01 — The risk

Cutting the cables does not switch Britain off. It runs the clock down.

Traffic between British sites keeps flowing. What stops is everything that needs permission from abroad — and it stops in two waves, hours apart and weeks apart.

Britain is an island in the one sense that matters to a network engineer: almost every route out is a cable on the seabed.

Almost, but not quite. A fibre route runs through the Channel Tunnel, a sliver of trading traffic hops the Dover Strait by microwave, and satellite carries a little more. None of it comes close to national capacity — and the tunnel runs between the same two countries an attacker would already be working in. Parliament's own committee describes the UK as almost entirely reliant on subsea cable to reach the outside world.

Around 60 subsea systems land on these shores, and globally that class of infrastructure carries 95–99% of intercontinental data. In 2025 the Joint Committee on the National Security Strategy reported that it could no longer rule out UK infrastructure being targeted in a crisis — and that it was not confident the country could prevent such attacks or recover within an acceptable time.

The first wave is the login. Hardly anyone runs their own identity any more — we sign in through Google, Microsoft Entra, Okta, Apple — and every one of those depends on the overseas links. When they cannot be reached, live sessions run down and cannot be renewed, push-based multi-factor prompts stop arriving, and staff are locked out of systems that are otherwise running perfectly. A server in Slough is no use if the thing that says who you are sits in Virginia.

The second wave is the certificates. Under the CA/Browser Forum's agreed schedule the maximum life of a TLS certificate falls to 47 days by March 2029, with domain-validation data reuse cut to 10 days. Renewal also now requires corroboration from network vantage points outside the country. So an isolated Britain would begin losing TLS in roughly seven weeks — with no compliant way to renew.

That is the failure Dart Mail is designed for. Not the bang. The weeks afterwards.

Fig. 2 — Our estimate of an isolated UK estate

Hour 0 Cables severed. Traffic between British sites continues over LINX and the regional exchanges. Overseas mail stops.
Hour 1–24 Single sign-on fails. Sessions expire and cannot be renewed against Google, Entra, Okta or Apple. Push-based MFA stops arriving. Staff are locked out of systems that are still running.
Day 1–3 Cloud control planes degrade further. Admin consoles, licensing checks and device management stop answering.
Day 10 Domain-validation reuse windows expire. New certificate issuance is no longer possible.
Week 7 First TLS failures. Certificates begin expiring across the estate. Browsers and mail clients start refusing connections.
Month 3+ Cascading failure of anything resting on public PKI — portals, APIs, VPNs, device management.
In plain English

What is a centralised login?

Hardly any organisation keeps its own list of staff and passwords now. When one of your people signs in — to email, to finance, to anything — the request goes off to Google, Microsoft, Okta or Apple, who confirm who they are and hand back a pass that lasts a few hours before it has to be renewed.

Think of it as a security desk that issues day passes — and the desk is in Virginia, not in your building. Your office is fine. Your computers are fine. But when nobody can reach the desk, the passes quietly run out and your staff cannot get back in.

In plain English

What is a certificate?

A certificate is a small file that proves a website or mail server really is who it says it is. It is what puts the padlock in the address bar. Without a valid one, browsers and mail apps do not show a warning you can click past — they simply refuse to connect.

Think of it as an ID card with an expiry date, and the office that renews it is abroad. The cards are deliberately short-lived — 47 days from 2029 — so once the link is cut they expire one by one, with no way to get new ones.

Your stack, and which half of it is abroad

Fig. 3 — eight pieces, one seabed

Your domain name

In the UK

Lookups are answered by resolvers at your ISP and by root and .uk servers with nodes on British soil.

seabed
Offshore

Changing a record, rolling a signing key, or reaching most managed DNS control panels.

Mostly holds

Your mailboxes

In the UK

The messages themselves, if your tenant is UK-resident. Microsoft offers that; Google does not.

seabed
Offshore

Everything that opens the mailbox — and all mail to or from anyone outside Britain.

Depends on provider

Signing in

In the UK

Nothing. There is no local copy of who your staff are.

seabed
Offshore

Google, Microsoft Entra, Okta and Apple issue every pass, and every renewal of one.

Fails in hours

Multi-factor checks

In the UK

Six-digit codes from an app on the handset still work with no connection at all.

seabed
Offshore

"Approve this sign-in?" push prompts, which travel through the vendor's cloud.

Fails at once

CDN and cached content

In the UK

Edge nodes in London and Manchester keep serving whatever they already hold in cache.

seabed
Offshore

Anything not already cached, plus purges, rule changes and the configuration itself.

Degrades

Load balancing

In the UK

Balancers inside a single datacentre carry on distributing what reaches them.

seabed
Offshore

Global traffic managers and health checks that decide which region your users are sent to.

Fails in hours

TLS certificates

In the UK

Certificates already issued keep working — right up until the day they expire.

seabed
Offshore

Every renewal: the issuing authority, the checks from foreign vantage points, the transparency logs.

Fails in weeks

Devices and admin

In the UK

Laptops and phones keep running exactly as they were last configured.

seabed
Offshore

Intune, Jamf, licence checks, admin consoles — every tool you would use to fix any of this.

Fails in days
60+Subsea systems
landing in the UK
95–99%Of intercontinental
data on subsea cable
47Day maximum cert life
from March 2029
~24 hrsTo the first sign-in
failures, we estimate
~7 wksTo the first TLS
failures, we estimate
NextWhat if — the public record
Read on