A recent Guardian investigation alleges that the Sellafield nuclear waste management site in the UK has been subjected to numerous cybersecurity breaches over the years.
These alleged breaches are wide-ranging, including an insecure server network which according to the Guardian, hackers have been able to access for years. Other alleged unsafe working practices are also identified, such as contractors being able to plug USB sticks into the system unsupervised when servicing it.
While the UK government response said there was no evidence of a hack by state actors, the Office for Nuclear Regulation (ONR) has placed Sellafield under ‘significantly enhanced regulatory attention’ as it was not satisfied with cybersecurity standards at the site.
Sellafield is not the only UK nuclear site which has received this label recently. Earlier this year, the energy company EDF, which runs five of the UK’s active nuclear power plants, as well as three which are decommissioning, was also placed under ‘significantly enhanced regulatory attention’ due to its cybersecurity practices.
The ONR was not satisfied with the cybersecurity standard in several of EDF’s nuclear power plants and will need to see enhancements at the next inspection to change the company’s status to a lower-risk one. EDF had already been alerted in 2022 that it would need to upgrade its cybersecurity practices for nuclear power plants but fell short of ONR’s expectations.
Longstanding issues with UK nuclear cybersecurity
It is disappointing to see significant cybersecurity issues remain in the UK nuclear industry. The nuclear industry overall was relatively late to the cybersecurity conversation, as previous Chatham House research identified, and this is by no means a new conversation.
Concerns about cybersecurity have existed for decades. Because of the nuclear industry’s strong emphasis on physical security, and the fact that much of the control software used in nuclear power plants was at first bespoke or only distributed to a small number of specialized facilities, there was a sense throughout the industry that it was managing cybersecurity risks adequately.
But, as the use of IT systems spread further and upgrades included off-the-shelf software packages, the nuclear industry’s cybersecurity practices did not keep pace.
The International Atomic Energy Agency (IAEA) has issued a set of recommendations and standards which states should adhere to, but their implementation is left up to each individual state government. This means that the cybersecurity standard for nuclear sites is applied unevenly, depending on government and operator awareness and capacity.
This could have far-reaching consequences. At Sellafield, the Guardian claims include concerns that the hackers have had access to information about the UK’s nuclear materials management and other sensitive data.
Security threats
The alleged security breaches could have long-term security implications for the UK and for nuclear security, depending on exactly what kind of data hackers might have had access to.
Digital access to IT infrastructure could grant physical control over systems, as was the case in the Stuxnet attack on Iran’s nuclear centrifuges.
Although highly unlikely in the UK, due to the safety measures in place, such an attack could lead to an accident which could result in radiation being released, causing damage to people’s health and contaminating the environment.
There are also risks of disrupting the UK’s energy supply if an attack targets a nuclear power plant, and the threat of hackers holding data or other sensitive information for ransom.
The UK’s Civil Nuclear Cyber Strategy 2022 recognizes these risks and lays out a plan to address them, but the time frame to 2026 seems too generous given that several of these risks have been known for years and should have been mitigated years ago.
With the UK’s nuclear sector expected to grow in size and importance due to net zero commitments, this is an urgent area for improvement.
Simple, urgent actions for the industry
Some simple steps are already recognized as best practice and could be taken far quicker than over the next four years.
Cyber security maturity assessments and PEST analysis as used in other sectors, would assist nuclear risk insurers and regulators to ascertain the effectiveness of responses to cyber threats.
Greater transparency would also help. It is very difficult to know what exactly is going on at Sellafield, or at the EDF sites under significantly enhanced ONR attention: ONR reports do not tend to go into significant detail, beyond saying whether or not cybersecurity standards have been reached.