© 2026 Aqora Quantum S.A.S.

Terms Privacy Legal Notice

Photonics

Fiber Tapping in Optical Networks: Attack Techniques, Detection, and Mitigation

Krzysztof Borzycki, Mirosław Klinkowski

Published Oct 15, 2026• 0 citations

Abstract

Initially considered secure against interception, fiber-optic networks were subsequently found susceptible to covert tapping, although such attacks require different coupling mechanisms and components than those used for twisted pair and coaxial cables. Fiber-optic networks carry the majority of data and voice traffic worldwide, including backhaul and fronthaul traffic in 4G and 5G radio networks, connections between data centers, and submarine cable systems. Consequently, physical access to fibers for interception has attracted the attention of intelligence agencies and industrial spies. This vulnerability is facilitated by the fact that single-mode optical fibers (SMFs) used in telecommunication networks have evolved relatively little over the last 40 years. Fibers of substantially different designs—anti-resonant hollow core fibers (HCF) and multi-core fibers (MCF)—made their commercial debut around 2023, and their susceptibility to tapping may differ substantially from that of conventional SMFs. New promising fiber monitoring techniques based on polarization measurements have also been demonstrated recently. While established tapping techniques remain feasible for conventional fibers, new fiber designs and monitoring technologies can make covert interception difficult. This review examines physical fiber tapping techniques and their practical feasibility, with particular emphasis on optical power constraints, introduced loss, detectability, and implementation limitations. It also reviews prevention and monitoring approaches, including optical time-domain reflectometry, received-power monitoring, and state-of-polarization (SOP) monitoring, and provides a prospective engineering assessment of the susceptibility of MCFs and HCFs to physical tapping.

DOI: 10.3390/photonics13100964

Related papers

Experimental Optical Setup to Measure Power Loss versus Fiber Bent Radius for Tapping into Optical Fiber Communication Links

And Kaan Yilmaz, Ahmet Deniz, Heba Yüksel

Optical fiber communication was widely believed that an optical network was a good way to prevent hacking through wiretaps which intercept network data. However, fiber optic cable is not particularly secure. Various tapping methods can be used to extract data from fiber optic networks with little or no risk of detection. One of the easiest ways of intruding into a fiber optic communication link is creating a bend on the fiber cable. Even small percentage of the transmitted light acquired with the bending method is enough for recovering the data by the attacker. Though there are some techniques and devices that can track the power and intensity inside the fiber cable, these methods cannot detect an attack exploiting small leakage. Therefore, it is critical to determine a range of radii of curvature for which tapping attacks are not detectable. Though there are some studies to quantify the power loss both theoretically and numerically, as of the authors' knowledge, there has not been any experimental validation of those studies. In this respect, an experimental optical setup and a technique relying on the ADC conversion capability of Arduino UNO to measure power loss resulting from different bending radii are proposed in this paper. A lower limit for radius of curvature for an attack to be undetected is obtained and the estimations in the literature for power loss resulting from fiber bending is validated.

International Conference on Electrical, Computer and Energy Technologies (ICECET)•Dec 9, 2021•11 citations

Eavesdropping Vulnerabilities in Optical Fiber Networks: Investigating Macro-Bending-Based Attacks Using Clip-on Couplers

Vladimir Spurny, Petr Dejdar, Adrián Tomašov +2 more

Fiber optic cables have long been considered a secure medium that prevents eavesdropping due to their complexity. However, there are attack methods that allow eavesdropping or denial of service. These include methods based on bending optical fibers. The danger resides in the possibility of being able to carry out an attack without having to interrupt the path. To facilitate such attacks, it is possible to use a clip-on coupler. This coupler is designed to allow eavesdropping on the link without interruption. In this study, we focus on evaluating the coupling efficiency of a simple but commercially available clip-on coupler. This work investigates the effectiveness of jamming into the optical link, i.e., replicating the jamming attack and measuring it by simulating real traffic conditions. To better understand the complexity of these attacks, we perform additional measurements to investigate the effect of clip-on coupling on changes in the polarization state. Through this research, we highlight the increasing vulnerability of optical fibers to eavesdropping attempts, especially those using macro-based methods. By evaluating the performance of commercially available clip-on coupling, we provide valuable insights into potential risks and mitigation strategies for securing modern optical communication networks.

