Scope — This assessment examines the Bab el-Mandeb–Red Sea–Suez system as a converged maritime-security environment in which Houthi missile and unmanned-system capabilities, merchant-shipping exposure, GNSS and AIS dependency, submarine telecommunications infrastructure, port cyber resilience and European supply-chain continuity increasingly interact, with specific attention to Italy, France, Germany, the United Kingdom and the European Union, while preserving a strict distinction between documented electronic interference and publicly unproven attribution.

Executive Summary / BLUF

• Bab el-Mandeb should now be assessed as a physical-digital chokepoint rather than solely as a naval one, because the same geographic corridor concentrates merchant shipping exposed to missiles and unmanned systems, satellite-dependent navigation, AIS-based situational awareness, telecommunications routes and logistics systems whose disruption can transmit a local security incident into European supply chains, even when no single actor is responsible for every component of the risk.
• The kinetic baseline is established rather than hypothetical: the U.S. Maritime Administration records more than 100 separate Houthi attacks on commercial vessels between November 2023 and October 2025, affecting vessels associated with more than 60 countries, while its current advisory identifies UAVs, unmanned surface and underwater vehicles, ballistic and cruise missiles, small boats, explosive craft and seizure or boarding as continuing threat vectors in the southern Red Sea, Bab el-Mandeb and Gulf of Aden. 2026-006-Red Sea, Bab el Mandeb Strait, Gulf of Aden, Arabian Sea, and Somali Basin-Houthi Attacks on Commercial Vessels — U.S. Maritime Administration
• The digital-navigation problem is independently documented, but attribution must remain disciplined: the U.S. Coast Guard GPS User Issue Detection & Evaluation Tool records repeated 2026 Red Sea reports of GPS loss, jamming and spoofing, including positions jumping to manifestly incorrect coordinates, while NAVCEN repeatedly found no corresponding GPS constellation failure, authorised test or evident space-weather explanation and classified the cases as “Unknown Interference”, which establishes the phenomenon but not its perpetrator. GPS User Issue Detection & Evaluation (GUIDE) Tool — U.S. Coast Guard Navigation Center
• The AIS problem is different but complementary: U.S. maritime guidance does not establish that the Houthis manipulate AIS signals, yet it explicitly warns that vessels transmitting AIS in the threat area can become easier for hostile actors to track and target, while the European Maritime Safety Agency has separately established a specialist working group dealing with AIS spoofing and GPS/GNSS jamming, demonstrating that European maritime authorities already treat manipulation of maritime digital positioning and identification systems as a security problem in its own right. 2026-006-Red Sea, Bab el Mandeb Strait, Gulf of Aden, Arabian Sea, and Somali Basin-Houthi Attacks on Commercial Vessels — U.S. Maritime Administration Working Group on “Automatic Identification System (AIS) spoofing” — European Maritime Safety Agency
• The telecommunications layer materially enlarges the strategic stakes because the International Telecommunication Union states that submarine telecommunications cables carry more than 99% of worldwide data traffic and identifies physical exposure, repair delays, geographic concentration and dependency on limited numbers of systems as major resilience problems; consequently, an armed crisis can degrade connectivity even without deliberate cable sabotage if access, repair vessels, insurance, port logistics or maintenance windows become constrained. International Advisory Body approves landmark report to strengthen submarine cable resilience — International Telecommunication Union — Jul 2026
• The European policy architecture already contains many of the required instruments, because the revised EU Maritime Security Strategy explicitly covers cyber and hybrid attacks, critical maritime infrastructure, underwater cables, ports, information sharing and civilian-military situational awareness, while the 2025–2026 EU cable-security framework adds prevention, detection, response, repair and deterrence; the strategic gap therefore lies less in recognising the problem than in integrating these instruments operationally around exposed sea lanes such as Bab el-Mandeb. Maritime security: Council approves revised EU strategy and action plan — Council of the European Union — Oct 2023 Submarine Cable Security Toolbox and Cable Projects of European Interest — European Commission — Feb 2026
• For Italy, the issue is immediate rather than conceptual: Defence Minister Guido Crosetto stated in September 2026 that he had instructed the Italian Navy to prepare what was necessary to secure the transit of Italian ships through the worsening Bab el-Mandeb situation, while Italy had already deployed frigates under EUNAVFOR ASPIDES and escorted merchant vessels through the Red Sea during 2026; the central institutional question is therefore how to connect naval protection to cyber resilience, alternative navigation, cable continuity, port preparedness and commercial intelligence. Il Ministro Crosetto al Forum “Risorsa Mare” — Italian Ministry of Defence — Sep 2026 Comunicato Stampa n. 29 del 01 agosto 2026 — Italian Ministry of Defence

Iran’s Prolonged-War Posture: Expanding the Battlespace Without Seeking a Conventional War of Attrition

Bab el-Mandeb: Europe’s Maritime Defence Is Becoming a Digital Resilience Test

Europe’s Red Sea problem is no longer whether it can escort a merchant vessel through Bab el-Mandeb, but whether it can keep the entire Europe–Suez–Asia continuity chain functioning when physical attack, corrupted navigation, communications failure and infrastructure disruption occur in the same operating space. By 24 August 2026, EUNAVFOR ASPIDES had supported more than 2,390 merchant vessels and provided close protection to more than 720 ships, while the European Union had already extended the mission to 28 February 2027. Yet the decisive institutional shift came on 30 March 2026, when ASPIDES and ATALANTA were authorised to collect and share information on suspicious activity concerning critical submarine infrastructure. That decision exposes the new strategic equation: naval defence can keep a ship moving, but only integrated cyber, port, telecommunications and recovery capacity can keep trade moving.

The cost of insecurity is measured in displaced commerce, not ships sunk

The 2024 Suez figures demonstrate why a relatively limited attack capability can generate effects far beyond the number of vessels actually struck. Suez Canal transits fell from 26,434 vessels in 2023 to 13,213 in 2024, a decline of approximately 50%, while net tonnage dropped from 1.568 billion tonnes to 525 million tonnes, down 66.5%, and canal revenue fell from $10.250 billion to $3.991 billion. UNCTAD separately recorded Gulf of Aden ship capacity down 76% and Cape of Good Hope arrivals up 89% by mid-2024.

Those numbers describe a behavioural shock rather than a physical closure. The European Central Bank calculated that an Asia–Europe voyage routed around the Cape of Good Hope is roughly 30% longer than the Suez alternative, which converts insecurity into additional vessel-days, bunker fuel, charter demand and inventory time. UNCTAD later estimated global ton-mile growth at nearly 6% in 2024 and container ton-mile growth at about 17%, even though global seaborne trade volume grew only 2.2%. Bab el-Mandeb therefore produces leverage because one threatened corridor can absorb capacity across an entire shipping network.

ASPIDES has become more than an escort operation

The institutional response has expanded with the burden. On 27 May 2026, ASPIDES reported more than 1,960 merchant vessels supported and more than 650 protected; by 24 August, those figures had risen above 2,390 and 720 respectively. The operation’s mandate now runs through 28 February 2027, with nearly €15 million allocated as the reference amount for EU common costs between March 2026 and February 2027, excluding the wider national cost of ships, aircraft, crews and logistics.

The more important change is qualitative. On 30 March 2026, the Council of the European Union expanded the mandates of ASPIDES and ATALANTA to allow collection and sharing of information on suspicious activity related to critical submarine infrastructure, strengthened ASPIDES links with the EU’s CRIMARIO maritime-awareness programme and added cooperation with the Yemeni Coast Guard and maritime forces of Djibouti. The EU has therefore begun to move from protection of individual hulls toward awareness of the infrastructure environment around the route, without converting ASPIDES into a general cyber or cable-protection command.

Navigation integrity has entered the security equation without settling attribution

U.S. Coast Guard NAVCEN records from March to June 2026 document repeated Red Sea GPS and GNSS anomalies, including loss of signal, position jumps and locations displayed far from a vessel’s actual position. Several cases were classified as “Unknown Interference” after investigators found no known GPS constellation anomaly, authorised test or convincing space-weather explanation. That distinction matters: interference is documented; public attribution to Ansar Allah is not.

The operational problem exists regardless of attribution because spoofing can be more dangerous than simple signal denial. A bridge receiving no position knows that navigation has degraded; a bridge receiving a plausible but false position may continue feeding corrupted information into ECDIS, AIS-related situational awareness and shore reporting. EMSA’s dedicated work on AIS spoofing and GPS/GNSS jamming therefore addresses a problem already visible in operational reporting, while the EU’s revised Maritime Security Strategy explicitly places cyber and hybrid threats, ports and undersea cables inside the maritime-security perimeter.

Europe has built the rules, but the information still sits in different institutions

The legal structure is unusually complete. Directive (EU) 2022/2555, NIS2, brings sea and coastal freight transport companies, port managing bodies, port facilities and operators of port equipment inside Europe’s high-criticality cybersecurity regime. Directive (EU) 2022/2557, the Critical Entities Resilience Directive, adds an all-hazard resilience framework. EMSA handles navigation-integrity cooperation, national CSIRTs handle cyber incidents, telecom authorities oversee communications infrastructure, while ASPIDES provides the deployed maritime-security component.

The weakness lies between these systems. A merchant master can report GNSS spoofing, a frigate can observe suspicious activity near infrastructure, a port operator can detect an OT anomaly and a cable company can register capacity loss, but those observations originate under different authorities, classification rules and commercial obligations. As of September 2026, the public dossier does not establish a permanent real-time European mechanism automatically correlating ASPIDES observations, EMSA navigation data, national cyber incident reporting, port status and cable performance. Europe has built the sensors and the mandates; the unresolved task is fusion.

Cable security is forcing Europe to treat recovery as a defence capability

Submarine telecommunications cables carry more than 99% of international data traffic, yet more than 200 cable repairs were recorded globally in 2023, showing why cable security cannot be designed around sabotage prevention alone. A fault may be accidental, but a security crisis can still raise its economic cost if repair ships cannot enter an area quickly, permits are delayed, port support is unavailable or alternative capacity is already congested.

The European Commission’s 2026 response moves directly into this recovery problem. Its cable-security package includes €347 million for strategic digital-backbone and resilience measures during 2026–2027 and a dedicated €20 million call for adaptable repair modules that can be positioned in ports or shipyards. This sits alongside €595 million supporting 74 backbone-connectivity projects and €35.6 million invested in eight Atlantic and Nordic submarine cable projects. The policy sequence has therefore shifted from mapping vulnerabilities to financing restoration capacity, because redundancy protects services immediately after failure while repair determines how long emergency routing must carry the load.

Italy and France bring ships; Germany and Britain expose the limits of a single European model

Italy entered 2026 with a direct operational role. The frigate Carlo Bergamini completed dedicated ASPIDES preparation against air, surface and underwater threats before deployment, and by September the Italian Navy also reported the mine-countermeasure vessels Rimini and Crotone operating in the theatre. Italy’s next problem is therefore institutional rather than purely naval: information gathered at sea must be usable by authorities responsible for ports, telecommunications, cybersecurity and merchant shipping if the country is to convert naval presence into national continuity.

France has combined surface escort with airborne maritime awareness. In August 2026, a French frigate escorted merchant shipping through Bab el-Mandeb while an ATLANTIQUE 2 maritime-patrol aircraft conducted surveillance, and a late-July operational update recorded two FREMM frigates and an ATLANTIQUE 2 active in the region. Germany presents a different profile: its Bundeswehr mandate allowed up to 350 personnel in ASPIDES through 31 October 2026, but only about 10 German personnel were actually deployed on 7 September. The United Kingdom remains outside ASPIDES while retaining national maritime cyber codes for ships and ports and, on 22 September 2026, announcing additional defensive military support to Saudi Arabia. Europe therefore has no uniform force model to integrate; it has different national assets that must remain interoperable.

The next 12–24 months will determine whether Europe owns a system or a collection of programmes

Between September 2026 and the end of 2028, the decisive test will not be whether Europe publishes another maritime-security strategy but whether existing instruments begin producing measurable recovery and coordination performance. ASPIDES already has a mandate through 28 February 2027; the €347 million cable programme is moving into implementation; NIS2 and the Critical Entities Resilience Directive provide the civilian regulatory base; EMSA already has a specialist GNSS/AIS mechanism; and Italy, France, Germany and the United Kingdom already contribute different combinations of naval, cyber and infrastructure capability.

The cost of failing to connect them will not fall mainly on defence ministries. Shipping companies will pay through longer routing and vessel utilisation; manufacturers will pay through inventory delays; ports will pay through disrupted throughput; telecommunications operators will pay for redundancy and emergency restoration; Egypt has already demonstrated the fiscal cost through the collapse of Suez revenue from $10.250 billion in 2023 to $3.991 billion in 2024; and European consumers ultimately absorb part of the transport and supply-chain premium. The institutional choice for the next 12–24 months is therefore concrete: either Europe turns naval protection, cyber regulation, navigation integrity and cable recovery into one interoperable continuity system, or it continues paying separately for each failure after it reaches a different ministry, operator or balance sheet.

Continental Hedging and the Limits of Maritime Interdiction in Taiwan Strait Deterrence

---

Navigational Index

Physical Coercion, Maritime Access and Strategic Leverage

How Houthi missiles, drones, unmanned maritime systems and geographic position translate limited regional military power into disproportionate effects on commercial routes linking Asia, the Middle East and Europe.

Navigation, Data and Infrastructure as a Single Exposure Surface

Why GNSS disruption, AIS dependency, submarine cables, digital vessel management, communications and port IT/OT systems now create a second layer of vulnerability that remains analytically distinct from the kinetic threat but can interact with it operationally.

From Naval Protection to European Cyber-Maritime Resilience

How ASPIDES, national naval deployments, EU maritime-security policy, cable-resilience instruments, cybersecurity law and national capabilities can be connected so that protection of the route encompasses ships, positioning, communications, ports, data and recovery capacity.

---

Master Abstract

The chokepoint has changed before the map has changed

The principal judgment is that Bab el-Mandeb has acquired a digital-security dimension that materially changes the meaning of maritime defence even though the public record does not establish a unified Houthi capability to attack every element of that digital ecosystem, because the strategic risk emerges from the co-location and interdependence of systems rather than from proof that one adversary controls them all. The kinetic component is documented by official maritime-security reporting: the current U.S. Maritime Administration advisory describes continued Houthi capacity to threaten commercial vessels through ballistic and cruise missiles, one-way UAVs, unmanned surface vehicles, unmanned underwater vehicles, small craft and boarding or seizure, while the International Maritime Organization in July and August 2026 again documented lethal attacks and warned that attacks in the Red Sea threaten seafarers, shipping security and global supply chains. 2026-006-Red Sea, Bab el Mandeb Strait, Gulf of Aden, Arabian Sea, and Somali Basin-Houthi Attacks on Commercial Vessels — U.S. Maritime Administration Statement on deadly ship attack in the Red Sea — International Maritime Organization — Aug 2026

What changes the analytical picture is that modern commercial navigation through the same battlespace is inseparable from satellite positioning, ship-identification systems, communications networks, digital charts, remote operational support, port-information systems and increasingly automated logistics processes, so degradation of the informational layer can increase the consequences of an already dangerous physical environment without constituting a conventional “cyberattack” in the narrow sense. The European Maritime Safety Agency has therefore convened Member-State experts specifically around AIS spoofing and GPS/GNSS jamming, while the revised EU Maritime Security Strategy explicitly places maritime-domain awareness, cyber and hybrid threats and the protection of underwater cables, ports and offshore infrastructure within a common security framework rather than treating them as unrelated technical disciplines. Working Group on “Automatic Identification System (AIS) spoofing” — European Maritime Safety Agency Maritime security strategy — European Commission

GNSS interference is established; Houthi attribution is not

The strongest publicly verifiable evidence for the electronic-navigation dimension comes from the U.S. Coast Guard Navigation Center, whose 2026 GUIDE records contain repeated Red Sea reports of GPS loss, spoofing and jamming, including a 23 March report in which a vessel’s position repeatedly moved between correct and clearly incorrect coordinates, a 21 May report describing intermittent loss and false positioning toward Sudan, and a June report of a position being displaced far from the vessel’s actual location. In many of those records, the GPS Operations Center reported no known constellation or control-segment anomaly, no authorised local test and no convincing space-weather explanation, while the cause was nevertheless retained as Unknown Interference rather than assigned to a named actor. GPS User Issue Detection & Evaluation (GUIDE) Tool — U.S. Coast Guard Navigation Center

That distinction is strategically significant because evidence of interference and evidence of attribution answer different intelligence questions: the first establishes an operational condition requiring redundancy and altered procedures, whereas the second would require evidence about emitter location, technical signatures, command relationships, captured systems, intelligence collection or another attribution chain that the public GUIDE record does not provide. Nothing in the verified Coast Guard material reviewed here permits the narrower conclusion that the documented Red Sea GNSS anomalies were conducted by Ansar Allah, and asserting such attribution would therefore turn an observed vulnerability into an unsupported actor-specific claim; conversely, the absence of public attribution does not diminish the operational requirement to navigate safely in an environment where reliable PNT cannot always be assumed. GPS User Issue Detection & Evaluation (GUIDE) Tool — U.S. Coast Guard Navigation Center

Abu Dhabi, Tel Aviv and Algiers: The Emerging Strategic Confrontation Across the Maghreb, Sahel and Red Sea

AIS is simultaneously a safety mechanism and an information exposure

AIS presents a related but technically different problem because its primary function is maritime safety, identification and situational awareness rather than positioning itself, yet the information it transmits can also reveal vessel identity, movement and location to actors capable of exploiting commercially available or directly received maritime data. The U.S. Maritime Administration therefore advises U.S.-flagged commercial vessels in the affected region that operation of AIS transponders can increase targeting exposure and notes that SOLAS and IMO guidance allow masters to disable AIS where continuous operation would compromise the safety or security of the ship, while also emphasising that such a decision remains a safety judgment because AIS has collision-avoidance and navigational value. 2026-006-Red Sea, Bab el Mandeb Strait, Gulf of Aden, Arabian Sea, and Somali Basin-Houthi Attacks on Commercial Vessels — U.S. Maritime Administration

This evidence supports a narrower and more defensible proposition than the claim that Ansar Allah is “hacking AIS”: maritime digital visibility can interact with kinetic targeting, while AIS itself is also exposed to spoofing and falsification risks that European authorities are separately studying, meaning vessel operators must manage both the danger of excessive visibility and the danger of corrupted situational awareness. EMSA’s dedicated working group explicitly addresses both AIS spoofing and GPS/GNSS jamming and describes its objective as improving detection, assessment and resilience against threats to critical digital systems at sea, which makes the cyber-maritime concept institutionally grounded rather than merely rhetorical. Working Group on “Automatic Identification System (AIS) spoofing” — European Maritime Safety Agency

