On March 9, an Indian supersonic missile landed in Pakistan. The following day, the Inter-Service Public Relations (ISPR) briefed the media about the incident. “An Indian projectile entered the Pakistani airspace and caused some damage to surrounding areas after it fell near Mian Channu in Khanewal district. Pakistan has asked India for an explanation regarding the incident. Pakistan has strongly condemned the incident,” said ISPR Director-General Maj-Gen Babar Iftikhar.

On March 11, the Indian ministry of defence said in a statement that the missile had been fired accidentally due to a “technical malfunction” during routine maintenance.

The incident highlighted fears of a full-scale war between the two nuclear-armed nations resulting from an accident.

The incident demonstrated that India’s weapons control systems are either ineffective or compromised. The relevant international agencies should insist that India’s systems be inspected to ensure that all vulnerabilities have been fixed.

The incident sent a strong message to both India and Pakistan about the dangers of an accidental exchange of nuclear strike in South Asia. It must be dealt with with the gravity it deserves, rather than being treated as a mistake investigations into which are kept away from public view.

As nuclear rivals, India and Pakistan should make sure that communication channels are kept open in order to prevent a recurrence of similar incidents.

Nuclear weapons and related systems have faced various cyber threats and cyber-based risks affecting various aspects of society, including the financial sector, the entertainment industry, department stores and insurance firms. When it comes to cyber-attacks on their most vital systems, governments have an even greater issue. Successful cyber-attacks on a nuclear weapons or related system could destroy the whole world. Cyber-attacks could result in misleading attack warnings, disrupt crucial communications or information access and pose a risk to nuclear planning or delivery systems.

Given the extent of global system digitalisation and the rapid evolution of the cyber threat, it is impossible to assume that systems with digital components, including nuclear weapons systems, will not be affected. Nuclear weapons and delivery systems are upgraded on a regular basis. This may include the addition of new digital systems or components. Malware could attack digital systems during fabrication, which is often away from protected facilities. Also, electric grid connections etc are often beyond the control of defence officials but have a direct impact on nuclear systems.

In 2019, a malware attack had targetted one of India’s largest nuclear reactors, Kudankulam. It infiltrated the plant’s firewalls and allegedly stole sensitive data. The attack was limited to the plant’s administrative network and was not as severe as other malware attacks such as Stuxnet — the highly sophisticated computer worm best known for attacking nuclear centrifuges at Iran’s Natanz facility — it raised serious concerns around the world about nuclear safety measures.

The attack was finally traced to a North Korean gang. Early uncertainty and speculation highlighted the difficulties in determining the source of cyber-attacks, as well as the potential for cyber threats to increase regional tensions.

Nuclear-armed states need to increase coordination and seek agreement on how to avoid potential cyber threats and safeguard their assets. Cyber-terrorists taking control of a nuclear power station can cause a catastrophe the size of Fukushima.

A fire and explosion occurred at a centrifuge production plant at a nuclear enrichment facility in Natanz on July 2, 2020. The attack was claimed by a group known as Cheetahs of the Homeland. In 2014, a cyber-attack had disrupted a German nuclear power station. In March 2016, Belgium’s nuclear plants faced the threat of a cyber-attack.

Nuclear-armed states need to increase coordination, seek agreement on how to avoid potential cyber threats and safeguard their assets.

Cyber threats affect in at least three ways: they can be used to compromise nuclear command and control systems, weaken the security of nuclear materials and facility operations and they can be used to demand ransom after gaining control of nuclear sites.

Traditional nuclear security techniques centred on preventing physical attacks, such as installing “guns, guards, and gates” to prevent 1) theft of bomb materials, 2) sabotage of a nuclear plant, or 3) illegal access to nuclear command, control, and communications systems. More recently the possibility of a cyber-assault is growing. Many countries are at risk and enough effort does not appear to have been made to make nuclear cyber security procedures failsafe.

Today cyber-attacks target computer systems used for a variety of objectives. No cyber-attack on a nuclear power facility has so far resulted in radioactive material being released.

A cyber attack might aim to interrupt the operation of a nuclear site, inflict economic harm, embarrass government or utility executives, blackmail firms or simply find out what happens. Cyber-attacks aimed at other targets too can spread to nuclear power plants, causing unforeseeable damage. Given the potential for tremendous devastation, any successful cyber-attack on a nuclear plant would, at the very least, erode trust in the state’s ability to act as a responsible host and in the owner and operator’s ability to operate the facility safely and securely. Some cyber-attacks may be meant to have just a local and restricted impact but radioactive material discharged from a failing reactor might damage unintended targets.

Cyber-attacks can be carried out by foreign governments, organisations antagonistic to a specific government or individuals motivated by money, hatred or curiosity.

All possible perpetrators must be addressed by the mechanisms designed to deter and combat such threats, taking into account the spectrum of motivations listed above.

Cyber assaults carried out by citizens of a state against targets within that state may be considered acts of domestic terrorism.

Cyber assaults perpetrated by non-targetted states or impacting non-targetted states may be deemed acts of international terrorism.

Cyber strikes by a foreign government could be deemed acts of war.

In some instances, cyber-attacks could be categorised as crimes against humanity.

For a variety of activities, modern nuclear power plants rely heavily on a large and diverse array of computers. Some computers may be used to monitor or control the operation of the reactor or its auxiliary systems. Computer networks are routinely used by nuclear power plant operators and technical support employees, and linkages between these systems and plant control systems may exist, sometimes unknown. The reactor may be forced into an accident when some software is updated or replaced.

The author is a researcher and cyber security specialist. He can be reached at cyber.expertabbasi@gmail.com