International Workshop on Fiber Optics in Access Networks (FOAN)•Oct 30, 2023•9 citations

Implementing and testing a fiber-optic polarization-based intrusion detection system

Rasha El Hajj, Gregory Macdonald, Pramode K. Verma +1 more

We describe a layer-1-based intrusion detection system for fiber-optic–based networks. Layer-1-based intrusion detection represents a significant elevation in security as it prohibits an adversary from obtaining information in the first place (no cryptanalysis is possible). We describe the experimental setup of the intrusion detection system, which is based on monitoring the behavior of certain attributes of light both in unperturbed and perturbed optical fiber links. The system was tested with optical fiber links of various lengths and types, under different environmental conditions, and under changes in fiber geometry similar to what is experienced during tapping activity. Comparison of the results for perturbed and unperturbed links has shown that the state of polarization is more sensitive to intrusion activity than the degree of polarization or power of the received light. The testing was conducted in a simulated telecommunication network environment that included both underground and aerial links. The links were monitored for intrusion activity. Attempts to tap the link were easily detected with no apparent degradation in the visual quality of the real-time surveillance video.

Optical Engineering•Sep 11, 2015•8 citations

Fiber Eavesdropping Using Tapers in Standard and Trench-Assisted Single-Mode Fibers

Thomas D. Bradley, Menno van den Hout, Besma Kalla +7 more

We investigate taper tapping in three types of single-mode fibers using simulations and experiments: Standard single-mode fiber (SMF), bend-resistant single-mode fiber (BR-SMF) with a shallow index trench, and bend-insensitive single-mode fiber (BI-SMF) with a deep index trench. Both trench-assisted fibers demonstrate a larger mode field expansion than the standard single-mode fiber, making them more susceptible to taper-tapping than standard single-mode fibers. Tapering both SSMF and BR-SMF fibers to as little as$\mathrm {25~\mu m}$diameter results in a high information extraction efficiency for an eavesdropper ($\mathrm {\geq -20~dB}$) while maintaining low loss for the legitimate channel ($\mathrm {\leq 1~dB}$), underlining the vulnerability of all fiber types to taper tapping. We also use optical time-domain reflectometry (OTDR) to identify changes in the fiber before and after tapering. Changes in the back reflected power of$\mathrm {\leq 0.5~dB}$and$\mathrm {\leq 0.25~dB}$are observed in$\mathrm {25~\mu m}$tapers in SMF and BR-SMF respectively.

IEEE Photonics Technology Letters•Jun 5, 2024•12 citations

Optical Network Security: Sensing Eavesdropper Intervention.

Stamatios V. Kartalopoulos

Optical communication networks transport an enormous aggregate client traffic, a good part of which is highly sensitive. As such, the optical signal in the fiber medium becomes attractive to bad actors in an attempt to tap the fiber or a component on the path in order to eavesdrop, source mimic, or attack to cause service denial. Therefore, it is important that the network has built-in security features to monitor the channel integrity and to also detect if and when unauthorized intervention has taken place. It is also important that the network is intelligent to countermeasure bad actors. Because the integrity of optical channels in are also affected by component degradation, photon-matter interactions and other non-linear phenomena, the network should be able to differentiate between malicious interventions and parametric degradations. In this paper we identify observable performance parameters and predictors, we describe a estimating method for in-line parameter monitoring, we conclusively distinguish between component degradations and intervention of a malicious eavesdropper and we describe countermeasure mechanisms.

