Sellafield to be prosecuted over alleged cyber compliance failure
Date of creation: March 31, 2024, 12:44 p.m. From SITE: https://www.computerweekly.com Original page link
Original page content Sellafield Ltd, the Nuclear Decommissioning Authority-backed organisation currently working to wind up operations at the troubled Sellafield nuclear facility in Cumbria, is to be prosecuted over significant cyber security failings under the auspices of the Nuclear Industries Security Regulations of 2003. The charges, laid by the Office for Nuclear Regulation (ONR), cover a range of alleged IT security offences during the period between 2019 and 2023. “The decision to begin legal proceedings follows an investigation by ONR, the UK’s independent nuclear regulator,” the body said in a brief statement. “There is no suggestion that public safety has been compromised as a result of these issues. “Details of the first court hearing will be announced when available. Given that some matters are now subject to legal proceedings, we are unable to comment further.” The announcement came mere hours after it was reported that Sellafield’s chief information security officer, Richard Meal – a former RAF officer who has been in post for over 10 years – stepped down from his role, although this has not been confirmed by Sellafield. Computer Weekly understands that Sellafield’s apparent cyber security issues have been bubbling to the surface for a while, and in 2023 the site’s operators strenuously denied allegations – arising from a lengthy Guardian investigation – that its IT systems had been thoroughly compromised by state-backed threat actors originating from China and Russia. The newspaper claimed the hackers had deployed difficult-to-detect sleeper malware on Sellafield’s systems to harvest data and snoop on the ongoing nuclear clean-up at the facility, which was the scene of the UK’s worst ever nuclear disaster in the 1950s. The Guardian accused Sellafield of a consistent cover-up of the intrusions, which supposedly dated to 2015, and alleged that the extent of the breach only came to light when workers at other sites discovered they could remotely access Sellafield’s systems. An insider at the site described Sellafield’s network as “fundamentally insecure” and drew attention to various concerns, which included the use of USB memory sticks by third-party contractors and an incident in which a visiting BBC camera crew accidentally filmed and broadcast user credentials. So severe were some of the failings that they were supposedly nicknamed “Voldemort”. At the time, Sellafield chief executive Euan Hutton told the BBC that the facility had “robust, multi-layer protection systems” and a “24/7-staffed cyber security operations centre” that would have detected any intrusion. The ONR has not provided details of any specific cyber security incidents that form the basis of its action. A spokesperson for the Department for Energy Security and Net Zero, which bears ultimate responsibility for funding Sellafield, said: “Safety and security at our former nuclear sites is paramount and we fully support the Office for Nuclear Regulation in its independent role as regulator. “The regulator has made clear that there is no suggestion that public safety has been compromised at Sellafield. “Since the period of this prosecution, we have seen a change of leadership at Sellafield and the ONR has noted a clear commitment to address its concerns.” A spokesperson for Sellafield Ltd said: “The ONR's Civil Nuclear Security and Safeguards (CNSS) has notified us of its intention to prosecute the company relating to alleged past nuclear industry security regulations compliance. “As the issue is now the subject of active court proceedings, we are unable to comment further.” Read more about security in the UK's nuclear sector Senior managers at an ‘Achilles heel’ local authority for Europe’s biggest nuclear site ‘still don’t know what was lost’ in a 2017 cyber attack, according to a council source. Lancaster University’s cyber team has joined with the Nuclear Decommissioning Authority to help support and protect its 300-year mission, while enhancing its own capabilities in the process. With the potential for catastrophic consequences from a nuclear weapons detonation attack, it is crucial to have the most robust nuclear policies in place, says an international affairs think tank. | Sellafield Ltd, the organisation responsible for cleaning up and decommissioning the UK's largest nuclear waste site, is to be prosecuted over alleged cyber security failings dating back to 2019
Date of avatar: March 31, 2024, 6:45 p.m.
