This paper will identify, raise awareness of, and help reduce risks to NATO’s nuclear weapon systems arising from cybersecurity vulnerabilities. It aims to respond to the need for more public information on cyber risks in NATO’s nuclear mission, and to provide policy-driven research to shape and inform nuclear policy at member-state level.
Appendix II: Nuclear Sharing
The concept of nuclear sharing was developed during the Cold War as a means by which to both improve the Alliance’s readiness to respond to attack from the USSR and provide a more comprehensive deterrent. By the 1950s, the US had deemed that the only feasible way in which to counter the conventional threat posed by the USSR in Europe was to station nuclear weapons throughout Western Europe.204 This led to the first nuclear weapons being stationed in Europe in September 1954; however, it is recorded that non-nuclear components, including bomb casings or assembles, were transported to the UK as early as 1950.205 Subsequently, the US has stationed nuclear weapons throughout Europe. The exact numbers are not known, but experts have estimated current stockpiles as detailed in the table below.206
|
Airbase |
Location |
Operated by |
2019 estimated stockpiles |
|---|---|---|---|
|
Aviano |
Italy |
NATO (US) |
25–35 US non-strategic B-61 gravity bombs |
|
Ghedi Torre |
Italy |
Italy |
20 US non-strategic B-61 gravity bombs |
|
Büchel |
Germany |
Joint: US & Germany |
10–20 US non-strategic B-61 gravity bombs |
|
Volkel |
Netherlands |
Netherlands |
10–20 US non-strategic B-61 gravity bombs |
|
Kleine Brogel |
Belgium |
Belgium |
10–20 US non-strategic B-61 gravity bombs |
|
Incirlik |
Turkey |
Turkey |
50 US non-strategic B-61 gravity bombs |
As the table above identifies, the US currently has solely B-61 gravity bombs at the listed airbases. These bombs are stored in an underground weapon security and survivability system (WS3),207 with electronic monitoring and control units that include sensors, electronic-data transmission units, motion detectors, video cameras, etc. At the depths of the Cold War, these numbers were greater and additional airbases also served as host to US nuclear weapons.208 While the US has provided the munitions, the host states have been responsible for the vehicles to deliver the payloads, which includes their maintenance. This again contributes to the sharing of the burden among NATO member states; this element of the agreement has presented challenges, which will be considered later.
From the early 1960s, codified nuclear sharing agreements between NATO members began to develop in order to govern the use of these weapons, beginning with the establishment of consultation procedures, which have their roots in the revision of the NATO doctrine under then US Secretary of Defense Robert McNamara.209 Given the highly confidential and sensitive nature of this process, publicly available information on how this consultation takes place, and by what means, is rather limited. However, one of few resources in the public domain notes that the entire request and release sequence would take 24 hours when accounting for transmission of request.210 While the technology used for the purpose of conveying commands has developed significantly throughout subsequent decades, reducing the time required in order to relay messages, open source material provides interesting insights into the procedures involved in the approval of a nuclear mission from a host state. Of particular note is that, notwithstanding the purpose of the consultation process to allow for the possibility of a host or potentially affected state to veto the use of nuclear weapons, this consultation process has historically been established to take place ‘time and circumstances permitting’.211 This proviso serves to undermine the basis of the consultation process, rendering it non-mandatory and opening the possibility that it could be bypassed in conditions in which time frames are often compressed. However, and regardless of the consultation process, nuclear host countries have been part of the NPG, and in practical terms control of the military bases that weapons would deploy out of are under their control, so they can veto at the planning stage on a scenario basis and can in practice prevent a decision if they really wanted to. On balance, therefore, the use of nuclear weapons by host countries without US consent is in all probability the most concerning scenario, rather than vice versa.
