Jersey's 2016 Triple Cable Break Made Geographic Separation an Accountability Test

Summary

On 28 November 2016, three of the four international submarine fibre cables used by JT were cut. JT said the three UK-facing cables were thought to have been cut by a ship dragging its anchor. The public packet does not contain a final marine-casualty finding, so vessel identity, intent, negligence and legal liability remain outside the evidence.[1][2]
JT redirected Channel Islands traffic over its remaining cable link with France. That was a real continuity success, not merely a design claim. It does not prove that every customer or service experienced normal performance.[2][8][10]
The operator's updates show reduced margin. On 30 November, JT said demand could be carried but spare capacity had been lost. On 1 December, it said all traffic was being carried with limited spare capacity and the network remained on high alert.[3][4]
The event tested correlated physical failure. Three UK-facing paths were lost in one episode. Multiple cables are not fully diverse if a single anchor track, landing approach, marine corridor or repair dependency can remove them together.
Restoration required specialist assets. JT reported the arrival of a cable repair ship on 30 November, the location of severed cable ends by 1 December, the first completed splice on 6 December, and all three cables back in full operation by 13 December.[3]-[7]
Repair milestones are not interchangeable. A ship arriving, a cable end being found, a fibre being spliced, an optical system passing tests, traffic being restored and full resilience returning are different evidentiary events.
Operator and independent impact accounts should be kept separate. JT and the joint statement described disruption as minimal or not noticeable, while contemporaneous reports warned of disruption and recorded severe degradation for some users.[2][3][7]-[10]
Government and industry material published before and after the event treats cable-route clustering, landing concentration, anchoring, outage reporting and repair capacity as resilience concerns.[12]-[17] Those sources provide control context; they are not retroactive findings that Jersey operators breached a particular duty in 2016.
The available evidence supports an infrastructure-accountability analysis, not an accusation. JT, Sure and BT controlled parts of capacity, interconnection, routing, repair coordination and communications. Government and regulators controlled legal protection and oversight. Maritime operators controlled navigation and anchoring. The record does not allocate every decision or loss.

The accountability question is usable continuity

A network diagram can show four international cables and still conceal the most important fact: whether the four routes are independent under the failure that actually occurs. Independence is not a count of lines. It is a property that must survive physical damage, equipment failure, capacity pressure, operational change and repair delay.

The 2016 Channel Islands incident makes that distinction visible. JT's first notice said three of its four international submarine cables had been cut and that the remaining traffic was being sent through France.[2] The network continued to carry communications. That means the backup path was not fictional. It had working optical capacity, terrestrial interconnection, routing and operational support.

The same notice warned that customers might notice an impact because all traffic was using the one remaining connection.[2] The next update was more precise: capacity was in place to manage demand, but spare capacity had been lost and disruption remained possible at peak times.[3] On 1 December, JT described the remaining spare capacity as limited and the situation as far from resolved.[4]

Those statements define the proper accountability unit. A fourth cable existed and carried traffic. The question is how much traffic it could carry, under what service priorities, with what latency and loss, and with what margin against another failure. A continuity claim is strongest when it answers those questions before an incident and records the answers while the incident is happening.

This is not a demand for perfect redundancy. Island networks face geographic, commercial and engineering constraints. It is a demand for an honest control record. If three paths share a marine corridor and one path crosses another jurisdiction, the continuity plan should state those facts. If the surviving path has enough capacity for ordinary traffic but not every peak, the plan should identify how essential services are protected. If specialist ships determine recovery time, their availability belongs in the operational model.

The Jersey record is valuable precisely because traffic continued. It allows accountability to be measured against an actual failover, not an imagined catastrophe.

A bounded chronology of loss and repair

The public timeline is unusually concrete because the Government of Jersey later published JT's media releases through a freedom-of-information response.[1] Those releases are first-party evidence. They establish what the operator said at each point. They are not a substitute for router telemetry, cable-test records or a final independent accident report.

