We study the problem of securely estimating the states of an unstable dynamical system subject to non-stochastic disturbances. The estimator obtains all its information through an uncertain channel, which is subject to nonstochastic disturbances as well, and an eavesdropper obtains a disturbed version of the channel inputs through a second uncertain channel. An encoder observes and block encodes the states in such a way that, upon sending the generated codeword, the estimator's error is bounded and a security criterion is satisfied, thereby ensuring that the eavesdropper obtains as little state information as possible. Two security criteria are considered and discussed with the help of a numerical example. A sufficient condition on the uncertain wiretap channel, i.e., the pair formed by the uncertain channel from the encoder to the estimator and the uncertain channel from the encoder to the eavesdropper is derived, which ensures that a bounded estimation error and security are achieved. This condition is also shown to be necessary for a subclass of uncertain wiretap channels. To formulate the condition, the zero-error secrecy capacity of uncertain wiretap channels is introduced, i.e., the maximal rate at which data can be transmitted from the encoder to the estimator in such a way that the eavesdropper is unable to reconstruct the transmitted data. Finally, the zero-error secrecy capacity of uncertain wiretap channels is studied.