Strengthening the Ties that Bind
By Ravi Nayyar
Holding the Indo-Pacific Together is about the weird and wonderful world of submarine communications cables in the Indo-Pacific, with a focus on Australia and India. I will refer to these cables as ‘submarine cables’.
Part I of this series set the scene, detailing the threat environment in which submarine cables and their infrastructure operate.
Part II got into the nitty gritty of Australian and Indian regulatory and civilian maritime security frameworks.
Part III (this piece) will go through how both countries should cooperate, both bilaterally and through the Quad, to strengthen the cyber and operational resilience of these cables and their infrastructure in the Indo-Pacific.
Before we formally commence this final instalment of Holding the Indo-Pacific Together, have a look at Figure 1.
The sheer number of submarine cables landing in Australia and India make both countries’ dependence on these pieces of vital maritime infrastructure all the more clear.
These cables are an indispensable enabler of both countries’ participation in the global digital economy, especially their ability to engage in cross-border financial transactions (see Part I of this series for the consequences of these cables being cut or damaged).
Vital for Australia because of the contribution of international trade to its economy, and for India as its exports hit a record high just in April this year.
It is thus imperative for the two strategic partners to work together to strengthen the cyber and operational resilience of submarine cables and their infrastructure that covers the Indo-Pacific.
Indeed, cooperation is the need of the hour because the Indian Ocean — one of the two oceans of the Indo-Pacific — is home to vital sea lines of communication for Australia and India. The Indian Ocean leads in terms of the tonnage of goods carried, including: one-third of the world’s bulk cargo; half of container shipments; and two-thirds of oil shipments.
Little wonder that Dr Subrahmanyam Jaishankar, the Indian External Affairs Minister, pointed to how ‘the very centrality of the [Indian] Ocean to global economic processes will ensure responsiveness to the ongoing [geopolitical] changes’. Little wonder that Australia’s 2017 Foreign Policy White Paper said that both countries’ ‘security interests are congruent, particularly in relation to the stability and openness of the Indian Ocean’.
Given that submarine cables are the ‘central nervous system of the global internet’, which itself underpins the functioning of the Indian Ocean region, it is critical that Australia and India cooperate to ensure that submarine cables and their infrastructure remain robust. Both countries stated in 2020 their ‘shared interest in… maintaining open, safe and efficient sea lanes for… communication’ and their being ‘natural partners to work together towards realisation of this shared vision’, having signed a Joint Declaration on a Shared Vision for Maritime Cooperation in the Indo-Pacific. Australia recognised this ‘natural’ partnership in 2017 when it stated that India ‘sits in the front rank of Australia’s international partnerships’.
The final instalment of Holding the Indo-Pacific Together will first detail specific initiatives for bilateral cooperation and then those for cooperation through the Quad.
Let’s get cracking.
Bilateral Cooperation
There are a range of things the two democracies should work on. These are across the following spheres: regulatory collaboration and harmonisation; operational collaboration; defence cooperation; and cyber diplomacy.
Regulatory Collaboration and Harmonisation
Australia and India’s regulatory agencies with responsibility for submarine cables and their infrastructure ought to work more closely together. Both governments must also work towards harmonising their regulatory regimes.
Firstly, it is incumbent on both countries to ensure that their regulatory agencies work closely to ensure that their regulatory frameworks (as detailed in Part II of this series) are appropriately tailored to ensure that operators are incentivised to be more proactive in their management of cyber and operational risks. Both countries must ensure that they attack the spider (proactive risk management), rather than merely clean up cobwebs (incentivising faster repairs).
In this vein, Memoranda of Understanding (‘MoU’) ought to be signed by the following departments and agencies from Australia and India:
- Commonwealth Department of Infrastructure, Transport, Regional Development, Communications and the Arts and the Union Department of Telecommunications; and
- Australian Communications and Media Authority and the Telecom Regulatory Authority of India.
These MoUs would create legal frameworks under which the departments and agencies can share risk information and best practice with ease, or at least help structure such frameworks. This will drive better cross-border cooperation and regulatory outcomes. These outcomes should include (steps towards) the harmonisation of Australian and Indian regulatory frameworks.