Nuclear sharing was primarily developed as a means by which to share the burden of maintaining the NATO nuclear deterrent among Alliance members.212 As part of these agreements, US nuclear weapons have been hosted within the various member countries, remaining in the custody of the US until required for missions, at which point custody and responsibility would be transferred to the host nation for delivery.213 This also serves as the means by which NATO member states that do not possess nuclear weapons are able to host them without contravening the nuclear Non-Proliferation Treaty (NPT), as they remain, according to NATO, in the ‘absolute control and custody’214 of the nuclear weapon states of the Alliance during peacetime, with transfer of control and custody undertaken solely at time of war.215
Partially in response to increasing political pressure from host states, not least arising from a series of near misses at the various European host sites,216 ‘dual key’ arrangements were reportedly established to add an additional layer of security and to share the burden further. The dual key system requires the authorization of both the US and the host country in order for the weapons to be used.217 This mechanism involves the incorporation of electronic locks, also known as Permissive Action Links (PALs),218 which US personnel would have to deactivate prior to usage, after which point pilots from NATO host countries would have full control over the weapons until delivery.219
There are, however, numerous inherent challenges posed by the maintenance of these nuclear sharing agreements that, together, constitute security concerns deserving of consideration. As part of the nuclear sharing agreements between the US and host countries, ‘custody, repair and improvements to the weapons and the storage bunkers are the responsibility of the U.S. Air Force’, whereas ‘perimeter security (fences, monitors, and motion detectors) and access to the storage sites is the responsibility of the host nation’.220 This complicates matters, as the maintenance of both is essential to the secure storage and security of the weapons; however, as the arrangement seems to exist, the US and the host state are reliant on each other to uphold their respective commitment. Such circumstances can be detrimental to ensuring the safety and security of holding weapons in host states, as detailed in the US Department of Defense’s Blue Ribbon Report released in 2008.221 Notably, standards in both personnel and physical security measures were found to vary across the different host bases; and the ‘host nation support to maintain security infrastructure at nuclear-capable units’ was stated to remain an issue, with most in need of resources to meet the US Department of Defense security requirements.222 The US has limited scope to ensure that efforts are made to ameliorate such security threats beyond investing in modernizing these facilities and encouraging the host state to take the necessary security measures, thus exerting pressure on the sharing agreements.223
Concerns over the physical security of nuclear weapons hosted in Europe have been exacerbated in recent years by a combination of increasing regional instability in Europe and its near-neighbourhood, combined with the actions of non-state armed groups and paramilitary groups.224 It has been reported that the commander of the Incirlik Air Base was involved in the attempted coup in Turkey in 2016, and that the Turkish authorities cut off the power supply to the base in order to reduce the risk of conspirators using the facility.225 Officials and experts raised both safety and security concerns over Incirlik Air Base after this incident, as the US nuclear weapons had to rely on back-up power for a period of five days after the coup attempt was discovered. It had already been acknowledged in the early 2000s that there was a growing likelihood of a terrorist attack against a European NATO base hosting nuclear weapons;226 and this concern has latterly been fuelled by recent actions by Islamic State of Iraq and Syria (ISIS). Following the terrorist attacks in Paris and Brussels in late 2015 and early 2016, it emerged that ISIS operatives had been observing nuclear facilities in Belgium, leading to increased concerns that the group was aiming to target nuclear facilities and potentially acquire nuclear materials.227 This intelligence served to heighten existing concerns (including in the US government) over the security of nuclear sites in Belgium, which once more underscores the inherent vulnerabilities that exist as a result of NATO’s nuclear sharing agreements and the delegation of responsibility for ensuring that facilities are secure. The possibility of cyber intrusion into the nuclear enterprise also remains as a possibility, especially considering that Iranian civil nuclear centrifuges were affected by a malware (Stuxnet) in 2010,228 and that the US has reportedly infiltrated the North Korean ballistic missile system and caused failures during the testing stage.229
