Yes, fiber optic cables can be tapped, and a well-executed tap doesn’t need to cut the fiber or interrupt the signal to do it. This guide covers exactly how a fiber tap works, where the weak points in a typical network sit, what detection methods actually catch and where they fall short, and how the leading Layer 1 security approaches compare on closing the gap encryption leaves open.
What Fiber Optic Tapping Actually Means
Fiber tapping is the physical interception of a fiber optic line: diverting a portion of the light traveling through the cable to a separate receiver without stopping the original signal from reaching its destination. Because this happens at the physical layer, before any digital processing occurs, it falls outside the scope of virtually all standard network security monitoring. That’s the single fact that makes this risk category different from almost everything else on a typical threat model, and it’s why fiber taps show up repeatedly in the history of both corporate espionage and state-level surveillance operations.
The Two Methods Used to Tap a Fiber
There are two primary techniques, and both are well documented.
A bend tap works by flexing bare fiber past its minimum bend radius. This causes a portion of the light to escape through the cladding, where a clamped photodetector positioned against the fiber can read it. No splice is required, and the fiber itself isn’t broken.
A coupler or splitter tap is more deliberate. A small optical component is spliced directly into the line, diverting a fixed percentage of the light down a secondary fiber to the interceptor’s equipment. This is the same underlying technology used in legitimate network monitoring — commercial splitters commonly ship in ratios like 70/30 or 90/10 — which means the hardware required isn’t specialized or hard to obtain.
Neither method needs to capture much light to be effective. A sensitive photodetector can reconstruct a fully readable signal from as little as 1-2% of the light passing through the fiber, and some documented cases have used splits even smaller than that. The remaining 98-99% of the signal continues on to its intended receiver, essentially unaffected. That asymmetry is what makes passive taps so difficult to catch through traffic behavior: both ends of the link keep functioning normally while a complete copy of the data quietly exits through a second path.
Where Taps Actually Happen
Taps target the weakest physical points in a network, not random locations along a route. Splice cabinets, manholes, and junction boxes are the recurring soft spots, since they’re far easier to access than a buried long-haul span. Any enterprise or carrier evaluating its exposure should weight physical security investment toward these access points specifically, not just the data center perimeter.
Why Taps Go Undetected — and Why Encryption Isn’t a Complete Fix
A passive tap produces no network-layer alert. Throughput stays where it should be, authentication behaves normally, and the only trace is a small, often tolerance-level optical loss. Tapping is a physical-layer event, while nearly all security monitoring operates at the digital layer above it — a structural mismatch, not a tooling failure.
Encryption is frequently assumed to close this gap, but it addresses a narrower problem than most people expect. Encryption determines whether an interceptor can read the data at the moment of capture. It does nothing to prevent that data from being recorded. A tapped, encrypted stream is unreadable today, but it remains a complete, storable copy — which is the foundation of harvest-now-decrypt-later (HNDL): an adversary captures the encrypted payload now and waits for the key exchange protecting it to eventually be broken.
Do you know The Fiber Link Nobody Could Tap, Even When We Let Them Try? It covers a real-world lab test of a 205-kilometer link against both naive fiber taps and rogue-transceiver attacks, which is a useful complement to the theory above.
That risk isn’t static. In July 2026, Anthropic’s Frontier Red Team reported that its Claude Mythos Preview model had autonomously developed a faster classical, non-quantum attack against round-reduced AES-128, covering 7 of the cipher’s 10 rounds at 200-800 times the speed of the previous best published attack. The result doesn’t break full AES-256 and has no effect on production systems today, but it demonstrates that AI-assisted cryptanalysis is progressing faster than most forecasts assumed — and data recorded today will eventually be attacked with whatever tools exist by the time an adversary tries to break it.
How Detection Works Today
Three methods make up the standard detection stack for fiber tapping, each with a different scope.
Optical time-domain reflectometry (OTDR) sends light pulses down a fiber and measures the backscattered light to build a loss profile for the span. A new bend, splice, or coupler shows up as an unexpected loss event when the current trace is compared against a stored baseline. This is the primary detection tool in active use across carrier and enterprise networks today.
