Telegraph: Russian software used to design British submarines.
A company hired to design software for a British submarine builder outsourced the work to programmers in Belarus and Russia, The Telegraph reported on August 3.
According to documents from the UK Ministry of Defence seen by the newspaper, the company subsequently attempted to cover up the potential security vulnerability.
The Telegraph reported that the company in question is a digital consulting firm called WM Reply, which was hired in 2020 to build an intranet for Rolls-Royce Submarines employees.
Rolls-Royce's nuclear engineers—who design submarines exclusively for the Royal Navy—use this internal network to communicate while working, avoiding the security risks of connecting to the wider internet.
Due to the sensitive nature of the work involved with Rolls-Royce Submarines, UK Ministry of Defence regulations stipulate that the internal network can only be designed by UK-based personnel with adequate security qualifications. Instead, WM Reply outsourced much of the work to programmers in Belarus and a remote worker in Tomsk, Siberia.
In late 2020, staff at WM Reply became concerned about the use of contractors based in a rival country of the United Kingdom. Conference call transcripts passed to Defence investigators revealed that the company chose not to inform Rolls-Royce of the outsourcing, fearing the contract – worth £500,000 ($640,000) – would be cancelled.
One employee involved in the call suggested providing the Belarusian programmers with the names of "people who died in the UK," while another suggested having a British developer compile all the code generated in Belarus and Russia, to create the illusion that the entire software was built in the UK.
Ultimately, Rolls-Royce was informed that some foreign programmers would be employed, but the company was not told that these programmers would be based in Russia or Belarus, documents passed to the Ministry of Defense allege.
Rolls Royce began investigating the matter in 2021, and an investigation was launched at the Ministry of Defence in 2022, at a time when the UK was supporting Ukrainian troops in the conflict with Russia. Rolls Royce has severed ties with WM Reply, a spokesperson for the submarine manufacturer told The Telegraph, adding that "at no point was there a risk of data, whether classified or not, being accessed or provided to individuals without security clearance."
"This matter has been fully investigated by Rolls-Royce. As they have stated, at no point was the integrity of the system compromised," a spokesperson for the department commented.
However, defense analysts told the newspaper that the code writers likely accessed Rolls Royce employees' communications, putting them at risk of blackmail or cyberattacks.
WM Reply's decision to outsource "potentially leaves us vulnerable to threats to national security," former Defense Secretary Ben Wallace told the newspaper.