Date	Publicly documented state
28 November 2016	Three of four JT international submarine cables were cut. The first release said the affected cables connected toward the UK and were thought to have been damaged by a ship dragging its anchor.[2]
29 November	JT said all traffic was being routed through the France link. Engineers had worked through the night and mobilised a specialist repair team. The company could not yet give a precise repair time.[2]
30 November	A specialist repair ship had arrived over one break. Another ship was travelling from France. JT said capacity could manage demand, but spare capacity had been lost and peak disruption remained possible.[3]
1 December	Wave Sentinel had located both severed ends of one cable and was beginning the task of joining them. JT said traffic was being carried with limited spare capacity and that the network remained on high alert.[4]
4 December	JT issued a further update preserved by the Government of Jersey. The frozen source set retains the document as part of the operator chronology; the present evidence does not rely on an unverified detail from it.[5]
6 December	JT said the first cable had been spliced and was being brought back online. Wave Sentinel was moving to another damaged cable, while Pierre de Fermat had begun work on the final cable. JT said two remaining damage locations were about 100 kilometres apart.[6]
13 December	A joint operator statement said all three cables had been repaired and returned to full operation. It credited coordination among BT, JT, Sure and the repair organisation.[7]

The table exposes several clocks. There was a damage clock, a traffic-failover clock, a repair-mobilisation clock, a physical-repair clock and a full-resilience clock. A single phrase such as "the outage lasted two weeks" would blur them.

For many users, basic reachability may have continued throughout. For some services, congestion or path changes may have reduced quality. For the network operator, risk remained elevated until capacity and route options were restored. For repair teams, work continued until damaged fibres were located, raised, spliced, tested and returned to service.

An accountable incident record should preserve all of those clocks. The beginning of customer harm may differ from the moment a cable alarm fires. The end of customer harm may precede the return of spare capacity. A repair completion statement may follow optical restoration because traffic must be reintroduced carefully. The public record gives landmarks, but it does not provide the underlying timestamps and acceptance criteria.

Three cuts exposed one physical failure domain

The event is often summarised as a rare accident. Rarity matters for probability. It does not change the observed failure domain. Three UK-facing cables were removed by one episode, while the France connection survived.[2] That pattern shows that the set of routes was not independent with respect to the physical hazard that occurred.

Physical correlation can arise in several ways. Cables may share a corridor across a busy anchorage. They may approach land through the same shallow-water zone. They may enter one beach manhole or landing facility. They may rely on common terrestrial ducts, power or transmission equipment after landing. They may be separated for most of their length but converge near a coast, where anchors and fishing gear create greater risk.

The public packet does not disclose the exact cable names, coordinates, burial depths or landing topology involved in the 2016 breaks. It therefore cannot support a precise map of the shared exposure. It can support a narrower conclusion: whatever separation existed was insufficient to prevent one reported anchor-dragging episode from cutting three UK-facing links.

The distinction between route count and failure-domain separation is recognised in broader resilience work. An FCC advisory group examined clustering of submarine cables and cable landing facilities and discussed spatial separation, coordination and protection as resilience concerns.[14] CRS later summarised recommendations that include diversification of routes and spatial-separation standards.[12][13] European work similarly frames mapping and stress testing as tools for assessing cable resilience.[17]

Those materials should not be used to declare a Jersey legal violation. The FCC and EU operate in different jurisdictions, and some reports postdate the event. Their value is analytical: they identify the same engineering problem revealed by the incident. A cable portfolio cannot be assessed only by counting assets. It must be assessed against correlated hazards.

A useful operator record would assign each cable to physical failure domains at several scales: deep-sea route, continental shelf, approach corridor, landing station, terrestrial backhaul, power, network equipment and repair agreement. Diversity claims could then be tested against the removal of each domain. If three named "diverse" services all traverse one approach, the record would make that dependency explicit.

The France path was a running control, not a paper promise

Network accountability should recognise controls that work. The remaining France cable carried Channel Islands communications after the three cuts.[2]-[4] Engineers from operators including JT and Sure coordinated to keep services available, and the final statement credited cooperation among BT, JT and Sure.[6][7]

That outcome matters because infrastructure plans often confuse installed assets with operational readiness. A backup path may exist but lack active capacity. It may require a manual commercial order. Routing policy may not prefer it under the intended fault. Security controls may prevent rapid activation. Traffic may reach the alternate landing but encounter an undersized terrestrial segment. Monitoring may not show whether essential services are succeeding.

The Jersey failover passed the most important first test: traffic moved and continued. The next tests concern quality and margin. JT's statements about lost or limited spare capacity indicate that the surviving path was operating closer to its boundary.[3][4] The public evidence does not quantify utilisation, queueing, latency, packet loss or service prioritisation.

