<!-- ARTICLE_BODY_START -->
On 16 September 2026, cable engineer Andy Palmer-Felgate published an analysis of submarine cable faults and repairs drawing on more than 3,000 maintenance records. One distinction in the chapter deserves attention beyond the cable industry: the time consumed before a repair vessel sails is different from the time spent travelling to the fault, and both are different from the work performed offshore. The analysis reports averages of 22.5 days from fault to sailing and another 7.5 days in transit. These are reported dataset averages, not promises for a particular outage. Palmer-Felgate’s 2026 analysis
A communications failure can therefore have several endings. A customer’s connection may recover because traffic moves elsewhere. A cable may remain physically broken after that recovery. A network may continue operating, but with less room to absorb a second failure. And the repair vessel may still be waiting for the conditions needed to start its assignment.
Those distinctions change what resilience means. Counting cables is not enough. Neither is counting suppliers, landing stations or advertised terabits. The relevant question is whether a service still has a usable path between the places it needs to reach, with enough capacity and sufficiently independent supporting infrastructure. Repair then determines how long the network must live with its diminished options.
This is an engineering story about physical routes, not an invitation to infer an attack from an interruption. It is also a story in which the seabed is only part of the system. Shore facilities, terrestrial connections, contracted maintenance, spare components and administrative preparation can decide whether a damaged cable produces a brief disturbance or a prolonged constraint.
What actually lies between two shores
The International Cable Protection Committee’s technical introduction describes optical fibres surrounded by supporting and protective materials, with construction varying according to the manufacturer and seabed conditions. Stable deep-ocean sections may lack the armour used in more demanding coastal environments. A cable is consequently not a uniform object whose protection can be inferred from a single photograph of a cross-section. The same system can require different construction along its route. ICPC telecommunications cable introduction, October 2011
That variation is worth keeping in mind when somebody describes cables as either exceptionally delicate or heavily armoured. Both descriptions can omit the design question: which loads must this particular section withstand? Protection against one class of mechanical interaction is not equivalent to protection against every possible disturbance. More material also changes handling requirements. A cable must be manufactured, transported, laid and eventually recovered, not merely survive a hypothetical force in isolation.
The optical path has its own dependencies. Nokia’s description of repeatered systems identifies electrically powered optical amplifiers placed along the submarine fibre to strengthen the signal. Shorter unrepeatered systems use a different arrangement, relying on amplification from the ends rather than electrically powered repeaters along the submerged span. These are categories of system architecture, not interchangeable labels for the same equipment. Nokia’s subsea network explanation
Light carries the information, but that does not make a long repeatered cable independent of electricity. A manufacturer’s engineering paper from 2010 describes constant-current power feeding from landing stations and a design in which equipment at either end can support the system’s voltage requirement if the other feed fails. That is a documented design feature, not a guarantee that every cable can survive every electrical fault. NEC power-feeding engineering paper
Consider an imaginary service with three necessary stages: an optical ocean crossing, a powered terminal at the coast, and a terrestrial connection from that terminal to a city. Making the ocean crossing more reliable cannot compensate for a terrestrial segment that is unavailable. Conversely, adding a second terrestrial route cannot restore a failed submerged optical path if no alternative ocean crossing exists. The useful diagram is therefore a chain of functions and dependencies, not simply a line across water.
The distinction becomes even more important when two services share part of that chain. Buying two commercial products can provide two contractual relationships while leaving one physical dependency unchanged. Procurement needs evidence about the actual arrangement; the customer cannot settle the question from different logos on two invoices.
An alarm is the beginning of diagnosis
Cable operators have information that ordinary internet users do not. NEC’s February 2010 description of its monitoring architecture distinguishes station equipment monitoring from remote fibre testing of the submerged transmission path. It describes equipment alarms and performance records being brought together for operational diagnosis. The article is historical documentation of an architecture, not a description of every contemporary operator’s monitoring software. NEC’s network-monitoring paper
An alarm record, a lost optical signal, a user’s failed connection and a news report are observations at different layers. They should not be collapsed into one event with one automatically known cause. A customer can observe a service failure without knowing whether the unavailable resource is in the sea, at the landing station, farther inland or in an application platform. An operator may locate a technical fault before the physical mechanism that damaged the equipment is established.
