Private companies need to get better at monitoring threats

Elisabeth Braw is a senior fellow at the Atlantic Council, the author of the award-winning “Goodbye Globalization” and a regular columnist for POLITICO.

Two privately owned undersea communications cables in the Baltic Sea were cut last week — seemingly on purpose. Currently, the prime suspect is a Chinese bulk carrier, and because no merchant vessel would cut undersea cables for the fun of it, the incident points to geopolitics.

It won’t be the last time something like this happens. On the contrary, we’re likely to see more such harm directed at private companies, simply because they’re convenient targets. And that makes it imperative that private companies of all kinds better understand the threats around them.

Arelion — a Sweden-based company, owned by an investment fund — operates communications cables in a “network [that] now stretches 75,000 kilometers across Europe, North America and Asia, and lets you connect directly to more than 2,750 wholesale customers in more than 128 countries.” A quintessential representative of the globalized economy, the company has offices all over Europe (including Moscow), Asia and the U.S., and its cables — which connect all manner of countries and continents — are indispensable to modern economies.

Yet, on the morning of Sunday, Nov. 17, one of Arelion’s cables, which connects Sweden and Lithuania, was cut. Of course, the company couldn’t know something was afoot before the cable suddenly stopped working. “It’s a mystery how it broke,” Arelion’s Chief Evangelist Mattias Fridström told the Swedish daily Aftonbladet. “But I leave that to the police.”

In a happier globalization-era world, such an unexpected cable rupture would, indeed, be a mystery, as most of the owners and operators of the world’s nearly 600 undersea internet cables painstakingly look after their expensive installations, making sure there are no hiccups. But in a world where states are trying to harm one another, and countries like Russia and China prefer doing so by using nonmilitary tools, private companies are suddenly finding themselves on the front line.

According to global insurance broker WTW’s 2024 political-risk survey, last year 69 percent of participating companies experienced supply-chain disruptions due to geopolitical events, and 72 percent experienced political-risk losses.

In many cases, companies themselves may be directly targeted. In recent months, Western logistics companies have witnessed parcel-bomb plots, allegedly instigated by Russia. The CEO of German arms-maker Rheinmetall has been the subject of an assassination attempt, also allegedly planned by Russia. And Western companies are now worried that Chinese and Russian competitors will use nefarious means to displace them from mines and other operations in Sub-Saharan African countries.

On the world’s high seas, owners of undersea cables, pipelines, offshore windfarms and other sea-based installations might be seeing their installations similarly sabotaged for geopolitical purposes too — in fact, that’s what appears to have happened to Alerion. It’s also what appears to have happened to Cinia, the Finnish owner of the C-Lion1 cable connecting Finland and Germany.

After that double incident, the Chinese-flagged and Chinese-owned bulk carrier Yi Peng 3, which was at the site when both pipelines were damaged, was swiftly followed by the Danish Navy as it made its way out of the Baltic Sea. Without naming the Chinese ship, German Defense Minister Boris Pistorius called the event “hybrid warfare” and “probably sabotage.”

Such sabotage is what appears to have happened in October 2023 as well, when a pipeline and two undersea cables in the Baltic Sea — all privately owned — were damaged. In that instance, investigators subsequently identified a Chinese merchant vessel as the prime suspect. It’s what happened to Chunghwa Telecom in February last year too, when the telecom providers’ two undersea cables connecting Taiwan’s Matsu Islands with Taiwan proper were cut by two Chinese merchant vessels.

Meanwhile, in the Red Sea, the Houthis are attacking ships simply because they’re owned by the West, flagged in the West or have other links to the West (the definition is up to the Houthis). The fact that Russia appears to be helping makes the arrangement even more attractive for the militia. And it won’t be the last outfit to discover it can target Western companies in crucial waterways — ostensibly for geopolitical reasons — and get unparallelled global attention for doing so.

Businesses have long had staffers keeping an eye on global developments — individuals following the news, reading reports, participating in conferences and the like. Such monitoring has helped companies decide where to set up new operations, where to invest, where it’s safe for their executives to travel and where the risk of corruption and criminal violence is acceptable.

But today, the business environment has moved beyond such general risk monitoring. Whether direct or indirect, almost any company is now at risk of geopolitically motivated harm. It’s no surprise that 72 percent of the multinationals surveyed by WTW report political-risk losses from last year. And that means businesses — especially ones operating sensitive installations — need to know whether those who might have geopolitically hostile intentions are nearby. Do companies operating in the Baltic Sea know if Russian officials are onboard nearby commercial vessels? Do they know if Chinese officials are onboard?

As I have previously written, some companies already have impressive intelligence-gathering operations. Of course, not every company can afford this, but by now it’s clear that some businesses are particularly exposed to geopolitical harm — perhaps none more so than shipping companies and sea-based infrastructure operators.

Companies like this would do well to jettison the old idea that they’re merely businesses. Each one of them is now a target. The Houthis’ campaign and the apparent sabotage of undersea cables and pipelines will be followed by many more such incidents. And though knowing about a threat is certainly far from complete protection, it’s a whole lot better than not knowing.