Executive Summary
Australia’s economic resilience and national security depend on the continuous operation of undersea cable infrastructure. Given that 90% of the nation’s undersea cable landing sites are concentrated in just two metropolitan areas, these systemic chokepoints have created vulnerabilities that could be exploited well before the onset of an open conflict. These risks are no longer theoretical. The Australian Security Intelligence Organisation has warned that the country is facing unprecedented levels of espionage and is nearing the threshold of high-impact sabotage. Disruption to this critical infrastructure would trigger cascading, economy-wide consequences and undermine Defence’s operational capability. People’s Republic of China-backed Advanced Persistent Threats (APTs) are actively seeking to pre-position cybersecurity vulnerabilities within the nation’s backhaul networks ahead of an anticipated crisis. Advancements in cryptographically relevant quantum computers (CRQCs) exacerbate this threat by undermining the encryption mechanisms that secure data transmitted over submarine cable networks. Harvest-now, decrypt-later” attacks mean that encrypted data intercepted today may be exposed as early as 2028. Zero-day exploits and rerouting-based cyberattacks enable adversaries to scale their espionage operations, with APTs already amassing large volumes of sensitive data in anticipation of emerging decryption capabilities. Delaying the transition to Post-Quantum Cryptography (PQC) directly undermines Australia’s national security posture by exposing critical assets and classified information to heightened quantum-enabled threats. Without stronger regulatory mandates and accelerated PQC migration timelines, Australia risks being caught flat-footed.
Introduction
Australia’s reliance on submarine cable infrastructure underpins its economic prosperity but also represents a growing strategic vulnerability. Carrying approximately 99% of the nation’s internet traffic,1 these cable systems have grown in strategic importance as emerging quantum-enabled decryption capabilities have increased the value of data transiting undersea networks. Amid intensifying strategic competition and rapid technological change, Australia’s reliance on digital connectivity has made its maritime data arteries central to national security. Since 2021, intensified grey-zone activity targeting seabed infrastructure in the Indo-Pacific has raised regional concern.2 However, Australia has yet to fully address the security challenges involved in protecting these vital networks.3 State-sponsored cyber-espionage campaigns targeting its backhaul networks have heightened the risk of disruption, leaving governments, Australian businesses, and Defence particularly vulnerable. This analysis examines the strategic risks created by state-sponsored cyber actors targeting Australia’s undersea cable infrastructure, while highlighting the nation’s unpreparedness to respond to emerging quantum-related cyber threats. The paper will identify regulatory gaps within current cybersecurity frameworks that underpin critical services and Defence’s supply chains, as well as proposed solutions to safeguard critical assets from quantum-enabled espionage.
Australia’s Growing Dependence on Submarine Cable Infrastructure
Australian society is structurally dependent on digital connectivity, with subsea cable systems forming the backbone of operational continuity across all critical sectors.4 Australian utility services (96.7%), transport and logistics (93.8%), communications (99.3%), healthcare (99%), and financial sectors (97.9%), all exhibit high levels of digital connectivity and are reliant on functioning telecommunication networks to operate.5 These networks are vital to Australia’s rapidly expanding digital economy, which reached $158.9 billion in 2024, accounting for 6.3% of total gross value added (GVA).6 Australia’s financial sectors rely on these cable networks to support essential electronic payment systems. The Reserve Bank Information and Transfer System (RITS) moves on average $300 billion each business day, equivalent to 11% of GDP.7 Given the deep interdependence on digital connectivity, any disruptions to these sea lines of communication would pose substantial risks to Australia’s economic stability and national security. Disruptions can rapidly cascade across sectors, amplifying economic, social, and national security impacts through the loss of essential services.8
Image 1: Total Volume of Data Downloaded (2019–2024). Source.