The undersea layer turns navigation security into communications security

The second major expansion of the risk surface lies below the vessels rather than aboard them, because submarine telecommunications infrastructure carries the overwhelming majority of international data and therefore places communications continuity within the same broad maritime-security geography. The International Advisory Body on Submarine Cable Resilience, whose final recommendations were approved in July 2026, describes submarine telecommunications cables as infrastructure carrying more than 99% of data traffic worldwide and identifies exposure to physical hazards, prolonged repair times, geographic concentration and dependency on limited numbers of systems as central resilience challenges. International Advisory Body approves landmark report to strengthen submarine cable resilience — International Telecommunication Union — Jul 2026

The important analytical implication is that intentional sabotage is only one possible failure pathway, because armed conflict can reduce infrastructure availability indirectly by making repair zones inaccessible, increasing risk to specialist vessels and crews, delaying permits or port operations, altering insurance conditions, constraining maintenance windows or forcing cable operators to depend longer on remaining routes. The European Union has adopted the same resilience logic through its 2025 cable-security action framework and the February 2026 Submarine Cable Security Toolbox and Cable Projects of European Interest, which organise cable security around prevention, detection, response and recovery, and deterrence rather than assuming that perimeter protection alone can guarantee continuity. Joint Communication to strengthen the security and resilience of submarine cables — European Commission — Feb 2025 Submarine Cable Security Toolbox and Cable Projects of European Interest — European Commission — Feb 2026

Houthi technological supply chains connect commercial components to military capability

The public official record also demonstrates why technology supply chains belong within the analysis even though this does not establish a Houthi cyberwarfare programme, because the latest publicly available UN Panel of Experts final report on Yemen records seizures containing drones, drone components, complete drone kits, remote-control units, high-frequency equipment, antennas, GPS modules, propellers, surveillance equipment, missile components, radars and communications equipment, while the Security Council subsequently required additional reporting on dual-use components and precursor chemicals. Reports — Panel of Experts on Yemen — United Nations Security Council

The analytical significance lies not in treating every navigation component as a weapon, but in recognising that contemporary missile and unmanned-system architectures depend on electronics, communications, positioning, propulsion, sensors and control components whose commercial availability can complicate export control and interdiction. The Security Council’s own 2025–2026 mandate specifically directed the Panel to report on dual-use components and precursor chemicals and their direct or indirect supply to Yemen, which provides an official institutional basis for treating supply-chain disruption and technology-control enforcement as components of the wider maritime-security response rather than as unrelated customs issues. Repertoire of the Practice of the Security Council — 28th Supplement — United Nations Security Council

---

Key Evidence Table

Indicator	Value/status	Reference date	Definition/scope	Issuer	Exact source
Houthi attacks on commercial vessels	More than 100 attacks, affecting vessels associated with more than 60 nations	Nov 2023–Oct 2025	Separate Houthi attacks against commercial vessels in the southern Red Sea/Gulf of Aden threat environment	U.S. Maritime Administration	2026-006-Red Sea, Bab el Mandeb Strait, Gulf of Aden, Arabian Sea, and Somali Basin-Houthi Attacks on Commercial Vessels
Red Sea GNSS interference	Multiple reports of GPS loss, jamming and spoofing; causes repeatedly recorded as Unknown Interference	Mar–Jun 2026 examples	User reports investigated against GPS constellation status, authorised testing and space weather	U.S. Coast Guard NAVCEN	GPS User Issue Detection & Evaluation (GUIDE) Tool
AIS-related targeting exposure	AIS transmission assessed as capable of increasing hostile targeting exposure	Current 2026 advisory	U.S.-flag commercial shipping in Red Sea/Bab el-Mandeb/Gulf of Aden and adjoining threat areas	U.S. Maritime Administration	2026-006-Red Sea, Bab el Mandeb Strait, Gulf of Aden, Arabian Sea, and Somali Basin-Houthi Attacks on Commercial Vessels
European AIS/GNSS security activity	Dedicated working group on AIS spoofing and GPS/GNSS jamming	Nov 2024 onward	Detection, assessment and resilience of digital maritime systems	EMSA	Working Group on “Automatic Identification System (AIS) spoofing”
Submarine-cable share of global data	More than 99% of worldwide data traffic	Jul 2026	Submarine telecommunications cables	ITU	International Advisory Body approves landmark report to strengthen submarine cable resilience
ASPIDES mandate	Extended to 28 February 2027	23 Feb 2026	EU defensive maritime-security operation for Red Sea and surrounding waters	Council of the EU	Red Sea: Council extends the mandate of Operation ASPIDES to safeguard freedom of navigation
ASPIDES common-cost reference amount	Nearly €15 million	1 Mar 2026–28 Feb 2027	Common costs of operation during extended mandate	Council of the EU	Red Sea: Council extends the mandate of Operation ASPIDES to safeguard freedom of navigation
Merchant vessels protected by ASPIDES	More than 670	First 29 months of operation, reported Jul 2026	Merchant vessels protected under defensive EU operation	EEAS / EUNAVFOR ASPIDES	HR/VP Kaja Kallas Visits EUNAVFOR ASPIDES in Djibouti
Seafarers assisted by ASPIDES	128	First 29 months of operation, reported Jul 2026	Seafarers saved/assisted by the operation	EEAS / EUNAVFOR ASPIDES	HR/VP Kaja Kallas Visits EUNAVFOR ASPIDES in Djibouti
Detour penalty via Cape of Good Hope	Asia–Europe voyages roughly 30% longer in the ECB’s 2024 assessment	2024 benchmark	Distance/time effect of rerouting around Africa rather than using Suez	European Central Bank	ECB staff macroeconomic projections for the euro area, March 2024

---

Physical Coercion, Maritime Access and Strategic Leverage

Bab el-Mandeb generates disproportionate strategic leverage because the military effect of a weapon deployed near the strait is not limited to physical damage against its direct target; rather, the relevant transmission mechanism operates through operator risk assessments, insurance, crew safety, naval-protection requirements, route planning, fleet allocation and the willingness of shipping companies to accept continued exposure. UNCTAD describes maritime transport as carrying more than 80% of world merchandise trade by volume and identifies the Red Sea and Suez disruptions as part of a broader pattern in which chokepoint instability reshapes routes, schedules and logistics, while its earlier documented observations showed substantial rerouting around the Cape of Good Hope when Red Sea risk rose. Multi-year expert meeting on transport, trade logistics and trade facilitation, 12th session — UN Trade and Development — Apr 2026

The European Central Bank’s historical measurement of the 2024 disruption illustrates the mechanism without implying that those exact magnitudes automatically describe September 2026: its March 2024 analysis estimated that rerouting Asia–Europe shipping around the Cape made voyages approximately 30% longer, while a more severe prolonged-disruption scenario would have reduced euro-area extra-area export growth by 1.3 percentage points in 2024 and 0.8 percentage points in 2025 relative to that projection’s baseline. Those numbers are scenario-dependent and historical rather than current forecasts, but they demonstrate why a relatively narrow physical chokepoint can produce macroeconomic consequences through vessel utilisation, transport prices, inventory timing and manufacturing supply chains rather than through destruction of cargo alone. ECB staff macroeconomic projections for the euro area, March 2024 — European Central Bank

The current operational environment reinforces that transmission mechanism because the IMO in July 2026 again characterised the Red Sea as a critical corridor for international trade and warned that renewed attacks endangered seafarers, shipping security, the marine environment and global supply-chain stability, while in August it confirmed fatalities following a projectile strike against the cargo ship TIHAMAH off Al Mokha. These official records establish that the threat is not reducible to political messaging or theoretical anti-access capability and that commercial-shipping decisions must account for recurrent lethal risk in the same geographic space through which Europe accesses Suez. Statement on recent attacks on ships in the Red Sea — International Maritime Organization — Jul 2026 Statement on deadly ship attack in the Red Sea — International Maritime Organization — Aug 2026

Navigation, Data and Infrastructure as a Single Exposure Surface

The decisive shift is therefore conceptual but grounded in observable systems: a protected merchant vessel is not operationally independent of accurate navigation, communications availability, trustworthy situational awareness, port connectivity and logistics data, so intercepting a missile protects one part of the maritime system without necessarily ensuring the continuity of the route. This is consistent with the revised EU Maritime Security Strategy, which directs attention not only to naval activity but also to improved maritime-domain situational awareness, greater civilian-military information exchange, cyber and hybrid threats, underwater cables, ports and other critical maritime infrastructure. Maritime security: Council approves revised EU strategy and action plan — Council of the European Union — Oct 2023

The EU already possesses elements of the institutional architecture required to integrate this picture, because the strategy specifies greater use of the Common Information Sharing Environment (CISE) and MARSUR for secure information exchange and coordination between national and European maritime-surveillance authorities, together with increased integration of space-based solutions and exercises addressing harbour protection, cyber threats and hybrid threats. The practical implication for Bab el-Mandeb is that GNSS interference reports, suspicious AIS anomalies, threat intelligence, naval observations, commercial shipping data, cable incidents and port cyber indicators should be treated as mutually relevant operational information streams rather than as separate technical datasets owned by unrelated communities. Maritime security: Council approves revised EU strategy and action plan — Council of the European Union — Oct 2023

European cybersecurity law provides another part of the architecture, because Directive (EU) 2022/2555 — the NIS2 Directive requires cybersecurity risk-management and incident-reporting mechanisms across designated essential and important entities and explicitly covers categories of critical economic infrastructure rather than limiting cybersecurity governance to traditional information-technology companies. The analytical implication is not that NIS2 constitutes a naval instrument, but that European resilience against Bab el-Mandeb disruption necessarily reaches beyond warships into the regulated cyber preparedness of ports, communications providers and other infrastructure operators whose service continuity determines whether maritime trade can continue under degraded conditions. Directive (EU) 2022/2555 — EUR-Lex

From Naval Protection to European Cyber-Maritime Resilience

Italy: the most immediate national convergence problem

Italy has already moved beyond a purely declaratory posture because the Ministry of Defence confirms the deployment of Italian naval units under EUNAVFOR ASPIDES, including Luigi Rizzo and Bergamini, with the latter conducting merchant-vessel protection in the Red Sea during summer 2026, while the Italian Navy defines ASPIDES as a defensive mission capable of close protection, area protection and escort against missile, aerial-drone, maritime-drone and small-boat threats in the high-threat zone off Yemen. Operazione Aspides — Marina Militare Comunicato Stampa n. 29 del 01 agosto 2026 — Italian Ministry of Defence

The September 2026 shift is important because Crosetto publicly stated that he and the Chief of Defence had activated the Navy to prepare what was necessary to secure Italian vessels through the deteriorating Bab el-Mandeb situation, explicitly connecting route interruption with shipment delays, higher costs and consequences for businesses and households. The statement is evidence of Italian government intent and preparatory action rather than, by itself, proof that a distinct new national naval mission has completed authorisation, deployment or reached operational capability, which should therefore be verified separately as the institutional record develops. Il Ministro Crosetto al Forum “Risorsa Mare” — Italian Ministry of Defence — Sep 2026

Italy’s next policy problem is consequently less about discovering the existence of a maritime threat than about joining naval escort, merchant-shipping intelligence, GNSS anomaly reporting, cable resilience, port cyber protection and degraded-mode operations into one national continuity framework, particularly because Italy’s geography and port-industrial system expose it directly to changes in Suez-linked maritime flows. Such integration would be consistent with the EU Maritime Security Strategy rather than a departure from it, because the strategy already defines maritime security in terms broad enough to encompass infrastructure, cyber threats and information-sharing alongside conventional naval functions. Maritime security strategy — European Commission

France: sustained naval presence combined with regional situational awareness

France remains directly relevant because the French Ministry of the Armed Forces reported in August 2026 that a French frigate escorted a merchant vessel through Bab el-Mandeb and the Red Sea under ASPIDES while an ATLANTIQUE 2 maritime-patrol aircraft conducted surveillance and situational-awareness missions, providing a model in which vessel protection and broader maritime-domain awareness are already operated together. Point de situation des opérations du jeudi 13 au 20 août 2026 — Ministère des Armées et des Anciens combattants

For the cyber-maritime problem, France’s comparative institutional value therefore lies in the combination of deployed naval capability, maritime surveillance and the ability to connect national assets to an EU operational architecture, although the official evidence reviewed here does not establish a dedicated French Bab el-Mandeb mission focused specifically on GNSS interference or submarine-cable protection. The relevant European requirement is thus to ensure that surveillance architectures capable of detecting ships, aircraft and missile threats can receive and distribute digital-navigation and infrastructure-warning information without conflating physical-domain observations with cyber attribution.

Germany: continued institutional relevance despite a different current force posture

Germany participated militarily in ASPIDES with the frigate Hessen, but the Bundeswehr’s current public operation page records that its last frigate contribution ended on 20 April 2024, meaning current German involvement should not be described as equivalent to the Italian or French naval deployments evidenced in 2026 unless a newer official deployment record emerges. Rotes Meer – EUNAVFOR Aspides — Bundeswehr

Germany nonetheless remains materially implicated through European trade, logistics, EU decision-making and the collective cyber and infrastructure-resilience architecture, while German personnel have previously participated in multinational ASPIDES command structures. The distinction matters analytically because European political participation, staff participation, industrial exposure and deployment of a surface combatant are separate variables and should not be collapsed into a binary description of whether a state “participates” in maritime security. Security and Defence Committee visits ITS Marceglia: two days at sea aboard the Flagship of Operation Aspides — EEAS

United Kingdom: outside ASPIDES but inside the same strategic problem

The United Kingdom is not a participant in the EU’s ASPIDES command structure, but the British government on 22 September 2026 joined France, Germany, Italy, the United States, Canada, Japan and the EU High Representative in a G7 statement characterising the situation in Yemen and Bab al-Mandab as a threat to regional stability, energy security, navigational rights and maritime security, while the UK Ministry of Defence announced additional defensive military support to Saudi Arabia following renewed Houthi attacks. G7 Statement on Bab al-Mandab and Navigational Rights and Freedoms — GOV.UK — Sep 2026 UK military support to the Kingdom of Saudi Arabia — GOV.UK — Sep 2026

The UK position therefore illustrates the importance of analysing European security beyond EU institutional membership, because British naval, air-defence, maritime-regulatory, intelligence and cyber capabilities remain relevant to regional stability while being connected through different political and operational mechanisms. The September G7 statement provides a fresh common diplomatic baseline across Italy, France, Germany and the United Kingdom, but it does not itself create a shared cyber-maritime command structure or establish a collective GNSS, cable and port-resilience mechanism; those would require additional institutional and technical arrangements beyond political alignment. G7 Statement on Bab al-Mandab and Navigational Rights and Freedoms — GOV.UK — Sep 2026

European Union: the instruments exist, but operational integration is incomplete

EUNAVFOR ASPIDES remains the principal EU kinetic-protection instrument in the theatre, and the Council extended its mandate through 28 February 2027, with nearly €15 million allocated for common costs during the extension period; by July 2026, the EEAS reported that the operation had protected more than 670 merchant vessels and saved 128 seafarers during its first 29 months. Red Sea: Council extends the mandate of Operation ASPIDES to safeguard freedom of navigation — Council of the European Union — Feb 2026 HR/VP Kaja Kallas Visits EUNAVFOR ASPIDES in Djibouti — EEAS — Jul 2026

The missing layer is not an absence of European policy instruments but the absence, in the official material reviewed, of a single operational framework that treats the Bab el-Mandeb route simultaneously as a missile-defence problem, a navigation-assurance problem, a telecommunications-continuity problem, a port-cyber problem and a supply-chain intelligence problem. The revised Maritime Security Strategy, EMSA’s AIS/GNSS work, NIS2, CISE, MARSUR and the EU submarine-cable framework provide compatible components, meaning the strategic evolution required is principally one of integration, information-sharing and operational continuity, not the invention of an entirely new policy field. Maritime security: Council approves revised EU strategy and action plan — Council of the European Union Working Group on “Automatic Identification System (AIS) spoofing” — EMSA Submarine Cable Security Toolbox and Cable Projects of European Interest — European Commission

Principal Gaps and Watch Indicators

The assessment would materially change if credible official evidence emerged assigning specific Red Sea GNSS spoofing or jamming incidents to Ansar Allah, because that would convert the current condition of co-located kinetic threat and unattributed electronic interference into evidence of integrated electronic-warfare employment; until such attribution is supported by technical or intelligence evidence, the correct formulation remains that both phenomena coexist in the same maritime environment without a publicly established common perpetrator. GPS User Issue Detection & Evaluation (GUIDE) Tool — U.S. Coast Guard Navigation Center

A second decisive indicator is whether Italian preparations announced in September 2026 produce a formally authorised and operationally distinct national protection mission, additional naval assets or new rules for cooperation with ASPIDES, because the current Ministry of Defence statement establishes preparation and intent while existing official records separately establish Italy’s substantial participation in ASPIDES. Il Ministro Crosetto al Forum “Risorsa Mare” — Italian Ministry of Defence Operazione Aspides — Marina Militare

A third indicator is any confirmed physical degradation of submarine telecommunications infrastructure in the southern Red Sea or Gulf of Aden combined with constrained repair access, because the ITU’s 2026 resilience analysis identifies repair time, physical exposure and geographic concentration as systemic vulnerabilities, while the EU cable-security framework makes rapid detection, recovery and rerouting central to resilience. International Advisory Body approves landmark report to strengthen submarine cable resilience — ITU Joint Communication to strengthen the security and resilience of submarine cables — European Commission

A fourth indicator is evidence that merchant vessels increasingly resort to dead reckoning, manual fixes, multi-constellation cross-checking or other alternative PNT procedures during Red Sea transit, because such behaviour would indicate that GNSS degradation is moving from intermittent electronic anomaly to a sustained operational-navigation constraint; NAVCEN already records at least one regional report describing navigation through dead reckoning and manual shore fixes during spoofing, although that example occurred in the Gulf of Oman rather than Bab el-Mandeb itself and should therefore not be misrepresented geographically. GPS User Issue Detection & Evaluation (GUIDE) Tool — U.S. Coast Guard Navigation Center

A fifth indicator concerns technological supply chains, because additional Panel of Experts evidence showing recurrent interdiction of guidance, communications, sensors, propulsion or specialised dual-use components would increase confidence that targeted export-control and interdiction measures can constrain replenishment, whereas evidence of effective substitution, indigenous production or diversified procurement would reduce the expected effect of component-denial policies. Reports — Panel of Experts on Yemen — United Nations Security Council

Decision-Relevant Courses of Action

Course	Institutional hook	Expected effect	Implementation burden	Time-to-effect	Reversibility	Principal downside
Expand naval protection and maritime-domain awareness without changing ASPIDES’ defensive character	Existing ASPIDES mandate, national naval authorities, CISE/MARSUR	Reduces kinetic exposure and improves warning and tracking	High operational and force-generation burden	Immediate to months	High	Sustained deployments consume scarce high-end naval assets and do not independently solve navigation or infrastructure failure
Establish a Red Sea GNSS/AIS anomaly-sharing mechanism for European shipping	EMSA AIS-spoofing work, CISE, national maritime authorities, ASPIDES information structures	Converts isolated technical reports into operational maritime-domain awareness and accelerates anomaly verification	Moderate technical and coordination burden	Months	High	Poorly governed reporting could generate false alarms or reveal commercially sensitive vessel information
Require tested degraded-PNT and degraded-connectivity procedures for exposed shipping and ports	Flag-state safety frameworks, maritime regulators, port-security and cybersecurity obligations	Reduces dependency on a single navigation or communications channel	Moderate training, equipment and certification burden	Months to several years	High	Additional operating cost and procedural complexity without eliminating sophisticated interference
Integrate Red Sea contingencies into EU cable-resilience planning	EU Cable Security Action Plan, Cable Security Toolbox, national telecom authorities	Improves rerouting, repair prioritisation, spare capacity and recovery planning	High cross-border infrastructure and commercial coordination burden	Medium term	Medium	Redundancy and repair capacity require sustained investment and cannot eliminate geographically concentrated risk
Tighten intelligence-led controls on military-relevant dual-use supply networks	UN Yemen sanctions framework, EU and national export-control regimes, customs and maritime interdiction	Raises replenishment friction for missiles and unmanned systems where identifiable components remain externally sourced	High intelligence, customs and diplomatic burden	Medium term	Medium	Substitution, diversion and legitimate commercial use complicate enforcement and can impose costs on lawful trade

These options are complementary rather than substitutes, because naval escort reduces immediate physical exposure while PNT resilience, cable redundancy, port cyber preparedness and supply-chain enforcement address different mechanisms through which the same geographic crisis can produce systemic economic effects; the principal policy choice is therefore not between “military” and “cyber” responses, but how much institutional integration is required to prevent failure in one domain from amplifying risk in another.