Imagine that an operations team records a loss of service at 02:00, identifies a suspect submerged segment at 02:12, and reroutes important traffic at 02:20. A later marine inspection establishes the extent of damage. These invented times illustrate an evidence sequence, not a typical response interval. The first timestamp establishes when a particular system noticed a symptom. The second records a diagnosis with some level of confidence. The third marks a service intervention. None alone establishes why the cable was damaged.
This separation also makes incident records more useful. A repair team needs the best technical localization available, including its uncertainty. A service team needs to know which customers and destinations are affected. An investigator needs preserved evidence and a defensible chain from observation to explanation. Giving all three teams a single label such as “cable outage” hides distinctions they need to do their jobs.
The same discipline applies when information changes. A preliminary fault estimate may be revised after additional testing. That revision does not by itself demonstrate concealment or incompetence. It may represent the normal transition from remote evidence to direct inspection. The important questions are what was known at each stage, how confidently it was known, and whether later statements clearly supersede earlier ones.
Route engineering is not drawing the shortest line
ICPC’s government best practices describe a combination of considerations behind route choice: seabed shape, other marine uses, environmental restrictions, connections to terrestrial networks, economic needs and geographic diversity. The document also warns that clustering routes and landings can increase the consequences of a single incident. It is industry guidance about planning, not a finding that every existing cluster is poorly designed. ICPC government best practices, version 1.2
The central design tension is easy to demonstrate without disclosing any real route. Suppose a proposed connection has two feasible corridors. Corridor A is shorter and can use an existing coastal facility. Corridor B is longer and needs additional terrestrial construction, but does not share the same regional exposure as an existing cable. If the objective is minimum construction cost for one link, A may look attractive. If the objective is continuity when the existing link fails, B may supply a different kind of value.
The comparison requires explicit scenarios. “Different” is not a binary property that applies equally to every hazard. Two routes can be separate with respect to a localized seabed disturbance but dependent on the same shore facility. Two landing stations can be separate buildings yet depend on a common inland connection. A more distant corridor may avoid one geological setting while introducing a different operational burden. There is no useful universal separation distance that resolves all those relationships.
Natural hazards can also have spatial footprints much larger than a single point on a map. Sarah Seabrook and colleagues’ 2023 study of the January 2022 Hunga eruption combined pre-eruption and post-eruption surveys with geological evidence and modelling. They identified extensive seafloor changes associated with volcaniclastic density currents, with local topography influencing the flow paths. Their results demonstrate why a seabed hazard assessment needs more than distance from an eruptive centre. The study is evidence from one exceptional event, not a frequency forecast for every submarine volcano. Seabrook and colleagues’ primary study
For our fictional corridor comparison, that suggests a better question than whether the lines appear far apart at the coast. Which parts of each route lie within the same plausible event footprint? Where is the footprint poorly constrained? What happens if the hazard extends beyond the mapped area? A project cannot remove uncertainty by colouring a route green. It can document the uncertainty, compare feasible alternatives and avoid treating an absence of observations as proof that nothing can happen.
The final route is a compromise that should remain intelligible after construction. If a longer alignment was chosen to avoid a shared exposure, that reason matters when somebody later proposes a cheaper modification. If a constrained coastal approach was unavoidable, the residual dependency belongs in the resilience assessment rather than disappearing from it.
Burial is a condition, not a permanent certificate
The industry and fishing-sector information service KIS-ORCA explains that cable burial depends on suitable seabed conditions; alternatives can include additional armour or other protection. It also cautions that moving sediments can expose cable that was originally buried. An installation record is therefore not evidence that every part of a route remains protected in the same way indefinitely. KIS-ORCA’s cable-burial explanation
This is a useful distinction between an action and a state. “The cable was buried” describes work performed at a time. “The cable remains covered to the intended specification” is a statement about its later condition. They require different evidence. The first might be established by construction records; the second requires an appropriate basis for judging change since construction.
A hypothetical asset register illustrates the problem. One entry says a segment was installed with protective measures ten years ago. Another says its condition was checked recently, with some locations needing follow-up. If an analyst treats both entries simply as “protected,” the database loses the information most relevant to maintenance. The improvement is not a more reassuring label. It is a record that separates intended design, observed installation, subsequent observations and unresolved uncertainty.
Nor does more protection automatically settle the whole-system question. A measure that reduces the chance of local mechanical damage may have different implications for installation, inspection and eventual recovery. Those implications need engineering assessment for the actual equipment and site. This article does not supply burial depths or recovery procedures; a general explanation cannot substitute for the specialists responsible for marine operations.