One should note that both countries’ top officials for telecommunications regulation met last year to exchange views, and both countries have already shared threat intelligence and ‘information on legislation and national cyber strategies’.
Such sharing of policy information ought to include talk on the harmonisation of both countries’ regulatory regimes for the installation and protection of submarine cables, certainly in light of the complexity of India’s frameworks and Australia’s framework being held up as a model. Australia can also work with India to simplify its submarine cable repair regime, given the latter’s sheer complexity (see Figure 2).
That complexity has contributed to India, on average, taking the second-most time in the world to commence repair of submarine cables. Streamlining the framework of permits for cable repair vessels to come into India’s maritime zones would reduce the amount of downtime and thus disruption to economic activity in the region, such as cross-border trade, from a break in or damage to submarine cables.
Operational Collaboration
Regulatory collaboration and harmonisation should be complemented by operational collaboration by the critical infrastructure protection and maritime agencies of both countries.
In this vein, the Australian Cyber and Infrastructure Security Centre and the Indian National Critical Information Infrastructure Protection Centre should sign an MoU. Both governments should look at linking the Australian Trusted Information Sharing Network for critical infrastructure operators with its Indian equivalent(s). If the Australian and Indian governments, as well as operators of submarine cables connected with both countries, are on the same page in terms of real-time threat intelligence and how to prosecute it, that can only be a good thing.
Australia’s Maritime Border Command (‘MBC’) should sign an MoU with India’s Multi-Agency Maritime Security Group (‘MAMSG’), which would be in line with both countries’ commitments in 2020 to ‘facilitate deeper engagement… including maritime domain awareness and expanded linkages between our maritime agencies’. Additionally, both countries should share intelligence on the operational resilience of submarine cables through the Information Fusion Centre-Indian Ocean Region (‘IFC-IOR’) which is hosted by the Indian Navy and hosts an International Liaison Officer from the Australian Defence Force.
Operational collaboration between the Australian MBC and Indian MAMSG, which said MoU will enable, will help ensure that threats to submarine cables traversing the Indian Ocean especially are better identified and tackled. Necessary because of the number of cables in that Ocean (see Figure 3).
Linking up civil maritime security frameworks like so would indeed implement the Framework for Security Cooperation between Australia and India 2014 (‘Framework for Security Cooperation’), which enshrined ‘exchanges and cooperation between the Indian Coast Guard and Australian border protection authorities’. Indeed, both countries pledged in 2020 to ‘strengthen maritime domain awareness [in the region and]… enhance civil maritime cooperation between law enforcement agencies and coast guard cooperation’. It was thus great to see a delegation from the MBC pay the IFC-IOR a visit in August just this year. An MoU between the MBC and MAMSG would reinforce such cooperation.
More broadly, bilateral cooperation between maritime security agencies would be provided with added impetus by the Indian National Security Advisor, Ajit Doval’s, emphasis in July 2022 on maritime security as core to India’s national security architecture, including the need to counter espionage via the maritime domain against Indian interests. Better protecting the cyber resilience submarine cables in the Indo-Pacific is indeed integral to both Australia and India’s maritime security, given the strategic significance of these cables, as detailed in Part I.
Defence Cooperation
Complementing operational collaboration between civil maritime security agencies should be bilateral defence cooperation in relation to protecting submarine cables and their infrastructure in the Indo-Pacific. This would occur under the Framework for Security Cooperation which plans for ‘service to service engagement’ and ‘regular bilateral maritime exercises’.
A key element of this would be in maritime domain awareness and anti-submarine warfare, given the nature of threats to submarine cables (see Part I).
To both countries’, there has been growing cooperation in the air. The 2019 edition of the AUSINDEX bilateral naval exercise saw the ‘first coordinated P-8 maritime patrol aircraft missions’ for both countries. The 2021 edition of Exercise MALABAR, which also included the United States and Japan, featured anti-submarine warfare operations. And in 2022, the Indian Navy and Royal Australian Air Force (‘RAAF’) conducted bilateral deployments of P-8I long-range maritime surveillance and anti-submarine warfare aircraft. The Indian aircraft’s deployment to Darwin in April saw both countries conduct coordinated maritime surveillance and anti-submarine warfare exercises. The RAAF aircraft’s deployment came under the auspices of a joint bilateral ‘maritime surveillance initiative’.
