Britain’s nuclear submarine engineers use software that was designed in Russia and Belarus, in contravention of Ministry of Defence rules, The Telegraph can reveal.

It seems to be a popular trend.

https://ukdefencejournal.org.uk/german-sub-navigation-system-russian-controlled/

German media has reported that the Russian controlled ‘Navi-Sailor 4100’ has been installed on at least 100 vessels operated by Germany’s military, including the submarine fleet

Bild reports here that in 2005, under Federal Chancellor Gerhard Schröder, around one hundred vehicles, including aval platforms, were equipped with new navigation systems from Russian company Transas.

https://www.wartsila.com/ancs/integrated-vessel-control-systems/navigation/navi-sailor-ecdis

• Real time monitoring
• Remote support 24/7 chart and service support with a complete history of records and remote diagnostic option

• Connectivity + Cyber security

Those seem like things that maybe it’d be a good idea to get from somewhere that isn’t Russia.

I remember poking around a while back when that story broke and discovering:

• The Navi-Sailor package directly connects to radar and positioning systems, so there are external radios interfacing with it. That is, their behavior can depend on what they receive from an externally-accessible radio, even independent of any explicit datalink systems.

• The supported maps by the Navi-Sailor package include formats specified to permit flagging map information as classified, including classification COSMIC (which is specifically used for information shared at NATO level that’s TOP SECRET-level and disclosure of which would be “gravely damaging to NATO”. Now maybe the German Navy does a really great job of restricting what information goes to the software, but I sure wouldn’t bet on it.

• It’s driving their warships. Lot of room for things to go badly there.

This is an outlier, but not by that much. Before the invasion of Ukraine, there was a lot of IT outsourcing to Belarus in the UK, with them having a technically competent workforce and low wages. (Much of that was things like software testing and boilerplate, though it’s not entirely infeasible that pieces of defence work ended up being outsourced there, especially if politically well-connected people stood to pocket the savings.)

You couldn’t make this stuff up.

They went on to reassure other team members by claiming that the risk was “minimal” given that they had already undertaken previous projects for Rolls-Royce using developers in Minsk without any problems.

Oh, great.