Reposted from CISA/DHS

This is DHS I&A’s first assessment of Domestic Violent Extremist threats to
US fiber optic cable lines. This assessment seeks to provide law enforcement and public safety partners with an overview of how DVEs could adopt tactics used by criminal actors to damage US critical infrastructure to further their ideological goals. Domestic Violent Extremists (DVEs) have increasingly discussed targeting
terrestrial fiber optic cables across the United States, raising the threat to
fiber-dependent infrastructure sectors. DVEs frequently discuss that fiber optic cables are a preferred target to disrupt critical infrastructure pursuant to their ideological goals of dismantling current societal structures. The spread of the COVID-19 virus prompted increased telework that has persisted, creating dependencies on fiber optic cable networks that were highlighted within information sharing platforms utilized by some Since 2020, DHS and open-source reporting have shown an uptick in DVEs across ideologies sharing simple tactics specifically related to fiber optic cables. In 2024, a blog utilized by some anarchist violent extremists used a military target assessment method to encourage attacking fiber optics as an “easy” target while referencing past attacks. In 2023, a channel frequently used by environmental violent extremists shared five issues of a magazine that critiqued the tactics used in successful previous attacks. In 2022, the Terrorgram Collective publication discussed tactics for targeting fiber cables, including the use of fifirearms, arson, and power tools.
Several discussions in recent years among users of an online forum
frequented by DVEs describe fiber optic cables as low-cost/high-reward targets to disrupt critical infrastructure. These users indicate a preference for fiber optic
cable cuts due to the perceived simplicity and ability to avoid law enforcement
interdiction. Fiber optic cable cuts often cause cascading effects on critical
infrastructure sectors, such as communications, and delay emergency services
from responding to incidents. Across the United States, fiber optic cable cuts have disrupted 911 services and forced police stations to redirect personnel to field emergency calls through non-emergency lines. Individuals from North Carolina, who intentionally cut fiber optic cables in Connecticut, disabled communications and internet-based financial services to thousands of homes and businesses for hours.
While DVEs have focused on opportunistic or simple attacks thus far,
online narratives about fiber optic vulnerability and increased information sharing could inspire DVEs to engage in larger-scale, pre-planned fiber attacks in the Homeland. Recent attacks in France and Germany that used multiple and coordinated cuts to fiber optics surrounding a target area resulted in blackouts and communications stoppages that strained emergency services’ responses. Information shared online about fiber optic systems and media coverage of attacks could inform DVE attack planning and operations. In February 2024, an online user claiming to be a former cable worker provided a detailed description of how a coordinated group of individuals could disrupt communications for an entire city. In 2023, online discussions, in response to news media coverage of recent attacks, dissected attacks in Sacramento, California, from 2014 and examined the nature of the successful attacks to develop methods for making future attacks more severe, indicating potential pre-planning by actors.  DVEs could also draw inspiration from European attacks that disrupted citywide telecommunications and transportation. Violent extremists in France caused massive disruptions to telecommunications by targeting primary fiber optic cables in several regions. In Germany, travelers were left stranded after actors cut fiber optic lines and caused hours-long train stoppages. Possible indicators of pre-operational planning for a large-scale
fiber optic attack include unauthorized surveillance around fiber optic sites,
particularly connection locations; signs of trespassing or digging around known
fiber connection locations; and successful small-scale fiber optic cuts.

See Original Post