Royal Navy Catches a Virus… from Russia, With Love?

Cyber-security is an ongoing issue for any enterprise these days, but the defense sector is more of a target than most. Britain’s Ministry of Defence has been finding this out the hard way lately, as a string of announcements have placed its security under a spotlight. The recent use of cyber-attacks as part of conventional warfare has even prodded the USA into both a National Cybersecurity Initiative related to government IT operations, and a Trust in Integrated Circuits initiative that may be even more challenging.

The first bit of bad news was confirmation that just 27% of UK MoD computer systems meet current data security standards for holding classified information and personal data, another 31% meet some standards, and the rest are still being evaluated. A January 2008 scandal, wherein a stolen laptop held unencrypted personal data related to 600,000 people who had either expressed an interest in, or joined, the armed services, drives home the risks.

HMS Ark Royal

This was followed by news that the Royal Navy would be relying on Windows XP as the basis of its new Submarine Command System Next Generation. SMCS-NG is being retrofitted to British submarines, including the nuclear missile armed Vanguard Class. BAE Systems was reported as saying that elements of Windows that were prone to security flaws “were tended to during the modification.” Microsoft’s own ability to perform this task has often been a problem.

The final punch came when the Ministry of Defense acknowledged that problems with computer viruses had affected email systems and internet access to Royal Navy ships, which are handled by Navystar/ N

• systems from Fujitsu. The UK MoD stressed that it has not jeopardised war-fighting systems, said that the lack of e-mail communication was due to the computers being shut down as a security measure rather than to viral damage, and added that no classified or personal data was compromised. Subsequent reports, however, have cast doubt on the claim. A whisleblower has apparently informed a Tory MP that email traffic from some RAF stations was sent to a server in Russia, and some of the RAF stations reportedly hit by the virus are used to scramble fighter aircraft to head off Russian bombers testing British air defenses. The virus was also blamed for damaging IT systems on 75% of the Royal Navy fleet, including the carrier HMS Ark Royal; commanders have reportedly been forced to use mobile phones to relay orders with officials in the UK. CIO UK | Contractor UK | BBC | The Register | The Telegraph | Public Service News re: origin | CIO UK re: audit | Contractor UK re: audit | cNET re: SMCS-NG | BAE re: SMCS-NG