Sustained growth in national internet usage underscores Australia’s reliance on undersea cable infrastructure. Over the past five years, bandwidth consumption has risen by 109 %, increasing from 6.9 million terabytes in early 2019 9 to 14.4 million terabytes by late 2024.10 The surge in bandwidth consumption has been largely driven by Australian organisations embracing Cloud Infrastructure as a Service (IaaS) offered by hyperscalers (Google, Meta, Microsoft, Amazon, Cloudflare).11 These firms account for the vast majority of global bandwidth consumption, with content delivery and cloud networks alone generating roughly three-quarters of international demand.12 Driven by low cost on-demand infrastructure provisioning, cloud adoption among Australian businesses has increased from 19.4% in 2014 to 55.4% by 2020.13 As of 2022, approximately 59% of Australian businesses now utilise cloud technology.14 This trend is likely to continue as rapid advancements in artificial intelligence and its integration into various sectors of the economy have intensified demand for high-capacity connectivity.15 Although hyperscalers have delivered economical and accessible digital infrastructure, they have enabled the offshoring of sensitive data, heightening the risk of foreign jurisdiction access.16
The Impact of Disruptions on Concentrated Data Flows
Australia’s reliance on cloud centric infrastructure has created structural dependencies on concentrated data channels, heightening the nation’s exposure to foreign interference. Australia’s external connectivity relies on 18 international submarine cables, with approximately 90% of cable landing sites concentrated in two metropolitan regions.17 Sydney, which hosts roughly 11 cables (60% of national capacity), serves as the nation’s primary connectivity hub, while Perth, with five cables (30%), functions as the gateway to the Indian Ocean and Asian regions.18 The concentration of undersea cable infrastructure has created systemic vulnerabilities that adversaries are likely to exploit during periods of heightened tension.19 Driven by intensifying great-power competition, the Australian Security Intelligence Organisation (ASIO) warns that the nation is experiencing “unprecedented levels of espionage” and is approaching “the threshold for high-impact sabotage”.20 State-sponsored Advanced Persistent Threats (APTs) are actively seeking to pre-position vulnerabilities within critical infrastructure networks to enable persistent, covert access and facilitate future disruption of core functions.21
ASIO’s impact modelling indicates that espionage enabled sabotage of critical infrastructure could impose economy-wide losses of up to $1.16 billion per incident.22 State-backed disruption operations would severely undermine essential services, impacting government, industry, universities, and the wider community. ASIO’s assessment concludes that a week-long disruption to digital, technology intensive industries could incur economic losses of up to $5.93 billion.23 Cumulative disruptions of digital and logistics systems would likely degrade the Australian Defence Force’s operational capability by constraining access to critical inputs (e.g., fuel, transport, data feeds, and materiel), creating supply-chain vulnerabilities that an adversary could exploit long before a conventional conflict fully unfolds.24
Image 2: Map of submarine cables landing in Australia. Source.
Compromised Cable Landing Stations: Routing and Zero-Day Exploits
While intercepting data within the maritime domain remains difficult, cable landing stations (CLS) present a high-reward, low-cost target for APTs.25 Submarine Line Terminal Equipment (SLTE) and Remote Network Management Systems (RNMS) notably face heightened disruption risks. Given that SLTEs aggregate massive data flows at a single, fragile junction, they are an attractive target for adversaries.26 The limited number of SLTE/RNMS vendors, coupled with RNMS’s reliance on common operating systems (e.g., Linux, Windows NT), makes them particularly vulnerable to cyber intrusion.27 People’s Republic of China (PRC)-linked APTs, such as Salt Typhoon and Volt Typhoon, have targeted major telecommunication providers and backbone infrastructure to facilitate large-scale data exfiltration.28 The United States (U.S.) government’s assessments indicate that Volt Typhoon’s activities are not consistent with traditional cyber espionage operations and assess with high confidence that the APT group is pre-positioning initial access points ahead of an anticipated conflict.29 These groups have experience utilising sophisticated techniques to bypass protective network segmentation boundaries and establish cross-segment persistence.30
PRC-aligned APTs may attempt to compromise optical transport network devices (DWDM/OTN/ROADM control-planes), which converts undersea cable signals to terrestrial signals.31 These systems provide the critical intermediate layer that links SLTEs to data centres and internet service providers.32 Mercury ISS’s security audits of optical transport devices (Ciena Optical Multiservice Edge 6500) operating on the Southern Cross Cable Network identified outdated and vulnerable firmware components in use, including flaws that enable remote code execution (Log4Shell CVE-2021-44228).33 Their assessment indicates that major telecom providers are still utilising unpatched 2017-era software.34 Machine in the middle (MITM) or passive eavesdropping attack vectors targeting the optical transport layer would allow adversaries to block specific wavelengths or intercept data packages traversing through backhaul networks.35
Image 3: Front Haul Diagram of CLS architecture. Source.
