Until last week, when two fibre-optic cables were severed in the Baltic Sea, few people realised how vulnerable the UK is to internet sabotage.
Suspicion over the most recent incident has fallen on a Chinese ship, the Yi Peng 3, which sailed over both cables – linking Finland to Germany and Sweden to Lithuania – around the time they were cut.
Fortunately the disruption was minimal. But we are an island – and if our digital lifelines to the rest of the world were severed, Britain might not be able to survive. Here, we imagine how the country could be brought to total collapse within just two terrifying days.
Wednesday, 3.13am
When the attack starts, most people are asleep. And nothing happens to wake them – no explosions, no sirens, no four-minute warnings. Britain is at war. We just don’t know it yet.
At GCHQ, the security services’ electronic eavesdropping centre at Cheltenham, the overnight surveillance team is on duty. They’re listening to communications in China, where it’s mid-morning in Beijing and Shanghai.
Only one insomniac data analyst notices that a single light has blinked out on a map of the North Sea.
It indicates a break in comms traffic between Britain and the coast of Germany – probably caused by an interruption to one of the undersea fibre-optic cables transmitting digital information between Europe and the UK.
Until last week, when two fibre-optic cables were severed in the Baltic Sea, few people realised how vulnerable the UK is to internet sabotage
That’s nothing unusual. Around the world, undersea cables are accidentally severed every week, by earthquakes and volcanic activity, by ships dragging their anchors, even by the razor-sharp fins of certain fish.
But, in the past 18 months, such breakages have occurred much more frequently. Telecoms giant RETN said that cable cuts affected up to 70 per cent of data traffic between Europe and Asia in early 2024 – nearly three times more than in previous years.
One broken cable is not going to cause noticeable delays to the UK’s communications. Britain is served by around 60 digital pipelines, each one no thicker than a garden hose but capable of transferring 95 per cent of the country’s internet traffic in milliseconds.
If one breaks, the data is simply rerouted through other cables. If four or five break, the impact will be significant enough to cause outages and perhaps cause real inconvenience, but the country will cope. More than that, no one has ever seriously considered.
As the analyst taps buttons, trying to detect why this cable has gone offline, another light cuts out. A pipeline in the same sector has snapped.
The data analyst looks at her watch and wonders whether to risk waking her department head.
A warning flashes in her mind, something written seven years ago by a backbench MP who was about to have a meteoric rise to power, Rishi Sunak. In 2017, in a report on how Britain’s internet was perilously vulnerable to attack, he said: ‘The most severe scenario . . . of connectivity loss is potentially catastrophic.’
Over the next five hours, three more cables are severed, all in the North Sea. Shortly before 9am, two more breakages occur, this time somewhere in the transatlantic pipeline that comes ashore in Cornwall. Just how catastrophic this attack will be over the next two days is unimaginable even to GCHQ.
8.57am
First, the flight information boards blank out at airports. After a few minutes, ominous messages begin flashing up: ‘We are currently experiencing widespread IT issues across our entire network. Our IT teams are actively investigating to determine the root cause of the problem.’
Travellers in the departure lounge reach for their phones to log on to airline websites, and see only error messages explaining that ‘the server cannot be reached’.
In the coffee shops and duty-free stores, passengers at the counters tap their bank cards on the wireless readers – but nothing happens.
‘Sorry, the system seems a bit slow for some reason,’ says a till assistant, unaware that her words are being echoed in shops up and down the country. By then, millions of people across the UK know there’s a problem.
But most assume the trouble is something personal to them – a payment that won’t go through, a frozen screen, a phone call cut off. Social media begins to buzz with variations on a single question: ‘Internet reely slow, any1 else seeing it?’
The Chinese Yi Peng 3 ship in the Baltic Sea last week which sailed over both fibre-optic cables – linking Finland to Germany and Sweden to Lithuania – around the time they were cut
9.40am
In cabinet Office Briefing Room A, an emergency COBRA meeting is called.
