Cyber Threats & Nuclear Fears

Since the second World War and throughout the subsequent Cold War, nuclear weapons seemed like the most destructive weapon that humanity ever developed. Now, the development of cyber weapons, information-warfare capabilities and the new dynamics of the ‘cyber age’ are providing a considerable challenge to the management, thinking and strategy that underpins nuclear weapons. 

While the nature and extent of these challenges varies between nuclear-armed states and across nuclear systems, they do, taken together, represent a noticeable shift in the context and environment in which we think about nuclear weapons, nuclear security, manage nuclear relationships and regulate global nuclear order.

Governments and legislators are struggling to keep pace with the rapid development of these cyber capabilities. 
As military systems become more technically complex it would be easy to assume that they are more secure. The opposite is true. Increased automation and connectivity increases vulnerabilities to cyber attacks. Updating the technology for the digital era is necessary, but it comes with the risk that anything digital can be hacked. Moreover, using new systems for both nuclear and non-nuclear operations will lead to levels of nuclear risk hardly imagined before.

Alarm is mounting over large security vulnerabilities produced by the pervasive spread of cyber capabilities into vast realms of social and economic activity. 

Currently most cyber threats fall into the category of mischief or normal crime, but the destructive potential for cyber attacks on nuclear power plants, other critical infrastructure or on the financial system, could do enormous harm. There is a need, therefore, to seek remedies and adapt to the challenges posed by this ubiquitous dual-use technology.

The main question that surrounds cyber war is not whether a cyber war can possible or not, but what would be the main target of this kind of operation. 

In 2005 the first type of a cyber weapon called Stuxnet hit an Iranian nuclear facility and potentially and created a new fear that such an attack could trigger a massive explosion which prompted widespread debate among policy makers. 

It is surprising to learn that the first target for a deliberate cyber war first was the nuclear program of a country, which seemed an impossibility for conventional military operations. In particular, a unique type of cyber risk arises from the integration of nuclear and non-nuclear capabilities, which is itself often enabled by computing and communications technology. Such integration raises the risk of an inadvertent nuclear escalation in times of conflict. 

Stuxnet showed us that nuclear weapon systems could have exploitable weaknesses in themselves, where it can spill over to the most destructible components of violence. 

The attack in 2005 should be accepted as a sign of future cyber warfare and its potential targets.  What humanity feared most could be the target of the people who are behind a screen. This person could be a state officer or something worse, like a terrorist or AI-powered robots that are free from established political and moral constraints of the people who are in command of these weapons.

Since the Cuban Missile Crisis, where the world came to the brink of a nuclear war, the world’s nuclear powers engaged in various reciprocal arms control regimes and limitation agreements. Those agreements generally used the classification and transparent presentation as the main way to execute such controls. But in a cyber world, there is extreme secrecy over the issue that surrounds it.

Many countries that are working over such tools are not willing to prepare comprehensive catalogues that can be used against nuclear weapons and their control and command systems. 

This extreme secrecy that surrounds the issue creates a problem for cynical scholars who think cyber weapons cannot match when they will face nuclear weapons. Indeed, the secrecy surrounding cyber tools and weapons is one of the gravest dangers in a world where these secrets could easily spill out and spread among other actors.

Nuclear - Cyber Nexus

Governments must also invest heavily in research activities particularly in the framework of existing institutions such as the NATO Cooperative Cyber Defence Centre of Excellence, the EU CBRN Centres of Excellence, the United Nations and within national cyber security institutions. Governments and decision-makers of the nuclear-armed states should publicly acknowledge that cyber security for nuclear weapons systems is a top tier priority for the safety and security of national military programs. 

If the security of nuclear weapons is in question, this not only reduces their credibility and deterrent value, but it also poses a massive safety and security risk. 

The developing relationship between cyber and nuclear technologies certainly represents an important shift in the context in which we think about nuclear weapons and nuclear security, manage nuclear relationships and strategic stability and regulate the global nuclear order. If we understand cyber as a holistic concept that includes not just the internet, but also the software, hardware, other infrastructure and people that operate and interact with these systems, then the challenge to nuclear weapons in the cyber age is in fact multifaceted. 

Leaders of nuclear armed states need to start a discussion about the nature and implications of the emerging cyber–nuclear nexus and begin to think about pursuing confidence building measures at the strategic level. 

Such dialogue may help provide the basis for more concrete mechanisms of protection and control, such as a set of moratoria or agreements between states not to target each other’s nuclear C2 systems with cyber, for example. This in turn may help lay the foundations for broader bilateral or even multilateral arms control agreements in the cyber–nuclear realm in the future, and even for talks that address the whole range of emerging technological challenges to nuclear orthodoxy. 

While none of this will be easy or straightforward, it is imperative to act now, to guard against the new and growing challenges to nuclear weapons presented by the cyber age. 

Mert Matsumoto:     The Diplomat:   RUSI:    Carnegie Endowment:     Herbert Lin:    ELN:    ArmsControl.Assoc:

You Might Also Read: 

Cyber Capabilities & National Power Rankings:

 

« NATO Prepares For Cyber Warfare
Reduce Vulnerabilities & Defend Your Brand Against DDoS Attacks »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Bayshore Networks

Bayshore Networks

Bayshore Networks was founded to safely and securely protect Industrial IoT (IIoT) networks, applications, machines and workers from cyber threats.

Averon

Averon

Averon's technology is the new gold standard for digital identity - the easiest, fastest and most secure verification solution for users on both WiFi and LTE.

CARICERT

CARICERT

CARICERT is the National Cyber Emergency Response Team of Curacao in the Caribbean.

Tech Mahindra

Tech Mahindra

Tech Mahindra is a global leader in IT solutions, BPO, business consulting services & digital technologies.

Seekurity

Seekurity

Seekurity is an information security consulting firm specialized in all areas of Cyber Security including Penetration Testing, Vulnerability Assessments and Risk Management.

Data Theorem

Data Theorem

Data Theorem is a leading provider in modern application security. Its core mission is to analyze and secure any modern application anytime, anywhere.

Citalid

Citalid

The Citalid cyber risk management platform combines threat and business intelligence to identify the risks scenarios you face.

Qrator Labs

Qrator Labs

Qrator Labs is a leader in DDoS attack mitigation, helping organizations protect their websites from the most harmful, sophisticated DDoS attacks.

SightGain

SightGain

SightGain is the only integrated risk management solution focused on cybersecurity readiness using real-world attack simulations in your live environment.

Motiv ICT Security

Motiv ICT Security

Motiv is the ICT security specialist that provides public and private sector organisations with IT security solutions and services to prevent cybercrime, data theft and data breaches.

Naq Cyber

Naq Cyber

Naq is the number one platform for SMEs looking to become legally compliant and protect against cybercrime and other data-related incidents.

HEQA Security

HEQA Security

HEQA Security (formerly QuantLR) offer the world’s most cost-effective, easy-to-integrate, and secure Quantum Key Distribution (QKD) solution

SecurEyes

SecurEyes

SecurEyes is a leading cybersecurity firm that provides specialised services, including cybersecurity assessments, managed services, and governance risk and compliance services.

OryxLabs

OryxLabs

OryxLabs provide advanced enterprise digital risk protection solutions. Learn more about how 24x7 continuous assessment, monitoring, and improvement can secure your network.

Allstate Identity Protection

Allstate Identity Protection

Allstate make it easy to provide complete identity protection, so everyone can live more confidently online.

Cytracom

Cytracom

Cytracom delivers powerful yet intuitive solutions that enable MSPs and ITSPs to meet the challenges of security, compliance, and connectivity.