Principal Judgment

The public record supports describing Bab el-Mandeb as an emerging cyber-maritime chokepoint, provided that expression is defined carefully: Houthi missiles, drones and maritime attacks constitute the documented hostile component; Red Sea GNSS interference constitutes a separately documented electronic-navigation hazard whose public attribution remains unresolved; AIS creates both safety value and targeting exposure while also being vulnerable to spoofing; submarine cables create a communications-continuity layer whose vulnerability includes repair and redundancy rather than sabotage alone; and European ports and logistics systems transform disruption at sea into downstream economic consequences.

The resulting strategic requirement is broader than missile interception but narrower than an unsupported claim of integrated Houthi cyberwarfare, because the evidence supports convergence of vulnerabilities more strongly than it supports attribution of every digital anomaly to the same actor. For Italy and Europe, the decision-relevant objective is therefore to reduce the conversion efficiency by which a local military crisis becomes a systemic trade, navigation or communications shock: ships must remain navigable under degraded GNSS, maritime authorities must distinguish genuine and manipulated vessel information, ports must preserve essential operations during cyber disruption, cable networks must possess rerouting and repair options, and naval forces must receive enough digital-domain information to understand when physical and electronic anomalies are interacting.

That direction is already compatible with the EU’s own maritime-security doctrine, which explicitly combines freedom of navigation, maritime-domain awareness, critical infrastructure protection, cyber and hybrid threats and civilian-military cooperation, so the central institutional problem is no longer whether cyber resilience belongs inside maritime security, but how rapidly Europe can translate already fragmented authorities and capabilities into a common operational model for strategically exposed corridors such as Bab el-Mandeb. Maritime security: Council approves revised EU strategy and action plan — Council of the European Union

Visualisation determination

No quantitative chart would materially improve this first-delivery assessment without either mixing historical and current datasets or assigning unsupported weights to heterogeneous kinetic, navigational, cyber and infrastructure risks; the geographical orientation above is therefore retained solely to establish the corridor relationship, while no decision-useful quantitative visualisation is supportable from the verified record without introducing assumptions that would violate the stated methodology.

Because the operational picture is changing rapidly, the official-record watch can also be automated around new IMO incidents, Italian or ASPIDES deployments, NAVCEN GNSS reports, UN Panel findings and EU cable-security measures, with notification only when a development materially changes this assessment.

Physical Coercion, Maritime Access and Strategic Leverage

Principal judgment

Bab el-Mandeb gives Ansar Allah a form of coercive leverage that is substantially larger than the movement’s conventional naval strength because the strategic effect of an attack is produced not only by the probability of destroying a vessel, but by the much wider commercial reaction generated when shipowners, charterers, insurers, crews, cargo owners and naval authorities conclude that passage through a geographically constrained corridor has become operationally uncertain. The evidence therefore supports interpreting the Red Sea campaign as an access-disruption mechanism rather than simply a succession of attacks on individual ships, because the costs transmitted through the system include rerouting, additional sailing time, higher fuel consumption, increased vessel utilisation, schedule unreliability, war-risk exposure, escort requirements and the absorption of additional fleet capacity on longer routes. UN Trade and Development reported that by mid-2024 ship capacity transiting the Gulf of Aden had fallen 76%, Suez Canal tonnage had fallen 70%, arrivals around the Cape of Good Hope had risen 89%, and longer routes had increased global container-ship demand by 12%, demonstrating quantitatively how threats concentrated around one maritime gateway can reconfigure traffic well outside the immediate battlespace. Review of Maritime Transport 2024 — UN Trade and Development

The physical threat should consequently be assessed through four linked effects: destruction, where a vessel or crew is physically damaged; deterrence, where the probability of attack changes operator behaviour before an attack occurs; displacement, where ships are forced onto longer alternative routes; and capacity absorption, where longer voyages reduce the effective availability of the global fleet even when no physical tonnage has been destroyed. The resulting leverage is structurally asymmetric because the attacker does not need to close the waterway in the legal or physical sense to impose costs approaching those associated with partial closure; it is sufficient to raise perceived transit risk above the commercial threshold at which a meaningful share of operators decides that additional time and distance are preferable to exposure. UNCTAD’s subsequent 2025 assessment confirms that this effect persisted beyond the initial shock, reporting that Suez tonnage remained approximately 70% below the 2023 average and that prolonged route displacement had become a structural feature of the maritime transport system rather than a brief interruption. Review of Maritime Transport 2025: Staying the course in turbulent waters — UN Trade and Development

A corridor can be disrupted without being physically closed

The central operational characteristic of Bab el-Mandeb is that freedom of navigation can remain legally available while becoming commercially unattractive for part of the fleet, which makes physical closure an unnecessarily demanding benchmark for measuring coercive success. Commercial routing decisions are made under uncertainty, and the relevant question for a shipping company is not whether every vessel will be attacked, but whether the expected combination of casualty risk, hull damage, cargo loss, crew exposure, delay, insurance conditions and potential diversion makes continued transit acceptable relative to the Cape of Good Hope alternative. The U.S. Maritime Administration’s current Red Sea advisory identifies one-way UAVs, unmanned surface vehicles, unmanned underwater vehicles, ballistic and cruise missiles, explosive boats, small-arms attacks, boarding, detention and seizure among the potential hostile actions facing commercial shipping, which means operators must account for several attack geometries rather than a single weapons system.

That diversity matters because defensive success against one vector does not automatically restore normal commercial confidence, while the attacker can exploit uncertainty by retaining several means of imposing risk even when only a fraction of them are employed during a particular period. A missile-interception capability can reduce the probability of a successful missile strike without removing the possibility of unmanned-surface attack, boarding, collateral damage from a nearby engagement, navigational hazards created by a damaged vessel, or renewed targeting after a period of inactivity; equally, a shipping company cannot assume that the absence of attacks during one month proves that the underlying threat architecture has disappeared. This distinction is reflected in the EU’s decision to maintain and extend EUNAVFOR ASPIDES through 28 February 2027, because the Council described the operation as a continuing response to threats against merchant and commercial vessels rather than as an emergency whose relevance ended with individual pauses in attack activity. Red Sea: Council extends the mandate of Operation ASPIDES to safeguard freedom of navigation — Council of the European Union — 23 February 2026

The public record shows a larger attack universe than a simple incident count suggests

Two official datasets are especially useful but should not be treated as interchangeable because they measure different things. The U.S. Maritime Administration reports more than 100 separate Houthi attacks on commercial vessels between November 2023 and October 2025, affecting vessels associated with more than 60 nations, whereas the IMO’s Red Sea incident register records 61 confirmed incidents from 10 January 2024 onward plus 17 incidents between November 2023 and 9 January 2024, producing a total of 78 confirmed incidents across those two reporting periods as currently displayed. The difference does not constitute a contradiction because an “attack” and an “incident notified to IMO and confirmed” are different units of observation, and one maritime incident can involve multiple projectiles or attack events, while institutional reporting thresholds, confirmation procedures and temporal coverage also differ. 2026-006 Red Sea, Bab el Mandeb Strait, Gulf of Aden, Arabian Sea, and Somali Basin — U.S. Maritime Administration and Red Sea area — International Maritime Organization provide the relevant official baselines.

Audited incident-count reconciliation

Official measure	Recorded value	Reporting period	Unit being counted	Analytical use	Important limitation
Houthi attacks on commercial vessels	100+	Nov 2023–Oct 2025	Separate attacks	Measures frequency of hostile action	Not identical to number of affected ships or IMO-confirmed incidents
National association of affected vessels	60+ nations	Nov 2023–Oct 2025	National associations connected with affected vessels	Demonstrates geographic breadth of exposure	Association may involve flag, ownership, management or related commercial structure depending on case
IMO-confirmed incidents after UNSCR 2722 reporting began	61	10 Jan 2024–current IMO register	Incidents notified to and confirmed by IMO	High-confidence incident baseline	Does not necessarily count every weapon employed during an incident
IMO-confirmed incidents before UNSCR 2722 reporting framework	17	Nov 2023–9 Jan 2024	Confirmed maritime incidents	Extends comparable historical context	Separate reporting period
Combined IMO confirmed incidents shown across both periods	78	Nov 2023–current register	Calculated from 61 + 17	Demonstrates sustained physical threat	Calculated total; not equivalent to MARAD’s 100+ attack count

Sources: U.S. Maritime Administration, MSCI Advisory 2026-006 and IMO Red Sea Area incident reporting.

The most important conclusion from these figures is not the precise choice between 78 incidents and more than 100 attacks, but the fact that hostile activity has been persistent enough to generate independent reporting regimes at MARAD, IMO, the United Nations Security Council and the European Union, while the Security Council in July 2026 extended its formal request for continued reporting on Houthi attacks through 15 January 2027. This institutional persistence is itself evidence that maritime risk has not reverted to a normal peacetime baseline even when attack intensity fluctuates, because the international system continues to allocate diplomatic, military and reporting resources to the corridor. Security Council Resolution 2826 (2026) — United Nations Security Council and the Council’s document search record confirm that the reporting mandate established under resolution 2722 was again extended in July 2026.

Weapon diversity increases the cost of defence more than the cost of coercion

The asymmetric character of the threat becomes more visible when the attack architecture is decomposed by operational function rather than by individual weapon designation. Ballistic and cruise missiles allow stand-off attacks against shipping; one-way UAVs can create repeated low-cost aerial threats and consume defensive attention; unmanned surface and underwater vehicles expand the threat into the maritime domain; small craft create boarding, seizure and close-range fire risks; and explosive boats create a different defensive problem involving detection and engagement close to commercial traffic. MARAD’s current advisory explicitly lists all of these categories, which means the defensive system must maintain simultaneous capacity against trajectories, speeds, signatures and engagement ranges that are operationally dissimilar. MSCI Advisory 2026-006 — U.S. Maritime Administration

The coercive advantage emerges because the attacker does not need each weapon category to achieve high success rates independently; a heterogeneous threat set can impose defensive expenditure by forcing naval forces to retain sensors, interceptors, aviation, electronic surveillance, close-in protection and command capacity against several possibilities at once. The defender must also discriminate threats in proximity to neutral commercial traffic, while a merchant vessel generally lacks the organic detection, air-defence and damage-control architecture of a warship. As a result, the economic value at risk aboard the merchant vessel, including hull, cargo, crew, contractual obligations and schedule integrity, can greatly exceed the cost of the individual attacking system, although a precise cost-exchange ratio cannot be responsibly calculated from the available official record because publicly verifiable unit costs, expenditure rates and engagement-specific inventories are incomplete.

Operational threat architecture

Threat vector identified in official guidance	Primary coercive function	Defensive demand created	Commercial consequence if threat remains credible
Ballistic missiles	High-speed stand-off strike	Long-range detection, tracking and missile defence	Higher perceived casualty and hull-loss risk
Cruise missiles	Low-altitude precision or area attack	Persistent radar coverage and intercept capacity	Route avoidance and escort demand
One-way UAVs	Persistent aerial harassment and strike	Air surveillance and repeated interception	Increased uncertainty and defence expenditure
Unmanned surface vehicles	Maritime strike from surface approach	Surface surveillance and close-in engagement	Additional threat near constrained routes
Unmanned underwater vehicles	Subsurface threat potential	Underwater awareness and force protection	Greater uncertainty around high-value vessels and infrastructure
Explosive boats	Close-range asymmetric attack	Rapid identification and close-in defence	Higher risk in congested navigation zones
Small boats / small-arms fire	Harassment, boarding or seizure	Escort, manoeuvre and force-protection requirements	Crew risk and possible vessel capture
Boarding / detention / seizure	Direct control of vessel and crew	Physical protection and crisis response	Cargo delay, hostage risk and reputational pressure

Source: threat categories are taken directly from U.S. Maritime Administration MSCI Advisory 2026-006; the stated coercive and defensive implications are analytical assessments derived from those officially identified vectors.

Target selection multiplies pressure beyond the ship actually attacked

Another important source of leverage lies in uncertainty over commercial association, because the current U.S. advisory warns that vessels with Israeli, U.S. or UK associations, as well as vessels within corporate or fleet structures connected to Israeli port calls, can face elevated risk. This creates a broader problem than direct flag-state targeting because modern shipping separates beneficial ownership, registered ownership, management, chartering, flag, cargo ownership, port history and group-company relationships across multiple jurisdictions, meaning that a vessel’s perceived exposure can depend on commercial relationships that are not obvious from its flag alone. MSCI Advisory 2026-006 — U.S. Maritime Administration

This expands coercive reach because fleet-level risk management can cause an operator to divert vessels that have never individually been threatened if the company believes that its wider commercial structure has entered the attacker’s targeting logic. The effect can therefore propagate horizontally across sister vessels, charter relationships and corporate networks, generating route changes that exceed the number of ships physically struck. It also complicates underwriting and operational planning because commercial entities must evaluate not only location but attribution of ownership, management and trading patterns, some of which change over time. The attack therefore operates partly against the network identity of the vessel, not merely against the physical hull occupying a set of coordinates, which helps explain why relatively limited attack volume can influence much larger numbers of voyages.

The 2024 traffic shock provides a measurable benchmark for strategic leverage

The clearest audited demonstration of the mechanism comes from Suez Canal traffic statistics, because the Suez Canal Authority reported that vessel transits fell from 26,434 in 2023 to 13,213 in 2024, a decline of approximately 50%, while net tonnage fell from 1.568 billion tonnes to 525 million tonnes, a reduction of 66.5%, and dollar-denominated revenue fell from $10.250 billion to $3.991 billion, a decline of approximately 61%. The Authority explicitly linked those changes to regional conditions and the Red Sea crisis, which makes the series particularly useful for identifying the macro-scale displacement created by insecurity south of Suez. Suez Canal Authority, navigation-performance statement — 16 April 2025

Suez Canal disruption benchmark

Indicator	2023	2024	Change reported by Suez Canal Authority	Strategic meaning
Vessel transits	26,434	13,213	−50%	Approximately half of the previous year’s vessel traffic remained
Net tonnage	1.568 bn tonnes	525 mn tonnes	−66.5%	Larger reduction than vessel count, indicating substantial displacement of carrying capacity
Revenue	$10.250 bn	$3.991 bn	−61%	Direct fiscal effect on Egypt from route avoidance
Cape of Good Hope arrivals	Baseline comparison	+89% by mid-2024	UNCTAD measure	Confirms route substitution rather than disappearance of underlying trade
Gulf of Aden ship capacity	Baseline comparison	−76% by mid-2024	UNCTAD measure	Demonstrates severe reduction in traffic entering the Red Sea route
Suez tonnage	Baseline comparison	−70% by mid-2024	UNCTAD measure	Confirms magnitude across a separate international dataset

Sources: Suez Canal Authority — 16 April 2025 and UNCTAD Review of Maritime Transport 2024.

These figures provide one of the strongest demonstrations of asymmetric leverage in the entire case because they show that the strategic objective does not require destroying a proportion of shipping comparable to the proportion diverted; the number of vessels physically attacked was a small fraction of the traffic volume that ultimately changed route, yet commercial and military risk perceptions produced a system-wide behavioural response. The critical ratio is therefore not weapons fired per vessel sunk but credible threat per voyage decision altered, which is much more favourable to an actor positioned near a geographic chokepoint than conventional force comparisons would suggest.

Longer routing consumes global shipping capacity even when every cargo eventually arrives

The economic mechanism becomes more consequential when measured in ton-miles rather than tonnes because a cargo moved an additional several thousand nautical miles consumes more vessel-days, crew time, bunker fuel and charter capacity even though the physical quantity of cargo is unchanged. UNCTAD reported that geopolitical rerouting drove global ton-mile growth to nearly 6% in 2024, almost three times the growth rate of cargo volume, while its detailed freight-rate analysis found that Red Sea rerouting contributed to an estimated 17% increase in container-shipping ton-miles during 2024, alongside higher vessel demand, delays and increased time-charter and fuel costs. Review of Maritime Transport 2025 — UN Trade and Development and Chapter III: Freight rates and maritime transport costs document those transport-market effects.

