The British government is reluctant to launch an investigation into a multi-million pounds bribery scandal involving a British defence firm and the Saudi royal family.
Britain’s Serious Fraud Office (SFO) has revealed that a British defence firm deposited millions of pounds into a bank account in Switzerland belonging to one of the members of the Saudi royal family.
The deposit was made to ensure that British Ministry of Defence would grant a two-billion pounds contract to GPT, a British wing of EADS, the biggest aerospace defence company in Europe.
Under the contract, GPT was responsible for modernizing communications and cyberwarfare equipment of the Saudi royal palaces and National Guard, which helped the Bahraini regime to suppress the protesters in May.
In 2008, a whistleblower told senior staff at EADS about the bribery scandal saying the deposits “may be illegal… I am flagging up to you a possible illegal transaction and seeking your guidance.”
Furthermore, another whistleblower briefed SFO on the scandal telling them that 11.5 million pounds have been deposited into a Swiss bank account.
The attorney general, Dominic Grieve, who was informed about the scandal by SFO, is to decide whether to open an investigation into the alleged bribes made by GPT.
Nevertheless, he may decide to refrain from launching an inquiry for the sake of the British firm’s interests.
In a similar case in 2007, the attorney general, Lord Goldsmith, decided to drop corruption charges against the arms company BAE after then-Prime Minister Tony Blair exerted pressure on him.
BAE had also bribed the then head of Saudi air force, Prince Turki-bin-Nasser, in order to secure a 40 billion pounds contract to sell jets to the Saudis.
Iran's Bushehr nuclear power plant, one of the sites the Stuxnet computer worm may have been aimed at. Photo / AP
Did they or didn’t they? Was the Stuxnet computer worm the work of an Israeli cyberwarfare team or of some other government wanting to implicate Israel?
The answer, says United States security specialist Bruce Schneier, writing on Forbes.com, is unlikely ever to be known.
Certainly, the London-based Jewish Chronicle reported last week that Israel wasn’t admitting to having created the worm. But the paper pointed out that the country has the capability – within Unit 8200 of the Israeli Defence Force – to do so.
And it quotes the head of the IDF’s intelligence branch, Major General Amos Yadlin, saying last year that “cyber will be the new battlefield” of war. Israeli Defence had over the past year “formalised its cyber efforts”, the paper said.
Stuxnet is such a sophisticated piece of software that there’s little dispute it’s the work of a national government, says Sydney-based Steve Martin of antivirus software company Symantec.
“The theory is, it looks like it’s government-based rather than from a private entity or criminals, and that probably narrows down the field somewhat,” he says.
But like Schneier, he believes the many law enforcement and intelligence agencies that will be trying to trace Stuxnet’s source have little chance of success.
“They want to find its origins, but more, they want to understand the strategy, because this really is the type of malicious code that is ideal for cyberwarfare. If I was a country intent on invading another, before I did that it would be pretty powerful to disrupt their electricity grid or water supplies or other services.”
The finger keeps pointing at Israel because the main victim of Stuxnet, which first surfaced in June, was Iran. The worm, which targets a particular type of industrial control system from German company Siemens, appears to have disrupted Iran’s fledgling nuclear industry, a flashpoint for tension particularly with Israel and the US.
Fuelling the speculation that Israel is responsible are clues in the Stuxnet code itself. The worm records a value of”19790509″ in the Windows registry, or settings database, of infected computers. The digits can be read as the date in 1979 when Iran executed Persian Jew Habib Elghanain for spying for Israel.
Elsewhere in the code can be found the word “myrtus”, which could mean the myrtle plant. The Hebrew word for myrtle is hadassah; Queen Esther, who in the fourth century BC saved Persian Jews from genocide, was named Hadassah.
Equally, myrtus might mean “my RTUs”, where RTU stands for remote terminal unit, an industrial control system component.
But obvious markers of Israeli authorship of the worm could be intended to throw investigators off the scent, Martin says.
“That could well be in there to confuse those trying to track down the source, which is a highly likely tactic for whoever has written the code.”
Or Israel might have wanted it to look as though it was being framed.
If it was the work of Israel, Jerusalem Post columnist Caroline Glick wrote last weekend, it showed the country was maintaining a technological edge over its enemies, which was “a great relief”.
Symantec estimates up to 10 programmers would have taken six months to write Stuxnet, clearly making it a government-sponsored – albeit illegal – effort.
The worm relies on five “zero-day exploits” – hitherto unknown security vulnerabilities – to infect Windows computers, en route to the industrial controllers that are its target. Martin says zero-day exploits are a rare commodity.
“To put that into perspective, in 2009 a total of 12 zero-day threats were identified.”
Symantec is less interested in Stuxnet’s origins than in preventing its spread. As far as Martin is aware, no New Zealand or Australian organisation has suffered damage from it. “The clear advice to organisations with industrial control systems is, first, make sure your security software is up to date on your PC network, and that you’ve scanned for this particular worm.”
Typically industrial control systems only come in contact with an organisation’s PC network through the intermediary of a USB memory stick, which might be used to transfer a software update.
“This is the single biggest threat we have seen and it has the potential for causing catastrophic consequences,” Martin says. “One would imagine that if I could turn off a cooling system in a nuclear plant, and also turn off the alarm that it was overheating, that I could get some sort of meltdown. This code absolutely has the potential to do that.”
Anthony Doesburg is an Auckland technology journalist.
The British government is reluctant to launch an investigation into a multi-million pounds bribery scandal involving a British defence firm and the Saudi royal family.