  We study the problem of securely estimating the states of an unstable
dynamical system subject to nonstochastic disturbances. The estimator obtains
all its information through an uncertain channel which is subject to
nonstochastic disturbances as well, and an eavesdropper obtains a disturbed
version of the channel inputs through a second uncertain channel. An encoder
observes and block-encodes the states in such a way that, upon sending the
generated codeword, the estimator's error is bounded and such that a security
criterion is satisfied ensuring that the eavesdropper obtains as little state
information as possible. Two security criteria are considered and discussed
with the help of a numerical example. A sufficient condition on the uncertain
wiretap channel, i.e., the pair formed by the uncertain channel from encoder to
estimator and the uncertain channel from encoder to eavesdropper, is derived
which ensures that a bounded estimation error and security are achieved. This
condition is also shown to be necessary for a subclass of uncertain wiretap
channels. To formulate the condition, the zero-error secrecy capacity of
uncertain wiretap channels is introduced, i.e., the maximal rate at which data
can be transmitted from the encoder to the estimator in such a way that the
eavesdropper is unable to reconstruct the transmitted data. Lastly, the
zero-error secrecy capacity of uncertain wiretap channels is studied.