The public-interest point is that protection has a lifecycle. Money committed at installation and money committed to understanding later condition serve different functions. Treating the second as optional because the first already happened can make a network look more robust on paper than the available evidence supports.
The arithmetic of a supposedly redundant network
Consider two entirely imaginary routes between a coastal network and an overseas destination. Each can carry 100 gigabits per second of usable traffic under the assumptions of the example. Demand at the relevant busy period is 140 gigabits per second, shared evenly between them. Under normal operation, both routes are comfortably below their individual limits.
If either route becomes unavailable, the other still connects the two ends. But its assumed 100-gigabit capacity cannot carry 140 gigabits of offered demand. The shortfall is 40 gigabits per second. It is correct to say that a path survives. It is incorrect to say that full service capacity survives. These conclusions follow from the invented capacities; they are not measurements of a cable system.
The distinction matters because “redundant” often conceals the service level being promised. Redundancy might mean that a small set of priority functions remains reachable. It might mean that normal peak demand can continue without material degradation. It might mean that the network can also tolerate maintenance on another component. Those are different requirements, with different costs and different evidence needed to establish compliance.
Now add a third route with 60 gigabits per second of genuinely usable capacity. After one 100-gigabit route fails, the surviving nominal total is 160, exceeding the original 140. That still does not finish the analysis. The relevant traffic must be able to use the additional path; the necessary interfaces, commercial arrangements and downstream connections must also support it. A capacity number elsewhere in the network cannot be added to the sum merely because it exists.
There is also a denominator problem. If an advertised figure describes the entire cable system, a particular operator may control only part of it. If it describes a future design capability, the presently equipped service may differ. If it describes a contracted service, the route supporting that service still needs to be understood. The original example deliberately starts with usable end-to-end capacity to avoid mixing these quantities.
For an honest stress test, demand should also be specified rather than assumed constant. A network that passes at a quiet hour may fail at its busy hour. An emergency could alter the mix of traffic. Even without predicting a disaster’s exact demand, planners can test a range and state where the surviving network ceases to meet the chosen requirement. A threshold with its assumptions is more informative than an unqualified claim of resilience.
Capacity is useful only if it reaches the required destination
Another invented network exposes a weakness in national or regional capacity totals. Imagine two coastal gateways, East and West, connected to a metropolitan network. Each gateway has ample overseas capacity. The terrestrial connection from the city to East can carry 120 units of traffic, while the connection to West can carry only 30. The units are deliberately abstract: the example concerns the arrangement, not a forecast of demand or a particular technology.
Normal traffic is 100 units. If the East route is lost, the presence of 120 or 200 units of overseas capacity at West does not give the city that capacity. Under the stated assumptions, the 30-unit terrestrial connection is the limiting segment. Adding another overseas cable at West would leave the immediate limitation unchanged. Upgrading the city-to-West connection would address that limitation, provided the rest of the path can carry the additional traffic.
Now change the requirement. Suppose 20 of the 100 units belong to a defined set of priority services. The surviving 30-unit path could be sufficient for that narrower requirement, but only if those services can actually reach their destinations through it and the arrangement is implemented as intended. That is not equivalent to restoring all users. The correct description depends on which requirement was chosen and what evidence demonstrates that it is met.
This is why an aggregate capacity statement should be accompanied by a description of the endpoints. A path to one overseas hub is not automatically a substitute for a path to every service hosted elsewhere. A connection into a country is not automatically available to every operator within it. Those statements follow from the elementary structure of a network: usable capacity must exist along the complete path, not merely at one attractive point on the diagram.
A related accounting mistake is to count the same constrained resource twice. Suppose two offered backup services both draw from a shared pool of 60 units. Treating each offer as an independent 60-unit reserve creates a fictitious total of 120. The pool can still be a valuable contingency resource, but its allocation rules and simultaneous demands determine what an individual customer can rely on. The question is contractual as well as physical, and the answer cannot be inferred from the size of the underlying cable alone.
These examples suggest a compact way to test a proposal before spending money: remove the specified component from the diagram, trace the remaining complete paths, and apply the actual capacity and access constraints along them. Then repeat for a different component rather than assuming the first successful result covers every case. The exercise establishes what a design can support under explicit assumptions. It does not require a prediction of which fault will happen next.
