Telegraph: Russian software used to design British submarines
A company hired to design software for a British submarine builder outsourced the work to programmers in Belarus and Russia, The Telegraph reported on August 3.
According to British Ministry of Defence documents seen by the newspaper, the company then tried to cover up the potential security flaw.
The business is a digital consultancy called WM Reply, which was hired in 2020 to build an intranet for Rolls-Royce Submarines employees, The Telegraph reported.
Rolls-Royce nuclear engineers – who design submarines exclusively for the Royal Navy – use this internal network to communicate while working to avoid the security risks of connecting to the wider internet.
Due to the sensitive nature of the Rolls-Royce Submarines work, UK Ministry of Defence rules stipulate that the internal network can only be designed by UK-based staff with security clearances. Instead, WM Reply outsourced much of the work to programmers in Belarus and one remote worker in Tomsk, Siberia.
In late 2020, staff at WM Reply became concerned about the use of contractors based in a rival country to the UK. Minutes of a conference call passed to Ministry of Defense investigators revealed that the company chose not to inform Rolls Royce about the outsourcing, fearing that the contract – worth £500,000 ($640,000) – would be canceled.
One employee on the call suggested giving Belarusian programmers the names of “people who died in the UK”, while another employee suggested having a British developer compile all the code created in Belarus and Russia, to make it appear as if the entire software was built in the UK.
Ultimately, Rolls-Royce was informed that some foreign programmers would be used, but the company was not informed that these programmers would be based in Russia or Belarus, documents passed to the Defense Ministry allege.
Rolls-Royce began investigating the incident in 2021 and an investigation was launched at the Ministry of Defence in 2022, at which time the UK was supporting the Ukrainian military in its conflict with Russia. Rolls-Royce has severed ties with WM Reply, a spokesman for the submarine maker told The Telegraph, adding that "at no time was there a risk that data, whether classified or not, was accessed or made available to individuals without security clearance."
"This matter has been fully investigated by Rolls-Royce. As they have said, at no point was the integrity of the system compromised," a spokesman for the ministry commented.
However, defense analysts told the paper that the codebreakers likely had access to Rolls Royce employees' communications, putting them at risk of blackmail or cyberattacks.
WM Reply's decision to outsource "potentially leaves us vulnerable to the risk of undermining national security," former Defence Secretary Ben Wallace told the newspaper.