When NATO’s nuclear sharing agreements were first established, the threat landscape was dramatically different compared with that of the present day. Adversaries and the nature of threats have changed, as have theatres of warfare, as technological advancements have contributed towards new military approaches. These changes have led to reconsideration of the necessity of hosting US nuclear weapons in Europe,230 as well as of the existing nuclear sharing agreements.231 In particular, such reconsideration has been motivated by concerns over legacy infrastructure, not least in a context in which treaties are being abandoned, and nuclear infrastructure is being modernized with digital means, increasing the attack vector for cyberattacks.232 Presently, it is believed that Incirlik Air Base in Turkey, which is estimated to host around 50 US B-61 bombs, does not have permanent nuclear-capable aircraft (F-16s) and is thus unable to carry out joint nuclear missions at short notice, as envisaged under NATO nuclear sharing agreements.233 This has been complicated further by the recent removal of Turkey from the F-35 joint strike fighter programme as a result of its interest in purchasing the Russian S-400 air defence system.234 The F-35 had been intended to replace the previous nuclear-capable aircraft in Turkey; however, the US raised concerns over the capability of the Russian-developed air defence system to collect stealth information on the F-35. In particular, concerns have centred on the potential connectivity between the S-400 and the F-35’s Autonomic Logistics Information System (ALIS), which is core to operating it with a global fleet understanding.235 As such, this overlapping of C4ISR systems could provide unprecedented access to a host of sensitive information. At present, it appears that remaining nuclear-capable F-16s that are currently stationed at other airbases (Balıkesir and Akıncı) throughout Turkey would need to be used in order for Turkey to remain actively involved in the delivery of the weapons stationed at Incirlik.236 This complicates the timeline of deciding, planning and preparing for a tactical nuclear operation from Turkey,237 reducing the credibility of nuclear deterrence provided by the host country.
Taken together, these developments will likely provoke questions over the sustainability of the nuclear sharing agreement between the US and Turkey. It will also raise questions as to what type of cybersecurity arrangements exist between the host country and the US in order to protect the airbases in Europe against threat. Moreover, considering that most of the nuclear weapons have been in the European territory for several decades, their modernization has been in discussion within the US. Although modernization is fundamentally important for nuclear safety, it carries cybersecurity risks (e.g. new digital components integrated to legacy systems, patching, etc.) that should not be underestimated.
204 Alberque, W (2017), The NPT and the origins of NATO’s nuclear sharing arrangements.
205 Norris, R. S, Arkin, W. M. and Burr, W. (1999), ‘Where they were’, Bulletin of the Atomic Scientists, 55(6), pp. 26–35, https://www.archives.gov/files/declassification/pidb/meetings/where-the… (accessed 6 Oct. 2019).
206 Data gathered from Nuclear Threat Initiative (2019), ‘Nuclear Disarmament Italy’, https://www.nti.org/analysis/articles/italy-nuclear-disarmament/ (accessed 10 Oct. 2019); Nuclear Threat Initiative (2019), ‘Nuclear Disarmament Germany’, https://www.nti.org/analysis/articles/germany-nuclear-disarmament/ (accessed 10 Oct. 2019); Nuclear Threat Initiative (2019), ‘Nuclear Disarmament Netherlands’, https://www.nti.org/analysis/articles/netherlands-nuclear-disarmament/ (accessed 10 Oct. 2019); Nuclear Threat Initiative (2019), ‘Nuclear Disarmament Belgium’, https://www.nti.org/analysis/articles/belgium-nuclear-disarmament/ (accessed 10 Oct. 2019); and Nuclear Threat Initiative (2019), ‘Nuclear Disarmament Turkey’, https://www.nti.org/analysis/articles/turkey-nuclear-disarmament/ (accessed 10 Oct. 2019). Hans Kristensen also highlights similar numbers; although he makes a precise estimate, stating that in Belgium, Germany, Italy and Netherlands there are 20 B61 bombers. See Kristensen, H. M. (2019), ‘U.S. Nuclear Weapons in Europe’, Briefing to the Center for Arms Control and Non-Proliferation, Federation of American Scientists, 1 November 2019, https://fas.org/wp-content/uploads/2019/11/Brief2019_EuroNukes_CACNP_.p… (accessed 25 Dec. 2019).