This is where a continuity ledger becomes useful. Before an incident, the operator can record the normal and emergency capacity of each path, the traffic classes each path can carry, contractual activation requirements, expected failover time and tested application performance. During an incident, the same ledger can record actual utilisation, discarded traffic, congestion alarms, path changes and exceptions. Afterward, it can compare the planned capacity with what occurred.

The ledger should avoid a binary label such as "backup available." A more truthful entry would say, for example, that a route can carry ordinary aggregate demand with a defined reserve, but that a peak scenario requires traffic shaping or additional capacity. It would state whether voice, emergency, financial, government and mobile interconnect traffic receive different treatment. It would identify the authority for those priorities and the evidence that they were applied.

Nothing in the frozen sources proves that JT lacked such records. The published updates demonstrate that capacity and margin were being considered. The accountability gap is public visibility: outsiders cannot verify the service-level performance or the exact headroom that remained.

Customer impact cannot be averaged into one sentence

The operator releases repeatedly described disruption as minimal, and the 13 December joint statement said coordination had ensured no noticeable impact on customer services.[3][6][7] Independent contemporaneous reporting was less uniform. ITV warned that disruption was expected, ThinkBroadband described severe service effects for some users, and other reports noted that Sure customers were also affected.[8]-[10]

These statements do not have to be treated as mutually exclusive. A network-wide aggregate can remain within capacity while individual routes, providers, applications or time periods perform poorly. Customers using one access network may be affected differently from those using another. Latency-sensitive applications may experience harm even when bulk traffic continues. A brief peak may be significant to a user but small in a daily average.

The correct response is not to choose the most dramatic or reassuring sentence. It is to specify the denominator and measurement. How many access lines lost reachability? Which prefixes or services traversed the constrained path? What were median and tail latency before and after failover? Where did packet loss occur? Were mobile voice, emergency calls, banking, government systems and enterprise circuits tested separately? How long did each abnormal state last?

Public incident communication can report both continuity and impairment. A strong notice might say that all international traffic has been rerouted, aggregate demand is being carried, spare capacity is reduced, specified services are degraded, and peak congestion is possible. It can update those measurements as conditions change.

JT's 30 November and 1 December releases came close to that form by acknowledging the loss of spare capacity and the possibility of peak disruption.[3][4] The final joint statement emphasised the success of coordination.[7] What remains absent is the quantitative bridge between those descriptions.

This gap matters for accountability because impact determines which fallback controls should be improved. If only peak consumer traffic degraded, additional emergency capacity may be the answer. If one operator's customers suffered more, interconnection or routing policy may need attention. If essential services were protected while less critical traffic slowed, the prioritisation control may have worked as designed.

Traffic engineering distributed the remaining risk

A cable break is a physical event, but user experience depends on logical network decisions after the break. Routers select available paths under policy. Operators may shift transit, alter local preference, manage congestion, reserve capacity or coordinate with peers. A physically surviving fibre does not automatically make every network reachable.

The JT releases say traffic was routed through France.[2] They do not disclose how BGP or internal traffic engineering accomplished that result, which upstreams or exchange points received the traffic, whether routes changed again during repair, or how Sure and BT coordinated capacity.

The network-control surface is therefore broader than cable ownership. It includes the prefixes accepted on the surviving path, the route advertisements used to reach Channel Islands networks, the capacity of terrestrial links beyond the landing, the policy for balancing operators, and the ability to detect hidden congestion. Peering and transit arrangements become continuity controls when the primary physical routes disappear.

The operator can test this layer without waiting for a cable cut. A controlled exercise can withdraw each international path, verify the remaining BGP state, measure application reachability from external vantage points and confirm that the surviving route has sufficient headroom. The exercise can model a second failure while repairs are pending. It can test whether DNS, authentication, monitoring and incident tools remain reachable.

Such a test should record running state rather than rely on an architecture diagram. Useful evidence includes route snapshots, interface utilisation, optical power, packet loss, latency, queue depth, alarm delivery and application success. It should identify the routes and systems that did not fail as well as those that did.

Asset inventories and route diagrams are important accountability records. They establish what should exist and who records it. Running routing and optical state determine whether packets move. Accountability emerges when the recorded design and the running state can be reconciled.

