  Uncertain wiretap channels are introduced. Their zero-error secrecy capacity
is defined. If the sensor-estimator channel is perfect, it is also calculated.
Further properties are discussed. The problem of estimating a dynamical system
with nonstochastic disturbances is studied where the sensor is connected to the
estimator and an eavesdropper via an uncertain wiretap channel. The estimator
should obtain a uniformly bounded estimation error whereas the eavesdropper's
error should tend to infinity. It is proved that the system can be estimated
securely if the zero-error capacity of the sensor-estimator channel is strictly
larger than the logarithm of the system's unstable pole and the zero-error
secrecy capacity of the uncertain wiretap channel is positive.