Independence cannot be purchased by multiplication
A second hypothetical calculation shows why shared dependencies matter. Suppose route A has a one-percent probability of being unavailable during a defined observation interval, and route B has the same probability. If those events are independent, the probability that both are unavailable in that interval is 0.01 multiplied by 0.01, or 0.0001: one in ten thousand.
The multiplication is valid only under the stated independence assumption. It is not a general estimate for two real cables. If both depend on the same unavailable shore facility, that shared event defeats the arithmetic. If one broad regional event affects both, their outcomes are correlated. The same two individual percentages can be consistent with very different probabilities of joint failure.
Imagine instead a simplified model containing a separate common event with probability one in a thousand that disables both routes. Even before considering the routes’ other failures, the joint-unavailability probability is at least one in a thousand. It cannot be the one-in-ten-thousand figure obtained by ignoring that common event. The example does not attempt a complete reliability model; it isolates the cost of making an unjustified independence assumption.
This gives a practical interpretation to a dependency review. It is not an exercise in finding every conceivable catastrophe. It is an attempt to identify the shared events that invalidate the comforting multiplication. The resulting list should distinguish evidence from conjecture. Confirmed shared infrastructure is different from an unverified possibility, and a poorly understood dependency deserves investigation rather than an invented numerical probability.
The geographical and commercial views need to meet here. A buyer may know the legal entities providing its services, while an engineer knows the underlying route segments. Neither view alone establishes independence. A useful arrangement allows the relevant physical diversity to be verified without requiring detailed infrastructure information to be published openly.
There is no requirement that every dependency be eliminated. Some may be too expensive or impractical to remove. The requirement is that the residual exposure remain visible in the decision. A network with a deliberately accepted limitation is easier to manage than one whose limitation has been hidden inside an optimistic calculation.
Restoration can precede repair by a long time
A real example makes the distinction concrete. In a statement dated 15 March 2024, MTN’s Bayobab reported that consortium partners had confirmed damage to four West African subsea cables the previous day. It described rerouting traffic and enabling additional circuits while partners mobilised a vessel for repair. The statement recorded concurrent service-restoration and physical-repair efforts; it did not say that rerouting had repaired the damaged systems. Bayobab’s dated operational statement
Cloudflare’s own observations on 14 March documented differing disruption patterns across affected countries and networks. The report also noted that MainOne’s website was unavailable for several hours and that its domain’s name servers were located within MainOne’s address space. This is a useful example of an outage’s effects reaching the services people might consult for information. Cloudflare’s measurements describe its observation points, not a complete census of every user’s experience. Cloudflare’s March 2024 measurement report
Return to the fictional two-route network. Suppose traffic becomes reachable again after an hour, but the failed route remains unavailable for thirty days. A public status message saying “service restored” might be accurate. A resilience report treating the whole event as a one-hour impairment would be incomplete. For almost a month, the system has fewer choices if another component fails.
There are therefore at least two useful clocks. One measures customer-facing interruption against a defined service criterion. The other measures the period in which the normal network arrangement has not been reinstated. They answer different questions and should not compete to be the only official duration.
A third measure can describe degraded performance after basic reachability returns. Some applications may work while others remain constrained by capacity or delay. A binary online/offline indicator cannot express that difference. The service criterion should say whether it concerns successful connections, sustained throughput, response time or another relevant property.
The communication challenge is to report progress without converting a partial success into a larger claim. “Priority traffic is using an alternative path” is more specific than “everything is back.” “The repaired route has passed testing” is different from “the vessel has arrived.” A sequence of precise milestones makes uncertainty easier to understand than repeated optimistic completion dates.
What a repair ship must accomplish
KIS-ORCA’s repair account describes shore-based fault testing, mobilisation with the required spare cable and equipment, recovery of the affected cable, removal of damaged material, jointing and testing. The work can involve remotely operated equipment as well as shipboard handling. The important point for a general reader is that restoration of the submerged asset is a marine engineering operation, not the equivalent of replacing a patch cord in a server room. KIS-ORCA’s repair overview
A damaged segment may not be a neat break with two conveniently accessible ends. The scope of work depends on what the team finds and what testing establishes. It would be misleading to turn a general description into a universal sequence with a fixed duration. This is also why an early estimate can be conditional on information that only becomes available offshore.
