According to an investigation published by The Telegraph on October 21, 17 Russian fishing vessels repeatedly sailed slowly or lingered for long periods near undersea communications cables linking Britain with the United States and Europe. The paper matched four and a half years of vessel-tracking data against cable location data and identified more than 500 instances of vessels lingering over cables or moving along their routes. It suggests these vessels may have been surveying the exact positions of the cables, but the activity confirmed does not in itself amount to an attack or a cable cut. The investigation highlights a challenge that goes beyond spotting suspicious vessel movements: how to establish what those activities were for, and how to protect critical communications infrastructure.
17 Russian fishing vessels, more than 500 instances of suspicious activity near cables
The Telegraph's investigation combined data from Global Fishing Watch, which tracks vessel movements using satellites and other means, with charts showing where undersea cables are laid. It identified 17 Russian fishing vessels that repeatedly sailed slowly or lingered for extended periods near the cables. The analysis, however, rests on records of vessel positions and movements. It is not a direct confirmation of what was actually done on the seabed.
One concrete example cited by the paper involves activity near Atlantic Crossing 1, an undersea communications cable running north of Scotland. Russian fishing vessels reportedly spent a total of 337 hours over this cable, 322 of them concentrated in April 2023. The concern for monitors is not that vessels simply passed over the cable, but that activity continued for long periods in a specific area. Even so, tracks alone cannot establish that the vessels were actually surveying the cable.
The main figures from the report, and the limits of what each one means, can be summarized as follows.
| Figure in the original report | What is being counted | What the figure alone does not tell us |
|---|---|---|
| 4.5 years | The period covered by the vessel-tracking data analyzed | Whether the vessels operated continuously with the same mission or purpose |
| 17 | Vessels confirmed lingering or sailing slowly near cables | The equipment on each vessel or its actual mission |
| 500+ | Instances of lingering over cables or moving along cable routes | How many times attacks or cable cuts were carried out |
This table organizes the figures published by The Telegraph; it is not an independent recount of the vessel-tracking data. Crucially, 17 is a count of vessels and 500-plus is a count of activities identified from tracks. Neither is a count of sabotage. Repeated suspicious tracks are a strong lead for narrowing down targets for monitoring. But piling up the number of occurrences does not reveal what equipment the vessels carried, whether they touched the cables, or what their purpose was.
Can vessel tracks reveal the purpose of an activity?
Using Automatic Identification System (AIS) information, it is possible to trace when, where and how a ship moved. It cannot show why a vessel sailed slowly through a particular area or stayed in one place for a long time. Determining whether it was ordinary fishing or a survey of undersea infrastructure requires information beyond the tracks themselves.
Global Fishing Watch, which supplies the data, itself says there are limits to inferring a vessel's intent from position data. In a June 4 explainer on illegal fishing risk, the group noted that AIS alone "cannot capture the operator's intent or the full legal context of the activity." It also said that in remote waters satellite reception of signals can drop out, and that position data may be deliberately manipulated or transmissions switched off. Assessing a vessel's activity therefore requires combining multiple indicators, such as vessel registry information.
That said, this describes the limits of AIS data in general and is not an assessment of the 17 Russian vessels in the report. Suspicious tracks do not by themselves justify concluding that sabotage or reconnaissance took place. At the same time, unresolved intent is no reason to neglect monitoring. If similar activity recurs near undersea cables, it can help identify waters where additional observation or investigation should be prioritized.
The Telegraph suggests the vessels may have been surveying the exact locations of the cables. But the equipment and missions of each of the 17 vessels, and what they actually did on the seabed, cannot be fully explained by tracks alone. Information that helps identify targets for monitoring must be clearly distinguished from evidence that proves specific vessels committed specific acts.
NATO expands drone surveillance, but proving intent remains a challenge
NATO is already building a surveillance system that combines drones with existing ships and other assets to protect undersea infrastructure. The setting for that effort is the Baltic Sea, not the North Atlantic that is the focus of this report. According to a February 12 NATO release, Task Force X-Baltic, launched in January 2025, supports Baltic Sentry, an initiative to protect undersea infrastructure. Between March and October 2025, it enabled the deployment and testing of 70 aerial and maritime drones.
However, the figure of 70 is neither the number of vehicles directly monitoring cables underwater nor a count of attacks thwarted. NATO assesses that using autonomous systems and AI can improve situational awareness and the ability to detect malicious activity, but this is not a record of tracking the 17 Russian fishing vessels reported in the North Atlantic. What the Baltic effort shows is an attempt to add observation tools, such as drones, to traditional ship-based monitoring.
Stronger monitoring does not necessarily make sabotage easier to prove. In a May 29 policy statement, the UK government also acknowledged that malicious activity at sea often has unclear intent, making it hard to prove and prosecute. Even where laws exist to punish serious sabotage clearly tied to a hostile state, evidence is still needed in each case to show what was actually done and who was involved.
To address these problems, the UK government is considering tougher penalties for deliberately or recklessly damaging undersea cables. It is also considering imposing duties on cable owners and operators to prevent, detect and respond to damage. For large-scale incidents, it plans to propose emergency powers allowing the government to direct companies to take measures to protect infrastructure. But these were presented as items under consideration or proposal in the May policy documents, and not all of them are systems already in force.
Drone surveillance, legal accountability and infrastructure protection by operators each play a different role. Even if suspicious vessels can be spotted early, further investigation is needed to prove what a ship actually did. Systems that let telecom operators respond quickly if a cable is damaged are also essential. More advanced monitoring technology alone cannot adequately secure undersea communications infrastructure.
Protecting undersea cables takes more than monitoring: recovery capacity matters too
According to the UK government's May explanation, there are about 64 undersea cables supporting the country's communications, and repair ships are arranged to reach the site within eight days if a fault occurs. That, however, is the time for a repair ship to arrive; it does not guarantee that repairs will be completed and communications restored within eight days. Depending on the damage and the repair work, additional time is needed before communications are actually restored.
The UK government also says the overwhelming majority of undersea cable faults have non-malicious causes. Among the typical causes it cites is damage from fishing activity and ships' anchors. Even as measures against security threats are strengthened, repair capacity to deal with such everyday accidents remains important. Only with both a system to monitor suspicious vessels and one to repair damaged cables can the reliability of communications infrastructure be maintained.
The figure of about 64 cables also cannot by itself tell us how much damage Britain's communications network could withstand. The number of cables, the time for repair ships to arrive and the time for communications to actually recover are different indicators. Equating a repair ship's arrival with completed recovery would underestimate the work required after damage and the possibility that disruption continues.
The Telegraph's investigation provides an important lead for monitoring by making visible the repeated vessel activity near undersea cables. But there are limits to determining intent or the presence of sabotage from tracks, and improving monitoring capability and proving acts need to be tackled as separate challenges. Moreover, if a cable is actually damaged, a system to maintain communications and restore them quickly is essential. In defending undersea communications infrastructure, what matters is not only the number of vessels tracked or drones deployed, but whether the whole chain, from detecting anomalies to response, repair and restoration of communications, can function consistently.