By degrading CLS availability or exploiting upstream network vulnerabilities in the Border Gateway Protocol (BGP), the PRC has the capability to reroute undersea cable traffic towards its surveillance infrastructure. BGP determines how data packets are routed between CLS, selecting the most efficient path to their destination.36 By manipulating BGP route announcements, particularly during periods of network instability, the PRC could covertly reroute Australian and regional transit internet traffic.37 Rerouting attacks would enable adversaries to scale MITM interception and data exfiltration operations. This threat is well established. In 2016, malicious BGP announcements silently rerouted traffic from Canada to South Korean government websites through China for nearly six months, enabling sustained surveillance.38 Similarly, in 2010, China Telecom briefly hijacked about 15% of global internet routes for roughly 18 minutes, likely exposing U.S. government and military-related traffic.39 Mitigating or detecting stealthy BGP attacks at scale remains difficult, as the protocol is effectively trust-based and lacks universal, verifiable cryptographic validation.40
The true scope of the risks involved remains unclear as the PRC is known to stockpile undisclosed “zero-day” vulnerabilities to strengthen its cyber capabilities.41 China’s vulnerability-disclosure architecture systematically diverts newly discovered flaws away from public reporting.42 The PRC mandates that new vulnerabilities must be reported to the Ministry of State Security (MSS) within 48 hours of being discovered, allowing Beijing to assess whether those exploits can be used against foreign targets.43 Their offensive cyber capabilities operate under a “military–civil fusion” framework, where private and civilian industry cyber resources are integrated with intelligence and military agencies.44 That arrangement allows APTs to embed supply chain vulnerabilities that can be strategically activated.45
The Australian Government should invest in federally funded bug bounty programs to identify supply-chain weaknesses in critical infrastructure networks. This would bring Australia into alignment with the United States and the United Kingdom, which have adopted such programs to systematically identify and report vulnerabilities.46 At a time of unprecedented espionage activity, any unaddressed weaknesses that allow critical systems to be compromised risk eroding allied confidence in the nation’s information security posture.47
Harvest-Now, Decrypt-Later: Quantum Decryption Threat
Concentrated data channels have enabled “harvest-now, decrypt-later” (HNDL) attacks, in which adversaries collect encrypted traffic today with the expectation that future cryptographically relevant quantum computers (CRQCs) will enable its decryption.48 As CRQCs and quantum optimisation algorithms mature, sensitive data harvested through state-sponsored espionage campaigns may become accessible, particularly data transiting undersea cable networks or stored within large cloud service providers.49 APT groups are already amassing large volumes of encrypted data in anticipation of these capabilities.50
Modern systems rely on symmetric and asymmetric cryptographic schemes, most commonly the Advanced Encryption Standard (AES) for symmetric encryption and Rivest–Shamir–Adleman (RSA) for asymmetric encryption.51 AES encryption is used for fast encryption of data at rest (such as files and disks), while RSA-2048 bit encryption is utilised for online communications, encrypted email, key exchange and financial transactions.52 The security of these schemes depends on the assumed computational infeasibility of certain mathematical problems.53 RSA is secure under the belief that integer factorization is computationally infeasible by traditional systems.54 Classical computers would require on the order of hundreds of trillions of years to break RSA-2048.55 However, sufficiently powerful quantum computers undermine these computational hardness assumptions that secure modern systems.
CRQCs leverage quantum mechanics and quantum bits (qubits) to process information. Unlike conventional systems that utilise classical bits (0 or 1), Qubits exist in a probabilistic state that is simultaneously both 0 and 1.56 This enables parallel computation, which allows CRQCs to solve complex mathematical problems exponentially faster than traditional computers.57 Shor’s algorithm enables a sufficiently powerful quantum computer to solve these hardness assumption problems efficiently, rendering RSA-2048 and asymmetric based protocols vulnerable.58 Symmetric encryption is not immune. Grover’s algorithm accelerates exhaustive key searches, reducing the cost of brute-force attacks and effectively halving the security of AES.59 This is particularly alarming, as RSA-2048 underpins core authentication mechanisms and highly sensitive correspondence, while AES is trusted to safeguard classified data.60
Image 4: How does a harvest now, decrypt later attack work? Source.