207 The US calls this system a Weapon Storage and Security System.
208 Kristensen, H. M. (2005), U.S. Nuclear Weapons in Europe: A Review of Post-Cold War Policy, Force Levels, and War Planning, Natural Resources Defense Council, https://www.nrdc.org/sites/default/files/euro.pdf (accessed 10 Oct. 2019).
209 Charles, D. (1985), ‘Who controls NATO’s nuclear weapons?’, Bulletin of the Atomic Scientists, 41(4), pp. 45–48, doi: 10.1080/00963402.1985.11455949 (accessed 10 Oct. 2019).
210 Kelleher, C. M. (1987), ‘NATO Nuclear Operations’, in Carter, A. B., Steinbruner, J. D. and Zrakat, C. A. (eds) (1987), Managing Nuclear Operations, Washington, DC: Brookings Institution, p. 457; Ball, D. ‘Controlling Theatre Nuclear War’, British Journal of Political Science, 19(3), p. 320, https://www.jstor.org/stable/193844 (accessed 25 Dec. 2019).
211 Charles (1985), ‘Who controls NATO’s nuclear weapons?’.
212 Chalmers, M. (2009), ‘NATO’s Nuclear Weapons: An Introduction to the Debate’, in Chalmers, M. and Lunn, S. (2009), NATO’s Tactical Nuclear Dilemma, Royal United Services Institute, pp. 1–5, https://rusi.org/sites/default/files/201003_op_natos_tactical_nuclear_d… (accessed 10 Oct. 2019).
213 King, J., Lindborg, C. and Maxon, P. (2008) NATO nuclear sharing: Opportunity for change? BASIC Getting to Zero Papers Number 9, pp. 1–2, https://basicint.org/wp-content/uploads/2018/06/gtz09_0.pdf (accessed 10 Oct. 2019).
214 NATO (2017), NATO and the Non-Proliferation Treaty, NATO, https://www.nato.int/nato_static_fl2014/assets/pdf/pdf_2017_03/20170323… (accessed 10 Oct. 2019).
215 See King, Lindborg and Maxon (2008), NATO nuclear sharing: Opportunity for change? However, this argument has been subject to continued contest on the grounds that the mere hosting of nuclear weapons in fact serves to contravene the NPT. See also:Spagnuolo, L. (2011), NATO’s nuclear Posture and Burden Sharing Arrangements: an Italian perspective, BASIC, https://basicint.org/wp-content/uploads/2018/06/report_from_roundtable_… (accessed 10 Oct. 2019).
216 See Schlosser, E. (2013), Command and Control: Nuclear Weapons, the Damascus Accident, and the Illusion of Safety, New York: Penguin Books.
217 Williams, I. and Andreasen, S. P. (2015), ‘The Future of NATO’s Nukes’, Hoover Institution, 25 March 2015, https://www.hoover.org/research/future-natos-nukes (accessed 6 Oct. 2019); Linne, R. L (1994), The History of NATO TNF Policy: The Role of Studies, Analysis and Exercises Conference Proceedings, Livermore: Sandia National Laboratories, https://inis.iaea.org/collection/NCLCollectionStore/_Public/26/072/2607… (accessed 10 Oct. 2019).
218 Kristensen (2005), U.S. Nuclear Weapons in Europe: A Review of Post-Cold War Policy, Force Levels, and War Planning.
219 Sechser, T. S. (2016), ‘Sharing the bomb: how foreign nuclear deployments shape nonproliferation and deterrence’, The Nonproliferation Review, 23(3–4), pp. 443–458, doi: 10.1080/10736700.2016.1259062 (accessed 10 Oct. 2019).