The European Central Bank quantified the route-length mechanism from another institutional perspective, estimating that voyages between Asia and Europe become approximately 30% longer when rerouted around the Cape of Good Hope rather than through the Suez route. The ECB also noted that roughly 10% of global seaborne trade by volume and approximately 12% of global crude-oil shipments passed through the Suez Canal in the reference period it examined, which explains why disturbances around Bab el-Mandeb can produce economic effects well beyond the immediate volume of attacked vessels. ECB staff macroeconomic projections for the euro area, March 2024 — European Central Bank

Transmission from physical threat to economic burden

Transmission mechanism	Verified quantitative evidence	Operational interpretation
Asia–Europe route extension	~30% longer when routed around Cape of Good Hope	More vessel-days required for each voyage
Global ton-mile increase	~6% in 2024	Shipping demand grew much faster than physical trade volume
Container ton-mile effect	~17% increase in 2024 according to UNCTAD freight chapter	Container fleet absorbed by distance rather than solely cargo growth
Container fleet-capacity growth	10.1% in 2024, nearly 3 million TEU	Significant new supply was partly absorbed by longer voyages
Container-demand growth	7.1% in 2024	Demand growth combined with rerouting prevented capacity additions from immediately normalising rates
Global seaborne-trade growth	2.2% in 2024	Physical trade expanded far more slowly than route-distance demand
Cape arrivals	+89% by mid-2024	Strong direct evidence of geographic substitution
Suez tonnage	−70% by mid-2024	Corresponding contraction through original corridor

Sources: UNCTAD Review of Maritime Transport 2025, UNCTAD Chapter III on freight rates, UNCTAD Review of Maritime Transport 2024, and European Central Bank, March 2024 projections.

The fleet-capacity implication is especially important because shipping supply cannot instantaneously expand when voyage length increases; vessels that previously completed a round trip in a shorter cycle become unavailable for additional voyages while they are still sailing around Africa, which raises the number of vessels required to preserve a given weekly service frequency. UNCTAD reported that global container capacity nevertheless expanded by 10.1% in 2024, equivalent to nearly 3 million TEU and the highest annual growth since 2008, yet the additional capacity did not immediately drive spot rates back to pre-crisis levels because longer routes and cargo growth absorbed much of that supply. Review of Maritime Transport 2025, Chapter III — UNCTAD

The strategic yield is amplified by uncertainty rather than continuous attack tempo

An important analytical error would be to assume that strategic pressure falls to zero whenever launches temporarily stop, because maritime commerce responds to expected future risk and the costs of reversing route decisions rather than solely to attacks occurring on the day a vessel enters the corridor. MARAD notes that there was a period without commercial attacks after the October 2025 Israel–Gaza ceasefire, yet its 2026 advisory still assessed that the Houthis retained the capability to threaten commercial vessels and maintained special warnings for vessels with designated associations; EUNAVFOR ASPIDES similarly remained operational and continued conducting close protection missions throughout 2026, including documented escorts by Italian and Greek frigates and multiple protection events in August and September. MSCI Advisory 2026-006 — U.S. Maritime Administration, EUNAVFOR ASPIDES Mandate — EEAS and the 7 September 2026 ASPIDES close-protection record demonstrate the persistence of the defensive posture.

By 24 August 2026, ASPIDES reported that since its February 2024 launch it had supported more than 2,390 merchant vessels and provided close protection to more than 720 ships, figures that substantially expand the earlier July totals and provide a more current measure of the operational burden generated by the threat environment. These numbers should not be interpreted as evidence that every protected ship would otherwise have been attacked, but they quantify the scale of military effort required to preserve confidence and transit through the corridor. EUNAVFOR ASPIDES Mandate — 24 August 2026 — EEAS

Defensive burden generated by the threat

Indicator	Current verified value	Date / period	What it measures
Merchant vessels supported by ASPIDES	2,390+	Launch Feb 2024 to 24 Aug 2026	Broad operational assistance to commercial traffic
Ships receiving close protection	720+	Launch Feb 2024 to 24 Aug 2026	Higher-intensity escort/protection activity
ASPIDES mandate	Through 28 Feb 2027	Council decision 23 Feb 2026	Persistence of EU operational commitment
Common-cost financial reference	Nearly €15 million	1 Mar 2026–28 Feb 2027	EU common-cost envelope, not total national cost
Italian frigate BERGAMINI protection event	Confirmed	23 Jul 2026	National asset employed within EU protective mission
Italian frigate LUIGI RIZZO protection event	Confirmed	3 Apr 2026	Additional Italian close-protection activity
Repeated EU close-protection events	Confirmed	Aug–Sep 2026	Threat management remained operationally active

Sources: EUNAVFOR ASPIDES Mandate — EEAS, 24 August 2026, Council extension of ASPIDES — 23 February 2026, BERGAMINI Close Protection and LUIGI RIZZO Close Protection.

Lethality matters because commercial shipping cannot absorb casualties as an ordinary cost of transit

The coercive mechanism cannot be reduced to freight economics because casualties alter both legal and corporate risk tolerances, particularly when civilian seafarers are exposed to weapons originally associated with state-level warfare. MARAD records that the July 2025 attacks on Magic Seas and Eternity C resulted in both vessels being sunk and four seafarers killed, while a September 2025 missile strike on a Dutch-flagged cargo vessel in the Gulf of Aden killed another mariner. MSCI Advisory 2026-006 — U.S. Maritime Administration

The lethal dimension remained active in 2026, when the IMO reported in August that the cargo ship TIHAMAH had been struck by a projectile off Al Mokha and that several seafarer fatalities had been confirmed; the IMO consequently urged shipowners and operators to conduct thorough risk assessments before transit. Statement on deadly ship attack in the Red Sea — International Maritime Organization — 12 August 2026

This human dimension strengthens the coercive effect because route selection is not exclusively an optimisation problem between additional fuel cost and insurance premium; shipowners and flag states must also consider obligations towards civilian crews, while crew availability itself can become a constraint if mariners or labour organisations judge particular routes unacceptably dangerous. The IMO’s repeated public interventions in July and August 2026 explicitly linked attacks not only to trade disruption but to the protection of civilian seafarers, demonstrating that the operational threshold for continued transit is partly human and legal rather than purely financial. Statement on recent attacks on ships in the Red Sea — IMO — 23 July 2026

Disruption creates secondary hazards even after the attacking weapon has completed its effect

A successful or attempted strike can produce navigational and environmental consequences independent of the initial weapon effect because a damaged vessel can lose propulsion, manoeuvrability or steering, create debris, require salvage assistance or generate pollution risk in already constrained waters. MARAD specifically warns commercial vessels to remain vigilant for hazards to navigation caused by vessels struck by the Houthis, while the IMO has repeatedly raised concern over the marine-environment consequences of attacks in the region. MSCI Advisory 2026-006 — U.S. Maritime Administration and Statement on recent attacks on ships in the Red Sea — IMO provide the relevant official warnings.

This means a single kinetic event can impose additional burdens on nearby shipping even when those ships were never intended targets, particularly when operators must alter course, wait for navigational warnings, avoid a damaged vessel or accommodate military operations surrounding the incident. The threat therefore has a collateral-access effect in addition to direct targeting, and this distinction is important for European planning because convoy or close-protection concepts address an individual vessel’s vulnerability but do not automatically remove navigation hazards created by damage elsewhere in the corridor.

The Suez shock shows why physical protection and economic resilience must be evaluated separately

Naval protection can improve the probability that a protected ship reaches its destination safely, but it cannot by itself restore the commercial equilibrium that existed before the threat because the economic system also depends on insurers, schedules, fleet networks, cargo owners and port sequencing returning to normal assumptions. The official traffic data demonstrate that route recovery can lag security developments substantially; even when some carriers resume transits, a network cannot instantaneously reverse months of revised schedules, contracted capacity, fleet positioning and Cape-routing practice. The Suez Canal Authority’s own 2025 data illustrate this gradual recovery dynamic, reporting that from the beginning of July through early December 2025 the Canal handled 5,874 vessels, 247.2 million net tonnes and $1.970 billion in revenue, compared with 5,584 vessels, 216 million tonnes and $1.677 billion in the corresponding previous-year period, which represented improvement but not an automatic return to the 2023 annual peak. Suez Canal Authority — Meeting with IMF Mission — 8 December 2025

The policy implication is that maritime access has both a tactical threshold and a commercial-confidence threshold: the first concerns whether passage can physically be defended, while the second concerns whether enough market participants believe that the corridor has become sufficiently predictable to restore network economics. This difference explains why limited attacks can impose costs long after an individual engagement has ended and why European governments cannot evaluate operational success solely by counting intercepted drones, missiles or escorted ships.

The European defensive response is evolving from vessel protection toward corridor protection

A significant institutional development occurred on 30 March 2026, when the Council of the European Union amended the mandates of ASPIDES and ATALANTA and authorised them, within available means and capabilities, to collect and share information on suspicious activities related to critical submarine infrastructure, while ASPIDES was also tasked with strengthening links to CRIMARIO and cooperating with regional maritime forces. This change is analytically important because it indicates that the EU itself has begun expanding the mission logic beyond immediate ship defence toward situational awareness of the wider maritime infrastructure environment. Maritime security: Council updates mandates of EU naval operations ASPIDES and ATALANTA — Council of the European Union — 30 March 2026

This does not transform ASPIDES into an offensive operation or establish that it protects every piece of submarine infrastructure directly, because the Council expressly conditioned the new information task on available means and capabilities, while the mission remains defensive. The significance instead lies in doctrinal expansion: the same naval presence originally created to protect commercial navigation is increasingly being asked to contribute information about infrastructure whose disruption can affect communications and economic continuity, showing that European policy is moving toward a corridor-level definition of maritime security.

Coercive leverage can therefore be measured through five distinct outputs

The military effectiveness of the Bab el-Mandeb campaign should not be measured solely by ships sunk, because that approach would miss most of the observable strategic effect. A more defensible framework separates physical attrition, traffic displacement, fleet-capacity absorption, defensive-resource consumption, and commercial-confidence degradation, with each category measured through its own evidence rather than collapsed into a single synthetic risk score.

Strategic-yield framework

Effect	Observable indicator	Verified evidence already available	Why it matters
Physical attrition	Ships damaged, sunk; casualties	Magic Seas, Eternity C, TIHAMAH and other officially recorded incidents	Demonstrates credibility of the threat
Traffic displacement	Suez / Gulf of Aden traffic reduction	Suez vessel count −50% in 2024; Suez tonnage −66.5%; Gulf of Aden capacity −76% by mid-2024	Shows effect far beyond ships actually struck
Alternative-route expansion	Cape of Good Hope traffic	Arrivals +89% by mid-2024	Identifies where displaced traffic went
Fleet-capacity absorption	Ton-mile growth and voyage extension	Asia–Europe journeys ~30% longer; global ton-miles nearly +6% in 2024	Converts geography into higher transport-resource demand
Defensive burden	Escort / support activity	2,390+ vessels supported; 720+ close-protected by ASPIDES to Aug 2026	Quantifies military effort required to sustain transit
Fiscal transmission	Suez Canal revenue	$10.250bn in 2023 to $3.991bn in 2024	Shows direct state-level economic impact
Commercial uncertainty	Freight-rate volatility and capacity demand	Elevated 2024 container spot rates; container ton-mile increase	Demonstrates broader market propagation

Sources: Suez Canal Authority, UNCTAD Review of Maritime Transport 2024, UNCTAD Review of Maritime Transport 2025, European Central Bank, EUNAVFOR ASPIDES and U.S. Maritime Administration.

What the physical-threat record does and does not establish

The evidence establishes that Houthi attacks have produced lethal outcomes, forced sustained international naval protection, contributed to a major rerouting of maritime traffic, materially reduced Suez Canal activity and imposed measurable additional transport demand through longer voyages, while the persistence of ASPIDES and UN reporting mechanisms indicates that governments continue to treat the threat as strategically relevant in 2026. It also establishes that the attack architecture is heterogeneous, encompassing missiles, UAVs, surface and underwater unmanned systems, small craft and seizure risks, which increases the complexity of defending commercial traffic. U.S. Maritime Administration, International Maritime Organization and Council of the European Union jointly support that baseline.

The official record does not justify concluding that Ansar Allah has physically closed Bab el-Mandeb, that every commercial diversion results directly from a specific Houthi launch, that every ship transiting without escort faces identical risk, or that the movement must achieve high rates of successful strikes to retain strategic leverage. The available evidence instead supports the more precise conclusion that credible capacity to impose selective lethal risk at a geographically concentrated passage can alter behaviour across a commercial system much larger than the attack force itself, and that this effect becomes strategically important when operators have only one economically significant alternative route, the Cape of Good Hope, whose additional distance consumes time, fuel and global fleet capacity.

Key judgments

The geographic advantage is multiplicative rather than additive, because Bab el-Mandeb allows relatively limited numbers of weapons and launch platforms to influence a shipping system whose economic value is determined by the continuity of thousands of voyages rather than by the fate of one vessel, while the 2024 collapse in Suez traffic demonstrates that operator behaviour can magnify military pressure far beyond the number of attacks physically conducted.

The strongest measure of coercive performance is commercial displacement rather than physical destruction, because a reduction of approximately 50% in Suez vessel transits and 66.5% in net tonnage during 2024 occurred without destruction of anything approaching a comparable share of global shipping capacity, demonstrating that perceived exposure itself became an economically consequential weapon.

The threat architecture raises the defender’s resource burden through heterogeneity, because missiles, UAVs, surface craft, underwater systems, boarding and explosive-boat scenarios demand overlapping but non-identical surveillance and engagement capabilities, while the merchant fleet cannot organically reproduce the protection architecture of a naval task group.

European close protection has become a persistent rather than episodic requirement, with more than 2,390 merchant vessels supported and more than 720 receiving close protection under ASPIDES by 24 August 2026, which shows the scale of defensive effort needed to keep traffic moving even when the majority of protected ships are never directly attacked. EUNAVFOR ASPIDES Mandate — EEAS

The coercive mechanism remains effective during pauses because commercial risk has memory, meaning insurers, operators and fleet planners cannot immediately reverse Cape-routing strategies every time attack tempo temporarily declines, while the continued existence of naval escort, risk advisories and UN reporting mechanisms confirms that residual capability and uncertainty remain operationally relevant.

The strategic contest is ultimately over the reliability of access rather than formal possession of the strait, because the actor that can repeatedly make passage uncertain can impose costs on international trade without controlling Bab el-Mandeb, whereas the defensive coalition succeeds only when it can reduce risk sufficiently for commercial actors to regard routine transit as more attractive than diversion.

What would change the assessment

The assessment of asymmetric coercive leverage would weaken materially if sustained official traffic data showed Suez and Gulf of Aden flows returning close to pre-crisis levels while Houthi military capabilities remained present, because that would indicate that operators had learned to discount the threat or that defensive measures had lowered expected losses below the threshold that drives diversion. Conversely, the assessment would strengthen if renewed attacks produced another measurable fall in transits, if war-risk or commercial restrictions broadened across additional vessel categories, if ASPIDES close-protection demand increased sharply, or if attack patterns demonstrated reliable engagement of vessels at greater distances from the Yemeni coast.

A second major change would occur if authoritative evidence showed substantial depletion of missile, UAV or maritime-unmanned inventories accompanied by declining ability to replenish them, because the present assessment assumes continuing capability rather than unlimited stocks; the UN Panel of Experts reported in its 2025 final report that strikes had affected storage facilities, production personnel and infrastructure but that knowledge and domestic manufacturing capability remained in place and that military experts consulted by the Panel considered the impact on overall Houthi military capability limited. Final report of the Panel of Experts on Yemen — United Nations — S/2025/650

Open official record

The most consequential unresolved records for this physical-coercion chapter are the current size and serviceability of Houthi missile and unmanned-system inventories, verified production rates for locally assembled weapons, replenishment rates for imported components, engagement-specific interceptor expenditure by defending naval forces, commercial war-risk premium series with sufficient public granularity to isolate Bab el-Mandeb exposure, and comprehensive 2026 Suez transit data comparable with the Suez Canal Authority’s audited 2023–2024 annual series. Without those records, the public evidence can establish the direction and scale of strategic disruption, but it cannot support a defensible numerical estimate of remaining Houthi strike endurance, the cost-exchange ratio between attacking weapons and naval interceptors, or the exact probability that a particular class of merchant vessel will be successfully attacked during one transit.

Navigation, Data and Infrastructure as a Single Exposure Surface

Principal judgment

The second layer of vulnerability around Bab el-Mandeb does not depend on proving the existence of a unified “Houthi cyber campaign,” because the relevant risk arises from the operational interdependence of navigation, identification, communications, vessel-management systems, port information technology, operational technology and submarine telecommunications infrastructure, all of which can degrade the safety or continuity of maritime trade even when the initiating cause differs across incidents. The public record supports a precise distinction: GNSS interference in the Red Sea is documented; public attribution of those incidents to Ansar Allah is not established in the U.S. Coast Guard reporting reviewed here; AIS carries both navigational value and manipulation risk; maritime bridge and machinery systems are increasingly software-dependent; ports sit inside the European Union’s high-criticality cybersecurity perimeter; and submarine cables carry more than 99% of international data traffic while remaining vulnerable to physical faults, repair delays and geographic concentration. The strategic issue is therefore not whether every digital failure has the same perpetrator, but whether disruption of one digital dependency can degrade the operation of ships, ports, cargo flows or communications during a period in which the physical maritime environment is already contested. GPS User Issue Detection & Evaluation (GUIDE) Tool — U.S. Coast Guard Navigation Center, Maritime cyber risk — International Maritime Organization, International Advisory Body approves landmark report to strengthen submarine cable resilience — International Telecommunication Union — Jul 2026 and Directive (EU) 2022/2555 — EUR-Lex establish the official baseline for those separate but connected dependencies.

GNSS interference is no longer an exceptional technical anomaly in the Red Sea record

The U.S. Coast Guard Navigation Center’s 2026 GUIDE database contains a sequence of Red Sea reports that is sufficiently dense to treat degraded satellite navigation as an operational condition requiring systematic mitigation rather than an isolated technical malfunction. Among the entries visible in the official database are reports of intermittent GPS spoofing on 12 March 2026, spoofing lasting approximately thirty minutes on 15 March, intermittent position jumps lasting about five hours on 23 March, loss of GPS on 24 and 30 March, continuous tracking alarms around Yanbu on 1 April, loss of GPS on 18 April and 4 May, disruption in the southern Red Sea on 13 May, jamming and spoofing around Yanbu on 21 May, loss of GPS aboard the VLCC DILAM on 22 May, intermittent disruption affecting two independent GPS units on 29 May, reported jamming on 14 June, and a 18 June 2026 report in which the indicated position was described as being very far from the vessel’s actual position. GPS User Issue Detection & Evaluation (GUIDE) Tool — U.S. Coast Guard Navigation Center documents these reports individually and classifies many of them as Unknown Interference rather than assigning them to a named actor.

The diagnostic value of the Coast Guard record lies not only in the reported symptoms but in the elimination of some alternative explanations. For several Red Sea entries, NAVCEN states that the GPS Operations Center reviewed the GPS constellation and control segment and found no known anomalies affecting signal integrity, while space weather was considered unlikely to explain the disruption, no authorised GPS tests were identified in the area, and no additional information established a specific cause. This does not prove hostile interference in every case, because the database records user reports followed by Coast Guard evaluation rather than a complete intelligence attribution process, but it does mean that several events cannot simply be dismissed as publicly documented satellite-system failure. The operational consequence is that mariners and authorities must plan for positioning data that can be unavailable or plausible but false even when the underlying GPS constellation remains healthy. GPS User Issue Detection & Evaluation (GUIDE) Tool — U.S. Coast Guard Navigation Center provides the incident-level evaluations.