Globecom•Jan 1, 2006•6 citations

NIS03-2: Optical Network Security: Sensing Eavesdropper Intervention

Stamatios V. Kartalopoulos

Optical communication networks transport an enormous aggregate client traffic, a good part of which is highly sensitive. As such, the optical signal in the fiber medium becomes attractive to bad actors in an attempt to tap the fiber or a component on the path in order to eavesdrop, source mimic, or attack to cause service denial. Therefore, it is important that the network has built-in security features to monitor the channel integrity and to also detect if and when unauthorized intervention has taken place. It is also important that the network is intelligent to countermeasure bad actors. Because the integrity of optical channels in are also affected by component degradation, photon-matter interactions and other non-linear phenomena, the network should be able to differentiate between malicious interventions and parametric degradations. In this paper we identify observable performance parameters and predictors, we describe a estimating method for in-line parameter monitoring, we conclusively distinguish between component degradations and intervention of a malicious eavesdropper and we describe countermeasure mechanisms.

Globecom•Nov 1, 2006•9 citations

Initially considered secure against interception, fiber-optic networks were subsequently found susceptible to covert tapping, although such attacks require different coupling mechanisms and components than those used for twisted pair and coaxial cables. Fiber-optic networks carry the majority of data and voice traffic worldwide, including backhaul and fronthaul traffic in 4G and 5G radio networks, connections between data centers, and submarine cable systems. Consequently, physical access to fibers for interception has attracted the attention of intelligence agencies and industrial spies. This vulnerability is facilitated by the fact that single-mode optical fibers (SMFs) used in telecommunication networks have evolved relatively little over the last 40 years. Fibers of substantially different designs—anti-resonant hollow core fibers (HCF) and multi-core fibers (MCF)—made their commercial debut around 2023, and their susceptibility to tapping may differ substantially from that of conventional SMFs. New promising fiber monitoring techniques based on polarization measurements have also been demonstrated recently. While established tapping techniques remain feasible for conventional fibers, new fiber designs and monitoring technologies can make covert interception difficult. This review examines physical fiber tapping techniques and their practical feasibility, with particular emphasis on optical power constraints, introduced loss, detectability, and implementation limitations. It also reviews prevention and monitoring approaches, including optical time-domain reflectometry, received-power monitoring, and state-of-polarization (SOP) monitoring, and provides a prospective engineering assessment of the susceptibility of MCFs and HCFs to physical tapping.

Optical fiber communication was widely believed that an optical network was a good way to prevent hacking through wiretaps which intercept network data. However, fiber optic cable is not particularly secure. Various tapping methods can be used to extract data from fiber optic networks with little or no risk of detection. One of the easiest ways of intruding into a fiber optic communication link is creating a bend on the fiber cable. Even small percentage of the transmitted light acquired with the bending method is enough for recovering the data by the attacker. Though there are some techniques and devices that can track the power and intensity inside the fiber cable, these methods cannot detect an attack exploiting small leakage. Therefore, it is critical to determine a range of radii of curvature for which tapping attacks are not detectable. Though there are some studies to quantify the power loss both theoretically and numerically, as of the authors' knowledge, there has not been any experimental validation of those studies. In this respect, an experimental optical setup and a technique relying on the ADC conversion capability of Arduino UNO to measure power loss resulting from different bending radii are proposed in this paper. A lower limit for radius of curvature for an attack to be undetected is obtained and the estimations in the literature for power loss resulting from fiber bending is validated.

Fiber optic cables have long been considered a secure medium that prevents eavesdropping due to their complexity. However, there are attack methods that allow eavesdropping or denial of service. These include methods based on bending optical fibers. The danger resides in the possibility of being able to carry out an attack without having to interrupt the path. To facilitate such attacks, it is possible to use a clip-on coupler. This coupler is designed to allow eavesdropping on the link without interruption. In this study, we focus on evaluating the coupling efficiency of a simple but commercially available clip-on coupler. This work investigates the effectiveness of jamming into the optical link, i.e., replicating the jamming attack and measuring it by simulating real traffic conditions. To better understand the complexity of these attacks, we perform additional measurements to investigate the effect of clip-on coupling on changes in the polarization state. Through this research, we highlight the increasing vulnerability of optical fibers to eavesdropping attempts, especially those using macro-based methods. By evaluating the performance of commercially available clip-on coupling, we provide valuable insights into potential risks and mitigation strategies for securing modern optical communication networks.