Continuous power monitoring is the second layer. Carriers track received power in real time and flag deviations from expected patterns, though a low-percentage splitter tap can produce a loss small enough to stay under the alarm threshold entirely.
Physical security of cabinets and manholes forms the third and most consequential layer, since the large majority of documented tapping incidents target these access points rather than buried spans. Tamper-evident seals, scheduled inspection, and distributed acoustic sensing all work to shrink the window an attacker has to install and maintain a tap undetected.
Comparing the Leading Layer 1 Approaches
Once detection methods are understood, the more useful question for a network owner is which security layer actually closes the gap that detection and encryption leave open. Three vendors come up consistently in this comparison: Ciena, Adva Network Security, and CyberRidge.
| Vendor / Platform | Core Approach | What It Protects | Recording Risk After a Tap |
|---|---|---|---|
| Ciena — WaveLogic Encryption | Layer 1 optical encryption of the signal’s content | The meaning of the data (confidentiality of content) | Encrypted stream remains fully recordable and storable |
| Adva Network Security (Adtran) — ConnectGuard | Layer 1 encryption plus post-quantum key exchange options | The meaning of the data, and strengthens the key exchange against future attacks | Encrypted stream remains recordable; PQC protects the key, not the copy |
| CyberRidge — Carmel | Photonic-layer security: spectral spreading, a continuously changing optical key, and noise-floor burial | The signal itself, not only its meaning | Captured signal is designed to carry no usable, recoverable data |
Read as a group, the table shows a real split in philosophy rather than a simple feature comparison. Ciena’s WaveLogic Encryption and Adva’s ConnectGuard both make the tapped signal unreadable at the moment of capture — a well-established and effective approach to confidentiality — but both leave an encrypted, recordable stream behind, which is exactly the condition harvest-now-decrypt-later depends on. CyberRidge’s Carmel is built around a different premise: making the captured signal unusable regardless of what decryption capability eventually exists, by removing the recoverable signal itself rather than only scrambling its content.
For more on what a physically unrecordable link actually sounds like in practice, see this episode.
Bottom Line
Fiber can be tapped without triggering an outage, and the greatest real-world exposure sits at cabinets, junction boxes, and manholes rather than buried long-haul spans. OTDR baselines, power monitoring, and physical security together form the standard detection stack, and each catches a different slice of taps while leaving low-loss taps as a residual risk. Encryption protects what a tap can read, not what it can record — and that distinction is the entire premise behind harvest-now-decrypt-later, which is the risk that photonic-layer approaches like Carmel are specifically designed to close.
FAQ
Q: Can a fiber optic tap be installed without triggering an alarm?
A: Yes. A bend tap or a low-ratio splitter tap can add minimal insertion loss, often within a fiber span’s normal tolerance budget, which means it may never cross the threshold that power-monitoring alarms are calibrated to catch. This is why physical security of cabinets and junction boxes, combined with regular OTDR baseline comparisons, is treated as essential rather than optional by carriers.
Q: Does OTDR detect every type of fiber tap?
A: No. OTDR is effective against taps that introduce measurable, detectable loss along the span, but a well-executed low-ratio splitter tap can fall below the sensitivity threshold of a typical OTDR baseline comparison, leaving it undetected.
Q: How does CyberRidge’s Carmel differ from Ciena’s or Adva’s Layer 1 encryption?
A: Ciena’s WaveLogic Encryption and Adva’s ConnectGuard both encrypt the content of the optical signal, which prevents a tap from reading it in real time but leaves a recordable, encrypted copy behind. Carmel is designed to make the captured signal itself unusable — through spectral spreading, a constantly changing optical key, and noise-floor burial — closing the recording risk directly rather than only the reading risk.
Q: Is CyberRidge’s Carmel meant to replace post-quantum cryptography or QKD?
A: No. CyberRidge positions Carmel as complementary to PQC and QKD rather than a replacement. PQC and QKD protect the key exchange; Carmel protects the transmitted optical signal itself, addressing a different half of the same long-term risk.