European investigators believe a Chinese-owned commercial ship deliberately dragged its anchor to sabotage the two undersea telecommunications cables cut in the Baltic Sea earlier this month. Western law enforcement suspects Russian intelligence was behind the operation.
Summary
European investigators allege that the Chinese-owned ship Yi Peng 3 deliberately dragged its anchor to sever two Baltic Sea undersea data cables connecting Lithuania-Sweden and Finland-Germany.
While the Chinese government is not suspected, officials are probing possible Russian intelligence involvement.
The ship’s suspicious movements, including transponder shutdowns and zig-zagging, suggest deliberate action.
The vessel, linked to Russian trade since March 2024, was carrying Russian fertilizer when stopped.
NATO warships surround the ship, but international maritime laws limit investigators’ access.
Seize the ship and sell it to cover the cost of repair.
Seizing a ship in international waters is a bad move. A better idea; block the docking of all Chinese ships at NATO country ports across the world until the cost of repairs are paid. Payment would arrive in about 5 minutes because the cost of of all Chinese flagged cargo ships idling outside ports for any length of time would be far far FAR more expensive.
If you want to snoop you don’t cut the cable so people come to repair it where you installed your snoopy device. Also, if there is no data on the cable because it has been cut there is no data to snoop.
They’re deep enough down that getting to them requires some creativity (ROVs, specially trained deep sea divers, etc.)
Then, how do you sever the connection with the operator not seeing the break? Just installing the snooper is going to take time. A sudden loss of all signal and then that signal coming back? Yeah they’ll notice.
Then how do they get the data back? Either they have to run their own cable out (expensive and obvious,) or they use the cable itself and double the data going through…( also obvious. )
Further, everyone and their grandma uses encryption for basically everything. Anything actually interesting is going to be heavily encrypted. (This is also why they’d double the data through put. The snooper won’t have the power to break the encryption,)
Even if data is encrypted, the source and destination addresses may be in the clear. If that's the case, it is still valuable for traffic analysis. Similarly, it's possible that an attacker has the means to decrypt traffic (they have the keys, or an exploit in the implementation).
As to getting the data back, you're right that an attacker probably wouldn't want to duplicate the entire flow of traffic, but they may wish to copy all data to/from certain addresses.