The Prime Minister and Defence Secretary were informed of the attack three hours ago by the Chief of the Defence Staff, Admiral Sir Tony Radakin. Now the heads of the security services will brief ministers and their private secretaries on the measures taken to avert total crisis.
Admiral Sir Ben Key, the First Sea Lord, announces that all available Royal Navy ships and RAF reconnaissance planes are tasked with finding the enemy ships cutting our cables, and have already identified three.
The French and Swedish navies have joined the hunt. All the Scandinavian nations have also suffered significant loss of internet connectivity. He suspects the Atlantic damage is being done by one or more submarines.
Anne Keast-Butler, the former deputy head of MI5 who is now chief of GCHQ, reports that 12 cables have now been sabotaged, bringing international travel to and from the UK to a standstill.
There has also been significant disruption to the banks, although the Stock Exchange is still operational. Even as she is talking, news of two more broken cables comes through.
Sir Keir Starmer wants to know how many cables have to be cut before Britain’s internet goes down completely. Keast-Butler assures him this is not possible: some of our systems are wholly land-based.
But any service linked to the world beyond Britain’s shores, such as the SWIFT banking network and the internet ‘cloud’, is vulnerable.
‘Can’t we switch to satellite?’ asks the Prime Minister. ‘What’s it called, low-earth orbit communications? How much of the network can be switched to that?’ The IT specialists exchange uneasy glances. ‘In theory, sir,’ he is told, ‘about 5 per cent.’
10.46am
Russia denies responsibility for the attack. In Britain, a Government spokesman urges the public to avoid using the internet to prevent overload. Social media traffic immediately doubles, as people share reports of outages and speculation about who is behind the attack.
The hashtag #whatsgoingon starts trending, and then #whatsREALLYgoingon, as conspiracy theories gain momentum.
1.00pm
In a broadcast from Downing Street, the PM calls the attack ‘unprecedented’ and appeals for calm. He does not reveal how many cables have been cut – the number is more than 20, with breakages occurring in a northwards direction both to the east and to the west. So far, English Channel cables are unaffected.
He repeats the plea for people to refrain from posting on social media. By now, this is becoming an unnecessary request, because the overseas servers for Facebook, Instagram and TikTok are unreachable and their UK servers are overloaded. Thanks to Elon Musk‘s Starlink satellites, X (formerly Twitter) is still functioning – provoking another conspiracy theory that the world’s richest man is behind the sabotage.
2.16pm
NHS England Digital, the health service’s data storage network that relies heavily on international cloud computing, is not functioning. Nor is the ‘just-in-time’ computer system that controls the flow of fuel and food deliveries to the nation’s supermarkets.
Sir Keir Starmer wants to know how many cables have to be cut before Britain’s internet goes down completely
3.07pm
The morning’s COBRA meeting is now a rolling war operations room – though no war has been declared, because our attacker has still not been identified.
The three ships captured in the North Sea appear to have been involved in cable-cutting, but maritime law prevents the Royal Navy from boarding them. All are Chinese owned, under Panamanian flags.
Meanwhile, the sabotage continues – with more than 25 breakages, and more every half an hour.
With planes and radar unable to find the vessels doing the damage, naval experts believe they must be submarines, possibly operated by remote control. Defence Secretary John Healey asks: ‘Do you mean undersea drones are cutting our cables? How many of them? How do we stop them?’
No one has an answer.
6.05pm
Half an hour after the PM gives permission for the Royal Marines to board one of the ships, it is confirmed that the crew is Russian.
Meanwhile, BBC Verify suggests there is no direct evidence linking the attacks to Russia and, citing a press statement from the Hamas-run Gaza Ministry of Health, reports claims that Israel might in fact be responsible.
8.37pm
Sky News goes off the air. The BBC continues broadcasting but iPlayer is down. So are Netflix and Amazon Prime video.
Amazon’s marketplace is still online, but purchasing is hit-and-miss: users in the South East of England and Scotland seem to have a better chance of successful transactions than people in the North and West of England.
