US military moves cyber staff to Hawaii and sets up Pacific monitoring centre
The US military has expanded its cybersecurity presence in Hawaii and established a regional centre to monitor Pacific military communications, according to a South China Morning Post report published on 5 November 2026. The report says the centre is intended to improve detection of threats and disruptions, including damaged undersea cables, electromagnetic spectrum problems and service outages originating in the United States that affect Pacific operations. It also states that neither initiative has been explicitly linked to China.
Brigadier General Michael Smith, US Pacific Command’s director for command, control, communications, computers and cyber, said personnel had been relocated from Maryland to Hawaii under an initiative called Cyber Defence Forces Pacific to add cybersecurity capacity in the theatre. Their number was not disclosed. They were assigned to the Defence Information Systems Agency’s Pacific command, which established the centre.
Colonel Michael Hlad, head of DISA’s Pacific field command, said an assessment the year before the report had found US forces were not adequately postured for regional requirements. The new centre would increase personnel at command headquarters by about 20 per cent, according to the report. The report does not tie the change to a specific incident.
Why undersea cables matter
The report notes that most intercontinental internet traffic runs through undersea cables. Damage can disrupt communications or push data onto alternative routes, and hostile forces may try to tap cables to intercept information.
The threat evidence in layers
A study by the China Strategic Risks Institute for the US-China Economic and Security Review Commission, described by the newspaper as released in September, said most damage to undersea cables worldwide resulted from accidents or natural events. It nonetheless warned that China was developing capabilities to disrupt the infrastructure, and said connections between the US mainland, Hawaii and Guam were particularly susceptible because alternative routes were limited.
US authorities have accused Volt Typhoon, which the newspaper describes as having alleged links to the Chinese state, of compromising critical infrastructure networks, including on Guam. The newspaper said a 2024 US cybersecurity and intelligence advisory had stated that the group was preparing disruptive or destructive cyberattacks in the event of a major crisis or conflict with the United States. Beijing has repeatedly dismissed allegations of state-sponsored hacking. In August, foreign ministry spokesman Lin Jian accused Washington of smearing China after US authorities seized domains allegedly used by Chinese hackers, the report said. Beijing has also raised concerns about undersea infrastructure.
A separate South China Morning Post article reported that two Chinese military researchers, Shi Guanglei and Shi Haiming of the National Defence University, wrote in Science and Technology Daily that the barrier to entry for undersea warfare was lowering. They cited AUKUS as a key driver and warned that undersea cables were increasingly vulnerable to low-cost drones.
Accident, repair capacity and ambiguity
Windward, a commercial maritime risk firm, reported that most physical damage to subsea cables globally was linked to commercial maritime activity, particularly fishing and bottom trawling, and that breaks in shallow shelf waters below 200 metres were overwhelmingly attributable to trawling. It counted 19 Pacific events involving vessels from states it classifies as of concern, 16 involving China and three involving Russia, and said 20 per cent of activities lasted more than 24 hours. It defines surveillance-related risk as slow speed near known cable routes for more than an hour, consistent with mapping, surveying or possible surveillance preparation, but not proof of surveillance or sabotage.
A peer-reviewed Marine Policy article by Moeri Matsuda, Kazuki Matsuo and Brendon J. Cannon offers a forward-looking expert assessment rather than a record of incidents. It reported near-unanimous expert agreement that Guam was important and faced higher espionage and sabotage risk than Hawaii, citing its command-and-control role and at least 11 cables making landfall there. It also reported that approximately 60 cable repair ships existed globally, unevenly distributed, leaving vulnerable states and chokepoints exposed to prolonged outages.
What the evidence does not show
An automated GDELT Cloud brief, which rated its own confidence as medium, found no confirmed seven-day surge of Indo-Pacific cable sabotage incidents for East Asia or Oceania in its collection window. It said the evidence supported elevated preparedness and investment monitoring rather than assumptions of active regional cable warfare. A short collection window and medium confidence cannot prove that no cable incident occurred, and the brief is an automated monitoring product rather than an official investigation.
The reporting does not establish active sabotage or tapping of Pacific undersea cables by any state actor. Nor does it show that the Hawaii initiative has changed detection, response or resilience. General dependence on cables, a study warning about future disruption capabilities, a disputed accusation against Volt Typhoon and observed vessel behaviour are not the same as a confirmed attack.
Allied networks and open questions
The report also places the Hawaii changes in an allied context. Hlad said US forces and allies used 18 separate networks to exchange military information and that DISA was seeking a common system for joint operations. The newspaper said the initiative had been tested during Keen Edge, a US-Japan command-post exercise, and that the two countries’ defence ministers agreed to step up joint efforts against malicious cyber activity. Separately, The Tribune reported in November 2025 that India and the US Navy had discussed cooperation to protect undersea cables and shipping routes. It did not link the talks to Hawaii.
The GDELT brief recommended that organisations dependent on Indo-Pacific connectivity treat cable risk as elevated and review route diversity, landing stations, repair vessels and vendor contingency rather than undertake crisis rerouting. That is a resilience checklist, not a diagnosis of an attack. The report gives no exact dates, no personnel total beyond the approximate 20 per cent headquarters increase, and does not describe any operational effect from the centre.
The newspaper’s statement that neither initiative was explicitly linked to China sits alongside its account of US accusations and Chinese warnings. That does not make cable risk irrelevant; it means the account does not establish a China-specific trigger. Military preparation for accidents, deliberate interference and espionage does not require public attribution of a specific operation. The evidence supports heightened monitoring and preparedness where routes are few, repair capacity is uneven and attribution is contested.
The practical question is narrower: can military and commercial operators detect a cable fault quickly, distinguish accident from deliberate interference, and restore capacity before a local break becomes a regional outage? The Hawaii changes, as reported, add staff and monitoring capacity. They do not answer that question on their own. The next useful check is primary confirmation from US military authorities of the centre’s remit, staffing and operational effect.
A snapped cable announces itself; the harder question is whether a trawler or something more deliberate put it there, and that answer rarely comes from a single reading. Judging it means knowing what normal looks like on a route: which paths carry traffic, how quickly traffic shifts when one fails, and what records of the failure survive. Networking is where that picture is built, from addressing and routing to the way redundancy behaves when a link drops, turning a vague sense of disruption into questions you can actually test. Readers who want that grounding can explore The Hack Academy’s online cybersecurity training programme, where networking is one of the listed subject areas, with self-paced learning and practical exercises alongside the theory in authorised, controlled environments. It will not attribute a cable fault, but it makes the next outage report easier to read.