Repair capability has several ingredients that cannot be replaced by the mere presence of a vessel. Global Marine’s account of its services includes route engineering, maintenance arrangements and universal-joint services encompassing components, equipment, training and jointer support. Those are the company’s descriptions of capabilities it offers, not independent performance rankings. Global Marine’s telecommunications services
In a hypothetical readiness audit, the useful question is not simply “Is a ship available?” It is whether the contracted response can bring together a suitable vessel, qualified personnel, compatible materials, relevant records and access to the work area. Each item has an owner. Each can be ready at a different time. A plan that lists the resources without establishing how they come together has described an inventory, not a response.
The audit should also distinguish a spare from a substitute. An item stored nearby is not necessarily compatible with the system needing repair. A specialist available in another region is not necessarily available at the required time. These are general logistical distinctions, not claims that any named operator lacks readiness. They explain why preparation must refer to the actual system rather than to an abstract global pool of equipment.
A further question follows after the immediate job: what resources have been consumed or committed? A successful repair can use spares and occupy maintenance capacity. Readiness for the next event includes restoring those resources, not just closing the previous incident ticket. The end of one repair is part of the starting condition for the next.
A schedule with parallel tasks and hard dependencies
ACMA describes itself as a nonprofit cooperative maintenance arrangement serving members responsible for undersea infrastructure, with dedicated facilities and vessels. It is one example of the institutional structure behind maintenance readiness: owners can organise access to repair capability collectively rather than assemble every element after a fault. The existence of an agreement should not be confused with an unconditional arrival time for every event. ACMA’s description of its maintenance arrangement
An invented schedule helps explain why elapsed time is not the sum of every task mentioned in an incident update. Suppose technical preparation requires four days, material preparation requires six, and the necessary authorisation takes nine. Assume these activities start together and can proceed independently, but departure requires all three to be complete. The earliest departure in that simplified schedule is day nine, not day nineteen.
If transit then takes three days and offshore work takes five, completion would be day seventeen under the example’s assumptions. Reducing technical preparation from four days to two does not move that completion date, because authorisation remains the longest prerequisite. Reducing authorisation to five days would move departure to day six, with material preparation now controlling the schedule, and completion to day fourteen.
This arithmetic does not identify the real bottleneck in any jurisdiction. It demonstrates why a useful incident timeline records dependencies and overlap. Without that structure, an analyst can overstate delays by adding concurrent tasks, or promise an improvement from accelerating work that is not controlling the completion date.
Now suppose weather prevents the planned offshore operation after arrival. The schedule needs a new constraint, not a retrospective claim that transit took longer. Suppose instead the vessel is still assigned to another repair. That is a resource constraint before departure. The categories matter because they suggest different interventions and belong to different decision-makers.
Averages can inform planning, but they cannot replace this event-specific schedule. A mean calculated from a mixture of short and very long jobs may describe none of them particularly well. For an actual response, the distribution, the outstanding prerequisites and the reasons for uncertainty matter at least as much as a single expected date.
Administrative readiness is still readiness
The Porto Declaration was affirmed by the International Advisory Body on Submarine Cable Resilience on 3 February 2026. Its non-binding guidance calls for clearer and more predictable permitting, a single governmental contact point, improved procedures and support for diverse routes and landings. It is a statement of policy direction, not proof that those changes have been implemented everywhere or that national requirements have ceased to apply. The Porto Declaration
The word “administrative” can make this work sound less real than engineering. Yet an unresolved prerequisite can affect the schedule regardless of whether it concerns a physical component or an official decision. Preparing a process before a fault can clarify who receives the notification, what information is necessary, which decisions can proceed together and which authority is responsible for an exception.
That does not imply removing legitimate environmental, navigational or security review. A predictable process can preserve substantive review while reducing avoidable ambiguity. The test is whether the necessary questions can be answered promptly by people with clear responsibilities, rather than repeatedly rediscovered during an outage.
Consider a fictional jurisdiction with three agencies involved in a marine repair. A single contact point could reduce confusion without transferring all three agencies’ legal powers to one official. The contact can ensure that the same technical description reaches each agency and identify conflicting requests early. Whether that arrangement changes the eventual repair time is an empirical question; a new organisational chart alone does not establish an improvement.
The 2026 repair analysis attributes much of the reported deterioration in response times to regulatory obstacles. That is the author’s interpretation of industry evidence, not a reason to assume that every long repair is bureaucratic or that additional technical capacity could never matter. The defensible lesson is to examine the actual components of delay before selecting a remedy. Faster paperwork cannot make unsuitable sea conditions safe, and a faster vessel cannot complete an approval that has not been issued.
