On August 16, 2026, the Wall Street Journal reported that Iran's government was weighing attacks on the Persian Gulf's undersea cable network, alongside an announced "restricted zone" running from the Strait of Hormuz into the Gulf. Asia Times, in a piece dated September 16 and updated September 19, named four systems at risk: Fibre in Gulf (FIG), Falcon, Asia-Africa-Europe-1 (AAE-1) and Gulf Bridge International. Saudi Arabia is a landing site for all four. We have not independently confirmed the WSJ reporting, and no cable damage from it has been reported. But the exposure is real enough to test Saudi policy.
The case for tighter state control
The strongest argument for a heavy-handed regime is simple: a cable landing station is critical national infrastructure, and the state cannot defend what it does not license, inspect and direct. Gulf economies have bet heavily on cloud and AI. As the Gulf Times noted in April, the UAE and Saudi Arabia have invested billions in digital infrastructure, which makes them especially sensitive to connectivity disruption. A regulator that can mandate resilience standards, security vetting and capacity reservations looks prudent.
What the permit regime actually does
Saudi Arabia does have such a regime. The Communications, Space and Technology Commission (CST) regulates landing stations under Decision 521/1445, dated February 8, 2024. It covers building and operating stations for international submarine or terrestrial cables, and selling international capacity over them. The permit itself costs SAR 100,000 and is listed with a 15-day processing time, applied for through the Business Portal with Nafath login.
That is a licensing gate, not a resilience guarantee. A permit decides who may land a cable and sell capacity. Based on the CST pages we could read, it does not make an offshore cable safe from a diver or remotely operated vehicle. Neither of the CST pages we fetched described resilience obligations in detail, and the full regulation text was not available to us. The threat, as Asia Times describes it, sits in shallow water: the Gulf is under 100 metres deep, so an attacker does not need exotic equipment.
Why the physical problem resists regulation
This is where a pro-innovation reading matters. Cable faults are common and mostly accidental. The Gulf Times, citing the International Cable Protection Committee, reports a stable 150 to 200 faults a year from 2014 to 2025, with 70 to 80 percent caused by fishing and anchors. Operators and repair ship owners already manage that baseline. A deliberate state-backed campaign is a different category, and no landing-station rule can deter it. It is a matter for navies, diplomacy and insurers.
The repair side is also a policy problem. The Gulf Times points to delays in obtaining permits for access to territorial waters, and to the need to resurvey the seabed after a conflict to find safe positions and sunken objects. If a cable is cut in a contested zone, the bottleneck is not the splice. It is access, security clearance for repair vessels, and the risk that a repair ship becomes a target. Saudi Arabia can usefully pre-clear repair access and standing arrangements with neighbours. Piling more licensing conditions on operators would not help.
There is a free-speech and openness angle too. When connectivity is the target, the first policy reflex in many states is to tighten control of traffic: throttling, mandatory rerouting through state-approved gateways, or narrower rules on who may carry international capacity. Those measures would make an outage worse for ordinary users and businesses. The proportionate response is more routes, not more chokepoints.
Diversification is the real test
Saudi Arabia's more credible answer is route diversity, and it is already being built. According to Bolsamania, stc won the SilkLink project from Syria's sovereign wealth fund on February 9, 2026, with a 75 percent stake. It covers 4,500 kilometres of fibre plus data centres and cable connection points, and gives the kingdom an overland path toward the Mediterranean that avoids the Gulf.
The East to Med Data Corridor (EMC) is the subsea counterpart. Naftemporiki describes a Saudi Arabia, Jordan, Israel and Greece route, with stc holding 72 percent, PPC 25 percent and TTSA 3 percent. It puts the western section at €700 million, with completion estimated in early 2028. Reports in February 2026 said Riyadh was considering rerouting EMC through Syria rather than Israel. We could not confirm that change, so treat the route as unsettled.
Neither project helps this winter. Both are years from full service, and an overland route has its own exposure to conflict, theft and political change in transit states. The honest reading is that Saudi Arabia is hedging against a risk that is already visible, with no finished hedge.
What a proportionate policy looks like
- Publish the resilience terms. If Decision 521/1445 carries resilience duties, the CST should say plainly what operators must do, so the market can price it.
- Pre-clear repair access. Standing agreements for repair vessels in the Gulf matter more than new permit conditions.
- Reward diversity. Let operators win permits and capacity deals by offering independent routes, including Red Sea and overland landings.
- Resist traffic controls. Do not answer a physical threat with new restrictions on lawful traffic.
The lesson is not that Saudi licensing failed. It was never designed to stop a state actor in shallow water. The test is whether the kingdom turns the scare into faster, open, multi-route capacity, or into more gatekeeping over a network that is already hard to defend.