French submarines spring a security leak

Investigations underway to find out how secret details of operating capabilities were leaked

More than 22,000 pages of secret operating documents for Indian submarines have been leaked, prompting concerns over the security of the vessels and questions about how such a massive data breach could have happened.

The French Scorpene submarines are being built in a state-run shipyard in Mumbai for the Indian navy, with the first vessel expected to be in service by the end of this year, according to Reuters. However, it is thought the 22,400 documents involved were in fact stolen in 2011.

In a statement to the press, Indian defence minister Manohar Parrikar said: "I understand there has been a case of hacking ... we will find out what happened."

In an additional statement, the Indian Defence Ministry said: "The available information is being examined ... and an analysis is being carried out by the concerned specialists. It appears the source of the leak is from overseas and not in India."

Advertisement - Article continues below
Advertisement - Article continues below

A spokeswoman for DCNS, which is building the six submarines and 35% owned by technology and engineering giant Thales, said that "for now [DCNS doesn't] know if the information is correct".

Reuters added that the level of detail in the documents "creates a major strategic problem for India, Malaysia and Chile", which, according to a source, operate the same model of submarine.

"It's a huge deal ... it allows them to understand everything about the submarines. What speeds it can do; how noisy it is; what speeds the mast can be raised at ... all of that is just devastating," the source told Reuters.

Speaking to IT Pro, Bola Rotibi, research director at analyst house Creative Intellect, said: "That this happened in 2011 goes to show how insecure things were at that time. It's only in the last three or four years that people have really started to double down on security."

The incident, Rotibi said, could be the result of "good old fashioned spying" by a nation-state, but equally it could be "more Machiavellian" industrial espionage-cum-sabotage, particularly as the details of the documents were released. Indeed, this is an allegation hinted at by DCNS.

"The competition is more and more hard and all means can be used in thei context," the company's spokeswoman told Reuters.

Advertisement - Article continues below

"There is [this breach news from] India, [so] Australia and other countries could raise legitimate questions over DCNS. It's part of the tools in economic war," she added.

For Rotibi, however, apportioning blame is less important than preparing for and dealing with breaches.

"Breaches can happen at any level, whether governmental or business," she said. "This case just reinforces two things we have seen over and again in our own research: the need for thorough screening of employees and contractors, to protect against insider threats, and for organisations to have processes in place to prevent, detect and remediate breaches."

Main image credit: Tunku Abdul Rahman, cc license 3

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now



How to protect against a DDoS attack

25 Oct 2019
data breaches

Ex-Equifax CIO to serve four months for insider trading

2 Jul 2019
data breaches

Ex-Equifax CIO to serve four months for insider trading

2 Jul 2019
data breaches

Ex-Equifax CIO to serve four months for insider trading

2 Jul 2019

Most Popular

data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
cyber security

If not passwords then what?

8 Jan 2020
Policy & legislation

GDPR and Brexit: How will one affect the other?

9 Jan 2020
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020