Statistics need a unit of exposure
ICPC’s media factsheet, updated in May 2026, describes roughly 150–200 telecommunications cable faults annually and attributes about 70–80 percent to accidental human activities such as fishing and anchors. It explicitly distinguishes these telecommunications statistics from submarine power-cable statistics. It also states that ICPC does not investigate and confirm the cause of individual incidents. These are industry-wide contextual figures, not an attribution tool for a particular break. ICPC’s media factsheet
A stable annual count can coexist with a falling rate per unit of infrastructure. In an invented example, twenty faults across 100,000 cable-kilometres correspond to one fault per 5,000 cable-kilometres during the specified year. If the network doubles in length and the count stays twenty, the corresponding rate is one per 10,000 cable-kilometres. Neither calculation tells us how the events were distributed among routes or customers.
A kilometre-based denominator is useful for one question, but it does not express service consequences. One failure on a poorly connected route can have a different effect from one failure where alternative capacity is available. A national interruption is not twenty times a minor disturbance simply because a fault count happens to be twenty. Frequency, duration, affected demand and remaining alternatives are separate dimensions.
The data’s collection process also matters. A database of repairs is not automatically a complete inventory of every optical impairment, every commercial outage or every incident that was never repaired. Definitions and reporting coverage should be carried into any comparison. An apparent change can reflect the population being counted as well as a change in the underlying system.
This does not make aggregate statistics useless. It makes them more useful when attached to the right question. They can inform where to investigate prevention and readiness, while operational records establish what happened to a particular network. The error is to promote a global average into a local diagnosis.
The internet’s visible path is not a seabed survey
Researchers have worked to connect the internet’s logical view to its physical submarine infrastructure. The Nautilus project maps IP links to one or more candidate cables and assigns confidence scores, using public data and validation through historical failures, targeted measurements and operator maps. Its published description is explicitly an inference framework, not a claim that each observed internet hop reveals a uniquely identified submarine asset. Ramanathan and Abdu Jyothi’s Nautilus research
A 2026 study by Mia Weaver and colleagues investigates extracting submarine-segment latency from traceroute measurements. It develops path-aware methods for minimum round-trip time while identifying limits on what existing measurement infrastructure can reveal, especially about dynamic latency variation. This is a methodological result about inference from available measurements; it is not evidence that public measurements directly observe every component of a route. Weaver and colleagues’ primary study
For a reader following an outage, the implication is a hierarchy of evidence. A changed route or increased delay can support the conclusion that network behaviour changed. It may be consistent with rerouting after a cable fault. Establishing the exact submerged path can require additional information. Establishing the physical cause of damage requires still more.
Suppose a hypothetical measurement sees a round-trip time increase from 80 to 140 milliseconds. The additional 60 milliseconds is an observation. Calling it the travel time around a particular ocean detour is an interpretation that needs support. The change could include multiple components, and the outward and return paths need not contribute equally. A graph cannot supply missing route knowledge simply because its line is precise.
The same restraint applies to maps. A public cable map can show connectivity without being a navigational chart or a disclosure of every engineering detail. Its purpose and resolution matter. Responsible analysis does not need to publish exact locations of vulnerable assets to explain why geographic concentration or shared dependencies deserve attention.
The repaired network needs a new baseline
The final test is not whether the interruption generated an impressive response. It is whether the organisation can explain the network’s condition afterwards. Which services returned first? Which remained degraded? When did the physical route re-enter service? Was the original level of alternative capacity restored? Were temporary arrangements removed deliberately, retained knowingly or simply forgotten?
These questions produce a more informative account than a single headline duration. In our fictional network, the initial service interruption might last one hour, constrained operation might last several days, and loss of the normal route arrangement might last a month. All three intervals can be true. Choosing one because it looks best would obscure the engineering lesson.
A repair record should also preserve what remains uncertain. The physical work may be complete while the cause investigation remains open. A network can restore service before deciding whether a design change is justified. It can decide to improve resilience without claiming that the previous incident proves a particular hostile intention. Recovery, explanation and redesign are related activities, but they do not share one mandatory finish line.
The strongest resilience claim is consequently conditional and testable: for these defined failures, with this demand and these dependencies, the service can meet this stated requirement; if an asset is lost, this documented repair arrangement governs recovery. That is less dramatic than saying a cable is invulnerable. It is also far more useful to the people who must keep communications working when a line across the sea disappears from service.