The HMS Queen Elizabeth aircraft carrier is the largest ship ever built for the Royal Navy. The project took over nine years of work, and its final cost is expected to exceed €4 billion. The vessel set sail last Monday to begin its sea trials, but recent images have revealed a curious detail: its systems run Windows XP. With two massive ransomware attacks in less than 60 days, many are questioning the carrier’s cybersecurity.
The Ship at a Glance
The HMS Queen Elizabeth serves as an effective replacement for the three Invincible-class carriers that were retired (Invincible, Ark Royal, and Illustrious). It measures 280 meters in length, has a displacement of over 70,000 tons, and can currently carry a maximum of 40 aircraft (36 F-35s and four helicopters). If there are no unexpected delays, the carrier will be commissioned at the end of the year and enter active service before 2021. It won’t be alone: it will have a twin, the HMS Prince of Wales, which is somewhat behind in construction. The HMS Queen Elizabeth is by far the largest and most modern ship ever built within the Royal Navy, yet there is one element in its design that caught us by surprise: its software.
Windows XP and Cybersecurity Concerns
The image shows two officers, with a monitor lit in the background. An experienced eye will quickly identify the blue-and-gray rectangle as the Windows XP login screen, whose extended support ended in April 2014. Any government organization can receive additional support if it chooses to contract it, but the British government stopped paying in 2015, with the idea of forcing an upgrade. That left its health system (dependent on XP) in an even more delicate position, and it was one of the main victims of the WannaCry campaign.
Official Responses
Defense Secretary Michael Fallon told the BBC that the Queen Elizabeth’s computer system is not vulnerable and that the security around it is appropriate.
More interesting are the statements from Commander Mark Deller, who spoke about a much cleaner and stricter acquisition process compared with the commercial computers used in the health system. He added that “When you buy a ship, you don’t buy it today; you bought it 20 years ago.” The original orders for the Queen Elizabeth class date back to July 2007, when Windows XP was less than six years old. Finally, he noted that the carrier has ample room for updates and modifications, so everything seen in the images can be improved in due time. That is complemented by the constant presence of a cybersecurity team as part of the crew. One can imagine that the HMS Queen Elizabeth will be subjected to every possible penetration test in the coming months. If there is an error in the system, it would be ideal to discover it now.