Thursday, 8.15am
BBC TV News is off the air but Radio 4 is broadcasting.
Russia is demanding the immediate release of its sailors and an official apology. All of Ireland has lost internet service. Cables in the English Channel have been cut.
More than half of Britain’s broadband servers are out of service, following the suspected release of a cyber-virus.
Cable TV is unavailable, though satellite and terrestrial signals are working. Mobile networks, overloaded by people trying to connect to the internet with their phones, are breaking down.
Barely 30 hours after the attack started, chaos is so widespread that it is impossible for politicians, journalists or security officials to comprehend it all. Every part of society is affected.
Much of the civil service, whose staff mostly work from home, is effectively shut down. Many businesses are equally paralysed.
Hospitals have staff, but no way of accessing patients records – everything is stored remotely, who knows where.
Nine-tenths of websites are offline, because their servers are not in the UK. Trains are not running because, without internet access, the signalling network is unstable. All card payments have frozen, as has online banking. Trading on the Stock Exchange is to be suspended.
These are some of the headlines items. But the petty breakdowns are so numerous that they too are overwhelming.
Household devices linked to the internet such as smart meters and even doorbells stop working. Home deliveries are delayed and cannot be tracked.
A host of app services, from Uber taxis to FaceTime chats, are unavailable.
10am
In another broadcast from Downing Street, the PM declares a state of national emergency.
The public are asked not to use public transport and to spread the news to neighbours who depend on digital comms for TV and radio. He warns that police will deal forcefully with outbreaks of looting.
11.35am
A combined British and EU operation working round the clock has found the first cable break and effects a hasty repair.
Only now does the extent of the sabotage become apparent: the cable is still dead. It must have been cut in more than one place – perhaps chopped into segments, like fibre-optic salami.
A repair on this scale, even on a single cable, has never been attempted. And now at least 35 of Britain’s 60 pipelines have been severed.
As the team relays this news back to London, Paris and Berlin by sat-link, the true magnitude of the crisis begins to become apparent.
If the cables can’t be repaired (just one of which could take at least 15 days) they will have to be replaced, which could take months. And there’s every chance that, as fast as new lines are laid, submarine drones will cut them again.
1.58pm
A bomb explodes at Slough Trading Estate, Europe’s biggest data hub, which processes about 380 megawatts of IT load – including much of London’s domestic banking network.
The Permanent Secretary to the Treasury, James Bowler, briefs the Chancellor Rachel Reeves 25 minutes later, explaining that it is likely some banking records are irretrievably lost – at least until international links are restored.
In other words, millions of people might have lost their savings and their current accounts in a flash. The Chancellor insists this is not possible, that back-ups must exist. ‘Those were the back-ups, Minister,’ is the reply.
3.01pm
Fire breaks out in a Midlands tower block. With 999 call handling computers out of action, it takes more than 40 minutes to raise the alarm, and only six fire engines can be reached to tackle a blaze that leaves hundreds of survivors homeless.
Power cuts begins across half the country, as the National Grid buckles.
3.43pm
The PM gives orders for the Army to be deployed, to reinforce overstretched police forces trying to quell mass looting.
In nearly every major city, crowds are raiding supermarkets and high streets.
This is not the indiscriminate theft that usually accompanies riots – people are mostly intent on stealing food. It is a mass panic in a country where money has stopped working.
‘I’m not a thief,’ says one woman, loading bags filled with packets and tins into the boot of her Volvo. ‘But there’s no way to pay for anything. And the shelves are nearly empty. What if there’s no more food? I have to think of my children.’
5.11pm
Under cover of darkness, gangs roam the streets, openly carrying machetes and knives.
In Bristol, Glasgow and Birmingham, gunfire is heard. With no CCTV cameras and no traffic police, car races are taking place on both city streets and motorways. Robbers brazenly target jewellery shops and gated homes.
In the space of just two days, Britain has collapsed into lawlessness.