Audited Red Sea GNSS incident sample

Date of user report	Location	Reported phenomenon	Operational symptom	NAVCEN finding	Public attribution
12 Mar 2026	Red Sea	GPS spoofing / jamming	Intermittent false GNSS position during transit	No known constellation anomaly; space weather unlikely; no authorised test identified	Unknown interference
15 Mar 2026	Red Sea	GPS spoofing	Approx. 30-minute spoofing episode	No known GPS system anomaly identified	Unknown interference
23 Mar 2026	Red Sea	Position spoofing	Position repeatedly jumped from correct position to clearly incorrect coordinates for about five hours	GPS constellation/control segment checked; no known anomaly	Unknown interference
24 Mar 2026	Red Sea	Loss of GPS	Loss of positioning service	No constellation anomaly, test or space-weather explanation identified	Unknown interference
30 Mar 2026	Red Sea	Loss of GPS	Navigation data unavailable	Same diagnostic pattern	Unknown interference
1 Apr 2026	Yanbu, Saudi Arabia	Tracking degradation	Continuous “very few satellites for tracking” alarms	No known system-level cause established	Unknown interference
13 May 2026	Southern Red Sea	GPS disruption	Signal disruption approaching southern Red Sea	No known constellation anomaly or authorised testing identified	Unknown interference
21 May 2026	Yanbu area	Jamming and spoofing	GPS lost or vessel position falsely displayed inside Sudan	No known GPS control/constellation anomaly	Unknown interference
22 May 2026	Red Sea	Loss of GPS	VLCC DILAM reported loss of GPS	No known GPS system anomaly identified	Unknown interference
29 May 2026	Red Sea	Intermittent GPS disruption	Alternating disruption between two onboard GPS systems	No definitive cause recorded	Unknown interference
14 Jun 2026	Red Sea	GPS jamming	Reported jamming signal	No known constellation anomaly, testing or space-weather cause	Unknown interference
18 Jun 2026	Red Sea	GPS position spoofing	Indicated position very far from actual position	No known GPS system anomaly or authorised testing identified	Unknown interference

Source: GPS User Issue Detection & Evaluation (GUIDE) Tool — U.S. Coast Guard Navigation Center. The table reproduces the operational meaning of selected official entries without assigning a perpetrator not identified by NAVCEN.

The evidence therefore supports a stronger operational conclusion than a simple statement that “GPS problems occur,” because several reports describe effects directly capable of altering bridge decision-making: complete position loss, intermittent restoration, incorrect geographical displacement, and disagreement between expected and displayed position. At least one related regional report from the Gulf of Oman described a vessel reverting to dead reckoning and manual fixes to shore references while GPS spoofing was observed, which demonstrates the practical fallback required when electronic PNT becomes unreliable, although that specific case should not be geographically misrepresented as a Bab el-Mandeb incident. GPS User Issue Detection & Evaluation (GUIDE) Tool — U.S. Coast Guard Navigation Center records the Gulf of Oman case as well as the Red Sea entries.

The distinction between jamming and spoofing changes the risk model

Jamming and spoofing produce different operational hazards and therefore require different responses. Jamming denies or degrades reception, which is often observable because the receiver loses satellites, position or timing information; spoofing is potentially more dangerous from a decision-support perspective because the receiver may continue producing a coherent but false position, velocity or timing solution. The Coast Guard reports from March, May and June 2026 include precisely this second category, with vessels reporting positions that jumped to clearly incorrect coordinates or were displayed inside another country, meaning the immediate safety problem is not merely absence of data but the possibility of trusted-looking false data entering the bridge system. GPS User Issue Detection & Evaluation (GUIDE) Tool — U.S. Coast Guard Navigation Center provides the official reports of both lost and falsified positioning.

That distinction matters because contemporary bridge systems increasingly fuse navigation information from GNSS, ECDIS, AIS, radar, speed logs, gyrocompass and other sensors, meaning a false position can propagate into route monitoring, collision-avoidance interpretation, vessel reporting or shore-side monitoring if integrity checks are weak or operators over-trust the primary PNT source. IMO’s navigation documentation includes specific guidance for shipborne Position, Navigation and Timing data processing, while its broader cyber guidance recognises that digital and interconnected bridge systems create vulnerabilities that can affect ECDIS, GNSS, AIS, voyage data recorders and radar/ARPA. IMO documents related to shipborne radiocommunication and navigation equipment and systems lists MSC.1/Circ.1575 on shipborne PNT data processing, while the industry cyber-security guidance hosted by IMO identifies bridge systems as a typical vulnerable system category.

Navigation degradation pathways

Failure mode	What the bridge receives	Immediate danger	Verification requirement	Preferred resilience concept
GNSS jamming	No or degraded satellite solution	Loss of primary electronic position	Cross-check radar, terrestrial references, inertial/dead-reckoning sources	Maintain alternative PNT sources and trained manual procedures
GNSS spoofing	Plausible but false position/time	Incorrect route, collision or grounding decisions	Independent position validation against radar, visual fixes, other sensors	Multi-source integrity monitoring rather than automatic trust
AIS position falsification	Incorrect target position or identity	False situational picture of surrounding traffic	Radar/ARPA and visual correlation	Sensor fusion with anomaly detection
AIS loss	Target identity / movement information unavailable	Reduced cooperative awareness	Radar tracking and bridge watch	Ability to operate safely without cooperative data
ECDIS corruption or outage	Electronic chart/navigation display degraded	Route-monitoring disruption	Backup navigation arrangements	Segregated systems, validated updates, alternative navigation
Timing corruption	Incorrect common time reference	Sensor/data synchronisation problems	Cross-check independent timing	Holdover timing / independent sources
Communications outage	Loss of shore, fleet or emergency connectivity	Reduced warning and coordination	Alternative radio/satellite channels	Communications diversity
Integrated bridge failure	Multiple navigation functions impaired simultaneously	Compounded loss of situational awareness	Independent backup equipment	Functional segregation and degraded-mode procedures

The analytical implication is that “GNSS resilience” cannot mean simply installing another GPS receiver, because two receivers can share the same vulnerable satellite signal environment. The May 2026 Coast Guard report explicitly describes disruption alternating between two independent GPS units, illustrating why receiver redundancy is not equivalent to signal-source diversity. The stronger resilience model requires dissimilar sources, independent validation and procedures that allow the bridge team to recognise when electronic data are internally consistent but externally wrong. GPS User Issue Detection & Evaluation (GUIDE) Tool — U.S. Coast Guard Navigation Center provides the official two-receiver Red Sea report.

AIS creates a dual vulnerability: visibility and trust

AIS is essential to modern navigational awareness because it distributes vessel identity, position, course, speed and voyage-related information to nearby ships and shore systems, but the same architecture creates two separate security problems: exposure, because transmitted information can help a hostile actor identify or follow shipping, and integrity, because false AIS identities or positions can corrupt the maritime picture. The European Maritime Safety Agency’s establishment of a dedicated working activity around AIS spoofing and GPS/GNSS jamming reflects institutional recognition that these are not merely theoretical technical weaknesses but operational maritime-security concerns requiring detection and resilience capabilities. Working Group on “Automatic Identification System (AIS) spoofing” — European Maritime Safety Agency documents that specialist activity.

A further technical limitation is that conventional AIS messages do not inherently provide strong authentication of identity and position. An International Association of Marine Aids to Navigation and Lighthouse Authorities workshop report published after the 2025 IMT workshop states that AIS messages can be transmitted with false identities or positions and that there is no built-in authentication mechanism in the current architecture, while it links future resilient maritime PNT to hybrid multi-technology solutions combining communications, navigation and sensing. Report on the IMT Workshop for Marine AtoN — IALA — Sep 2025 describes this vulnerability and the rationale for more resilient PNT architectures.

The operational significance is that AIS cannot be treated as an unquestioned ground truth during a period of electronic interference, especially when the same geographic theatre contains both kinetic targeting and navigational anomalies. A ship receiving an AIS contact whose identity or position is inconsistent with radar should not assume that the cooperative digital picture overrides independent sensors, while shore-side maritime-domain-awareness systems also require anomaly detection capable of recognising improbable movement, duplicated identities, impossible speeds or discontinuous tracks. This does not establish hostile AIS manipulation in the Red Sea by Ansar Allah, but it defines a technically documented attack or error surface that can amplify risk if the physical environment is already contested.

AIS dependency and integrity matrix

AIS function	Operational value	Vulnerability	Failure effect	Required cross-check
Vessel identity	Rapid identification of surrounding traffic	False MMSI / identity transmission	Misclassification of vessel	Registry, radar, visual and intelligence correlation
Position	Cooperative traffic picture	Spoofed or erroneous coordinates	False traffic geometry	Radar/ARPA and independent positioning
Course / speed	Predictive collision avoidance	Manipulated or stale movement data	Incorrect CPA/TCPA assumptions	Radar-derived motion
Destination / voyage data	Port and traffic planning	Incorrect manual or manipulated inputs	Erroneous traffic expectations	Port-call data and operator confirmation
Shore monitoring	Wide-area maritime awareness	Spoofing, duplicated tracks, signal gaps	Distorted common operating picture	Multi-sensor fusion and anomaly detection
Tactical visibility	Safety and identification	Information can reveal commercial movement	Potential targeting exposure	Risk-based transmission procedures consistent with applicable maritime rules

Digital bridge integration converts single-system failure into system-level risk

The maritime cyber problem becomes more serious as formerly separate shipboard systems are integrated. IMO’s current maritime cyber-risk framework defines cyber risk in terms of shipping-related operational, safety or security failures arising when technology or information is corrupted, lost or compromised, while the revised 2024 guidelines structure cyber-risk management around identify, protect, detect, respond and recover functions. Maritime cyber risk — International Maritime Organization and Maritime Safety Committee, 108th session — International Maritime Organization — May 2024 establish that framework.

The operational concern is not simply that “ships use computers,” but that modern navigation, propulsion, machinery, power, cargo handling, access control and communications systems increasingly depend on digital interfaces whose failure can produce physical consequences. The maritime cybersecurity guidance hosted by IMO identifies bridge systems, cargo handling and management systems, propulsion and machinery management, power-control systems, access-control systems, administrative systems and communications systems as vulnerable categories and notes that a cyber incident affecting navigation can extend to ECDIS, GNSS, AIS, VDR and radar/ARPA. Guidelines on Cyber Security Onboard Ships — hosted by IMO provides the detailed system categories.

The same guidance provides an operationally relevant example in which an integrated navigation bridge experienced failure of almost all navigation systems in a high-traffic area with reduced visibility, leaving the vessel to navigate using one radar and backup paper charts for two days until repairs could be completed. The documented cause in that case was outdated operating systems rather than hostile action, which is analytically important because it demonstrates that cyber-maritime resilience must cover software failure, configuration error, obsolete systems and supply-chain maintenance risks as well as malicious intrusion. Guidelines on Cyber Security Onboard Ships — hosted by IMO records the incident as a bridge-system vulnerability example.

Shipboard digital dependency matrix

System domain	Primary operational function	Failure consequence	Cyber / digital dependency	Degraded-mode requirement
ECDIS	Route planning and monitoring	Loss of electronic chart/navigation support	Software, chart updates, positioning inputs	Backup navigation capability and validated charts
GNSS/PNT	Position and timing	False or unavailable navigation solution	External signal dependency	Independent PNT and manual fixing
AIS	Cooperative identification and tracking	Reduced or corrupted traffic picture	Digital radio messages and GNSS inputs	Radar/visual correlation
Radar / ARPA	Independent target detection	Reduced collision avoidance	Digital processing and sensor integration	Redundant radar / manual plotting capability
Voyage Data Recorder	Recording and incident reconstruction	Reduced forensic visibility	Integrated sensor feeds and storage	Protected recording architecture
Propulsion control	Vessel movement	Loss or degradation of propulsion	OT control networks	Local/manual control where designed
Steering	Manoeuvrability	Loss of course control	Electronic/OT control systems	Emergency steering procedures
Power management	Electrical continuity	Cascading loss of shipboard systems	Automated control and switching	Emergency generation and manual recovery
Cargo management	Cargo integrity and loading	Commercial, safety or stability effects	Digital cargo-management applications	Manual contingency procedures
Communications	Safety, operational coordination, company contact	Isolation or delayed warning	Satellite/radio/IP systems	Multiple independent communication paths

Ports extend the exposure surface from vessel systems into industrial control

The cyber-maritime risk does not stop when a vessel reaches the harbour because ports combine information technology with operational technology controlling gates, cranes, terminal operations, cargo handling, access systems, energy supply, vessel traffic services and commercial documentation. The port cybersecurity guidance hosted by IMO states that many maritime IT, OT and Industrial Internet of Things platforms incorporate legacy technologies that were not originally designed for robust cybersecurity, while increasing operational efficiency has linked formerly standalone systems, networked OT equipment, Wi-Fi networks and administrative systems to broader digital environments. IAPH Cybersecurity Guidelines for Ports and Port Facilities — hosted by IMO describes this integration risk directly.

The distinction between IT and OT is critical because compromise of administrative IT can affect business processes, while compromise of OT can affect the physical movement of cranes, cargo, power or access systems; however, modern ports often connect the two through scheduling, inventory, terminal-management and maintenance systems, creating pathways for disruption to move from data to operations. A port can therefore remain physically undamaged while becoming unable to process ships at expected speed, release containers, coordinate truck flows or maintain safe terminal operations, which means cyber availability has become part of effective maritime capacity.

European law recognises this dependence explicitly. Directive (EU) 2022/2555, the NIS2 Directive, places the water-transport subsector within its Annex I sectors of high criticality and includes sea and coastal passenger and freight transport companies, port managing bodies and their port facilities, entities operating works and equipment within ports, and vessel traffic service operators. Directive (EU) 2022/2555 — EUR-Lex establishes this scope.

NIS2 maritime coverage relevant to cyber-maritime resilience

NIS2 Annex I water-transport entity	Operational role	Why relevant to Red Sea/Suez disruption
Sea and coastal passenger transport companies	Vessel operation and passenger movement	Cyber resilience affects continuity of fleet operations
Sea and coastal freight transport companies	Cargo transport	Disruption can compound longer routing and schedule instability
Port managing bodies	Port governance and infrastructure	Cyber outage can reduce terminal and harbour throughput
Port facilities	Cargo/passenger handling interface	Operational continuity determines whether diverted or delayed traffic can be absorbed
Entities operating works/equipment within ports	Cranes, infrastructure and terminal machinery	OT compromise can affect physical cargo movement
Vessel Traffic Service operators	Maritime traffic coordination	Loss or manipulation of information can degrade safe port approaches and traffic management

The significance is that cyber resilience is no longer merely a recommended technical best practice for European ports but part of the regulated resilience environment for critical transport entities, while the related Critical Entities Resilience Directive, Directive (EU) 2022/2557, also includes water transport, ports and VTS within its sectoral scope, creating a complementary physical-resilience framework alongside NIS2. Directive (EU) 2022/2557 — EUR-Lex confirms the corresponding critical-entity categories.

The operational risk is concentrated at interfaces rather than inside isolated systems

The highest-consequence failure points frequently occur where systems exchange data, because digital navigation and logistics depend on trusted interfaces between ship sensors, bridge displays, satellite services, shipping companies, port community systems, terminal operators and customs or cargo-management platforms. A false GNSS position can affect ECDIS; an incorrect AIS position can distort shore surveillance; loss of connectivity can prevent updated voyage information from reaching ship or shore; terminal-system disruption can delay unloading; and corrupted scheduling data can propagate through inland transport even though each individual subsystem remains physically intact.

This architecture means that redundancy has to be evaluated functionally rather than numerically. Two navigation displays fed by the same corrupted PNT source do not create genuine redundancy; two port applications hosted on the same infrastructure may fail simultaneously; a backup communications service dependent on the same terrestrial landing route may not survive the same cable outage; and two cyber-monitoring systems drawing from the same compromised telemetry may reproduce the same false picture. The appropriate resilience test is therefore whether the alternative path fails under the same initiating event, not simply whether a nominal backup exists.

Functional dependency and common-mode failure matrix

Primary capability	Nominal backup	Common-mode failure risk	Stronger resilience design
GNSS receiver A	GNSS receiver B	Both depend on same satellite environment	Add radar, visual, terrestrial, inertial or other independent PNT
Primary ECDIS	Secondary ECDIS	Same software/update or corrupted position source	Independent validated backup and manual navigation procedures
Primary satcom terminal	Second terminal	Same satellite provider or gateway dependency	Provider and path diversity
Port terminal-management system	Mirrored server	Same compromised network/domain	Segmented recovery environment and tested offline operations
Primary cable route	Logical reroute	Same landing station or regional corridor	Geographic route diversity
Port operations centre	Disaster-recovery site	Same power/telecom dependencies	Independent utilities and communications
AIS shore picture	Second AIS receiver	Same false transmitted source	Radar, satellite imagery and multi-sensor correlation
Central OT management	Secondary control workstation	Same OT network compromise	Segmented local manual control and safe-state procedures

Submarine cables make Bab el-Mandeb part of a wider digital-continuity problem

Submarine cables carry more than 99% of international data traffic, according to the ITU, which means maritime security increasingly includes an infrastructure layer whose primary product is not cargo or energy but digital connectivity. The ITU’s 2026 submarine-cable resilience work identifies physical exposure, increasing repair times, geographic concentration and high dependence on a limited number of cable systems as key resilience challenges, while its broader background material notes that more than 500 active and planned submarine telecommunications cable systems were estimated globally as of 2024. International Advisory Body approves landmark report to strengthen submarine cable resilience — ITU — 10 Jul 2026 and Submarine cable resilience — ITU provide the official global baseline.

The same ITU material reports more than 200 cable repairs worldwide in 2023, equivalent to more than three cable failures per week on average, while its February 2026 Porto summit material similarly describes more than 200 faults globally each year. The figure is strategically important because it demonstrates that cable failure is not an exceptional event requiring hostile sabotage; resilience must therefore be designed around recurring accidental and natural faults as well as deliberate interference. Submarine Cable Resilience — ITU and Second International Submarine Cable Resilience Summit — ITU — Feb 2026 provide those quantitative references.

