In this era of rapidly evolving technology, nuclear facilities are exposed to dynamic and evolving spectrum of cyber vulnerabilities.
Cyber-attacks on nuclear facilities are a matter of concern and it’s not the first time that a cyber-attack has been carried out. Such as attack on the nuclear program of Iran to serve the purpose of espionage, the attack on Korean Hydro and Nuclear Power Company (2014) for data theft purposes and also Nuclear Regulatory Commission/U.S. Department of Energy (2016) in which was an intentional attempt by an employee to infect computers of U.S. government.
The attack on the Indian nuclear facilities of Kudankulam was reported in September 2019, a malware attack on Kudankulam by the Indian Computer Emergency Response Team. Indian Department of Atomic Energy, investigated the attack and later on confirmed, that only one computer was targeted, connected to the administrative network’s internet servers.
Later on the Nuclear Power Cooperation of India Limited (NPCIL) confirmed that, operational networks at Kudankulam are completely separate from the administrative systems.
The recent attack on Iran; July 2, 2020 on its nuclear facility at Nantaz earlier this month, is considered as lethal as the Stuxnet attacks and have raised serious concerns about vulnerability of nuclear facilities vis-à-vis cyber security threats. Such type of attacks can cause serious damage to nuclear reactors and can also cause off-site release of harmful radioactive radiations, although there was off-site release of radiations that could create radioactive pollution but states must be careful from cyber in future which could be hazardous.
The rapid advancement in cyber technology can be a blessing and curse at the same time. Because if on one hand it provides with opportunity of innovation in the domain of network centric warfare and added to the cost effectiveness of war related expenditures, but it also pose serious threats which could possibly by dissemination of information, hacking, sabotage, theft and release of important and covert information related to the critical infrastructure whether it’s civilian, military or nuclear. The international community, these days is facing serious cyber threats to nuclear facilities and has already taking measures by designing technical and legal framework to secure the nuclear facilities from any kind of cyber sabotage and threat.
In the context of South Asia, the region is already exposed to cyber threats and vulnerabilities keeping in view the attack on Kudankulam, although that was administrative breach but with rapid pace of advancement in cyber technology, attacks could also be launched on operational facilities. Cyber technology and security is considered an important pillar of national security and states have already started integrating cyber security policies and initiatives in their national security frameworks.
India has already formulated the Cyber Security Policy 2013 and inducted in national security framework, but Pakistan has not formulated any policy yet although the government has taken different initiatives such as establishing National Centre of Excellence of Cyber Security, PAK-CERT etc.
India and Pakistan are involved in cyber space rivalry; both states attack each other and breach security using tools, such as cyber spoofing, spear phishing and denial of data services. Pakistan’s digital infrastructure is facing serious cyber security threats from India due to India’s increasing cyber security collaboration with Israel. The region is already under the potential hazard of Advance Persistent Threats along with ongoing cyber espionage campaigns. There are no strong international norms framed yet that could legally bind the states against the acquisition and use of cyber technology. States are likely to exploit their cyber capabilities for both low and high-intensity conflicts in the absence of clear international norms or rules of engagement.
States like India are aiming to pursue the development of cyber weapons which can offset disadvantages in conventional warfare. Hence use of cyber weapons and attacks can cause the serious damages as cyber weapons are offensive in nature because states will may not be able absorb the attack or if inn case state absorb the attack, may not be able to respond in a significant way. Different tools used by malevolent actors can endanger the nuclear facilities, ranging from network based attacks, packet sniffing, cyber-spoofing, radio attacks, crypto attacks, spyware attacks and air-gapped network attacks which increase the intensity of damage. The potential use of offensive cyber operations using such tools will exploit the vulnerabilities exist in nuclear infrastructure and of systems will increase the possibility of war in the future could cause serious damages to nuclear facilities region.
In South Asia, situation may lead to strategic imbalance as India is already aiming to acquire the cyber weapons. Admiral Suresh Mehta, former Indian Naval Chief in an interview to Start Post admitted that Indian armed forces have invested a lot on network based operations; both in single and in a joint fashion and India cannot afford cyber vulnerability. Information Technology is India’s strength and it would be in its interest to invest in developing a formidable ‘offensive’ and ‘defensive’ cyber warfare capability. Keeping in view the Indian ambitions Pakistan cannot remain silent so Pakistan has also started acquiring and developing cyber tools and techniques to deal with any future consequences. Pakistan has a multilayered defense for the entire spectrum of any nuclear security threat – insider, outsider, and cyber threats which work on the principle of Five Ds, that is, to deter, detect, delay, defend, and destroy.
However the level of damage that could be inflicted by cyber-attacks and operations may adversely impact the deterrence stability of the region According to McConnell there are four elements that are essential for achieving cyber deterrence which include ‘attribution’ that enables states to guess about who carried out the attack, ‘location’ from where the attack was launched ‘response’ the capability to absorb an attack and retaliate and ‘transparency’ which explains about the knowledge of enemy’s capability. Due to the complex nature of cyber technology it seems difficult to achieve all the essential of the cyber deterrence. In global context as well as South Asia establishing cyber deterrence seems to be a bit difficult. If in case any of the operations is carried out against nuclear facilities, it may take long time to reach the base of the network or malware technique that how it was used and from where attack was launched and who were the involved actors.
The scenario of global security and strategic balance in South Asia has been changed with advent of cyber tools technology. Never the less recent attacks on nuclear facilities demonstrate an inconsistent approach towards ensuring cyber security. Although the international community is making efforts through various workshops, training and reports and insisted upon collaboration in the cyber security of nuclear facilities. As far as the cyber deterrence is concerned, South Asian states may require a little more effort and time to fulfill the essentials of deterrence.
*The writer is working as Research Affiliate at Strategic Vision Institute Islamabad, a nonpartisan based out of Islamabad.