam, Netherlands, attempted to understand their cause and impact continue. RIPE NCC turned to RIPE Atlas to provide a preliminary analysis of these events and ask to what extent the Internet in the region has been resilient to them.

According to RIPE NCC's preliminary report, the data indicates that a significant minority (20-30%) of paths measured had latency increases. But also of note, RIPE NCC didn't find indications of higher packet loss.

This result indicates the resiliency of the Internet in as far as we measure it with RIPE Atlas anchors.

This suggest that, in the Baltic region, the Internet managed to route around the damage that occurred - for each of the physical links cut, we see relatively minor latency consequences and no visible packet loss. This hints at enough backup capacity to handle this event. If this wasn't the case, we would expect our data to have looked quite different: the packet loss should have gone up; and/or the shape of the latency increases would have been gradual, as opposed to the stepwise changes we saw for the latency-affected paths.

Update: 21 November

Reuters: Danish military says it's staying close to Chinese ship after data cable breaches

The Danish military said on Wednesday that it was staying close to a Chinese ship currently sitting idle in Danish waters, days after two fibre-optic data telecommunication cables in the Baltic Sea were severed.

Chinese bulk carrier Yi Peng 3 was anchored in the Kattegat strait between Denmark and Sweden on Wednesday, with a Danish navy patrol ship at anchor nearby, MarineTraffic vessel tracking data showed.

The Maritime Executive: Denmark Guards Chinese Bulker Linked to Subsea Cable Damage

Denmark's defense ministry has confirmed that it is monitoring a Chinese bulker suspected of potential involvement in the severing of two subsea cables in the Baltic last weekend. The damage is being investigated as a presumed sabotage attack.

The vessel, the Yi Peng 3, was outbound from St. Petersburg in the Baltic during the timeframe of the two back-to-back cable breaks. Its AIS record shows that it exhibited unusual course and speed changes at positions that may have corresponded to the twin casualties.

The ship was intercepted by a Danish Navy patrol ship as it transited towards the Great Belt on November 18. The bulker then went to anchor in the Kattegat, with the patrol ship waiting nearby. Despite the appearance of formal intervention, Denmark stopped short of announcing that the ship had been detained.

"The Danish Defence can confirm that we are present in the area near the Chinese ship Yi Peng 3. The Danish Defence currently has no further comments," the ministry said in a brief statement.

Sweden’s National Operations Department confirmed that the vessel is under scrutiny. “It is part of the sphere of interest, but there may be more," spokesman Per Engström said.

Marine Traffic: YI PENG 3 vessel's most recent movements

Marine Traffic released YI PENG 3 vessel's most recent movements on a Linkedin post

MarineTraffic data reveals that the YIPENG3 experienced a 7.5-hour transponder signal gap between 15:11:24 UTC and 22:41:44 UTC on November 17th. During this time, the vessel travelled 78 km at an average speed of 10.4 km/h.

The Danish Navy is currently closely monitoring the vessel, and our data confirm that a Danish pilot boarded the ship on November 19th at 07.53 UTC.

The YI PENG 3 is linked to Chinese interests through its ISM manager (WIN ENTERPRISE SHIP MANAGEMENT), commercial manager, and registered owner (NINGBO YIPENG SHIPPING CO LTD). As of November 20, 2024, neither the vessel nor these entities appear on published sanction lists. However, historical trade data shows the ship has transported Russian thermal coal and coal from Murmansk and Nakhodka on at least seven occasions.

European Subsea Cables Association: no evidence to make any conclusive statement, speculation on the cause of fault can lead to misinformation being shared

European Subsea Cables Association commented the incidents via a Linkedin post, saying that there is no evidence to make any conclusive statement, and speculation on the cause of fault at a very early stage can lead to misinformation being shared.

Two subsea cables located in the Baltic Sea have recently reported faults. BCS East-West cable reportedly experienced a fault at 08:00 on Sunday 17th November and the C-Lion cable reportedly experienced a fault at 02:00 on Monday 18th November (times UTC).

There has been speculation and opinion shared on social media and from news outlets as to the causes of these two subsea cable faults. Many commentators have pointed towards deliberate action. However, at this stage there is no evidence to make any conclusive statement.

Particularly since the Nord Stream Pipeline was damaged in 2022, the security of critical undersea infrastructure has been a central topic of discussion, and action, for both industry and government.

For these and future incidents it is prudent to consider the following:

-       The primary causes of cable damage in Northern European waters are commercial fishing or ship anchors, with a smaller proportion of faults caused by natural hazards (seafloor currents, storms, submarine landslides, sediment flows etc).