Australia and India are also upgrading airstrips in the Cocos (Keeling) Islands and the Andamans, respectively, that should be used to conduct reciprocal maritime surveillance patrols in the Indian Ocean. Such joint basing arrangements would be enabled by the Australia-India Mutual Logistics Support Arrangement, signed in 2020.
It should be noted that, though India took delivery of its twelfth P-8I in February this year in a boost to its long-range maritime surveillance capacity, it still needs to expand and upgrade its fleet of short- and medium-range maritime patrol and electronic intelligence-gathering aircraft — both fixed wing and rotary wing aircraft — given the age and inadequate number of its Dornier 228s. Said expansion and up gradation would enable the Indian Navy to fly a wider range of joint maritime surveillance and anti-submarine warfare missions with the RAAF. And thus enable both countries to co-collect and co-develop better intelligence on threats to submarine cables within at least the Indian Ocean.
Cooperation in the air should be complemented by joint deployment of hydrographic survey vessels by both countries, as well as Offshore Patrol Vessels (‘OPVs’) by the Royal Australian Navy (which is bringing twelve PV80 Arafura OPVs into service) and Indian Coast Guard (which operates 26 OPVs). There’s also the suggestion that the AUKUS arrangement between Australia, the United Kingdom and the United States, should feature cooperation with India on things other than submarines, including on things like autonomous underwater vehicles. That can be used to generate situational awareness along the routes of submarine cables traversing the Indo-Pacific (see Part I for an introduction to these submersibles.)
Such cooperation by both countries would certainly benefit the operational resilience of submarine cables, given that both countries would be developing greater situational awareness of threats thereto, be they from human activity (such as sabotage by state actors or negligence by merchant vessels) or natural phenomena below the surface (see Part I for an explanation of these threats). These activities also enable both countries to build interoperability between their forces, helping speed up their response to the manifestation of said threats.
The MBC and Australian Defence Force should also work with the Indian Navy and agencies like the Indian Coast Guard, the Central Industrial Security Force, the Indian Navy’s Sagar Prahari Bal and Marine Police to strengthen the Indian agencies’ surveillance capacity, particularly for areas home to cable landing stations. They can share know-how, best practice and technology to enhance their abilities to track potential sabotage of submarine cable infrastructure in each country’s respective maritime zones.
The Australian Army Reserve’s three Regional Force Surveillance Units (‘RFSUs’) — the North West Mobile Force (‘NORFORCE’), 51 Far North Queensland Regiment and Pilbara Regiment — should do joint exercises with Indian agencies and (para)military forces like the Border Security Force that are responsible for coastal surveillance. This is because the RFSUs conduct long range reconnaissance patrols of the coastline of northern Australia (from the Pilbara to North Queensland) and mostly recruit from Indigenous communities that live in their areas of operations. The units’ operational effectiveness is bolstered by the traditional knowledge of their soldiers in bushcraft, survival and tracking, including the ability to spot unusual activity along the coast such as illegal beach landing or air landing sites.
In NORFORCE’s case, the soldiers work with the Australian Border Force, which adds to their experience in coastal surveillance and their suitability to conduct joint exercises with Indian coastal defence units. They can share some of their lessons with Indian counterparts to help them better identify signs of unauthorised activity near cable landing stations, for instance, and thus bolster India’s (civil) maritime security framework.
Cyber Diplomacy
The above cooperation should be reinforced by bilateral cyber diplomacy.
Both governments already meet on cyber security and critical infrastructure protection via the Australia-India Framework Arrangement on Cyber and Cyber-Enabled Critical Technology Cooperation as well as the Australia-India Cyber and Critical Technology Partnership. Both countries recognise ‘cooperation in the areas of cyber governance, cyber security, capacity building, … and cyber and critical technologies as an essential pillar’ of the bilateral.
