UK proposes 14-year cable sentences as Asia-Pacific writes its own rules

UK puts criminal penalties behind subsea cable rules

The white paper would replace the Submarine Telegraph Act 1885 and update the Telecommunications (Security) Act 2021 and the Communications Act 2003. Intentional damage could carry up to 14 years in prison, reckless conduct up to 10 years, gross negligence up to two years. Operators that refuse a government order could face fines of up to GBP 17 million or 10% of global turnover.

The duties reach physical and operational risk, not just cyber threats, and the UK and Asia-Pacific regimes set different thresholds. A multinational operator will have to track several compliance maps at once. The UK measures remain proposals in a white paper, not enacted law.

The UK has more than 64 active subsea cables landing on its shores, including 45 international systems and 19 domestic ones. They carry 99% of UK international data traffic, the government estimates. In April 2026 it accused Russian submarines of a covert operation around cables and pipelines north of the UK.

Singapore licenses data centres and cloud providers

Parliament passed the Digital Infrastructure Bill on 7 October 2026, and the Act is expected to come into force in stages in 2027. The major digital infrastructure licence covers commercial data centre services with a critical IT load of at least 10 megawatts serving unrelated parties. Cloud providers with at least SG$100 million in average annual revenue from Singapore users over the preceding three years need the same licence. The bill complements the Cybersecurity Act 2018.

A separate data centre licence applies at 3 megawatts and carries environmental sustainability requirements. Singapore's digital economy accounted for 18.6% of GDP in 2024.

Asia-Pacific rules shift from guidance to binding controls

Japan's unified critical infrastructure cybersecurity standards entered into force on 1 October 2026. The National Cybersecurity Office confirmed the date. They were adopted on 31 July, with sector guidelines following on 11 September. India's Cyber Security in Power Sector Regulations, 2026 were notified on 31 July and appeared on the Central Electricity Authority's site on 12 August.

An OT-ISAC report current as of 20 October separates binding controls from supervisory inspections and nonbinding strategies. It also lists Singapore's 2026 Cybersecurity Code of Practice among regional measures. OT-ISAC urges operators to map requirements onto existing OT controls, assess supplier dependencies and prepare for audits.

Compliance duties widen, and AI adds a new test

Under the UK proposals, subsea operators would have to identify and manage risks to their infrastructure. Singapore's guidance calls for board-level oversight of operational resilience. It also asks for documented risk tolerance thresholds. The UK National Cyber Security Centre's 2026 assessment adds another test: AI accelerates reconnaissance, vulnerability exploitation and attacks on legacy critical infrastructure, and AI deployments add exploitable surfaces.

The same assessment says public evidence does not establish a representative, independently verified improvement in mean time to detect, mean time to respond or false-negative rates from AI-enabled security operations centres. That covers energy, maritime and industrial control environments. Regulators are writing duties before that evidence base settles.

What happens next

India's power-sector regulations take general effect on 1 April 2027, with some clauses left to later orders. OT-ISAC advises operators to check applicability against primary legislation and official regulator guidance before treating a policy as a compliance obligation.