Repair logistics were part of network design

Submarine cables cannot usually be repaired by an ordinary field crew. Owners locate a fault, mobilise a specialist vessel, obtain access to the site, recover cable ends, splice fibres, test the system and return the cable to the seabed. Weather, sea conditions, vessel availability, permitting, distance and the extent of damage can change the schedule.

JT's updates make those dependencies visible. A specialist ship arrived over one break by 30 November.[3] By 1 December, it had located both ends of a severed cable and was beginning the joining process.[4] On 6 December, JT said the first cable had been spliced and that two vessels were working on the remaining damage.[6] All three were reported operational on 13 December.[7]

CRS describes the wider repair model: cable owners use optical tests to locate damage and rely on specialised ships and agreements to restore systems.[12] It also notes that repair-fleet availability can become a constraint.[12][13] These general observations fit the Jersey chronology without proving the terms of JT's particular contracts.

Repair readiness should be treated as a capacity control. The relevant questions include which maintenance agreement covers each cable, where the assigned ships are located, what mobilisation time is assumed, whether simultaneous faults can be handled, what spares are available, and which party authorises each stage. A plan should account for the possibility that one ship is already committed elsewhere.

The 6 December update is especially informative because it refers to two repair ships and damage locations approximately 100 kilometres apart.[6] The incident did not require one sequential repair operation at one point. Parallel repair capacity helped restore resilience.

An accountable recovery record would preserve the fault-location estimate, vessel assignment, arrival time, weather delay, recovery of each cable end, splice completion, optical acceptance, traffic reintroduction and final resilience declaration. Each milestone should have an owner and evidence.

Restoration should be proved at multiple layers

"Cable repaired" can mean several things. The damaged section may have been physically joined. Optical continuity may have been restored. Transmission equipment may have accepted the span. IP traffic may have returned. Customer services may have normalised. Redundancy may have been restored only after all routes and capacity were back.

JT's 6 December statement carefully said that the first cable had been spliced and was being brought back online.[6] That wording distinguishes the physical repair from the service transition. The 13 December statement said all three cables were repaired and in full operation.[7]

That progression provides a model for evidence-based closeout. A physical splice should be followed by optical tests such as loss and reflection measurements. Transmission systems should show stable signal levels and error rates. Routing should return according to a reviewed policy rather than simply reverting to an old state. Traffic should be introduced gradually where possible. External monitoring should confirm reachability and performance.

The final acceptance criteria should include resilience, not just the repaired cable. If traffic was concentrated on France during the incident, the return of one UK path reduced risk. The return of all three restored a broader set of options. The operator should confirm that routes are again distributed as intended and that temporary traffic controls have been removed.

Public statements need not expose security-sensitive topology. They can still distinguish physical repair, service restoration and full resilience. They can disclose whether performance has normalised and whether further work remains.

The Jersey releases did this in broad terms. The public record does not include the detailed test results. That absence prevents an outsider from independently verifying the exact restoration state, but it does not erase the documented repair milestones.

Who controlled which boundary

Accountability is clearer when it follows practical control rather than a single corporate label.

JT controlled its cable capacity, network configuration, traffic decisions, monitoring, customer notices and the evidence it chose to publish. The sources indicate that it also coordinated repair activity and worked with other operators.[2]-[7]

Sure controlled the parts of its network and customer service within its authority and contributed engineering support, according to JT's updates.[3][6][7] BT controlled relevant UK-side infrastructure and coordinated repair of at least one cable, according to the joint statement.[7]

The repair organisation, its agents and vessel crews controlled specialist marine operations once mobilised. Their work was constrained by weather, damage location, access and equipment.[3]-[7]

Maritime operators controlled navigation and anchoring aboard their vessels. The public source set does not establish which vessel caused the damage or the decisions behind it. A general UK navigation notice published later addresses responsible anchoring and fishing practices around subsea infrastructure.[16] It provides preventive context, not a verdict about this event.

The Government of Jersey controlled legal protections, public oversight and the later release of relevant records.[1][11] The historic Telecommunications (Transfer) Regulations identify cable interests in the restructuring of Jersey telecommunications assets.[11] That legal record helps establish that cable ownership and rights were formal public matters. It does not establish the live network state in November 2016.

