Aleem Datoo, British American Security Information Council (BASIC), outlines just how vulnerable the UK’s nuclear weapons system is to cyber security threats.

Article from SGR Newsletter no.45; online publication 24 February 2017
 

Download pdf of article
 

Following global trends, UK military operations are increasingly dependent on a range of interconnected cyber networks. Cyber security for these military systems needs continuous assessment. The UK’s Trident system¹ is particularly susceptible as a high-value target to a potential adversary and its elaborate design. All military systems have cyber vulnerabilities, and Trident is no exception.

The term ‘cyber’ comprises all components that relay digital information including both software and hardware and the human control, and a cyber attack is one that disrupts cyber dependent systems. Contrary to popular belief, the short history of cyber warfare has already proven² that ‘air gapping’ ³ a system is no assurance of invulnerability. A cyber attack can involve the introduction of malicious software or hardware at any point during operation, construction, overhaul or maintenance. A particular piece of malware can lay dormant and undetectable by the operators until it is activated by time delay, algorithm design or remote trigger.

The diversity of infection points, the vast number of computers, lines of code and pieces of hardware that form Trident’s cyber system mean the vulnerability is real. A Cyber Primer published by the British government reported that in 2008 that a cyber worm from Ukraine penetrated all systems using Windows operating systems including those in the Royal Navy, the MoD’s administrative systems and the House of Commons.⁴ Royal Navy submarines use ‘Windows for Submarines’,⁵ significantly more susceptible to malware than a bespoke system based upon Linux.⁶

The Trident system receives regular maintenance and patch-ups involving updating both the software and hardware, and this is when it is most vulnerable to the introduction of malware. This vulnerability will extend to the Successor submarines – now named ‘Dreadnought’ – whilst their software programs are written and hardware components are being designed by several private companies. Infiltration may not be immediately apparent and would likely involve remote or pre-programmed activation,⁷ making an attack both difficult to identify and defend against. The effects that malware could have are varied. Its purpose could be to gather information, such as design details or the location of the submarine (rendering its stealth qualities futile). It could even impact or neutralise the basic function of the submarine or missiles.

Countermeasures are not simple. It is possible to build rigorous software defences against penetration and use ‘red teams’ to identify holes to be patched, but dealing with millions of lines of code based on a stock Windows system it is impossible to guarantee the system.⁸ It is possible to reinforce the security of hardware design and maintenance, but much of this is conducted outside the UK or within private organisations not explicitly accountable for UK Trident’s cyber security.⁹

According to the US Defense Science Board (DSB), the annual cost of reinforcing its cyber vulnerabilities is $500 million.¹⁰ In a 2013 report, they claimed “most of our [nuclear deterrent] systems have not been assessed against a [high] tier cyber attack,” and will look to address the military cyber vulnerabilities through the Third Offset Strategy.¹¹

UK Defence Secretary Michael Fallon’s attempts to give assurances in the context of growing concerns around cyber security for Trident in early 2016 rang somewhat hollow. “As for cyber-attack, while deployed, submarines operate in isolation. It is hard to think of a system [Trident] less susceptible to a cyber-attack.” ¹² Despite the UK’s 2015 Strategic Defence and Security Review that promised £860 million for cyber security,¹³ and despite the tests and inspections conducted on Trident systems by the Royal Navy,¹⁴ Fallon’s comments suggest a lack of understanding around the nature of cyber vulnerabilities.

States are directing significant resources into their offensive and defensive cyber capabilities. This, coupled with a critical lack of rules of engagement and mechanisms of attributability, necessitate an attention for all nuclear armed states to invest heavily in cyber defences for their systems, though it will never be possible to provide complete cyber security. The UK needs to conduct continuous and thorough assessments of the vulnerabilities to Trident, and the cyber dimension feature more in its decision making over the Successor Program. The danger that Successor submarines could become a significant security liability for the UK is real.
 

Aleem Datoo is a researcher with BASIC, and lead author of a briefing on Trident’s cyber vulnerabilities.¹⁵
 

References

1. Referring to the Trident missiles, nuclear warheads and the Vanguard Class Submarines.