Global cable resilience baseline

Indicator	Verified value	Reference	Analytical significance
Share of international data traffic carried by subsea cables	>99%	ITU 2026	Digital commerce and communications depend overwhelmingly on undersea infrastructure
Active and planned submarine telecom cable systems	500+ estimated	ITU background, 2024 estimate	Global system has many routes but remains geographically concentrated in specific corridors
Cable repairs reported globally	200+ in 2023	ITU / ICPC	Cable faults are normal resilience events, not inherently evidence of hostile action
Average equivalent fault/repair frequency	>3 per week	Calculated from ITU 200+ annual repairs	Restoration capacity is part of normal network security
Major resilience challenges	Physical risk, repair time, geographic concentration, limited-route dependence	ITU 2026	Security must include restoration and routing diversity, not only prevention
EU new cable-security investment announced	€347 million	European Commission, Feb 2026	Indicates material European funding for cable security and resilience

The Red Sea issue is therefore not simply that cables lie beneath a contested maritime corridor, but that crisis conditions can alter the time required to inspect, reach and repair infrastructure even when the initiating cable break is accidental. Specialist cable ships, crews, permits, coastal access, port support and security arrangements are all part of the restoration chain, meaning military instability can transform a routine infrastructure failure into a longer-duration communications disruption by reducing repair accessibility. The ITU’s explicit emphasis on increased repair time as a resilience challenge makes this mechanism institutionally documented rather than speculative. International Advisory Body approves landmark report to strengthen submarine cable resilience — ITU — Jul 2026 identifies repair time as one of the principal resilience challenges.

Europe has moved from cable protection to a full resilience-cycle doctrine

The European Commission and High Representative adopted an EU Action Plan on Cable Security on 21 February 2025, while the 2026 Submarine Cable Security Toolbox organises security around the full resilience cycle of prevention, detection, response and recovery, and deterrence rather than treating cable security as simple physical protection. The Commission states that the framework follows Recommendation 2024/779 on secure and resilient submarine cable infrastructure, that an expert group produced an EU risk assessment together with mapping and stress-test guidance in October 2025, and that the 2026 toolbox proposes mitigation measures against threats, vulnerabilities and dependencies while identifying Cable Projects of European Interest for priority funding. Submarine Cable Security Toolbox and Cable Projects of European Interest — European Commission — 5 Feb 2026 sets out the current architecture.

The framework matters for Bab el-Mandeb because it shifts the strategic question from “Can every cable be protected continuously?” to “Can the network continue delivering essential connectivity after a failure?” This distinction favours investments in route diversity, repair capacity, monitoring, stress testing, information sharing and recovery planning, especially where multiple systems share the same regional chokepoint. The European Commission’s February 2026 implementation package was accompanied by €347 million in investment for submarine-cable security and resilience, indicating that the EU has moved beyond conceptual policy into a funded infrastructure programme. Submarine Cable Security Toolbox and Cable Projects of European Interest — European Commission identifies the related investment package.

EU cable-security resilience cycle

Phase	Operational question	Example capability required	Bab el-Mandeb relevance
Prevention	How can failure likelihood or impact be reduced?	Route diversity, physical protection, secure design, risk assessment	Reduce dependence on one corridor or landing architecture
Detection	How quickly is damage or anomalous activity identified?	Monitoring, sensor data, operator-government information sharing	Shorter uncertainty after a Red Sea cable event
Response	Can authorities and operators coordinate immediately?	Incident command, maritime awareness, repair prioritisation	Crisis conditions can complicate access to affected waters
Recovery	How rapidly can service be restored?	Spare capacity, rerouting, repair vessels, permits, landing access	Repair delay can turn local damage into prolonged disruption
Deterrence	Can deliberate interference be discouraged or attributed?	Surveillance, investigation, legal and diplomatic response	Relevant if evidence eventually establishes malicious interference

The EU maritime-security architecture increasingly links cyber threats and physical infrastructure

The revised EU Maritime Security Strategy approved by the Council in October 2023 explicitly identifies hybrid and cyber-attacks targeting maritime infrastructure among the evolving threats that European maritime-security policy must address. This provides a formal institutional bridge between naval security, infrastructure resilience and cyber defence and prevents digital risk from being treated solely as an internal IT-management problem of individual shipping companies or ports. Maritime security: Council approves revised EU strategy and action plan — Council of the European Union — 24 Oct 2023 states that cyber and hybrid attacks on maritime infrastructure fall within the revised strategy.

The practical implication is that European maritime-domain awareness must include data quality as well as object detection. A system that successfully identifies a vessel but relies on corrupted GNSS or AIS information can still generate an incorrect operational picture; conversely, a cyber-security centre may detect anomalous network behaviour without understanding its navigational relevance unless it exchanges information with maritime authorities. The strongest architecture therefore integrates naval surveillance, port cybersecurity, telecommunications monitoring, GNSS/AIS anomaly reporting and commercial operators into a shared decision environment without erasing the distinct attribution standards appropriate to each domain.

Cyber resilience must be designed around operational consequence rather than IT ownership

One of the most important governance implications is that the traditional separation between “cybersecurity” and “maritime safety” becomes increasingly artificial when the same digital system can influence both business continuity and physical navigation. IMO’s current cyber-risk framework explicitly defines the objective as supporting safe and secure shipping that is operationally resilient to cyber risks, while its revised guidelines include risk identification, protection, detection, response and recovery. Maritime cyber risk — International Maritime Organization and Maritime Safety Committee 108 — IMO provide the official policy basis.

This operational framing is critical because a technically successful cyberattack that has no maritime consequence is less strategically important than a modest digital malfunction that disables navigation, blocks terminal operations or interrupts cargo flow during a period of physical crisis. Conversely, an incident that begins as ordinary equipment failure may produce the same operational consequence as hostile cyber action from the perspective of continuity planning. Resilience therefore has to prioritise essential functions—safe navigation, propulsion, steering, communications, cargo handling, vessel traffic management, port access and restoration—rather than assuming that protecting administrative IT alone protects the maritime system.

Operational-consequence hierarchy

Digital failure	Immediate technical effect	Maritime consequence	Potential economic consequence
False GNSS position	Wrong location/time solution	Navigation or collision-avoidance error	Grounding, delay, casualty, route restrictions
AIS spoofing	False identity/position	Distorted traffic picture	Delay, false alarms, targeting or avoidance errors
ECDIS outage	Loss of primary electronic route display	Reduced navigation capability	Slower transit, diversion, increased crew workload
Satcom outage	Loss of remote connectivity	Reduced coordination / warning	Fleet scheduling and port interface disruption
Port terminal system outage	Cargo data unavailable	Loading/unloading slowdown	Berthing delay and supply-chain congestion
Crane/OT disruption	Physical equipment unavailable	Cargo cannot move at expected rate	Terminal throughput collapse
VTS system disruption	Reduced traffic coordination	Higher approach/harbour risk	Port restrictions and congestion
Cable fault with delayed repair	Reduced regional connectivity	Degraded port/company/government communications	Wider cloud, finance and logistics disruption
Power-management compromise	Ship/port systems lose electricity	Multi-system degradation	Operational shutdown

The resilience problem is cumulative because failures can cascade across organisational boundaries

A merchant vessel experiencing spoofed GNSS can arrive late or require additional navigation support; a port operating with degraded communications may then process that vessel less efficiently; a cable outage can slow data exchange among terminal systems, shipping lines and logistics providers; and a concurrent cyber incident can reduce the availability of alternative coordination channels. None of those failures needs to originate from the same adversary for the combined effect to exceed the sum of the individual incidents. This is the defining feature of the single exposure surface: systems that are institutionally separate can become operationally coupled through time and dependency.

The strongest resilience architecture must therefore identify cascading dependencies before crisis rather than after failure. It requires mapping which ship and port functions depend on GNSS timing, which terminals depend on external cloud infrastructure, which communications routes share cable landings, which vessel traffic systems rely on common telecom providers, and which emergency procedures assume internet availability. The European cable-security framework’s emphasis on mapping and stress testing is directly relevant here because the purpose of stress testing is not merely to identify physical cable weakness but to reveal which services fail together when one dependency is removed. Submarine Cable Security Toolbox and Cable Projects of European Interest — European Commission notes that the EU expert group developed mapping and stress-test guidance during 2025.

Degraded-mode operation is the decisive measure of resilience

The most important operational test is not whether systems can prevent every disruption but whether ships and ports can continue essential functions when preferred digital services are unavailable or untrustworthy. Maritime organisations therefore require predefined degraded modes rather than improvised reactions: manual or radar-supported navigation when GNSS is suspect; independent verification when AIS data conflict with radar; emergency communications when primary satellite connectivity fails; local control of critical machinery when remote interfaces are unavailable; and offline or reduced-function port procedures when terminal-management systems cannot be trusted.

The example in the shipboard cyber guidance where an integrated bridge lost nearly all navigation systems but continued using one radar and paper charts illustrates the difference between system failure and mission failure: the digital system failed, but the ship retained enough alternative capability to navigate to port. Guidelines on Cyber Security Onboard Ships — hosted by IMO provides that documented example.

Degraded-mode resilience matrix

Essential function	Preferred mode	Degraded mode	Failure threshold that should trigger transition
Positioning	Integrated GNSS-fed navigation	Radar, visual/manual fixes, dead reckoning, independent PNT	Position inconsistency, signal loss, impossible coordinate jump
Collision avoidance	AIS + radar + visual watch	Radar/ARPA + visual watch without AIS trust	AIS/radar disagreement or suspect AIS integrity
Route monitoring	ECDIS with validated PNT	Backup chart/navigation system	ECDIS failure or untrusted position input
Ship-shore communications	Primary satcom / IP services	Alternative satellite, MF/HF/VHF as applicable	Primary communications outage or compromise
Port cargo management	Integrated terminal-management systems	Reduced/offline workflow	Cyber incident or database integrity failure
OT control	Central networked control	Local/manual safe operation	Loss of control integrity or cyber isolation
Vessel traffic management	Networked VTS picture	Radar/radio-based reduced operation	Data-integrity or communications failure
Cable connectivity	Primary submarine route	Rerouted capacity over alternative systems	Cable fault or landing-station loss

Quantitative evidence demonstrates why resilience must focus on restoration as well as defence

The cable data are especially instructive because they demonstrate a principle that applies across the digital maritime system: failure cannot always be prevented, but its systemic impact can be reduced through redundancy and recovery. With more than 200 cable repairs reported globally in 2023, the normal operating model already assumes failures occur; the strategic question is therefore how quickly services reroute and how rapidly physical repair follows. Submarine Cable Resilience — ITU provides the annual fault/repair reference.

The same logic applies to GNSS and port systems. No realistic architecture can guarantee that satellite interference never occurs or that malware never reaches a port network, but a resilient architecture can reduce the operational yield of those disruptions by detecting anomalies quickly, isolating affected systems, switching to independent sources, maintaining safe reduced operations and restoring normal service without extensive cascading effects. This is why the IMO and EU frameworks converge conceptually on identify/protect/detect/respond/recover or prevention/detection/response/recovery models even though they govern different infrastructures. Maritime Safety Committee 108 — IMO and Submarine Cable Security Toolbox — European Commission demonstrate this convergence.

Cross-domain resilience architecture

Domain	Prevent	Detect	Respond	Recover
GNSS/PNT	Multi-source PNT, receiver hardening	Integrity monitoring and position cross-check	Revert to independent navigation sources	Restore trusted primary PNT
AIS	Secure procedures and sensor fusion	Detect improbable identity/position behaviour	Downgrade trust and use radar/visual sources	Re-establish validated maritime picture
Ship IT	Segmentation, patching, access controls	Endpoint/network monitoring	Isolate affected systems	Restore validated configuration
Ship OT	Segmentation and local-control capability	OT anomaly monitoring	Shift to safe/local control	Controlled restoration
Port IT	Zero-trust/access controls, backups	SOC/SIEM and integrity monitoring	Isolate compromised services	Recover validated business systems
Port OT	Network zoning, controlled remote access	Industrial monitoring	Safe-state/manual operation	Restore equipment incrementally
Telecom cables	Route diversity, protection, risk mapping	Cable monitoring and incident reporting	Reroute traffic and mobilise repair	Repair physical infrastructure
Maritime-domain awareness	Diverse sensor sources	Cross-source anomaly detection	Reclassify unreliable feeds	Restore common operating picture

What the evidence does and does not establish

The official record establishes that Red Sea GPS/GNSS anomalies are recurrent enough to merit operational attention; that several 2026 reports involved position spoofing rather than only signal loss; that NAVCEN did not identify a GPS constellation anomaly, authorised test or space-weather explanation for multiple incidents; that AIS architecture presents recognised spoofing and authentication weaknesses; that modern shipboard navigation and control functions are software-dependent; that port authorities and water-transport entities are classified by the European Union as high-criticality entities under NIS2; that submarine cables carry more than 99% of international data traffic; and that cable failures occur frequently enough for resilience and repair capability to be standard operating requirements rather than exceptional preparations. U.S. Coast Guard NAVCEN, IMO maritime cyber risk, Directive (EU) 2022/2555 and ITU submarine cable resilience jointly establish those elements.

The public evidence does not establish that Ansar Allah caused the documented GNSS incidents, that it has manipulated AIS in the Red Sea, that any particular submarine-cable fault in the region was caused by Houthi action, or that a single integrated command system is coordinating kinetic, electronic, cyber and infrastructure attacks. Those propositions would require actor-specific technical, forensic or intelligence evidence not contained in the official records reviewed here. The defensible judgment is therefore narrower but strategically significant: the physical threat operates inside a maritime system whose digital dependencies have independently documented vulnerabilities, and the interaction between those vulnerabilities can raise the consequences of otherwise separate incidents.

Key judgments

GNSS integrity has become an operational maritime-security issue rather than a peripheral electronics problem, because the official Coast Guard record shows repeated 2026 Red Sea reports involving signal loss, jamming and false positions while eliminating several benign GPS-system explanations without publicly identifying a perpetrator.

The most dangerous navigation failure is not necessarily loss of signal but acceptance of false data, because spoofing can allow a bridge system to continue operating with apparently coherent but incorrect position information, creating the possibility that error propagates into ECDIS, AIS-related situational awareness and shore reporting before operators recognise the anomaly.

AIS should be treated simultaneously as a safety asset and an untrusted data source in contested environments, because it improves cooperative awareness while remaining susceptible to false identity or position information and lacking built-in authentication in its conventional architecture, which requires continuous comparison with radar and other independent sources.

Ship cyber resilience is inseparable from navigation and machinery resilience, because bridge, propulsion, power, cargo and communications systems increasingly depend on software and network interfaces, while documented industry incidents demonstrate that ordinary software or maintenance failure can degrade multiple navigation functions without any hostile cyber action.

Ports are part of the same security perimeter rather than downstream commercial infrastructure, because NIS2 explicitly treats water-transport companies, port managing bodies, port facilities, port-equipment operators and vessel traffic services as entities within sectors of high criticality, reflecting the operational consequences that cyber disruption can impose on physical trade.

Submarine-cable security is primarily a resilience problem rather than a sabotage-only problem, because more than 200 repairs are required globally in a normal year and the ITU identifies repair time, route concentration and dependence on limited cable systems as central vulnerabilities, meaning conflict can increase strategic damage simply by slowing recovery.

What would change the assessment

The assessment would strengthen materially if competent authorities published technical evidence demonstrating coordinated manipulation of GNSS, AIS or maritime communications in conjunction with kinetic attacks, because that would shift the current model from co-located vulnerabilities toward demonstrated cross-domain operations. It would also strengthen if Red Sea GNSS reports expanded southward and became sustained around Bab el-Mandeb itself, if vessels increasingly documented routine degraded-PNT navigation, if port authorities reported correlated navigation-data anomalies and cyber incidents, or if cable disruptions produced measurable capacity shortages because repair vessels could not safely reach the affected infrastructure.

The assessment would weaken if official data showed that recent GNSS anomalies were primarily attributable to benign equipment faults, if independently verified maritime PNT alternatives demonstrated reliable operation throughout the affected area, if port stress tests showed essential services could sustain prolonged external connectivity loss without significant throughput degradation, or if cable-route diversity proved sufficient to absorb major regional failures with negligible service impact.

Open official record

The most consequential missing official records are precise emitter-location and signal-characterisation data for the Red Sea GNSS events; authenticated incident-level evidence linking AIS anomalies to deliberate manipulation rather than data or equipment error; port-level dependency maps identifying which operational technologies depend on public GNSS timing or common telecom carriers; publicly auditable stress-test results for major European ports under simultaneous navigation, communications and cyber degradation; exact cable-route and spare-capacity utilisation data for Red Sea systems during outages; and verified repair-vessel mobilisation and restoration timelines under heightened maritime-security conditions.

Without those records, the evidence supports a high-confidence assessment that ships, ports, navigation systems and cable infrastructure form an increasingly interconnected exposure surface, while it does not support attributing all failures within that surface to a single actor or assigning a numerical probability to a coordinated cyber-maritime attack.

From Naval Protection to European Cyber-Maritime Resilience

Principal judgment

The European response to Bab el-Mandeb is beginning to move beyond a model centred narrowly on protecting individual merchant vessels, because the institutional architecture now contains the legal, operational, cyber, infrastructure and information-sharing instruments needed to treat the Red Sea route as a continuity system whose essential functions include safe passage, trusted positioning, communications availability, port operability, submarine-cable restoration and recovery from degraded digital conditions; however, those instruments remain distributed across different authorities, missions, regulators and national capabilities rather than operating through a single integrated cyber-maritime command structure. The most important institutional development occurred on 30 March 2026, when the Council of the European Union expanded the mandates of both EUNAVFOR ASPIDES and EUNAVFOR ATALANTA so that, within available means and capabilities, they can collect and share information concerning suspicious activity related to critical submarine infrastructure, while ASPIDES was additionally directed to strengthen links with the EU’s CRIMARIO maritime-capacity programme, cooperate with the Yemeni Coast Guard and support the maritime forces of Djibouti; this change creates an official bridge between traditional naval protection and the protection of the wider infrastructure environment through which maritime trade and communications operate. Maritime security: Council updates mandates of EU naval operations ASPIDES and ATALANTA — Council of the European Union — Mar 2026

This evolution should not be interpreted as the creation of an EU cyber-maritime command or as evidence that ASPIDES has become responsible for defending every cable, port, satellite-navigation service or digital platform connected with Red Sea trade, because the Council expressly limited the new critical-submarine-infrastructure task to the operation’s available means and capabilities, while the fundamental mission remains defensive maritime security and freedom of navigation; rather, the significance is that information concerning underwater infrastructure has formally entered the naval operational picture, allowing a future European resilience architecture to connect naval situational awareness with regulatory cybersecurity, telecommunications resilience, port continuity and civilian infrastructure recovery without changing ASPIDES into an offensive or general-purpose cyber operation. EUNAVFOR ASPIDES Mandate — EEAS — Aug 2026 and the Council mandate update of 30 March 2026 establish that distinction.