Regulators control reporting, resilience expectations and review powers within their jurisdiction. FCC and Federal Register materials concern U.S. submarine-cable reporting and resilience.[14][15] They illustrate the value of recording outages even when traffic can be rerouted, because a degraded cable system can still represent material risk.[15] They are not Jersey enforcement findings.

Customers controlled their own application continuity and access alternatives where available. They could not inspect the seabed, procure a repair ship or change an operator's international routing. It would be unreasonable to transfer the operator's infrastructure evidence duty to users merely because users could retry a service.

A geographic-separation stress test

The durable lesson is not simply "build more cables." Additional routes can add capacity while preserving the same physical concentration. The correct control is a stress test that links geography to running service.

First, create an authoritative route inventory. For each cable, record ownership, capacity, landing points, approach corridors, terrestrial backhaul, maintenance agreement and activation status. Mark the confidence and update date of each field.

Second, map common failure domains. Identify shared shallow-water corridors, anchorages, landing facilities, ducts, power, transmission equipment, control systems and repair dependencies. Sensitive details can be protected while risk classes remain reviewable.

Third, define traffic demand by service. Ordinary aggregate demand is not enough. Model peak demand and critical services such as emergency communication, government operations, banking, healthcare and mobile interconnects. Record which services can degrade and which require reserved continuity.

Fourth, remove routes in a controlled exercise. Withdraw each path and combinations of correlated paths. Verify BGP state, terrestrial capacity, queue behaviour, latency, loss and application success from internal and external vantage points.

Fifth, test a second failure. The Jersey network was operating with reduced spare capacity while repairs proceeded.[3][4] A continuity plan should ask what happens if the remaining route or a landing facility develops a fault during that interval.

Sixth, test repair mobilisation. Confirm contacts, contracts, spare cable, vessel availability, permissions, weather assumptions and parallel-repair options. Measure from fault detection to a credible repair estimate.

Seventh, define restoration evidence. Require optical, transmission, routing and application checks before declaring a cable or the full system restored.

Eighth, publish a bounded summary. Customers and public authorities need to know the failure class, current service state, reduced margin, repair progress and measurable improvements without receiving exploit-ready infrastructure detail.

This stress test transforms "four cables" from a count into a control claim.

Outage reporting should include degraded resilience

An operator may reroute traffic so successfully that the public sees little disruption. The infrastructure can still be in a materially degraded state. Three lost cables and one heavily used fallback path leave less tolerance for another fault.

The U.S. Federal Register rule adopted in 2016 is useful comparative evidence because it defined submarine-cable outages to include significant degradation regardless of whether traffic could be rerouted to an alternate path.[15] The rule does not govern Jersey. Its logic is directly relevant: successful traffic rerouting should not make the underlying loss invisible to oversight.

A resilience report should therefore distinguish customer-facing outage from infrastructure loss. It can record how many fibres or systems are unavailable, what capacity has been lost, how much traffic has been rerouted, what reserve remains, which repair resources are active and when risk is expected to normalise.

JT's updates did disclose the key qualitative fact that spare capacity had been lost or was limited.[3][4] That is stronger than saying only that services remained operational. A more complete public record would add quantitative ranges and service-level checks.

Reporting also creates a historical dataset. Regulators and operators can identify repeated failure domains, repair delays, congested fallback patterns and geographic concentration. Investment decisions can then target the controls that actually failed.

The purpose is not to punish a network for using redundancy successfully. It is to make successful redundancy auditable and to prevent a near miss from disappearing because customers remained mostly connected.

What the evidence does not prove

The source set does not identify a vessel with sufficient authority for this article to name it as the cause. It does not establish why an anchor was deployed, whether navigation rules were violated, or whether any person acted negligently. It does not allocate legal or financial liability.

It does not provide exact cable names, coordinates, burial depth, route geometry or a map of the shared failure domain. It does not disclose the normal or emergency capacity of the France path, utilisation during the incident, traffic shaping, priority rules or commercial transit changes.

It does not quantify every customer impact. The operator's description of minimal disruption and independent reports of degradation use different evidence and denominators. Neither can be converted into a universal claim.

It does not reveal whether emergency calls, hospitals, financial services or government systems experienced specific effects. Those outcomes should not be inferred from general Internet performance.