In response, the U.S National Institute of Standards and Technology (NIST) has released Federal Information Processing Standards (FIPS) engineered to withstand attacks from quantum computers.61 These post-quantum cryptography (PQC) standards are designed to secure a wide range of electronic information and enable organisations to begin transitioning away from quantum-vulnerable public-key cryptography.62 The three finalised standards expected to see widespread adoption include FIPS 203 (ML-KEM) for general encryption, FIPS 204 (ML-DSA) for primary digital signatures, and FIPS 205 (SLH-DSA) as a hash-based backup digital signature scheme.63 Major cloud providers including, AWS, Google Cloud, Microsoft Azure, and Cloudflare have already begun integrating PQC schemes ahead of NIST’s finalised standards.64
To mitigate exposure to HNDL attacks, the Australian Government must work closely with hyperscalers to accelerate PQC adoption timelines, particularly across cloud services that underpin critical infrastructure. Hyperscalers and the Government should support PQC as the default configuration, strengthen organisational awareness of HNDL attacks, and accelerate migration pathways across the public and private sectors.
Caught Flat-Footed, Accelerated Q-Day Timeline
Advances in the maturity of quantum algorithms are accelerating the approach of “Q-Day,” the point at which quantum computers can break today’s public-key cryptography.65 Publicly known improvements in quantum decryption optimisation have significantly reduced the resources required to break RSA-2048, indicating a growing and imminent threat. In 2012, estimates suggested such an attack would require around one billion physical qubits, placing it well beyond realistic feasibility.66 By 2019, work by Gidney and Ekerå reduced the estimated RSA-2048 decryption requirement to roughly 20 million physical qubits (6,200 logical qubits) with an execution time of roughly eight hours, shifting the attack from infeasible to theoretically practical.67 As of 2025, estimates from Google researcher Gidney indicate the same attack could be completed in under a week using fewer than one million physical qubits (1,400 logical qubits), a 95% reduction from his 2019 estimate.68
Commercial CRQC roadmaps reinforce this trajectory. IonQ’s aggressive projections indicate that it aims to build systems capable of approximately 1,600 logical qubits by 2028,69 while more conservative estimates by IBM place systems of around 2,000 logical qubits in the early 2030s.70 This implies that “Q-Day” could become commercially feasible as early as 2028. The Australian Signals Directorate (ASD) recommends that organisations begin transitioning to PQC by 2028, prioritising critical systems and sensitive data.71 By the end of 2030, organisations should have completed their PQC transition.72 However, given the accelerating pace of CRQC development and the fact that HNDL activity is already occurring, these timelines are increasingly tight and may leave organisations exposed during the transition window. Accelerated PQC migration timelines are needed to mitigate immediate threats and avert irreversible long-term risks.
Despite the imminent threat, only 5% of organisations consider it a near-term priority or have a defined PQC transition plan.73 The CSIRO 2025 Quantum Readiness Survey shows Australia is profoundly unprepared for the post-quantum transition, with half of organisations unaware of ASD’s 2030 PQC deadline.74 The study spanned critical sectors (telecoms, finance, energy/water, transport, health, and public administration/safety) that all report a lack of PQC awareness, leaving them exposed to HNDL attacks.75 Over 70% of organisations are unaware of or unsure about the cryptographic shift itself, and 65.4% remain unsure or uncommitted to migration.76 Fewer than 29% have taken any action, and just 3.8% have an allocated budget, leaving 77% with no funding, no plans, or no visibility at all.77
Image 5: ASD’s 2025 recommended PQC transition timeline. Source.
Closing Regulatory Gaps to Mitigate HNDL Exposure
The Australian Government must urgently address gaps within the Security of Critical Infrastructure (SOCI) Act 2018 and Defence Industry Security Program (DISP) to minimise exposure to HNDL risks. Under DISP, contractors must meet or exceed ASD Essential Eight Maturity Level 2 for all corporate ICT systems used for Defence correspondence.78 However, the Essential Eight framework does not explicitly address HNDL risks or provide any guidance on PQC, which leaves a critical gap in protection against emerging cryptographic threats.79 DISP allows entities that comply with other international security standards, such as ISO 27001:2022, to demonstrate compliance.80 However, ISO/IEC 27001 Control 8.24 requires cryptography to be applied where risk warrants it, without prescribing specific algorithms or methods.81 This means the current use of RSA remains acceptable, and there is no explicit regulatory pressure to transition to PQC.