This should include cooperation between national Computer Emergency Response Teams (CERT Australia and CERT-in), given that these are the national agencies that must especially cooperate in a crisis borne from damage to submarine cables connected to both countries. Indeed, cooperation between CERT Australia and CERT-in is part of the implementation of the Framework for Security Cooperation. Operationalised by their recent participation in the Asia Pacific Computer Emergency Response Team annual incident response drill.
Both governments have held several bilateral meetings dealing with cooperation on the fifth domain that would concern submarine cables. The first Joint Working Group on Cyber Security Cooperation was held in June 2021, during which both countries noted ‘the need to strengthen security of critical information infrastructure’. The Fourth Australia-India Bilateral Cyber Policy Dialogue was held in July 2021. The first India-Australia Foreign Ministers’ Cyber Framework Dialogue was held in February 2022, during which both countries ‘acknowledged the importance of the security and resilience of telecommunications networks’. The Australia-India Joint Working Group on Information Communication Technologies first met in July 2022. The Australian Government’s planned Centre of Excellence for Critical and Emerging Technology Policy in Bengaluru, which is slated to ‘promote stronger investment opportunities and cutting-edge innovation in cyber’, would arguably — and if not, should — foster greater bilateral cooperation on telecommunications technology and policy, which would include that on submarine cables in the Indo-Pacific.
Just to further put the importance of such cyber diplomacy to the bilateral, note what the Indian External Affairs Minister, Dr Jaishankar, said just a few days ago in his address to the Australia-India Leadership Dialogue 2022:
As I understand it, the focus of this gathering is to ensure that technology makes its due contribution to what is a growing meeting of interests and values between us. On my part, I would only emphasize that recent international developments have given even greater salience to such cooperation. The unpredictability of global supply chains have created legitimate concerns about the resilience and reliability… As political democracies, market economies and pluralistic societies, India and Australia share a strong interest in all these domains.
There’s a tight fit between the thrust of those remarks and bilateral cooperation on submarine cables and their infrastructure in the Indo-Pacific.
Cooperation through the Quad
Bilateral cyber diplomacy between Australia and India should be reinforced by cooperation through the Quad — comprising Australia, India, Japan and the United States — in relation to the strengthening of the cyber and operational resilience of submarine cables and their infrastructure in the Indo-Pacific.
Cooperation through the Quad — with senior diplomats from the four countries meeting just a few days back in New Delhi — on this subject will be in line with the minilateral grouping’s agenda. In launching the Quad Cybersecurity Partnership in their May 2022 meeting, the four countries adopted Joint Principles to guide that cooperation and ‘support cyber security uplift across the Indo-Pacific region’. Per these principles, the Quad is working to strengthen the cyber resilience of critical infrastructure assets, both directly and through their (software) supply chains. The Quad countries will also coordinate their cyber resilience capacity building programs in the Indo-Pacific region. The Quad Senior Cyber Group met in March 2022, discussing the enhancement of critical infrastructure protection in the region. Under the Quad’s cooperation on infrastructure, the countries work together on enhancing digital connectivity, among other policy objectives.
All these facets of the Quad’s agenda can easily provide impetus, if they haven’t already, to cooperation by the four members on uplifting the cyber and operational resilience of submarine cables and their infrastructure in the Indo-Pacific. After all, the latter are critical infrastructure assets and pillars of digital connectivity in the region (see Part I for more on that point). The Quad countries can work with fellow members of the Indo-Pacific region to bolster their regulatory and maritime security frameworks with respect to submarine cables and, say, cable landing stations in their coastal areas. This can include regulatory and operational collaboration — within the Quad and between Quad countries and other countries of the region — of the sort detailed earlier in this piece. It would be great to see greater exchange of policy, best practice and threat intelligence between governments and the telecommunications sectors within the region.
Besides, the Quad can directly provide financial support to bids to install, operate and/or maintain submarine cables and their infrastructure (like cable landing stations, fibre backhaul, data centres and Internet exchange points) by firms that are from the four countries and whose offerings have been vetted by the four countries’ telecommunications regulators and signals intelligence agencies. There is fairly recent precedent for the provision of such support by a Quad country in the telecommunications sector. Look at the Australian Government’s providing a financial package of over US$1.33 billion to support Telstra’s (an Australian telecommunications provider) acquisition of Digicel Pacific, which was concluded in July 2022.
