HACKING UK TRIDENT: A Growing Threat JUNE 2017 BASIC Stanislav Abaimov and Paul Ingram British American Security Disclaimer Information Council (BASIC) 3 Whitehall Court Only publicly available information has been used in Westminster the research behind this publication. No classified London SQ1A 2EL information has been disclosed. We have been careful not to include a level of detail that could be of Charity Registration No. 1001081 use to any group that might be motivated and capable of compromising the security of the T: +44 (0) 20 77663465 operational systems concerned. Any cyber-attacks www.basicint.org that have any hope of success could only be mounted by a highly-sophisticated group probably © British American Security Information with the backing of a major state. This report will Council (BASIC), June 2017 have no impact upon the awareness or capabilities of any such group. The opinions expressed in this publication are the responsibility of the authors and do not necessarily reflect the views of BASIC. We have included in this report a number of scenarios to illustrate the type of threat this report is All rights reserved. No part of this publication discussing. The stories, characters and incidents may be reproduced or transmitted in any form portrayed in those illustrations are fictitious. or by any means, electronic or mechanical No identification with actual persons (living or including photocopying, recording or any deceased), specific subcontractors, hacking groups information storage or retrieval system, or foreign entities is intended or should be inferred. without the prior written permission of the copyright holder. Please direct all enquiries to the publishers. The Authors British American Security Information Council (BASIC) Stanislav Abaimov is a PhD researcher in Cyber Security and BASIC is a think tank based in Whitehall in London, Electronic Engineering in the taking a non-partisan, inclusive and dialogue-based University of Rome, Tor Vergata. approach to encourage stable global nuclear He has earned a degree of MSc disarmament, arms control and non-proliferation. in Information Security, Royal The organization works to facilitate constructive Holloway, University of London, engagement between siloed communities on an Academic Center of Excellence in Cyber Security, traditionally sensitive or complex issues of nuclear certified by EPSRC and GCHQ. He is also a policy, to create space for new and diverse graduate of the Moscow State Institute of Electronics perspectives to grow from those interactions. Over and Mathematics, faculty of “Automated Systems the 30 years since the organization was founded, in and Informatics in Control Systems”. During his 1987, BASIC has developed institutional expertise Master Studies Stanislav conducted his research in across a number of transatlantic issue areas, the field of Advanced Persistent Threat, security including the UK‑US nuclear relationship, the UK’s testing, digital forensics, and cyber warfare and Trident programme, the politics of disarmament and defence. His Ph.D. research focuses on CBRNe arms control in the UK Parliament, NATO nuclear cyber security and Industrial Control Systems in weapons in Europe, the Middle East, the evolving Critical Infrastructure. Stanislav is supporting role of responsibility in nuclear governance, research in SCADA systems in CBRNe and Critical and expanding technological threats to SSBN Infrastructure, ICS malware and his interests vary platforms. from cyber security in ICSs and Autonomous Weapons Systems to Wireless Communications, Threat Modelling, Network Analysis, and Cyber Defence. Paul Ingram is BASIC’s Executive Director. Paul has authored numerous BASIC reports and briefings covering a variety of nuclear and non‑nuclear issues since 2002, including cyber security and emerging vulnerabilities of SSBNs. He has extensive media experience and formerly hosted a weekly peak‑time talk show on IRINN (Iranian domestic TV News in Farsi) from 2007‑2012, addressing issues relevant to global security. Paul also taught systems approaches on the flagship Top Management Programme at the UK Government’s National School of Government from 2006‑2012. Executive Summary This paper reviews the growing potential for cyber-attack on the UK’s operational fleet of Vanguard-class submarines armed with nuclear-tipped Trident II D-5 ballistic missiles, and some of the implications for strategic stability. A successful attack could neutralise operations, penetrate and why). This has a transformative impact lead to loss of life, defeat or perhaps even the upon all forms of warfare. But there is a particular catastrophic exchange of nuclear warheads (directly danger associated with nuclear weapons by virtue of or indirectly). But the very possibility of cyber-attack their destructiveness that demands policy makers and the growing capability to launch them against and those responsible for managing the systems to SSBNs, could have a severe impact upon the consider more seriously the dangers involved when confidence of maintaining an assured second‑strike deploying nuclear weapon systems in an capability and therefore on strategic stability ever-changing technical and strategic environment. between states. Recent suggestions that the fleet is vulnerable have sometimes been met with Malware injection during manufacturing, mid-life complacency and claims that the isolated ‘air‑gapped’ refurbishment or software updates and data systems cannot be penetrated. Whilst we recognise transmission interception allow potential adversaries that it is important not to be alarmist, these claims to conduct long-term cyber operations. BASIC has are false. already highlighted the future potential for emerging technologies to deliver high confidence in global In a time of global interconnectivity and enhanced detection of submarines.1 Future weaponized accessibility to cyber tools, cyber warfare has underwater drones may facilitate close proximity already become a vital component of conventional kinetic and cyber-attacks on ballistic missile warfare, a new military domain in its own right. submarines (SSBNs). Advanced nano and bionic We are not talking about a lone wolf teenager in a technologies such as implantable and subdermal basement hacking into the controls of a missile and data storage and communication devices may be warhead and starting a nuclear war. Rather, we smuggled into the vessel and activated consider the most significant threat by some margin autonomously, manually or remotely. originates from the expanding investments by leading states in their offensive cyber capabilities, This report considers the major electronic network alongside their exiting intelligence networks. The and communication systems associated with the UK exponential growth in the complexity of cyber-attack Trident system to identify its level of exposure to techniques outmatches the defensive capabilities, a modern and future cyber-attacks. It reviews the trend that can only continue partly because any submarine systems architecture and its modus defensive operations have to anticipate all possible operandi, and identifies potentially applicable attack vectors before they are mounted, and partly cyber-attack techniques and scenarios. As it is based because the most effective form of defensive cyber upon publicly available sources, its conclusions operation involves offensive cyber intelligence cannot be considered final or definitive. (hacking into one’s opponents’ systems to glean information on what it is they are attempting to The report provides illustrative attack vectors aimed at disrupting, destroying or endangering operations. On the other hand, it also confirms that it takes “In addition to significant sophisticated, well-resourced and sustained cyber- investment in cyber defence, attacks to exploit the vulnerabilities in remote those responsible also need to submarine subsystems. These attacks are beyond the scope of all but the most well-resourced and consider strategies that build extensive non‑state groups. Essentially, the resilience within the systems, principal threat comes from other states’ cyber and to incorporate this threat operations alongside extensive and highly sophisticated intelligence activities. into broader assessments relevant to the choice of The overall submarine network architecture is weapon systems, platforms physically isolated from the internet and any civilian and broader defence and network, thus severely limiting the possibility of real time external access into the command network by security strategies.” remote hackers. This does not prevent attacks from inside the submarine or the prior injection of malware into submarines, missiles, warheads or other infrastructure at the manufacturing, construction and The challenge of maintaining covert and secure maintenance stages. Regular radio-transmissions patrols under reliable operational control is of utmost from ashore could be used for limited bandwidth importance to an effective nuclear deterrence cyber‑attacks, spoofing or activating pre‑installed posture based upon submarines. The continuous malware programmes. Such highly covert, adaptive and rapid development of new cyber technologies and targeted programmes could be designed to will inevitably result in some loss of confidence in trigger in response to particular events. This was the future patrols, with negative results on strategic case in the advanced malware used in the so-called stability. It is crystal clear that the highest