Europe already possesses most of the institutional components required for cyber-maritime resilience

The European architecture can be understood as a set of overlapping layers rather than a missing-policy problem, because ASPIDES provides defensive maritime protection and situational awareness, the EU Maritime Security Strategy establishes the strategic requirement to protect ports, undersea cables and other maritime infrastructure from cyber and hybrid threats, NIS2 imposes cybersecurity risk-management obligations on key water-transport and port entities, the Critical Entities Resilience Directive creates a parallel physical-resilience framework, EMSA is developing Member-State cooperation on AIS spoofing and GPS/GNSS jamming, and the EU Cable Security Toolbox addresses submarine infrastructure across prevention, detection, response, recovery and deterrence. The challenge is therefore that the maritime, cyber, infrastructure and commercial layers operate through distinct institutional chains whose information has to converge quickly enough for a vessel master, port authority, naval headquarters or telecommunications operator to act on the same incident without waiting for separate bureaucratic processes to mature. Maritime security: Council approves revised EU strategy and action plan — Council of the EU — Oct 2023, Directive (EU) 2022/2555 — EUR-Lex, Working Group on AIS spoofing — EMSA and Submarine Cable Security Toolbox — European Commission — Feb 2026 provide the relevant institutional basis.

European cyber-maritime institutional architecture

Function	Principal EU instrument or body	Current verified authority / activity	Relevance to Bab el-Mandeb resilience	Remaining integration issue
Merchant-vessel protection	EUNAVFOR ASPIDES	Escort, protection, situational awareness and defensive action	Maintains physical access through the corridor	Naval protection does not independently guarantee digital continuity
Critical submarine infrastructure awareness	ASPIDES + ATALANTA	Since Mar 2026, may collect and share information on suspicious activities related to critical submarine infrastructure	Connects naval presence with infrastructure awareness	Collection must connect efficiently with civilian infrastructure authorities
Maritime strategic policy	Revised EU Maritime Security Strategy	Covers cyber/hybrid threats, ports, undersea cables, offshore infrastructure and maritime exercises	Provides common strategic framework	Implementation remains distributed across Member States and EU bodies
GNSS/AIS anomaly cooperation	EMSA / Member-State experts	Working group on AIS spoofing and GPS/GNSS jamming	Provides specialist mechanism for navigation-integrity reporting	Operational fusion with naval reporting is not publicly demonstrated as automatic
Cyber-risk management	NIS2	Applies to designated water-transport companies, ports, port facilities and port-equipment entities	Governs cybersecurity preparation and reporting	NIS2 is regulatory, not an operational naval command mechanism
Physical resilience	Directive (EU) 2022/2557	Requires critical entities to assess risks and implement resilience measures	Supports continuity of critical transport infrastructure	National implementation and cross-sector dependencies vary
Submarine-cable resilience	EU Cable Action Plan / Toolbox / CEF Digital	Prevention, detection, response, recovery, deterrence and funded infrastructure measures	Supports communications continuity after cable incidents	Red Sea-specific repair access depends on partners outside EU territory
Regional maritime capacity	CRIMARIO	EU maritime-domain-awareness and capacity programme	Improves partner information exchange in critical routes	Depends on interoperability and partner participation
Incident coordination	National CSIRTs / competent authorities under NIS2	Cyber reporting and response mechanisms	Handles cyber incidents affecting transport and ports	Cyber and naval incidents may follow separate reporting chains

The revised EU Maritime Security Strategy already establishes the conceptual framework for such integration because it calls for increasing the resilience and protection of gas pipelines, undersea cables, ports, offshore energy facilities and LNG terminals, improving maritime situational awareness, developing regional surveillance for underwater and offshore infrastructure, strengthening civilian-military cooperation and conducting regular EU-level exercises covering harbour protection and cyber and hybrid threats; consequently, a cyber-maritime model for Bab el-Mandeb would not require rewriting Europe’s strategic doctrine so much as applying existing doctrine to a specific high-risk external corridor. Maritime security: Council approves revised EU strategy and action plan — Council of the European Union — Oct 2023

ASPIDES is becoming the operational maritime sensor around which other resilience functions can connect

ASPIDES currently represents the strongest European operational presence physically located in the risk environment, and its scale illustrates why it is institutionally important beyond individual escorts: by 24 August 2026, the operation reported having supported more than 2,390 merchant vessels and provided close protection to more than 720 ships since its February 2024 launch, while the Council has extended the mission through 28 February 2027 with a financial reference amount of nearly €15 million for common costs between 1 March 2026 and 28 February 2027. These figures describe the EU common operational structure rather than the full national cost of deploying frigates, aircraft, personnel and logistics, which remains borne substantially by participating states. EUNAVFOR ASPIDES Mandate — EEAS — Aug 2026 and Red Sea: Council extends the mandate of Operation ASPIDES — Council of the EU — Feb 2026 provide the current verified figures.

The operation’s value for cyber-maritime resilience lies primarily in proximity, persistence and situational awareness, because an asset operating near Bab el-Mandeb can observe vessel behaviour, suspicious maritime activity, physical infrastructure anomalies and operational conditions that civilian regulators located in Europe cannot observe directly; the March 2026 mandate amendment therefore creates an important institutional path by allowing ASPIDES to collect and share information regarding suspicious activities associated with critical submarine infrastructure, thereby creating a potential connection between military maritime surveillance and infrastructure operators or civilian authorities responsible for cables and other underwater systems. Council mandate update for ASPIDES and ATALANTA — Mar 2026

Evolution of ASPIDES from vessel protection toward corridor awareness

Date	Institutional development	Verified significance
8 Feb 2024	Operation formally established	Created EU defensive maritime-security mission
19 Feb 2024	ASPIDES launched	Operational presence begins
23 Feb 2026	Mandate extended to 28 Feb 2027	Confirms persistence of threat-management requirement
23 Feb 2026	Nearly €15m common-cost reference amount approved	Finances common operation costs for Mar 2026–Feb 2027 period
30 Mar 2026	Mandate amended	Critical-submarine-infrastructure information task added
30 Mar 2026	CRIMARIO links strengthened	Connects operation more closely with regional maritime-capacity architecture
30 Mar 2026	Djibouti training and Yemeni Coast Guard cooperation included	Expands local maritime-security partnerships
27 May 2026	1,960+ merchant vessels supported; 650+ protected	Mid-year operational scale
24 Aug 2026	2,390+ vessels supported; 720+ close-protected	Demonstrates continuing rise in operational burden

The progression from 1,960 supported merchant vessels and more than 650 protected ships on 27 May 2026 to more than 2,390 supported and 720 close-protected by 24 August shows that ASPIDES’ activity expanded materially over less than three months, with at least 430 additional vessels supported and more than 70 additional vessels receiving protection during that interval, calculated directly from the two EEAS reporting vintages. EUNAVFOR ASPIDES Mandate — EEAS — May 2026 and EUNAVFOR ASPIDES Mandate — EEAS — Aug 2026 provide the underlying official figures.

The institutional gap is not detection but fusion

The central integration problem is that the relevant observations are produced by different systems that answer to different authorities: a frigate can detect a suspicious vessel near submarine infrastructure; a merchant bridge can report GNSS anomalies; EMSA experts can analyse AIS spoofing patterns; a port security team can identify network compromise; a telecommunications operator can observe cable-performance degradation; a national CSIRT can receive cyber incident reports; and a naval headquarters can hold tactical intelligence concerning hostile activity, yet none of those actors automatically owns the complete operational picture. The resulting challenge is to construct a shared incident model without violating legal competence, military classification, commercial confidentiality or data-protection requirements.

The EU already possesses a policy basis for this type of fusion because the revised Maritime Security Strategy explicitly emphasises improved information exchange and civilian-military cooperation, while ASPIDES has been ordered to strengthen links with CRIMARIO, and EMSA has established a specialist forum for Member States examining AIS spoofing and GPS/GNSS jamming; what is not publicly established is the existence of a single real-time European workflow under which a GNSS anomaly detected by a merchant ship is automatically correlated with AIS behaviour, naval observations, cable data and cyber indicators before being distributed as an operational warning. Council maritime-security strategy — Oct 2023, Council ASPIDES mandate update — Mar 2026 and EMSA AIS Spoofing Working Group support that distinction.

Cross-domain incident-fusion model

Observation	Primary holder	Immediate question	Required correlation	Possible operational output
GNSS loss or spoofing	Ship master / operator	Is navigation data trustworthy?	Other vessel reports, NAVCEN/EMSA data, radar position	Navigation warning or degraded-PNT procedure
Suspicious AIS behaviour	EMSA / maritime authority / ship	Is identity or position false?	Radar, satellite data, registry, other AIS feeds	Integrity alert
Suspicious activity near a cable	Naval asset / partner coast guard	Is infrastructure being approached or interfered with?	Operator data, cable route information, vessel history	Infrastructure-security alert
Cable performance degradation	Telecom operator	Is there a fault, cut or capacity loss?	Maritime activity, landing-station status, repair data	Rerouting / repair mobilisation
Port cyber incident	Port operator / CSIRT	Are cargo or OT systems compromised?	National cyber authority, shipping schedules, VTS	Port degraded-mode activation
Merchant vessel cyber incident	Company / flag authority	Is safe navigation or propulsion affected?	Maritime authority, CSIRT, ship systems	Assistance, isolation, routing change
Kinetic threat warning	Naval command	Is a vessel or area under attack risk?	Commercial traffic, ship identity, threat intelligence	Escort, warning or route adjustment

The analytical value of fusion is not that every anomaly should be treated as hostile, because doing so would generate false positives and undermine operational credibility; rather, shared data allow authorities to distinguish isolated equipment failure from correlated activity, because simultaneous GNSS anomalies across multiple vessels, suspicious AIS tracks near cable routes and abnormal maritime behaviour would carry a different evidentiary meaning from one ship reporting a receiver malfunction.

NIS2 supplies the regulatory cyber layer that naval missions cannot provide

The legal architecture becomes clearer when ASPIDES is separated from the cybersecurity obligations applying to civilian entities, because Directive (EU) 2022/2555 — NIS2 requires Member States to establish cybersecurity strategies, competent authorities, cyber-crisis-management authorities, single points of contact and CSIRTs, while Annex I includes inland, sea and coastal passenger and freight water-transport companies, managing bodies of ports, port facilities and entities operating works and equipment within ports among sectors of high criticality. Directive (EU) 2022/2555 — EUR-Lex establishes that legal scope.

The strategic significance is that naval forces do not need to become port cybersecurity regulators, because NIS2 already assigns risk-management and reporting responsibilities to civilian authorities and operators; integration therefore requires interfaces between governance regimes, not institutional substitution. A port cyber incident that reduces container-handling capacity belongs within NIS2 incident management and national cyber response, while the resulting reduction in port availability can become maritime-security information if it affects protected shipping, military planning or the ability of European logistics chains to absorb disruption generated by Bab el-Mandeb.

The parallel Critical Entities Resilience Directive, Directive (EU) 2022/2557, adds another layer by requiring critical entities to conduct risk assessments and implement proportionate technical, security and organisational measures to ensure resilience, meaning the European architecture deliberately separates but connects cybersecurity and broader physical resilience rather than treating them as one legal category. Directive (EU) 2022/2557 — EUR-Lex establishes the resilience-measure requirement.

Legal and operational division of responsibility

Problem	Primary regime	Core responsibility	What it does not replace
Missile / drone threat to shipping	ASPIDES / national defence authorities	Physical defensive maritime security	Port or telecom cybersecurity regulation
GNSS/AIS integrity	Maritime safety authorities / EMSA / operators	Detection, assessment and navigation procedures	Intelligence attribution by itself
Port cyber incident	NIS2 / national competent authorities / CSIRT	Cyber-risk management, response and reporting	Naval protection
Port physical resilience	CER Directive / national resilience authorities	Continuity against all-hazard disruptions	Cyber-specific controls alone
Cable security	EU Cable Action Plan / national telecom authorities / operators	Prevention, detection, response, recovery and deterrence	Direct naval command over commercial networks
Suspicious underwater activity	ASPIDES / ATALANTA within mandate and available capability	Observation and information sharing	Cable ownership or repair responsibility
Commercial recovery	Operators, ports, telecom providers, logistics companies	Restore service and throughput	Military threat suppression

The resulting architecture is deliberately distributed because military, regulatory and commercial responsibilities remain legally distinct, but resilience depends on ensuring that those boundaries do not become information barriers during a crisis.

Submarine-cable policy is shifting toward deployable recovery capability

The 2026 Cable Security Toolbox adds an important material dimension because the European Commission did not limit the programme to regulatory guidance; on 5 February 2026, it announced €347 million for strategic submarine-cable projects and specifically opened a €20 million call to improve European repair capacity through adaptable repair modules that can be stationed at ports or shipyards and rapidly deployed to restore damaged cable services. Commission increases submarine cable security with €347 million investment and new toolbox — European Commission — Feb 2026 provides the official financial breakdown.

This is strategically important for the Red Sea because maritime resilience depends not only on identifying damage but on shortening the interval between fault detection and restoration, which requires repair vessels, equipment, permits, route information, spare capacity and access to safe ports; a €20 million repair-capacity programme does not by itself create Red Sea repair sovereignty for Europe, particularly because much of the relevant infrastructure lies outside EU territorial waters, but it shows that repair capability is being treated as a security asset rather than a purely commercial service. The Commission’s broader cable-security framework identifies prevention, detection, response and recovery, and deterrence as distinct stages, while its related connectivity programmes show €595 million supporting 74 backbone-connectivity projects, €35.6 million invested in eight specific submarine data cables in the Atlantic and Nordic regions, and a further €347 million allocated for 2026–2027 digital backbone infrastructure, including smart subsea cables, repair capacity and Cable Projects of European Interest. Joint Communication to strengthen the security and resilience of submarine cables — European Commission provides those cumulative programme figures.

EU cable-security implementation data

Instrument / funding line	Verified amount or status	Operational purpose
CEF Digital backbone connectivity support	€595m	74 backbone-connectivity projects
Investment in eight Atlantic/Nordic submarine data cables	€35.6m	Route and infrastructure strengthening
Additional 2026–2027 cable/backbone programme	€347m	Strategic digital backbone and Cable Projects of European Interest
2026 cable-repair-capacity call	€20m	Adaptable repair modules for ports or shipyards
EU cable resilience cycle	Prevention → Detection → Response/Recovery → Deterrence	Full lifecycle security framework
EU cable risk assessment	Published Oct 2025	Maps threats, vulnerabilities and dependencies
Stress-test guidance	Published with 2025 risk work	Supports infrastructure resilience testing

The broader implication is that cyber-maritime resilience requires recovery capacity located close enough to be useful, because redundant routes help maintain service immediately after a break, while physical restoration still depends on specialist assets whose mobilisation time can determine the duration of reduced connectivity.

Italy already combines high-end naval presence with a growing need for infrastructure integration

Italy represents one of the clearest national cases because its current naval contribution is operationally substantial and geographically connected to Suez-linked trade, while the Italian Navy reported in June 2026 that frigate Carlo Bergamini had completed readiness activities before employment in ASPIDES and had been prepared specifically to protect navigation and major sea lines of communication; the same unit had previously completed an ASPIDES training module involving simulated air, underwater and surface threats, passive-defence activities and live-fire exercises. Nave Carlo Bergamini ha terminato un periodo di addestramento e approntamento ad Augusta — Marina Militare — Jun 2026 and Nave Bergamini ha completato con successo il modulo ASPIDES — Marina Militare — Apr 2026 establish the preparation and threat categories.

By early September 2026, the Italian Navy reported that Carlo Bergamini remained active in ASPIDES in the Red Sea and Gulf of Aden, while mine countermeasure vessels Rimini and Crotone were also operating in the theatre, giving Italy a combination of surface protection and mine-countermeasure capability in a maritime environment where sea lines of communication and critical routes face diversified threats. Oltre gli stretti — Marina Militare — Sep 2026 provides the current Italian deployment picture.

The next institutional connection for Italy therefore concerns data rather than another category of weapon system: information generated by deployed naval assets about suspicious maritime behaviour or infrastructure conditions must be capable of reaching the national authorities responsible for cybersecurity, telecommunications, port resilience and merchant shipping, while reciprocal information concerning GNSS anomalies, port outages or cable incidents must be available quickly enough to inform naval protection decisions; the official record reviewed here establishes the naval components but does not publicly demonstrate a permanent Italian Red Sea fusion cell uniting all of those domains.

Italy: existing capabilities and integration questions

Capability	Verified status	Cyber-maritime relevance
FREMM frigate Carlo Bergamini	Operating within ASPIDES in 2026	Escort, surveillance, protection and maritime-domain awareness
Air / surface / subsurface ASPIDES training	Completed Apr 2026	Prepares unit for multidomain physical threat environment
Mine countermeasure vessels Rimini and Crotone	Reported in theatre Sep 2026	Adds seabed / mine-related maritime-security capability
Italian participation in ASPIDES	Active	Connects national assets to EU command structure
Port / transport cyber obligations	Governed through EU/National NIS2 implementation	Creates civilian cyber-resilience layer
Cable-security participation	Through EU cable framework and national infrastructure authorities	Links telecommunications continuity to maritime resilience
Remaining public-record gap	No single publicly documented national fusion architecture	Limits assessment of end-to-end integration

France combines maritime escort with airborne situational awareness

France’s contribution demonstrates a different but complementary model because its Ministry of the Armed Forces reported in August 2026 that a French frigate escorted a merchant vessel through Bab el-Mandeb and the Red Sea under ASPIDES while an ATLANTIQUE 2 maritime-patrol aircraft conducted surveillance and situational-awareness missions, and an earlier operational update for late July reported two FREMM frigates plus an ATL2 conducting patrols and merchant escorts in the region. Point de situation des opérations du jeudi 13 au 20 août 2026 — Ministère des Armées and Point de situation des opérations du jeudi 23 au jeudi 30 juillet 2026 — Ministère des Armées provide the verified deployment picture.

The combination of surface escort and airborne surveillance is particularly relevant to cyber-maritime resilience because an aircraft can contribute an independent situational picture that does not depend on merchant AIS reports alone, while a frigate provides direct observation in the protected corridor; however, the public record reviewed does not establish that these French platforms are routinely conducting dedicated GNSS attribution or submarine-cable monitoring missions, so their relevance lies principally in multi-sensor maritime-domain awareness rather than evidence of a specific French electronic-warfare mission.

France also possesses a mature national cyber authority, ANSSI, whose 2025 threat panorama reported 3,586 security events, including 1,366 incidents and 2,209 reports, illustrating the scale of the wider national cyber-response environment into which maritime or infrastructure incidents can be absorbed, although those figures cover all sectors and should not be interpreted as maritime incident counts. Panorama de la cybermenace 2025 — ANSSI — Mar 2026 provides the official national figures.

