Sellafield to be prosecuted over alleged cyber compliance failure
Like 0 Avatar config id=1 Typo writer Date of creation: March 31, 2024, 12:56 p.m.
Original page link
Category: Technology
Tags: investigation, chief information security officer, public safety, department for energy security and net zero, office for nuclear regulation, decommissioning, state-backed threat actors, it security, nuclear sites, cyber security, china, nuclear facility, court hearing, court proceedings., legal action, russia, sellafield ltd, compromised it systems
Tags2: investigation, public safety, office for nuclear regulation, state-backed threat actors, it security, cyber security, sellafield ltd, chief information security officer, department for energy security and net zero, decommissioning, nuclear sites, china, nuclear facility, court hearing, court proceedings., legal action, russia, compromised it systems
Avatar post content:
Sellafield Ltd, the organization tasked with decommissioning the troubled Sellafield nuclear facility, is facing prosecution for significant cyber security failures. The charges, brought by the Office for Nuclear Regulation (ONR), cover a range of alleged IT security offenses between 2019 and 2023. The ONR stated that the legal action follows an investigation by the UK's independent nuclear regulator. While there is no suggestion that public safety has been compromised, details of the court hearing are yet to be announced. Sellafield's chief information security officer, Richard Meal, recently stepped down from his role, although this has not been confirmed by the company. Sellafield has faced allegations of cyber security issues in the past, including claims of compromised IT systems by state-backed threat actors from China and Russia. The company has denied these allegations. The ONR has not provided specific details of the cyber security incidents leading to the prosecution. The Department for Energy Security and Net Zero, which funds Sellafield, stated that safety and security at nuclear sites are of utmost importance, and it supports the ONR's actions. Sellafield Ltd has acknowledged the prosecution and is unable to comment further due to the ongoing court proceedings.
Original page content Sellafield Ltd, the Nuclear Decommissioning Authority-backed organisation currently working to wind up operations at the troubled Sellafield nuclear facility in Cumbria, is to be prosecuted over significant cyber security failings under the auspices of the Nuclear Industries Security Regulations of 2003. The charges, laid by the Office for Nuclear Regulation (ONR), cover a range of alleged IT security offences during the period between 2019 and 2023. “The decision to begin legal proceedings follows an investigation by ONR, the UK’s independent nuclear regulator,” the body said in a brief statement. “There is no suggestion that public safety has been compromised as a result of these issues. “Details of the first court hearing will be announced when available. Given that some matters are now subject to legal proceedings, we are unable to comment further.” The announcement came mere hours after it was reported that Sellafield’s chief information security officer, Richard Meal – a former RAF officer who has been in post for over 10 years – stepped down from his role, although this has not been confirmed by Sellafield. Computer Weekly understands that Sellafield’s apparent cyber security issues have been bubbling to the surface for a while, and in 2023 the site’s operators strenuously denied allegations – arising from a lengthy Guardian investigation – that its IT systems had been thoroughly compromised by state-backed threat actors originating from China and Russia. The newspaper claimed the hackers had deployed difficult-to-detect sleeper malware on Sellafield’s systems to harvest data and snoop on the ongoing nuclear clean-up at the facility, which was the scene of the UK’s worst ever nuclear disaster in the 1950s. The Guardian accused Sellafield of a consistent cover-up of the intrusions, which supposedly dated to 2015, and alleged that the extent of the breach only came to light when workers at other sites discovered they could remotely access Sellafield’s systems. An insider at the site described Sellafield’s network as “fundamentally insecure” and drew attention to various concerns, which included the use of USB memory sticks by third-party contractors and an incident in which a visiting BBC camera crew accidentally filmed and broadcast user credentials. So severe were some of the failings that they were supposedly nicknamed “Voldemort”. At the time, Sellafield chief executive Euan Hutton told the BBC that the facility had “robust, multi-layer protection systems” and a “24/7-staffed cyber security operations centre” that would have detected any intrusion. The ONR has not provided details of any specific cyber security incidents that form the basis of its action. A spokesperson for the Department for Energy Security and Net Zero, which bears ultimate responsibility for funding Sellafield, said: “Safety and security at our former nuclear sites is paramount and we fully support the Office for Nuclear Regulation in its independent role as regulator. “The regulator has made clear that there is no suggestion that public safety has been compromised at Sellafield. “Since the period of this prosecution, we have seen a change of leadership at Sellafield and the ONR has noted a clear commitment to address its concerns.” A spokesperson for Sellafield Ltd said: “The ONR's Civil Nuclear Security and Safeguards (CNSS) has notified us of its intention to prosecute the company relating to alleged past nuclear industry security regulations compliance. “As the issue is now the subject of active court proceedings, we are unable to comment further.” Read more about security in the UK's nuclear sector Senior managers at an ‘Achilles heel’ local authority for Europe’s biggest nuclear site ‘still don’t know what was lost’ in a 2017 cyber attack, according to a council source. Lancaster University’s cyber team has joined with the Nuclear Decommissioning Authority to help support and protect its 300-year mission, while enhancing its own capabilities in the process. With the potential for catastrophic consequences from a nuclear weapons detonation attack, it is crucial to have the most robust nuclear policies in place, says an international affairs think tank. | Sellafield Ltd, the organisation responsible for cleaning up and decommissioning the UK's largest nuclear waste site, is to be prosecuted over alleged cyber security failings dating back to 2019