There’s also the potential for Australia and India to cooperate through the Quad with fellow members of the Indo-Pacific when it comes to maritime domain awareness, helping identify and prosecute threats to those cables (see Part I for more on the threat environment). For instance, the Indo-Pacific Partnership for Maritime Domain Awareness initiative (‘IPMDA’), announced by the Quad in May 2022, seeks ’to work with regional partners to respond to… natural disasters, and combat illegal fishing’. It is aimed at integrating partners’ situational awareness of the Pacific Islands, Southeast Asia and the Indian Ocean region. The IPMDA’s work can be applied to monitor the threat environment for submarine cables traversing the Indo-Pacific. After all, the IPMDA’s aggregating maritime intelligence across regional fusion centres, including the IFC-IOR, will be crucial because the cables can be damaged through the activities of vessels that do not comply with international law — such as illegal, unreported and unregulated fishing, and maritime militia vessels — as well as natural disasters (see Part I).
Indeed, the opportunities for the Quad countries to work with regional partners are certainly there in Southeast Asia. Look at Figure 4 for the sheer number of cables traversing what Australia considers to be ‘at the heart of a peaceful, stable and resilient Indo-Pacific’.
The Quad countries can partner up with members of the Association of Southeast Asian Nations (‘ASEAN’, represented in Figure 4) on submarine cables policy and operational matters. This would effect the Quad’s ‘unwavering support for ASEAN unity and centrality and for the practical implementation of [the] ASEAN Outlook on the Indo-Pacific’, per the Quad Leaders’ May 2022 Joint Statement.
Cooperation by ASEAN countries with the Quad on submarine cables and their infrastructure should be natural because it arguably fits implicitly into the ASEAN Outlook on the Indo-Pacific (‘Outlook’). For instance, ASEAN expressly opens the door for cooperation ‘with other regional and sub-regional mechanisms in the Asia-Pacific and Indian Ocean regions on specific areas of common interests to complement the relevant initiatives’ (para [5]). Such mechanisms can include the Quad.
The Outlook also devotes an area of cooperation among ASEAN countries — and with the aforementioned ‘sub-regional mechanisms’ — to connectivity (paras [16]-[17]). ASEAN recognises how ‘the increasing integration and interconnection among Indian Ocean and Pacific Ocean countries require investments and efforts to build connectivity infrastructures, including physical… linkages’ (para [16]). Submarine cables arguably fit the bill as said ‘physical linkages’. The sort of direct financial support by government to bids by private firms in relation to submarine cables and their infrastructure as flagged above is also by the Outlook, which flags a potential area of cooperation as regional public-private partnerships to ‘mobilise resources for… infrastructure projects’ (para [17]).
Don’t forget the Outlook flagging ‘Logistics Infrastructure and Services’, ‘Digital Economy and the facilitation of cross-border data flow’, ‘facilitating the sharing of experiences and expertise on’ policy pertaining to the ‘digital revolution’ as areas of cooperation (para [20]). Submarine cables and their infrastructure would easily fit into this as fundamental enablers of the digital economy, including of cross-border trade and data flows (see Part I for more on the criticality of submarine cables and their infrastructure). The opportunities for collaboration by Australia and India, through the Quad, with ASEAN are reinforced by how, in 2019 in relation to Southeast Asia, the OECD pointed to the development of submarine cables as part of ‘regional approaches to improving international broadband connectivity’.
All in all, the Quad can work together to provide, through a combination and public and private sectors, a more competitive offer relative to that from China when it comes to critical telecommunications infrastructure for Southeast Asian countries. Salient when China’s Digital Silk Road initiative (introduced in Part I) directly supports the construction and operation of submarine cables in the region, connecting them with cable landing stations on the Chinese coast. As an example, take the Asia-Africa-Europe 1 cable which was built by China UniCom (see Figure 5).
