The UK’s Trident submarine fleet is vulnerable to a “catastrophic” cyber-attack that could render Britain’s nuclear weapons useless, according to a report by a London-based thinktank.
The 38-page report, Hacking UK Trident: A Growing Threat, warns that a successful cyber-attack could “neutralise operations, lead to loss of life, defeat or perhaps even the catastrophic exchange of nuclear warheads (directly or indirectly)”.
The Ministry of Defence has repeatedly said the operating systems of Britain’s nuclear submarines cannot be penetrated while at sea because they are not connected to the internet at that point.
But the report’s authors, the British American Security Information Council (Basic), expressed scepticism.
“Submarines on patrol are clearly air-gapped, not being connected to the internet or other networks, except when receiving (very simple) data from outside. As a consequence, it has sometimes been claimed by officials that Trident is safe from hacking. But this is patently false and complacent,” they say in the report.
Even if it were true that a submarine at sea could not be attacked digitally, the report points out that the vessels are only at sea part of the time and are vulnerable to the introduction of malware at other points, such as during maintenance while docked at the Faslane naval base in Scotland.
The report says: “Trident’s sensitive cyber systems are not connected to the internet or any other civilian network. Nevertheless, the vessel, missiles, warheads and all the various support systems rely on networked computers, devices and software, and each of these have to be designed and programmed. All of them incorporate unique data and must be regularly upgraded, reconfigured and patched.”
The UK has four nuclear missile-carrying submarines, which are in the process of being replaced. Their replacements are scheduled to go into service in the early 2030s.
The report comes after the cyber-attack last month that disrupted the NHS, which uses the same Windows software as the Trident submarines. There was speculation too that the US used cyberwarfare to destroy a North Korean missile test. A Trident test-firing of a missile last year off the coast of Florida also went awry, with no official explanation given.
The report was co-written by Stanislav Abaimov, a researcher in cybersecurity and electronic engineering at the University of Rome and a graduate of the Moscow State Institute of Electronics and Mathematics, and Paul Ingram, Basic’s executive director.
In reaction to the report, Des Browne, who as UK defence secretary in 2007 was responsible for steering the original decision to renew Trident through parliament, said: “The WannaCry worm attack earlier this month affecting 300,000 computers worldwide, including vital NHS services, was just a taste of what is possible when cyber-weapons are stolen.
“To imagine that critical digital systems at the heart of nuclear weapon systems are somehow immune or can be confidently protected by dedicated teams of network managers is to be irresponsibly complacent.”
Abaimov said: “There are numerous cyber vulnerabilities in the Trident system at each stage of operation, from design to decommissioning. An effective approach to reducing the risk would involve a massive and inevitably expensive operation to strengthen the resilience of subcontractors, maintenance systems, components design and even software updates. If the UK is to continue deploying nuclear weapon systems this is an essential and urgent task in the era of cyberwarfare.”
The report’s authors estimate that the capital costs for the UK government to improve cybersecurity for the Trident programme would run to several billions of pounds over the next 15 years.
The report is to be published on the Basic website.
- This article was amended on 1 June 2017. The UK has four nuclear missile-carrying submarines, not four nuclear-powered submarines as stated in an earlier version.