Tags: public safety, usb memory sticks, commitment, cyber security failings, data breach, investigation, office for nuclear regulation, network security, sleeper malware, sellafield ltd, prosecution, response, guardian investigation, it security offences, court hearing, state-backed threat actors, leadership change., user credentials
Content: # Part 1: Sellafield Ltd Faces Prosecution for Cyber Security Failings Sellafield Ltd, the Nuclear Decommissioning Authority-backed organisation, is set to face prosecution for significant cyber security failings. The charges, brought by the Office for Nuclear Regulation (ONR), relate to alleged IT security offences that occurred between 2019 and 2023. The ONR, the UK's independent nuclear regulator, initiated legal proceedings following an investigation into the matter. It is important to note that there is no indication that public safety has been compromised as a result of these issues. Details of the first court hearing will be announced in due course, and Sellafield Ltd is unable to comment further due to the ongoing legal proceedings. # Part 2: Background on Sellafield's Cyber Security Issues Recent developments regarding Sellafield's cyber security highlight a long-standing concern in this area. In 2023, allegations emerged from a Guardian investigation, claiming that Sellafield's IT systems had been thoroughly compromised by state-backed threat actors from China and Russia. The hackers were said to have deployed sleeper malware, which was difficult to detect, to gather data and monitor the nuclear clean-up at the facility. Sellafield was accused of covering up these intrusions, which reportedly began in 2015, and the full extent of the breach only came to light when workers at other sites discovered they could remotely access Sellafield's systems. Concerns were raised about the site's network security, including the use of USB memory sticks by third-party contractors and an incident where user credentials were accidentally filmed and broadcast by a BBC camera crew. Sellafield's CEO at the time insisted that the facility had robust security measures in place, including a 24/7-staffed cyber security operations centre. # Part 3: Response and Commitment to Address Concerns The Office for Nuclear Regulation has not provided specific details about the cyber security incidents that form the basis of its action against Sellafield Ltd. The Department for Energy Security and Net Zero, which is responsible for funding Sellafield, emphasized the importance of safety and security at nuclear sites and expressed its support for the ONR's regulatory role. It was highlighted that there is no indication that public safety has been compromised at Sellafield. Since the period covered by the prosecution, there has been a change in leadership at Sellafield, and the ONR has acknowledged a clear commitment from the organization to address its concerns. Sellafield Ltd confirmed that it has been notified of the intention to prosecute and, due to the ongoing court proceedings, is unable to provide further comment. Read more about security in the UK's nuclear sector: - "Achilles Heel" Local Authority for Europe's Biggest Nuclear Site Still Unaware of Cyber Attack Impact - Lancaster University Teams Up with Nuclear Decommissioning Authority to Strengthen Cyber Security - Importance of Robust Nuclear Policies to Mitigate Catastrophic Consequences of Attacks, Says Think Tank.
Date of avatar: March 31, 2024, 12:56 p.m.
Tags: investigation, chief information security officer, public safety, department for energy security and net zero, office for nuclear regulation, decommissioning, state-backed threat actors, it security, nuclear sites, cyber security, china, nuclear facility, court hearing, court proceedings., legal action, russia, sellafield ltd, compromised it systems
Content: Sellafield Ltd, the organization tasked with decommissioning the troubled Sellafield nuclear facility, is facing prosecution for significant cyber security failures. The charges, brought by the Office for Nuclear Regulation (ONR), cover a range of alleged IT security offenses between 2019 and 2023. The ONR stated that the legal action follows an investigation by the UK's independent nuclear regulator. While there is no suggestion that public safety has been compromised, details of the court hearing are yet to be announced. Sellafield's chief information security officer, Richard Meal, recently stepped down from his role, although this has not been confirmed by the company. Sellafield has faced allegations of cyber security issues in the past, including claims of compromised IT systems by state-backed threat actors from China and Russia. The company has denied these allegations. The ONR has not provided specific details of the cyber security incidents leading to the prosecution. The Department for Energy Security and Net Zero, which funds Sellafield, stated that safety and security at nuclear sites are of utmost importance, and it supports the ONR's actions. Sellafield Ltd has acknowledged the prosecution and is unable to comment further due to the ongoing court proceedings.
Date of avatar: March 31, 2024, 12:54 p.m.
Tags: richard meal, nuclear decommissioning authority, public safety, office for nuclear regulation, state-backed threat actors, it security, legal proceedings, cyber security, prosecution, sellafield ltd
Content: Sellafield Ltd, the Nuclear Decommissioning Authority-backed organisation responsible for winding up operations at the Sellafield nuclear facility in Cumbria, is facing prosecution for significant cyber security failings. The charges, brought by the Office for Nuclear Regulation (ONR), cover alleged IT security offences between 2019 and 2023. The ONR stated that public safety has not been compromised. The announcement came shortly after Sellafield's chief information security officer, Richard Meal, reportedly stepped down. Sellafield has faced cyber security issues in the past, with allegations of state-backed threat actors compromising its IT systems. Sellafield has not provided further comment due to ongoing legal proceedings.