Building the next generation of railway cybersecurity

Thales recently signed an agreement with the Global Centre of Rail Excellence in Wales. Credit: GCRE

The railways are a pivotal part of the UK’s infrastructure. The most recent Office for Road and Rail figures recorded a total of 420 million journeys made by passengers in Great Britain from April to June 2024, up 7% from the same period in 2023.

Rail makes a huge contribution to the UK’s economic productivity and connectivity. With many parts of the network now full at peak times, new capacity is urgently needed, alongside making existing operations more resilient and efficient.

One way this is happening is through digital transformation. With modern signalling and train control capabilities, such as Connected Driver Advisory Systems (CDAS) and Traffic Management (TM), the industry can start to improve capacity on existing lines in the short to medium term, without the high costs and long timelines of delivering completely new railway infrastructure.

Security varies between international and national rail in terms of the threats faced, but across the industry, there has been a necessary shift towards a technology-centred approach to face evolving threats.

Improving the ability of operators to measure and sense what’s going on is a big part of this. We’re starting to see greater use of Internet of Things (IoT) sensors to monitor everything from passenger flow and fleet status to planning, scheduling, and optimising maintenance schedules. This increased digitisation must also be cyber resilient, with railway cybersecurity designed into these systems from the outset.

Operators need to be confident that they can proceed with rolling out more digitally enabled ways of working, with automated reporting, warnings, and actions; and trust the output those systems are giving. 

This cyber resilience is fast becoming a legal requirement. There must be a detailed understanding of the intricacies of designing secure, resilient solutions for control and management – and trust that data on things such as train position can be trusted to be accurate.

The rail industry needs to be properly equipped to deal with cyber threats just as it would be for any other safety or operational risk because if there’s any doubt, services must be halted. 

One example of where we can build trust in these digital systems is through establishing secure communications. Online Key Management Systems (OKMS) help secure and manage the transfer of safety-critical information between things like trackside equipment, and in-cab European Train Control Systems (ETS) equipment.

Already deployed on several railway systems around the world including the UK, the online element means that control keys and instructions can be issued in a more automated fashion, without the need for a human interface. 

Several organisations across the industry are helping develop, shape, and test the next generation of rail and mobility. One of them is the Global Centre of Rail Excellence (GCRE), which will become one of Europe’s leading rail innovation centres when it opens in South Wales.

The GCRE will have the capability to test new technologies and solution innovations, including everything from the lifespan of infrastructure as it ages to system integrations, as well as delivering training with university and industrial partners. Thales, with our expertise in protecting critical systems for rail networks and operators across Europe, recently signed a Memorandum of Understanding (MoU) with the GCRE.  

There are several ways our objectives and activities align between the two organisations. We are both committed to addressing core aspects of our future Critical National Infrastructure through technological innovation and investment, alongside increasing the cyber resilience of this infrastructure.

We are committed to innovating on railway cybersecurity to support digital transformation, as well as investing and driving the future direction of what cybersecurity is needed for in the era of AI. Once the GCRE gets up and running, we will be working closely together on testing and exercising digital security in the rail industry.  

As important as it is, however, the railway of the future won’t just be about the technology. We also need the talent and workforce in place to make the digital railway an operational reality, encouraging those with cybersecurity backgrounds, as well as those just beginning their careers, to consider roles in rail innovation. 

To that end, a significant part of Thales’ collaboration with the GCRE will be in delivering and developing educational and training programmes.

Thales has already worked with over 200 schools and 8,000 students across South Wales to inspire young minds about these prospects, alongside a partnership with Cyber College Cymru for those in their next stage of education to create pathways for students to pick up skills and connect with job and training opportunities in the industry. 

There are two key issues with the production of REEs. First, all the rare earth deposits are mixed together, so it is difficult and expensive for processors to separate them and to take advantage of their individual properties. It is similarly challenging to split up the more valuable ones, such as terbium, from those of little value, like lanthanum.

Second, REEs are bound up in mineral deposits with the low-level radioactive element, thorium, exposure to which has been linked to an increased risk of developing lung and pancreatic cancer.

These obstacles create a huge challenge for any Western company that wants to become involved in the industry. However, they must be overcome if the Western world is to end its dependence on China.

The biggest rare earth mines are located in China, and this source of domestic production has helped drive Chinese dominance. The Bayan Obo deposit in Inner Mongolia, north China – containing 40 million tonnes of rare earths reserves – houses the world’s largest deposits. The mine has been in production since 1957 and currently accounts for more than 70% of China’s light REE production.

However, Western mines are aiming to change this balance of production and power. The Mountain Pass Mine, owned by MP Materials , a Las Vegas-based mining company, is an open-pit mine of rare earths on the south flank of the Clark Mountain Range, 85km south-west of Las Vegas. In 2020, the mine supplied 15.8% of the world’s rare earth production and is the only rare earth mining and processing facility in the US.

In October 2020, Donald Trump, the former US president, signed an executive order declaring a national emergency in the mining industry, aimed at boosting the domestic production of rare earths. Trump ordered his cabinet to study the matter, with a view towards giving government grants for production equipment and imposing tariffs, quotas or other import restrictions against China.

The move, it said, would “allow the US Government to leverage the resources of its closest allies to enrich US manufacturing and industrial base capabilities and increase the nation’s advantage in an environment of great competition”.

The move, it said, would “allow the US Government to leverage the resources of its closest allies to enrich US manufacturing and industrial base capabilities and increase the nation’s advantage in an environment of great competition”.