It does not supply optical test results, router snapshots, BGP updates, alarm logs, repair contracts, vessel logs or a post-incident regulator finding. It does not show what route-separation or capacity changes were made afterward.

The later FCC, CRS, UK and EU materials explain resilience controls and risks. They do not prove that every recommendation applied to Jersey in 2016, that a duty was breached, or that one measure would have prevented the damage.

These limits are not editorial footnotes. They define the boundary between evidence and speculation. An accountability article becomes less useful when it fills missing logs with confident accusations.

A practical evidence standard for island connectivity

Island connectivity has a simple visible outcome: people and systems can communicate beyond the island. The infrastructure producing that outcome is not simple. It includes seabed routes, landing facilities, transmission systems, terrestrial backhaul, autonomous-system routing, transit agreements, capacity management, monitoring and specialist repair.

A practical evidence standard should follow that chain.

The resource record should identify each cable and controlling party. The geography record should identify correlated physical failure domains. The capacity record should state normal, peak and emergency headroom. The routing record should prove that traffic can use the surviving path. The application record should test essential services. The incident record should preserve alarms, decisions and public notices. The repair record should connect vessel mobilisation to optical and service acceptance. The closeout record should prove that temporary controls were removed and full resilience returned.

Government has a role because island communications underpin public services and economic activity. That role does not require government to operate the network. It requires a credible oversight record and rules that make infrastructure degradation visible. The Government of Jersey's later publication of the operator releases helps preserve part of that record.[1]

Operators have a role because they control the running systems. A route inventory held by a regulator cannot make traffic move. Accurate records become useful when operators test them against real failover and share enough evidence to make continuity claims credible.

Repair providers have a role because restoration time is partly a supply-chain and logistics property. A cable plan without a repair plan is incomplete.

Users and dependent institutions have a role in application continuity, but they cannot substitute for network-level evidence. A hospital can maintain alternate communications; it cannot create geographic cable separation.

Conclusion: redundancy is a tested property

The 2016 Channel Islands cable incident produced a better outcome than the raw damage count suggested. Three UK-facing cables were cut, yet the remaining France link carried traffic. Engineering teams coordinated, specialist ships repaired the damage, the first cable was being restored by 6 December, and all three were reported back in full operation by 13 December.[2]-[7]

That record deserves credit. It also demonstrates why resilience should not be measured by the number of cables alone. Three routes were vulnerable to one physical episode. The surviving route had enough usable capacity to preserve broad continuity, but the operator acknowledged reduced spare capacity and possible peak disruption.[3][4]

The accountability standard is therefore evidence, not perfection. Which routes were physically independent? What traffic moved? What capacity remained? Which services degraded? When were repair assets mobilised? What did each restoration milestone prove? What changed after the event?

Cable inventories and legal records are necessary ledgers. They do not create continuity. Running optical systems, routing policy, available capacity, application performance and repair execution create continuity. A credible public record connects the two.

Jersey's experience shows that redundancy can work while still revealing a concentration risk. The right response is neither complacency nor catastrophe rhetoric. It is a measurable geographic-separation test, a realistic capacity plan, a service-level impact record and a repair closeout that proves the island has regained more than one line on a diagram.

A final operational checklist

Before claiming submarine-cable resilience, an operator should be able to answer ten bounded questions with current evidence. Which physical routes are active? Which corridors, landings, terrestrial links, power systems and repair agreements do they share? What is the tested capacity of each surviving combination? Which essential services have explicit performance thresholds? How quickly does traffic move when one or several cables disappear? Which internal and external measurements prove that the new path works? What spare margin remains after failover? Which maintenance organisation and vessel can respond to simultaneous faults?

What optical, routing and application tests authorize restoration? Which public notice explains degraded resilience without exposing sensitive topology?

The checklist should be rerun when capacity, landing infrastructure, transit policy or repair coverage changes. Its output should be versioned so that a post-incident review can compare the plan with observed performance. A route that existed but was not usable should not retain a passing status. A route that carried traffic under stress should receive credit, together with any capacity limits the exercise exposed.

The 2016 record supplies a real benchmark. One France path preserved broad connectivity after three UK-facing cuts, while reduced margin and repair logistics remained live risks. Future resilience evidence should be at least as specific about what survived, what was constrained and what had to be repaired.