decrypted · 25 october 2026 · supply chain · uk policy and law · digital sovereignty

Britain's 1885 cable law is being replaced, and a longer sentence is not a resilience plan

The government has put forward a replacement for a law passed in 1885, when an undersea cable meant a telegraph line. The Submarine Telegraph Act is still the main statute protecting the cables that carry the UK's internet traffic, and ministers now want something fit for this century. The Record reported this week that a consultation white paper is out, open until 14 January 2027. It is worth reading, though not for the reason the headlines will give.

What is on the table

According to The Record, the proposals set three tiers of offence: up to 14 years for deliberate damage, ten for reckless damage and two for gross negligence. A legal analysis by Bratby Law puts today's ceiling at five years for wilful damage, with negligence carrying three months and a £1,000 fine. I have seen the 14-year figure reported only once, so treat it as reported rather than confirmed. The scope widens to electricity interconnectors and pipelines.

The more interesting half is the duties. The Record says the government wants statutory security and resilience requirements for subsea operators, plus powers to direct cable and repair companies on national security grounds. Earlier plans, as Bratby Law describes them, modelled those duties on the Telecommunications (Security) Act 2021: manage the risk, keep response plans, report incidents quickly.

Why a longer sentence is not a defence

Think of a motorway. A tougher penalty is a speed camera: it punishes the guilty afterwards. It does not clear a pile-up, and it does not stop a driver who has already decided to cause one. Resilience is the second road you can divert onto.

The Record notes that the Estlink 2 cable between Finland and Estonia was damaged on Christmas Day 2024 by a tanker's anchor, with repairs estimated at €50 to 60 million. Finnish investigators first suspected deliberate damage, but several officials later believed that and other Baltic breaks were accidental. The government itself says most UK faults come from anchors, fishing nets, environmental hazards or technical failure, while warning that suspicious activity is growing. A law that turns on proving intent leaves most of the everyday risk untouched.

What a director does with this

Secure by Design here means assuming the cable will break and building for it. Ask:

Do your primary and backup routes share a cable or a landing station?
Has failover been tested, or only bought?
Is your second cloud region really a second failure domain, or the same route under another name?
Do contracts promise repair times? With powers over repair providers on the table, repair capacity is plainly on ministers' minds.

Bratby Law expects the operator duties to arrive no earlier than 2027, so waiting for regulation is not a plan. The questions are cheap. A genuinely separate second route is not, and that is a board decision rather than an IT one.

Also this week

Supply chain: an abandoned updater. Eye Security reported CVE-2026-30612 in Time4Popcorn, an abandoned fork of the Popcorn Time client. Its updaters fetched executables over unencrypted HTTP and accepted them without checking signatures, so whoever controlled the dead update domain could run code as SYSTEM on Windows or root on macOS. Eye registered the domain, plus 14 more tied to the service, and saw up to 3 million Windows and 350,000 macOS client connections, including from corporate, government and military networks. None of the users appeared to be actively using the app, which is rather the point: forgotten software keeps its privileges long after everyone has forgotten it. Between November 2025 and March 2026 Eye used the flaw to switch the updater off, and the domain has passed to The Shadowserver Foundation. Android users remain exposed, and BleepingComputer notes the app still ships a Chrome engine from 2014 with no sandbox. The design lesson is old: sign your updates, verify them on the client, and keep an inventory that includes software nobody remembers installing. A small, unglamorous failure with a very large reach.

Breach: a lab portal goes dark. Quest Diagnostics, a US clinical laboratory company, took its Quanum Lab Services Manager offline after finding unauthorised access on 21 October. BleepingComputer and The Record both report that Quest believes some patient data was accessed, that it is still working out what, and that no group has claimed responsibility. Quest said the incident did not involve the recent PHP flaws, and that no other part of the company was affected, though it paused several other systems during the investigation. Customers fell back on paper requisitions. Ask your own lab, pathology and supplier portals what the paper fallback is, and whether anyone has tried it on a Monday morning.

Sources