From analysis of Stuxnet’s attack code we must infer that the attackers are in possession of an IR-1 mockup that not only allowed them to design the attack but also to test-drive it. This fact alone allows us to pin down potential suspects. As has been detailed in the well-known NYT article, places where some of the few centrifuges from Libyan origin can be found include the Dimona complex in Israel, and Oak Ridge, Tennessee.
Jeffrey Lewis has written an excellent blog post on the subject. If you can learn just one thing from his post, it’s what we encounter over and over again: No matter where you start digging in the Stuxnet saga, things are getting even more complex the deeper you dig. In an interesting and plausible twist, Jeffrey links the testing of the Libyan centrifuges to Urenco, the company where it all started. Urenco is the place where A. Q. Khan once worked and where he stole the blue prints of the G-1, the first German gas centrifuge that he then turned into the P-1 in Pakistan.
Urenco remains an interesting target for proliferants as well. One of Tehran’s big players in nukes is Sharif technical university in Tehran. Guess what, in 2003 they established a partnership with the Jülich branch of the technical university of applied sciences of Aachen. This partnership gets them as close to uranium enrichment know-how as possible, at least in terms of geographics: Jülich is a small town near the border to the Netherlands. It’s also the location of Urenco’s German headquater. It’s like going back to the roots.