IGF 2023 WS #220 Cybersecurity of Civilian Nuclear Infrastructure

This session was co-chaired by Dr Talita Dias and Rowan Wilkinson from the International Law Programme, Chatham House). It focused on the convergence of cyber and nuclear risks from a technical, policy, security, and legal perspective. To shed light on those different perspectives, the session benefited from the inputs of Marion Messmer (International Security Programme, Chatham House), Tariq Rauf (former Head of Nuclear Verification and Security Policy Coordination at the International Atomic Energy Agency (IAEA), Dr Giacomo Persi Paoli (Head of the Security and Technology Programme at the United Nations Institute for Disarmament Research – UNIDIR), Michael Karimian (Director for Digital Diplomacy at Microsoft, Asia Pacific), Tomohiro Mikanagi (Legal Advisor to the Japanese Ministry of Foreign Affairs), and Dr Priya Urs (Junior Research Fellow in Law at St John’s College, University of Oxford).

As previous examples of cyberattacks against nuclear infrastructure in Iran, India, North and South Korea, Norway, Germany, the US, Ukraine, and the International Atomic Energy Agency (IAEA) illustrate, the actual and potential risks of such attacks include both physical and non-physical harms such as: a) extraction of sensitive information about nuclear capabilities; b) malfunctioning of equipment, including nuclear enrichment centrifuges; c) disruption of energy supplies; d) increased radiation levels; e) potentially disastrous consequences for the environment, human life and health; f) psychological harm to individuals, such as trauma and fear arising from the threat of those consequences; and g) reputational harm to the nuclear energy sector, as well as States, international organisations and companies involved the provision of nuclear energy or cybersecurity. According to the results of our interactive survey during the session (using Mentimeter), physical consequences, in particular increased radiation levels, are the number one concern among both in-person and online participants.

Malicious cyber operations threatening civilian nuclear infrastructure may take a variety of forms. They primarily include: a) disruption of software (e.g., through malware or other forms of malicious code); b) disruption of hardware, including malfunction of equipment (e.g., through physical penetration via USB sticks); c) data gathering or surveillance operations (e.g., through phishing and other social engineering tactics), and d) information operations (e.g., mis- and disinformation about nuclear risks). Such operations can either intentionally target civilian nuclear infrastructure or cause collateral damage to it. The session also highlighted that these risks have now been amplified by: a) the push for green energy; b) the increased use of small modular reactors and microreactors; c) the use of nuclear energy, including those reactors by private companies, to power AI systems; d) the use of AI to automate and diversify the types of cyber operations against different targets, including critical infrastructure and potentially nuclear infrastructure.

There was agreement that these risks remain significant and concerning, as even remote or uncertain risks can have catastrophic consequences for humanity. While it was once thought that civilian nuclear infrastructure was safe from cyber threats because of the use of specific controlling systems, the need to upload these systems, including to off-the-shelf software, has meant that cybersecurity is now a sector-wide concern. New developments in the civilian nuclear sector, such as small modular and micro nuclear reactors pose both challenges and opportunities. On the one hand, they are safer by design and have enabled nuclear energy to reach remote parts of the world. At the same time, the increasing number and variety of those reactors, coupled with the fact that many use off-the-shelf software, may also increase the attack surface and raise cybersecurity vulnerabilities, particularly given long IT supply chains and inconsistent national standards for their development and operation. The war in Ukraine has also highlighted the vulnerability of civilian nuclear infrastructure to cyber and physical attacks in parallel. A particular risk of these attacks is that they lead to nuclear reactors being switched off or disconnected from the power grid, which could interfere with their cooling system and lead to a meltdown situation. These risks could be mitigated by, inter alia, having sufficient backup generators on site.

The IAEA has issued more than 30 technical guidelines and recommendations to try and mitigate the risks arising from cyber operations against the civilian nuclear sector. Their main message is that cybersecurity is vital for nuclear safety, i.e. the physical integrity of nuclear power plants, radioactive materials, and nuclear personnel, as well as nuclear security, i.e., protection from criminal or other intentional unauthorized acts involving or directed at nuclear and other radioactive material, associated facilities and associated activities, including confidential information and nuclear control systems. However, it was stressed that, despite the IAEA’s efforts, at the end of the day, nuclear security is a national responsibility. Thus, the IAEA Nuclear Security Series complements international legal instruments on nuclear security and serves as a global reference to help parties meet their obligations. While the security guidance is not legally binding on Member States, it is widely applied. It has become an indispensable reference point and a common denominator for the vast majority of Member States that have adopted this guidance for use in national regulations to enhance nuclear security in nuclear power generation, research reactors and fuel cycle facilities as well as in nuclear applications in medicine, industry, agriculture, and research. Key measures recommended in the Series include audits, risk assessments, training, awareness, and capacity-building, as well as international cooperation. It was also noted that the Convention on the Physical Protection of Nuclear Material (CPPNM) requires States Parties to protect nuclear material used for civilian purposes from cyber operations but lacks universality (notably, Iran is not a party to it).

Within the United Nations (UN), States have been discussing cybersecurity for 25 years. Notably, UN Member States have endorsed 11 Norms of Responsible State Behaviour in cyberspace, most of which seek to protect critical infrastructure from malicious cyber operations. However, the protection of the nuclear sector from cyber operations has not been specifically raised or addressed as of yet. It was argued that the main UN forum for cybersecurity discussion – the Open-Ended Working Group on the security of and in the use of information and communications technologies – is probably not well-placed to discuss how those general norms can be implemented in specific sectors, such as nuclear energy. The idea was put forward to establish a dedicated forum, within or outside the UN, to discuss the operationalisation of the Norms, including in the nuclear sector.

The key role that the private sector plays in the protection of the civilian nuclear infrastructure, including power plant operators and software companies, was also discussed. Steps that can be taken by private actors to increase such protection include embedding cybersecurity by design in product development, staying ahead of malicious cyber actors, such as by better understanding the cyber threat landscape and sharing threat intelligence, providing appropriate education and training on the cybersecurity of their products, as well as engaging with States and civil society to strengthen existing technical, policy and legal protection. One prime example of a multistakeholder initiative pushing for the protection of critical infrastructure is the Cybersecurity Tech Accord. This could serve as inspiration for future policy efforts to enhance the cybersecurity of the civilian nuclear sector.

The session concluded with a discussion of the international legal framework applicable to the issue. It was noted that while international law lacks specific rules on the cybersecurity of the civilian nuclear sector, existing rules apply. Notable among these are the rules of sovereignty, non-intervention, and due diligence, which apply by default in cyberspace, including in the context of cyber operations against the civilian nuclear sector. Sovereignty prohibits States from carrying out cyber operations that cause physical or functional effects in the territory of another State, or that undermine inherently governmental functions, including in the context of civilian nuclear infrastructure. Non-intervention prohibits States from carrying out or supporting cyber operations that coercively interfere in the internal or external affairs of another State. Insofar as nuclear energy policy falls within this ambit, cyber operations that threaten the sector are prohibited intervention. Finally, it was noted that States must exercise due diligence in protecting domestic and foreign civilian nuclear infrastructure from cyber operations as far as possible. Specific duties to protect the civilian nuclear sector from harmful operations, including by digital means, arise from the Nuclear Terrorism Convention and the CPPNM.