-       Subsea cables are protected as much as possible through burial beneath the seabed, armouring, and careful route design to avoid predicted hazards, but it is not always possible to avoid damage and cable repairs are not uncommon.

-       The cause of a fault can rarely be attributed instantly as a cable repair ship will take several days to attend the location of the damage. Physical inspection of the cable & the seabed is typically required to give a good indication of the cause.

-       When a cable experiences a fault, engineers will perform tests on the cable that will give them a distance along the cable to the fault, and with their records they will be able to calculate geographical fault position.

-       Investigations can be undertaken using tools such as vessel tracking AIS (Automatic Identification System), to see if there were any vessels at the fault location at the time it was damaged. This does not necessarily indicate whether the cause was accidental or intentional.

-       Subsea cable damage is not rare. On average, a subsea cable is damaged somewhere in the world every three days, with estimates of around 150-200 cable faults occurring each year.

-       Damaging just one, or even two, cables will rarely cause significant disruption of service and customers in the area affected are unlikely to notice any impact. Cable operators build diversity & redundancy in their networks specifically to mitigate for these sorts of occurrences.

Speculation on the cause of fault at a very early stage can lead to misinformation being shared. Most cable faults are not reported in the media, however, when they are reported before the facts are available, such speculation often leads to unhelpful and premature conclusions being drawn about the cause of cable damage.

Cloudflare: Resilient Internet connectivity in Europe mitigates impact from multiple cable cuts

According to Cloudflare Radar, the two cable cuts that occurred in the Baltic Sea resulted in little-to-no observable impact to the affected countries, in large part because of the significant redundancy and resilience of Internet infrastructure in Europe.

The Cloudflare Radar graphs show, there was no apparent impact to traffic volumes in either country (Sweden or Lithuania) at the time that the BCS East-West Interlink submarine cable was damaged.

Internet quality metrics for both Sweden and Lithuania show changes in measured bandwidth and latency throughout the day on Sunday, but with no sudden anomalous shifts visible around the time of the cable cut. (The loss of connectivity associated with a cable cut potentially manifests itself as an increase in latency and concurrent decrease in bandwidth due to loss of capacity.) The latency graph for Sweden does show an increase in latency, but it began before the cable cut occurred, is similar to a pattern visible several hours earlier, and is matched by an increase in measured bandwidth, so it is unlikely to be related to the cable cut event. No change in announced IP address space was visible for any of these autonomous systems, suggesting no loss of connectivity as the capacity was re-routed.

The Cloudflare Radar graphs also show, there was no apparent impact to traffic volumes in either Finland or Germany at the time that the C-Lion1 cable was damaged. By looking at volume-related metrics, alone, Internet connectivity would appear to be unaffected by the cable cut. From a routing perspective, there was no notable BGP announcement activity observed for top autonomous systems in either Finland or Germany around 02:00 on November 18, and total announced IP address space aggregated at a country level also demonstrated no change.

The two cable cuts that occurred in the Baltic Sea resulted in little-to-no observable impact to the affected countries, in large part because of the significant redundancy and resilience of Internet infrastructure in Europe.

It is a best practive to build redundant and resilient network architecture, at multiple levels, although it is not always feasible due to financial or geographic constraints. read more

Update: 22 November

EuroNews: Denmark and Norway continue to investigate damaged cables in Baltic Sea

"We are looking thoroughly and seriously into it, also in light of the current political situation. I note that the German and Swedish authorities are suspecting sabotage," Danish Minister of Defence, Troels Lund Poulsen, said after a meeting with his Nordic colleagues and the Ukrainian Minister of Defence.

Asked about the Denmark's activities in the area, Poulsen said "it is no secret that the Danish Defence have been following the ship. And the relevant authorities are looking into the matter."

Doug Madory, Director of Internet Analysis at Kentik: Dig into the subsea cable cuts in the Baltic Sea, the loss of the two cables caused minimal disruption due to the rich fabric of connectivity in the region.

Motorship Suukko II: Close investigation on the track of Yi Peng 3. Maybe anchor was dragged 400 km under the surface.

Youtube account Motership Suukko II published a video, suggusting Yi Peng 3 may have sailed 400 km dragging the anchor in the Baltic Sea. Click to watch the video

Update: November 28

LRT: Damaged Lithuania-Sweden telecoms cable repaired – Telia

“Telia’s Baltic Sea traffic was restored on Thursday following the disruption of Lithuania’s international link with Sweden for almost two weeks,” Telia Lietuva said on Thursday, November 28.