220 Remkes, R. C. N. (2011), ‘The Security of NATO Nuclear Weapons: Issues and Implications’, in Andreasen, S. and Williams, I. (eds) (2011), Reducing Nuclear Risks in Europe: A Framework for Action, Nuclear Threat Initiative, pp. 66–75, https://media.nti.org/pdfs/NTI_Framework_Chpt3.pdf (accessed 10 Oct. 2019).
221 Peyer, P. A. (2008), Air Force Blue Ribbon Review of Nuclear Weapons Policies and Procedures, Headquarters U.S. Air Force, https://fas.org/nuke/guide/usa/doctrine/usaf/BRR-2008.pdf (accessed 10 Oct. 2019).
222 Ibid., pp. 50–52.
223 Other studies have also indicated that American bases within the US also face similar challenges. See Lewis, P., Aghlani, S., Pelopidas, B. and Williams, H. (2014), Too Close for Comfort: Cases of Near Nuclear Use and Options for Policy, Chatham House Report, London: Royal Institute of International Affairs, https://www.chathamhouse.org/publications/papers/view/199200 (accessed 10 Oct. 2019).
224 Remkes (2011), ‘The Security of NATO Nuclear Weapons: Issues and Implications’.
225 Borger, J. (2016), ‘Turkey coup attempt raises fears over safety of US nuclear stockpile’, Guardian, 17 July 2016, https://www.theguardian.com/us-news/2016/jul/17/turkey-coup-attempt-rai… (accessed 25 Dec. 2019).
226 Ibid.
227 Rubin, A. J. and Schreuer, M. (2016), ‘Belgium Fears Nuclear Plants Are Vulnerable’, New York Times, 25 March 2016, https://www.nytimes.com/2016/03/26/world/europe/belgium-fears-nuclear-p… (accessed 10 Oct. 2019).
228 Broad, W., Markoff, J. and Sanger, D. (2011), ‘Israeli Test on Worm Called Crucial in Iran Nuclear Delay’, New York Times, 15 January 2011, https://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html (accessed 20 Jun. 2020).
229 Gartzke, E. and Lindsay, J. (2017), ‘The U.S. wants to stop North Korean missiles before they launch. That may not be a great idea’, Washington Post, 15 March 2017, https://www.washingtonpost.com/news/monkey-cage/wp/2017/03/15/the-u-s-w…- korean-missiles-before-they-launch-that-may-not-be-a-great-idea/ (accessed 1 Dec. 2019); Gartzke, E. and Lindsay, J. R. (2017), ‘Thermonuclear cyberwar’, Journal of Cybersecurity, 3(1): pp. 37–48, https://doi.org/10.1093/cybsec/tyw017 (accessed 11 Jul. 2020).
230 Varialle, C. (2015), Tactical Nuclear Weapons, NATO and Deterrence: Are NATO’s TNW actually a threat to the credibility of its own deterrence?, BASIC, https://www.basicint.org/wp-content/uploads/2018/06/tnw-nato-deterrence… (accessed 10 Oct. 2019).
232 Erlanger, S. (2019), ‘Are We Headed for Another Expensive Nuclear Arms Race? Could Be.’, New York Times, 8 August 2019, https://www.nytimes.com/2019/08/08/world/europe/arms-race-russia-china… (accessed 10 Oct. 2019).
233 Street, T. (2018), NATO Nuclear Sharing, Org Explains #5, Oxford Research Group, https://www.oxfordresearchgroup.org.uk/Handlers/Download.ashx?IDMF=0eb9… (accessed 10 Oct. 2019).
234 Mehta, A. (2019), ‘Turkey officially kicked out of F-35 program, costing US half a billion dollars’, Defense News, https://www.defensenews.com/air/2019/07/17/turkey-officially-kicked-out… (accessed 10 Oct. 2019).
235 Kasapoğlu, C. (2019), ‘Turkey and Nuclear Command, Control and Communications’, NAPSNet Special Reports, https://nautilus.org/napsnet/napsnet-special-reports/turkey-and-nuclear… (accessed 10 Oct. 2019).
236 Ibid.
237 Ibid.