EXPERT COMMENT
Decades-old concerns are still not being adequately addressed.
A recent Guardian investigation alleges that the Sellafield nuclear waste management site in the UK has been subjected to numerous cybersecurity breaches over the years.
These alleged breaches are wide-ranging, including an insecure server network which according to the Guardian, hackers have been able to access for years. Other alleged unsafe working practices are also identified, such as contractors being able to plug USB sticks into the system unsupervised when servicing it.
While the UK government response said there was no evidence of a hack by state actors, the Office for Nuclear Regulation (ONR) has placed Sellafield under ‘significantly enhanced regulatory attention' as it was not satisfied with cybersecurity standards at the site.
Sellafield is not the only UK nuclear site which has received this label recently. Earlier this year, the energy company EDF, which runs five of the UK's active nuclear power plants, as well as three which are decommissioning, was also placed under ‘significantly enhanced regulatory attention' due to its cybersecurity practices.
The ONR was not satisfied with the cybersecurity standard in several of EDF's nuclear power plants and will need to see enhancements at the next inspection to change the company's status to a lower-risk one. EDF had already been alerted in 2022 that it would need to upgrade its cybersecurity practices for nuclear power plants but fell short of ONR's expectations.
Click here to continue reading the full version of this Expert Comment on the Chatham House website.