Germany illustrates the importance of separating mandate, personnel and deployed platform

Germany remains formally involved in ASPIDES but currently contributes through a different force posture from its initial deployment, because Bundeswehr records show that Germany first joined the mission on 23 February 2024 with the air-defence frigate Hessen, while the current German international-crisis-management table lists an ASPIDES mandate valid until 31 October 2026 with a personnel ceiling of 350; more current Bundeswehr personnel statistics dated 7 September 2026 show approximately 10 German personnel actually deployed in ASPIDES. The Bundeswehr’s International Crisis Management and Aktuelle Personalzahlen der Bundeswehr — Sep 2026 provide those different measures.

Germany: mandate versus actual deployment

Measure	Current official figure	Interpretation
Current ASPIDES German mandate	Until 31 Oct 2026	Legal/political authorisation period shown by Bundeswehr
Mandated personnel ceiling	350	Maximum authorised personnel, not actual deployment
Personnel actually deployed	~10	Bundeswehr figure dated 7 Sep 2026
Initial frigate contribution	Hessen, from Feb 2024	Earlier surface-combatant deployment
Current large surface combatant contribution	Not shown in the Sep 2026 personnel record	Should not be inferred from mandate alone

This distinction is critical for comparative analysis because a Member State can remain legally committed to an operation, supply headquarters personnel or specialist functions and participate in strategic decisions without maintaining a frigate continuously inside the area of operation; any European resilience model must therefore allocate tasks according to actual assets and national specialisations rather than assuming nominally equal contributions from all participating states.

The United Kingdom sits outside ASPIDES but remains operationally relevant to the same resilience system

The United Kingdom illustrates why cyber-maritime security around Bab el-Mandeb cannot be treated as exclusively an EU institutional problem, because the UK remains outside ASPIDES yet maintains maritime-security, cyber, military and telecommunications capabilities relevant to the same route; on 22 September 2026, the UK announced additional defensive support to Saudi Arabia consisting of an RAF Voyager air-to-air refuelling aircraft, building on an existing British contribution to Saudi air defence that includes equipment and UK personnel supporting defence against missile and drone attacks. UK military support to the Kingdom of Saudi Arabia — GOV.UK — Sep 2026 establishes the current deployment decision.

On the same date, the G7 foreign ministers of Canada, France, Germany, Italy, Japan, the United Kingdom and the United States together with the EU High Representative issued a statement describing the Yemen situation as a threat to regional security, energy security, navigational rights and maritime security in the Red Sea and Bab al-Mandeb, creating a diplomatic coordination framework broader than the EU naval operation itself. G7 Statement on Bab al-Mandab and Navigational Rights and Freedoms — GOV.UK — 22 Sep 2026 records that common position.

The UK also maintains dedicated maritime cyber guidance for both vessels and ports, with the Department for Transport’s updated Cyber Security Code of Practice for Ships covering risk assessment, resilience, incident handling and rapid recovery across IT, OT and communications technology, while the separate Ports and Port Systems Cyber Security Code of Practice addresses governance, asset protection, vulnerabilities, mitigation and recovery for port facilities. Ship security: cyber security code of practice — GOV.UK and Ports and port systems: cyber security code of practice — GOV.UK provide the current official framework.

Comparative national implementation picture

Dimension	Italy	France	Germany	United Kingdom
ASPIDES participation	Active naval deployment	Active naval and air surveillance deployment	Formal participation; ~10 personnel deployed as of 7 Sep 2026	Not part of ASPIDES
2026 surface presence evidenced	FREMM Carlo Bergamini; mine countermeasure vessels	FREMM deployments	No current frigate established by latest personnel record	Separate national / partner framework
Airborne maritime surveillance	National capabilities exist, not separately quantified here	ATLANTIQUE 2 explicitly documented	Not established in reviewed 2026 ASPIDES record	Relevant national capabilities but not ASPIDES
Cyber regulation	EU NIS2 / national implementation	EU NIS2 + ANSSI national cyber architecture	EU NIS2 + German national structures	National cyber codes and UK regulatory framework
Port cyber guidance	EU and national implementation	EU and national implementation	EU and national implementation	Dedicated DfT/MCA port cyber code
Cable resilience	EU Cable Security framework	EU Cable Security framework	EU Cable Security framework	Separate UK telecom / infrastructure framework
Primary integration challenge	Link naval assets with ports, cyber and cable authorities	Fuse naval/air surveillance with cyber/infrastructure intelligence	Match authorised role with available deployed assets	Interface national capabilities with EU and G7 partners

The table should not be read as a ranking because the four countries operate under different legal frameworks, force-posture decisions and alliance structures, while their contributions to cyber-maritime resilience involve different combinations of naval presence, regulatory responsibility, cyber capability and regional partnerships.

Recovery capacity is the missing operational bridge between cybersecurity and maritime security

A resilience architecture becomes strategically meaningful only when it defines what happens after protection fails, because neither missile defence nor cybersecurity can guarantee that no vessel, port system, cable or navigation service will ever be disrupted; consequently, recovery must be treated as an operational capability with pre-arranged priorities, decision rights and fallback procedures rather than as an administrative phase beginning after the crisis has ended.

For shipping, recovery means restoring trusted navigation data, communications and onboard systems; for ports it means maintaining minimum cargo-handling and vessel-traffic functions while compromised networks are isolated; for telecommunications it means rerouting traffic and mobilising repair capability; for governments it means sharing enough information to determine which infrastructure receives priority access to scarce assets; and for naval forces it means securing repair activity or maritime access where the security environment prevents civilian operators from acting independently.

Recovery-capacity architecture

Disrupted function	Immediate continuity action	Recovery authority	Critical dependency	Strategic failure if unavailable
GNSS/PNT	Shift to alternative navigation and cross-checking	Ship master / maritime authority	Independent PNT capability	Navigation becomes unreliable
AIS integrity	Downgrade trust and use independent sensors	Vessel / VTS / maritime authority	Radar and alternative data	Maritime picture becomes corrupted
Ship IT/OT	Segment affected network and preserve safe control	Ship operator / master / technical team	Local/manual control capability	Cyber incident becomes physical-operational failure
Port IT	Activate business continuity / offline procedures	Port operator / CSIRT	Clean backups and offline workflow	Cargo throughput collapses
Port OT	Place equipment in safe/local mode	Terminal operator	Segmentation and local control	Physical handling stops
Cable fault	Reroute traffic	Cable/network operator	Spare capacity on alternative systems	Regional connectivity degrades
Cable physical repair	Mobilise repair ship/module	Operator + national authorities	Secure maritime access and repair equipment	Outage duration increases
Naval protection	Reallocate escort / surveillance assets	ASPIDES / national command	Available ships and aircraft	Merchant confidence and repair access deteriorate

The European Commission’s decision to allocate a dedicated €20 million repair-capacity call inside the wider €347 million cable-security package illustrates this shift from protection toward restoration, while the CER Directive similarly requires critical entities to implement organisational and technical measures designed to sustain resilience rather than merely prevent incidents. European Commission cable-security investment announcement and Directive (EU) 2022/2557 provide the official basis.

A cyber-maritime common operating picture would have to preserve attribution boundaries

Integrating information does not mean integrating conclusions prematurely, because GNSS interference, AIS anomalies, port cyber incidents, cable faults and hostile maritime behaviour all require different evidentiary standards before responsibility can be assigned. A useful common operating picture would therefore display confidence, provenance and attribution status alongside the event itself, allowing naval and civilian authorities to respond operationally without converting correlation into attribution.

Example evidentiary architecture for shared reporting

Event	Operational status	Attribution status	Required evidence before attribution	Immediate action does not require attribution?
GNSS loss	Confirmed / reported	Unknown	Signal analysis, emitter location, intelligence	Yes
GNSS spoofing	Confirmed / reported	Unknown	Technical signature and source localisation	Yes
AIS anomaly	Confirmed	Unknown / technical error possible	Source authentication and sensor correlation	Yes
Cable break	Confirmed	Accident / unknown / malicious	Physical inspection, vessel activity, forensic evidence	Yes
Port ransomware	Confirmed cyber incident	Actor unknown or under investigation	Malware, infrastructure and intelligence analysis	Yes
Suspicious vessel near cable	Observation confirmed	Intent unknown	Pattern, activity, intelligence and physical evidence	Yes
Missile launch	Physical attack confirmed	Attribution depends on evidence	Launch detection, weapon characteristics, intelligence	Yes

The advantage of this architecture is that it separates response confidence from attribution confidence, because operators can change navigation mode, isolate networks, escort repair ships or reroute traffic immediately without claiming that the perpetrator has been identified; this principle is especially important in Bab el-Mandeb, where the public evidence already demonstrates the coexistence of kinetic threat and unattributed electronic interference.

The decisive institutional objective is continuity of the route as a system

A cyber-maritime model changes the unit of protection from the individual vessel to the continuity chain, because European economic security depends on several sequential functions remaining available: a merchant vessel must be able to approach and transit safely; positioning and communications must remain sufficiently trustworthy; naval or maritime authorities must maintain situational awareness; the destination port must remain operable; data and customs systems must process the cargo; communications networks must remain available; and disrupted infrastructure must be recoverable quickly enough that one failure does not propagate across the logistics system.

End-to-end continuity chain

Stage	Essential function	Principal authority / operator	Resilience requirement
Pre-transit	Threat and route assessment	Shipping company / maritime authorities	Trusted intelligence and navigation warnings
Approach to Bab el-Mandeb	Accurate position and traffic picture	Ship master / bridge team	GNSS/AIS cross-check and alternative PNT
High-threat transit	Physical protection and maritime awareness	ASPIDES / national navies	Escort, surveillance, warning and defensive capability
Infrastructure monitoring	Detect suspicious subsea activity	Naval forces / partners / operators	Shared maritime and cable situational awareness
Communications continuity	Maintain data and safety communications	Telecom and satellite providers	Redundant paths
Port approach	Vessel traffic management	Port / VTS	Reliable radar, communications and digital systems
Cargo handling	Maintain terminal operations	Port/terminal operator	Resilient IT/OT and degraded-mode capability
Cyber incident management	Contain and recover systems	National CSIRT / operator	Reporting, isolation and validated restoration
Cable failure	Reroute and repair	Cable operators / national authorities	Spare capacity and rapid repair access
Strategic coordination	Prioritise scarce capabilities	National governments / EU institutions	Shared situational awareness and decision thresholds

This chain demonstrates why cyber-maritime resilience is not equivalent to “adding cybersecurity to ASPIDES,” because the naval operation occupies only one segment of the system, while the complete resilience architecture requires regulatory authorities, ports, telecommunications providers, shipping companies, cyber responders and partner states to maintain interoperable procedures around the naval protective layer.

Implementation can be organised through functional interfaces rather than a new supranational command

The existing official architecture supports several distinct institutional pathways that can be assessed without presuming that one should replace the others. One pathway would strengthen information exchange between ASPIDES, EMSA, CRIMARIO, national maritime authorities and civilian infrastructure operators while leaving current legal mandates intact; another would create more formal cross-domain crisis procedures linking NIS2 cyber authorities with maritime-security authorities during Red Sea incidents; another would focus primarily on common exercises and degraded-mode testing; and another would prioritise repair capacity, redundant communications and infrastructure recovery rather than additional command structures.

Institutional pathways and trade-offs

Pathway	Existing legal / institutional hook	Primary effect	Implementation burden	Main limitation
Enhanced cross-domain information sharing	EU Maritime Security Strategy, ASPIDES/ATALANTA mandate, EMSA, CRIMARIO	Improves early warning and correlation	Moderate governance and technical integration	Information-sharing restrictions and classification
Joint cyber-maritime exercises	Revised EU Maritime Security Strategy	Tests ship-port-cable continuity under realistic failure	Moderate recurring cost	Exercises do not create physical redundancy by themselves
Navigation-integrity reporting network	EMSA working group + maritime authorities	Faster GNSS/AIS anomaly recognition	Low-to-moderate technical burden	Requires high data quality to avoid false alerts
Port degraded-mode programme	NIS2 + CER	Maintains essential cargo and VTS functions during cyber failure	Significant operator investment	Capabilities vary across ports
Cable-repair readiness	EU Cable Toolbox / CEF Digital	Reduces outage duration	High specialised-capability cost	Physical access may depend on non-EU states
Expanded naval/infrastructure surveillance	ASPIDES amended mandate	Improves detection of suspicious maritime activity	Asset-intensive	Scarce vessels and aircraft
Partner capacity building	ASPIDES, CRIMARIO, Djibouti/Yemeni cooperation	Extends awareness outside EU territory	Diplomatic and training burden	Dependent on partner capacity and information-sharing rules

These pathways are complementary rather than mutually exclusive because one primarily improves information, another recovery, another physical protection and another civilian continuity, while their feasibility depends on legal competence, resources and national participation rather than on the technical problem alone.

Measurable readiness requires performance indicators rather than declarations

A major weakness in public discussion of resilience is that institutional existence can be mistaken for operational effectiveness, whereas a meaningful cyber-maritime framework would have to measure response and recovery performance; therefore, rather than counting strategies, working groups or exercises alone, readiness can be evaluated through objective indicators such as time to distribute a GNSS warning, percentage of ports capable of operating essential functions offline, time required to reroute cable traffic, availability of repair assets, percentage of high-risk vessels with validated alternative PNT procedures, and frequency with which naval and civilian infrastructure authorities conduct joint exercises.

Potential auditable readiness indicators

Capability	Quantifiable indicator	Desired evidence source
GNSS anomaly response	Time from first validated report to regional warning	EMSA / national maritime authority
AIS integrity	Percentage of anomalies correlated with independent sensors	EMSA / coast guards
Merchant degraded navigation	Percentage of high-risk vessels with tested alternative PNT procedures	Flag states / shipping companies
Port IT recovery	Recovery time for essential terminal functions	Port operators / national cyber authorities
Port OT continuity	Ability to operate critical equipment under segmented/local control	Port resilience tests
Cable rerouting	Percentage of traffic restored through alternative routes after simulated outage	Telecom operators / regulators
Cable physical recovery	Time from fault confirmation to repair mobilisation	Cable operators / EU cable programme
Naval infrastructure awareness	Number of validated critical-infrastructure observations shared	ASPIDES / ATALANTA
Cross-domain exercises	Frequency and scope of ship-port-cable cyber-maritime exercises	EU / Member States
Partner interoperability	Number of operational information exchanges with regional partners	ASPIDES / CRIMARIO

The public record currently provides substantial information on ASPIDES activity and EU funding but much less on these end-to-end performance variables, which means the principal uncertainty no longer concerns whether Europe recognises the cyber-maritime problem but how effectively its different instruments perform when multiple systems are degraded simultaneously.

Key judgments

European cyber-maritime resilience already has a legal and institutional foundation, because ASPIDES, the revised Maritime Security Strategy, NIS2, the Critical Entities Resilience Directive, EMSA’s navigation-integrity work and the Cable Security Toolbox collectively cover the principal military, cyber, transport and telecommunications dimensions, while the unresolved problem is operational coordination between them rather than absence of policy. Council Maritime Security Strategy, NIS2 and Cable Security Toolbox establish that framework.

The March 2026 ASPIDES mandate amendment constitutes the clearest institutional step toward corridor-level protection, because the operation is now authorised to collect and share information concerning suspicious activity related to critical submarine infrastructure while strengthening cooperation with CRIMARIO and regional maritime partners, although this remains an information task within available means rather than a general mandate to defend or repair commercial cable infrastructure. Council of the EU — 30 Mar 2026

The defensive burden is sufficiently large to justify treating ASPIDES as a persistent maritime-security institution rather than a short emergency deployment, because more than 2,390 merchant vessels had been supported and more than 720 close-protected by 24 August 2026, while the mission has been extended through February 2027. EUNAVFOR ASPIDES Mandate — Aug 2026 and Council extension decision — Feb 2026 provide the official figures.

Cyber-maritime resilience depends on maintaining legal separation while creating operational interoperability, because naval forces should not replace national CSIRTs, telecom regulators or port operators, while those civilian entities cannot independently provide sea-based surveillance, escort or infrastructure-security awareness in the Bab el-Mandeb theatre.

Recovery capacity is becoming a strategic capability in its own right, as demonstrated by the EU’s €347 million cable-security package and dedicated €20 million repair-capacity call, because the duration of a disruption depends as much on spare capacity, repair access and restoration speed as on whether damage could originally have been prevented. European Commission — Feb 2026

Italy, France, Germany and the United Kingdom contribute through structurally different combinations of deployed assets, legal authorities and cyber institutions, which means a European cyber-maritime architecture would function most effectively as an interoperable network of specialised national capabilities rather than assuming identical force contributions or institutional roles across all four states.

What would change the assessment

The assessment would strengthen materially if the EU or participating states established a formal real-time cross-domain mechanism connecting ASPIDES, EMSA, national cyber authorities, telecom regulators, port operators and critical-infrastructure providers, because that would demonstrate that the current collection of parallel instruments had become an operational cyber-maritime system rather than a policy architecture with bilateral or ad hoc interfaces.

It would strengthen further if future ASPIDES reporting documented routine critical-submarine-infrastructure surveillance outputs, if cable incidents in the Red Sea were followed by coordinated EU naval and civilian response, if Member States conducted publicly documented exercises combining GNSS spoofing, port cyber failure, submarine-cable outage and merchant protection, or if measurable recovery standards were published for high-criticality ports and cable systems.

The assessment would weaken if legal, technical or classification barriers prevented timely information exchange across naval and civilian authorities, if Member States reduced contributions to ASPIDES without compensating capabilities, if cable-repair programmes remained largely nominal rather than deployable, or if port and shipping resilience plans proved dependent on digital services that fail simultaneously under common-mode disruption.

Open official record

The most consequential unresolved records concern whether ASPIDES and EMSA operate a formal real-time interface for navigation-integrity incidents; whether national CSIRTs receive structured maritime operational information during Red Sea incidents; how EU cable-security information is exchanged with naval commands when suspicious vessel activity occurs near underwater infrastructure; the exact number and readiness of European cable-repair assets that could be deployed toward the Red Sea; the time required to reroute high-priority European traffic after simultaneous regional cable failures; the percentage of major European ports capable of operating critical VTS, cargo and gate functions under prolonged external-connectivity loss; and whether Italy, France, Germany and the United Kingdom maintain permanent national cross-domain maritime resilience cells linking defence, transport, cyber and telecommunications authorities.

Until those records become publicly auditable, the strongest defensible conclusion is that Europe has moved substantially beyond a purely naval understanding of Bab el-Mandeb security and has created most of the individual instruments required for cyber-maritime resilience, while the strategic frontier now lies in connecting protection, information integrity, critical-infrastructure awareness, civilian cyber response and recovery capacity rapidly enough that a local failure cannot propagate across the entire Europe–Suez–Asia continuity chain.

---

Copyright of debuglies.com – Even partial reproduction of the contents is not permitted without prior authorization Reproduction reserved