Figure 5: The Asia-Africa-Europe 1 submarine cable (Source: Submarine Cable Map).
The need for the Quad to put its money where its mouth is, so to say, is all the more live because countries in the region are more interested in the construction of quality digital infrastructure than the checking of national security risks from that infrastructure. They perceive the Chinese as able to provide such infrastructure at a lower cost than Western firms and/or governments, as well as infrastructure which is ‘globally standardized’. That’s combined with the need for Southeast Asian countries to establish and/or administer robust investment screening, data governance and critical infrastructure regimes that can check the substantial espionage and risk which comes from Chinese-backed submarine cable projects (see Part I).
A case in point is Indonesia. While Indonesians’ trust in China has dropped sharply in recent years, they are more concerned about Chinese cement plants taking away local jobs and eroding the domestic cement industry than national security risks coming from China’s national champions, Huawei and ZTE, building their telecommunications networks. As with the region generally, the price competitiveness of the companies’ gear — including export buyers’ credits being granted by Chinese state-owned banks to Indonesian buyers of Huawei and ZTE gear — was key to the country selecting these companies. But also key was also the ‘unmatched’ and ‘rapidly growing’ level of training and capacity-building that those companies have provided to Indonesian citizens, ranging from students to policymakers.
Hence, these firms are perceived by many Indonesians as ‘two of its most critical partners in its digital economy and development endeavors’, rather than ‘prospective antagonists’, in stark contrast to the perception of these firms in Western economies.
Note that this is while Indonesia ranks as one of the world’s most hacked countries and has suffered tens of billions of dollars’ worth of losses from those hacks. And yet Indonesian officials are partnering with Huawei and ZTE much more from a digital economy development perspective, rather than prioritising the cyber resilience or national security issues at play. This case study can arguably be extended to the installation and operation of submarine cables connecting with Indonesia.
Therefore, it is all the more critical for Australia and India, through the Quad, to present Southeast Asian countries with a compelling proposition when it comes to submarine cable projects. Not just that, but a proposition which is compelling because it is centred around delivering better digital economy development outcomes for the beneficiary country or countries than what a Chinese project can deliver.
To apply the language which Priyandita, van der Kley and Herscovitch use in relation to Indonesia, though it is unlikely that the Quad can prevent countries in the region from using Chinese gear in submarine cable networks, well-designed, development-focused proposals ‘could prevent overreliance’ on said gear in the region. This would reduce the risk of sabotage and/or espionage in relation to said cable networks, and thus the risk to the functioning of Southeast Asia’s thriving digital economy, which has been forecast to hit US$1 trillion by 2030.
And note that a thriving Southeast Asia is what the Outlook seeks to achieve and whose implementation the Quad ‘unawavering[ly] support[s]’.
This in addition to the greater trust which such effects would build in Australia and India, as well as the Quad as a minilateral grouping more interested in the provision of cyber and operationally resilient public goods.
All under the auspices of the Quad’s commitment to ‘deepen engagement with regional partners, including through capacity-building and technical assistance… and promote the safety and security of sea lines of communication’.
Bringing it All Together
Folks, Holding the Indo-Pacific Together attempted to bring home to you why submarine cables and their infrastructure matter, with a focus on Australia and India as resident powers in the Indo-Pacific.
How the cyber and operational resilience of these assets are threatened.
How it is overseen by both countries from regulatory and civilian maritime security standpoints.
And how Australia and India can cooperate to strengthen the cyber and operational resilience of submarine cables and their infrastructure in the region, both bilaterally and through the Quad.
Such cooperation is vital to both countries’ national security and indeed the assurance of a free and open Indo-Pacific, given the criticality of submarine cables and their infrastructure to the very functioning of the region.
Burdette said in 2021 that:
The submarine communications cable network, a physical manifestation of transnational connectivity, is an understudied area of international relations at the intersection of geopolitics and global cybersecurity challenges.
I hope this series helped remedy the issue.
I’ll let Dr Jaishankar bring it home on an optimistic note:
There is a world out there[,] Ladies and Gentlemen, that not only beckons to our partnership but values it for the contribution we make to the common good.