We describe a layer-1-based intrusion detection system for fiber-optic–based networks. Layer-1-based intrusion detection represents a significant elevation in security as it prohibits an adversary from obtaining information in the first place (no cryptanalysis is possible). We describe the experimental setup of the intrusion detection system, which is based on monitoring the behavior of certain attributes of light both in unperturbed and perturbed optical fiber links. The system was tested with optical fiber links of various lengths and types, under different environmental conditions, and under changes in fiber geometry similar to what is experienced during tapping activity. Comparison of the results for perturbed and unperturbed links has shown that the state of polarization is more sensitive to intrusion activity than the degree of polarization or power of the received light. The testing was conducted in a simulated telecommunication network environment that included both underground and aerial links. The links were monitored for intrusion activity. Attempts to tap the link were easily detected with no apparent degradation in the visual quality of the real-time surveillance video.

We investigate taper tapping in three types of single-mode fibers using simulations and experiments: Standard single-mode fiber (SMF), bend-resistant single-mode fiber (BR-SMF) with a shallow index trench, and bend-insensitive single-mode fiber (BI-SMF) with a deep index trench. Both trench-assisted fibers demonstrate a larger mode field expansion than the standard single-mode fiber, making them more susceptible to taper-tapping than standard single-mode fibers. Tapering both SSMF and BR-SMF fibers to as little as

\mathrm {25~\mu m}

diameter results in a high information extraction efficiency for an eavesdropper (

\mathrm {\geq -20~dB}

) while maintaining low loss for the legitimate channel (

\mathrm {\leq 1~dB}

), underlining the vulnerability of all fiber types to taper tapping. We also use optical time-domain reflectometry (OTDR) to identify changes in the fiber before and after tapering. Changes in the back reflected power of

\mathrm {\leq 0.5~dB}

and

\mathrm {\leq 0.25~dB}

are observed in

\mathrm {25~\mu m}

tapers in SMF and BR-SMF respectively.

Optical communication networks transport an enormous aggregate client traffic, a good part of which is highly sensitive. As such, the optical signal in the fiber medium becomes attractive to bad actors in an attempt to tap the fiber or a component on the path in order to eavesdrop, source mimic, or attack to cause service denial. Therefore, it is important that the network has built-in security features to monitor the channel integrity and to also detect if and when unauthorized intervention has taken place. It is also important that the network is intelligent to countermeasure bad actors. Because the integrity of optical channels in are also affected by component degradation, photon-matter interactions and other non-linear phenomena, the network should be able to differentiate between malicious interventions and parametric degradations. In this paper we identify observable performance parameters and predictors, we describe a estimating method for in-line parameter monitoring, we conclusively distinguish between component degradations and intervention of a malicious eavesdropper and we describe countermeasure mechanisms.

Optical communication networks transport an enormous aggregate client traffic, a good part of which is highly sensitive. As such, the optical signal in the fiber medium becomes attractive to bad actors in an attempt to tap the fiber or a component on the path in order to eavesdrop, source mimic, or attack to cause service denial. Therefore, it is important that the network has built-in security features to monitor the channel integrity and to also detect if and when unauthorized intervention has taken place. It is also important that the network is intelligent to countermeasure bad actors. Because the integrity of optical channels in are also affected by component degradation, photon-matter interactions and other non-linear phenomena, the network should be able to differentiate between malicious interventions and parametric degradations. In this paper we identify observable performance parameters and predictors, we describe a estimating method for in-line parameter monitoring, we conclusively distinguish between component degradations and intervention of a malicious eavesdropper and we describe countermeasure mechanisms.