Get a Better Understanding of Fiber Optic Taps
https://www.apcon.com/sites/default/files/Resources%20for%20Download/12064-a_apcon_tech_brief_-_fiber_optic_tap_lowres.pdf

Taps are a basic building block of network monitoring. By allowing network managers to “listen in” on
all network traffic between switches, routers, and other features on the network landscape, taps allow
network managers to observe the packets moving through the network without disturbing those packets.
In general, taps deliver full-duplex monitoring with 100 percent network traffic visibility, including layer 1
and 2 errors for comprehensive troubleshooting. Conversely, SPAN or Mirror ports often drop malformed packets, obscuring errors.

In the mid-1980s, I (JH) submitted a paper to a military fiber optics conference that covered how to tap fiber, how to detect it was being tapped and how to secure communications in fiber in case it was tapped. the paper was classified and until it was declassified around 2005, was not discussed.

First of all, tapping fiber is easy. You can buy optical splitters that plug into the network like a cable and divert a small amount of the light to a separate receiver. A typical tap passes 90-95% of the light and diverts 5-10%, often enough to run a separate receiver, certainly at the transmitter end.

But there is another way, using a simple trick that uses the property of an optical fiber that stressing it causes loss. Just put a bend in a fiber and aim a detector at the light that leaks out due to the stress. This is the same technology used for the test instrument called a fiber identifier. This will not work with bend-insensitive fiber, by the way, so if you want to prevent this type of tap or at least make it more difficult, use BI fiber.

If you know fiber can be tapped, how do you detect it? Put in your own coupler tap at the receiver end and monitor the power in the fiber continuously. If someone puts a tap on the fiber, you will see a drop in power, if only a few tenths of a dB, which is easy to detect.

Is it possible to wiretap a fiber optic cable without breaking the signal?
https://www.quora.com/Is-it-possible-to-wiretap-a-fiber-optic-cable-without-breaking-the-signal

In fact it is so easy to do that we used to set it as a project for new grads when they joined the research labs.

You have to strip off the outer plastic layers until you get to the glass fibre itself. You will need to practice this bit, as it is actually quite hard to do in the middle of a cable. You then need a second bare glass fibre, and run in parallel to the primary fibre.

To get the light to leak out you need to set up a series of microbends – and the easiest way to do this is with one of those giant plastic crocodile clips that you use to seal food bags. The aim is to get about 1% of the light to leak out of the primary fibre and be captured by the second fibre. It is best to do this nearer the transmit end of the fibre, as the power is strongest there.

It would be very hard for a person monitoring the primary cable to notice you doing this

Getting the light out of the fibre is the easy bit. The hard bit is actually decoding the raw signals and working out what the data was. Modern systems use coherent techniques to encode information in the amplitude, phase and polarisation of the light – and each manufacturer does things differently. So your best hope of success is to use a real receiver from the same manufacturer as the transmitter.

Detecting fiber taps

One way to detect fiber tapping is by noting increased attenuation added at the point of tapping. Some systems can detect sudden attenuation on a fiber link and will automatically raise an alarm.[2] There are, however, tappers which allow tapping without significant added attenuation.

In either case there should be a change of scattering pattern in that point in line which, potentially, can be detectable. However once the tapper has been detected it may be too late since a part of the information has been already eavesdropped.

One counter-measure is encryption to make the stolen data unintelligible to the thief.

Ethernet Taps – Don’t Get Me Started
http://www.fragmentationneeded.net/2012/01/ethernet-taps-dont-get-me-started.html

One firm says its “massive passive monitoring” equipment can “capture up to 1bn intercepts a day”. Some offer cameras hidden in cola cans, bricks or children’s carseats, while one manufacturer turns cars or vans into surveillance control centres.

There is nothing illegal about selling such equipment, and the companies say the new technologies are there to help governments defeat terrorism and crime.

In today’s world, hackers can easily obtain tools to tap into a fiber-optic line, what with a host of freely available YouTube videos that explain exactly how to do it.

In the Lab: Hacking an Optical Fiber Line in Minutes
https://www.youtube.com/watch?v=6ImKA6PVEH0

From our R&D lab in Ottawa, Ciena’s Patrick Scully demonstrates how simple it is to steal massive amounts of data by quickly and easily taping a fiber optic cable, and explains how optical encryption can be used to protect against this threat ensuring the security of all in-flight data.