Organisations that store, process or transmit SECRET or TOP SECRET classified information must comply with the ASD Information Security Manual (ISM), as required by the Australian Government’s Protective Security Policy Framework (PSPF).82 PQC is endorsed but not currently mandatory under the ISM and organisations are strongly encouraged to prepare for a 2030 PQC transition.83 RSA remains an ASD-approved cryptographic algorithm under the ISM and may be used in accordance with approved key sizes.84 Under PSPF Release 2025, the use of ASD-approved PQC algorithms is only mandatory for newly procured cryptographic equipment and software (PSPF Requirement 0212).85
The PSPF and ISM do not mandate immediate PQC uplift for existing systems, provided those systems remain authorised and compliant with current ISM controls. In practice, organisations may achieve DISP and PSPF compliance while still relying on vulnerable cryptographic algorithms, introducing systemic risk across Defence’s supply chain. This exposes classified information, Defence research and development, and intelligence to heightened HNDL exposure. Defence must close this gap by embedding HNDL risk management and mandatory PQC transition planning into DISP to proactively mitigate CRQC threats across its supply chains.
Under Part 2A of the SOCI Act, and pursuant to section 30AH, the Critical Infrastructure Risk Management Program (CIRMP) Rules require responsible entities to comply with subsection 8(4), including adoption of an approved cyber security framework such as ISO/IEC 27001:2015 or the ASD Essential Eight.86 PQC was not a practical consideration in 2015 when ISO 27001:2015 was formalised, reflecting the threat landscape of that period rather than emerging quantum risks. Proposed enhancements to the CIRMP Rules, include the adoption of ISO/IEC 27001:2023.87 However, neither the ASD Essential Eight nor ISO/IEC 27001:2023 mandates PQC or have HNDL mitigation strategies. As a result, entities are largely left to self-select controls, with minimal regulatory pressure to plan for quantum-era threats. The Australian Government must amend the CIRMP Rules to require ASD’s ISM as the baseline cybersecurity framework to ensure PQC resilience across its critical infrastructure and minimise the impact of PRC-enabled HNDL espionage campaigns.
Policy Recommendations
- Mandate post-quantum cryptography for all classified ICT systems under the Protective Security Policy Framework, explicitly including legacy systems to mitigate “harvest now, decrypt later” threats and protect critical assets.
- Mandate compliance with the ASD Information Security Manual across the SOCI Critical Infrastructure Risk Management Program and the Defence Industry Security Program to safeguard classified information from quantum-enabled threats.
- Strengthen partnerships with hyperscalers to accelerate post-quantum cryptography adoption among Australian businesses, bridging the transition gap ahead of 2028.
- Take proactive measures by investing in federally backed vulnerability research and bug-bounty programs to systematically identify and remediate supply-chain weaknesses affecting critical infrastructure.
Conclusion
As great-power competition intensifies, rapid advances in quantum decryption leave Australian businesses and Defence’s supply chains increasingly vulnerable to Chinese-backed espionage campaigns. Current cybersecurity regulations entrench existing harvest-now, decrypt-later risks by allowing organisations to defer PQC transitions until 2030, leaving classified and sensitive information exposed. Organisations compliant with current cybersecurity frameworks remain vulnerable, as compressed Q-Day timelines could render intercepted encrypted data accessible as early as 2028. Immediate action is required to close existing cybersecurity gaps and apply regulatory pressure to drive PQC adoption, particularly among organisations subject to Protective Security Policy Framework, Defence Industry Security Program, and Security of Critical Infrastructure (Act) obligations. Given that 77% of Australian organisations lack awareness of the imminent quantum decryption threats, the Australian government must work with hyperscalers and cloud service providers to accelerate PQC adoption. The Australian government should invest in federally funded bug bounty programs to systematically identify and remediate cybersecurity supply-chain vulnerabilities. Without proactive cybersecurity measures, Australia risks eroding allied confidence in its information security posture and Defence’s operational readiness.