Telia's BCS East-West Interlink between Lithuania and Sweden’s Gotland island was damaged on Sunday, November 17. According to the company, the Lithuanian population did not experience any connectivity disruptions as a result of the incident.

WSJ: Chinese Ship’s Crew Suspected of Deliberately Dragging Anchor for 100 Miles to Cut Baltic Cables

Investigators suspect that the crew of the Yi Peng 3 bulk carrier—225 meters long, 32 meters wide and loaded with Russian fertilizer—deliberately severed two critical data cables last week as its anchor was dragged along the Baltic seabed for over 100 miles.

Their probe now centers on whether the captain of the Chinese-owned ship, which departed the Russian Baltic port of Ust-Luga on Nov. 15, was induced by Russian intelligence to carry out the sabotage. It would be the latest in a series of attacks on Europe’s critical infrastructure that law-enforcement and intelligence officials say have been orchestrated by Russia. read more

LRT: Lithuania, Finland, Sweden set up team to probe Baltic Sea cable damage

Eurojust will coordinate the new team’s activities, Lithuania’s Prosecutor General’s Office said on Wednesday, November 27.

“The establishment of a joint investigation group is one of the most effective and advanced forms of cross-border cooperation in criminal matters, enabling officials from different countries to exchange relevant data in a swift and simple manner, to partake in investigations in foreign countries, and to benefit from the financial and other assistance provided by Eurojust for the operation of such a group,” the statement reads.

The agreement to establish the JIT was signed on November 26.

A pre-trial investigation into the damage of an internet cable between Lithuania and Sweden is being carried out in Lithuania under the Criminal Code article stipulating criminal liability for terrorism.

Update: November 29

Sky News: Sweden asks China to help clarify what happened to damaged undersea cables

Sweden has formally asked Beijing to help clarify what happened when two data cables were damaged in the Baltic Sea where a China-flagged vessel had been sighted.

Swedish Prime Minister Ulf Kristersson said the request has been made as one of the cables, which connects Sweden and Lithuania, came back online after its operator Arelion said it had been repaired.

The China-flagged bulk carrier Yi Peng 3, which is currently moored in international waters between Sweden and Denmark, was seen in the area at the time the cables were damaged. Western intelligence officials from multiple countries have said they are confident the Chinese ship caused the damage to both cables.

China's foreign ministry said on Wednesday November 27 the communications channels with Sweden and other relevant parties were "unobstructed", when asked about the Swedish request for co-operation.

Authorities in Beijing had earlier said they had no information about the ship but that China was ready to "maintain communication" with relevant parties. read more

Cinia's C-Lion1 Submarine Cable Has Fully Restored

The break in Cinia's C-Lion1 submarine cable has been repaired and the direct submarine cable connection between Finland and Germany is back online and fully operational.

The fault in the submarine cable was detected on Monday 18th of November 2024 at 4:04 am, and the repair work in the Swedish EEZ, east of Öland, was completed ahead of schedule on Thursday 28th of November 2024 at 9 pm (EET).

Cinia said the cable outage caused minimal disruption to Finnish society and Cinia's clients thanks to alternative routes and rapid repair processes, and the cause of the cable damage remains under investigation. read more

Update: December 19

Reuters: China lets Sweden, Finland, Germany and Denmark board ship in cable breach case

China has allowed representatives from Germany, Sweden, Finland and Denmark to board a Chinese bulk carrier, Yi Peng 3, at the centre of an investigation into Baltic Sea cable breaches, the Danish foreign minister said on Thursday (December 19).

The Yi Peng 3 vessel is wanted in Sweden for questioning over a breach of two undersea fibre-optic cables in November, and has been stationary in waters nearby for a month while diplomats in Stockholm and Beijing discussed the matter.

Swedish police in a statement said they participated on board the vessel as observers only, while Chinese authorities conducted investigations. read more

Update: December 23

Financial Times: Sweden criticises China for refusing full access to vessel suspected of Baltic Sea cable sabotage

According to Financial Times, the Yi Peng 3 sailed away from its mooring in international waters between Denmark and Sweden on Saturday (December 22), and appears to be heading for Egypt after Chinese investigators boarded the ship on Thursday. The Chinese team had allowed representatives from Sweden, Germany, Finland and Denmark on board as observers, but did not permit access for Henrik Söderman, the Swedish public prosecutor, according to authorities in Stockholm. read more