Cyberattacks on weapons systems or power plants risk escalation to nuclear war and extinction

Nowadays, ‘cyberattack’ is a term used on a daily basis. Bendovschi notes that in the literature can be found various definitions of the this and other similar terms, but all of cyberattacks should be seen as aimed at compromising the data confidentiality, integrity and availability [4, p. 25]. A cyberattack may generally be seen as intentionally stealing, exposing, altering, disabling, or destroying some data, applications or other assets using a network or a given digital device without having the necessary access to do that [5]. According to some scholars, a cyber incident is defined as a system’s security policy breach which affects the integrity or availability of a system in line with the 1990 Computer Misuse Act. This may also include gaining an unauthorised access or at least an attempt to gain such access [6].

Cyberattacks are not concentrated in a single sector. In fact, they can affect any activity in a society – government institutions, individual companies and even entire industries. Due to their nature and importance, critical infrastructure objects require special attention in terms of ensuring their security. For example, cyberattacks on nuclear power plants and facilities that store nuclear or other radioactive materials, as well as nuclear weapons, can have existential consequences. Although states are making great efforts to achieve the highest possible level of nuclear security, there is no such thing as absolute security. Because of this even the slightest possibility of the potential use of nuclear weapons should not be underestimated, including being misled due to misjudgment. The latter is especially important nowadays, when the world relies more and more on technology, which also raises a number of questions about the risks resulting from it. Historically, at least ten similar cases can be listed since the end of World War II [7, pp. 7-23].

Cyberattacks can be used against computer based systems (CBS) through which malicious acts to be carried out against facilities, institutions and even against single individuals involved in nuclear safety and nuclear security activities. As one can suggest, this may be done in a combination with some conventional methods such as physical access and people from within the target organization [8, p. 2]. The consequences of cyberattacks can vary from a simply unauthorized access to theft of nuclear or other radioactive materials to even a hypothetical use of nuclear weapons.

According to the International agency on atomic anergy (IAEA) Nuclear security series No. 42-G, such an attack should be regarded as a malicious act aimed at ‘stealing, altering, preventing access to or destroying a specified target through unauthorized access to (or actions within) a susceptible computer based system’ [8, pp. 10-11]. These attacks may compromise its confidentiality, integrity or availability of any sensitive information or even all of them, which in turn, may lead to or facilitate a malicious act with negative consequences for nuclear security [Ibid.].

The IAEA also defines the computer based systems as ‘technologies that create, provide access to, process, compute, communicate or store digital information, or perform, provide or control services involving such information’ [8]. Provided this, such systems may be of different types and most of them are owned or can be easily accessed by billions of people around the world. It is also possible that in some cases the CBS include services that are not physically accessed such as cloud computing or virtual machines [8, p. 5].

It should be noted that cyberattacks can be performed physically accessing physical certain information and/or a device, which can be done directly by an adversary or indirectly - through an employee who does not even suspect it. The latter can refer both to certain weaknesses in the security system, which are used by the adversary, and the manipulation of an employee by a malicious actor through social engineering.

Cyber threats are constantly evolving, regarding virtually any other human activity. Therefore, nuclear security is not an exception to this. What is more, a single malicious act can result in a catastrophe with global scale. This, for example, can be either through attack on a nuclear power plant or on nuclear weapons systems. In the first case this may also involve nuclear safety measures, while in the latter will be narrowed mainly to nuclear security related measures. According to Stoutland and Pitts-Kiefer, this regards the risk of launch due to miscalculation or unauthorized use, which eventually will result in less confidence in the nuclear weapons as a deterrent factor concerning strategic stability [9, pp. 11-12].