PARIS, July 25 — The Cold River attack has accelerated efforts to secure fusion research networks across NATO, throwing the vulnerability of cutting-edge energy science into stark relief. In the corridors of the ITER Organization in southern France, where 35 countries including Russia (though cooperation has been strained since the invasion of Ukraine) collaborate on the world’s largest experimental tokamak, the hacking incident has become a catalyst for a new wave of security mandates that ripple well beyond the construction site.
Against this backdrop, the United Kingdom’s STEP programme — which aims to complete a prototype fusion power plant by 2040 — introduced a ‘security-by-design’ mandate for its entire supply chain. By 2025, all contractors will require audited cybersecurity compliance, a move that reflects what is at stake: the theft of Western fusion designs could help rival powers close a technological gap that has taken decades to open.
The Cold River Aftermath
The attack itself—whose precise details remain classified—prompted immediate reactions on both sides of the Atlantic. The US Department of Energy’s Fusion Energy Sciences office is piloting a new ‘Cyber Secure Network for Fusion’ built on zero-trust architecture, with pilot deployment at the Princeton Plasma Physics Laboratory and General Atomics scheduled for the third quarter of 2024. The ITER Organization, meanwhile, implemented additional access controls in April 2023, including mandatory multi-factor authentication for remote access and network segmentation of the scientific control systems.
These measures are not merely technical. They constitute a recognition that fusion research, long treated as an open scientific enterprise, has become a strategic asset—and therefore a target.
The wider picture involves a global race: the US, UK, EU, China, South Korea, Japan, and India are all pursuing fusion projects, each with its own security calculus.
The Wider Geopolitical Picture
China’s EAST tokamak has already achieved sustained 101-second plasma confinement, and its China Fusion Engineering Test Reactor is scheduled for operation in the 2030s. Russia itself operates the T-15MD tokamak at the Kurchatov Institute and, despite sanctions, continues its fusion research and development. The theft of Western designs could accelerate Moscow’s progress—a prospect that has concentrated minds in London and Washington.
The UK’s 2024 integrated review identified fusion security as a national priority and established a dedicated Fusion Security Liaison Officer position at GCHQ. The next likely step, according to informed observers, is increased classified cooperation between US and UK intelligence agencies on protecting fusion intellectual property, alongside NATO’s new ‘Critical Energy Infrastructure Protection initiative’ announced at the 2023 Vilnius Summit.
What Comes Next
In the corridors of power, the Cold River attack has done what months of diplomatic warnings could not: it has made fusion security a front-burner issue. Whether the new security architecture can keep pace with the accelerating research timeline—and with adversaries who are watching closely—remains an open question. What is at stake is nothing less than control over the energy source of the second half of the century.
