“If we were in such danger with SCADA,
should we have thrownthe first SCADA punch?” Jay Healey, Director of the Cyber Statecraft Initiative at Atlantic Council, posed to a packed house at the Defence One Summit last week.
SCADA, or Supervisory Control and Data Acquisition, refers to the software systems which run America’s utilities and which are notoriously porous in cyber space.
Healey was referring to the cyber weapon called Stuxnet, widely understood to be the first kinetic weapon designed from software — the cyber shot heard round the world.
Stuxnet demonstrated the “absolute cyberpower” of the U.S. and Israel, wrote Ralph Langer in his epic Nov. 19 deep dive into Stuxnet. It’s convenient to press a button and watch reactors go down, but this cyberpower ability to reach out and touch one’s rivals comes with a price.
“We’re not thinking this stuff through,” Healey said, answering his own question, “we’re taking a short term view.”
Just today, tech reporter Brian Fung of the Washington Post outlined how the designers behind the “Internet of things” often don’t understand the full extent of what they’re designing.
“Eventually, [networked household items] will be able to respond to signals from one another independent of human input,” wrote Fung. “Your bathroom scale might tell your refrigerator that you’re overweight, and your fridge might start recommending healthier recipes.”
“That could be great, but it also vastly expands the universe of things that could go wrong … take dishwashers. At heart, they’re very simple machines. But a hacked dishwasher might start running on overdrive, going through multiple cycles, wasting gallons of water and costing you extra and possibly flooding your house.”
Just as a hacked dam would flood a whole town.
Peter Singer, a leading analyst of security and intelligence at the Brookings Institution, highlighted these global consequences at the Defence One Summit, stating that Washington probably hadn’t weighed the multi-spectrum risk of militarizing cyber space.
He cited the revelation that NSA spying resulted in billions of potential revenue losses for American telecoms overseas.
“There’s a four to one ratio in Pentagon spending on offensive cyber research versus defensive cyber research,” Singer said. “I would argue that the big shift is, in the long run, I think history will care more about Stuxnet than Snowden.”
In short: spying (defence activity) may damage egos and diplomatic prestige abroad, but Stuxnet (offensive activity) damaged actual things.
“It’s the idea of using cyber not to steal or disrupt information, but to cause a kinetic change in the world, and that integrates with what’s happening on civilian side,” said Singer. “With the move to the Internet of things, where we don’t use our devices just to communicate with each other, [but to] power and run the world, which then bleeds in vulnerabilities.”
To the NSA’s credit, it “could have broken the victim’s neck” and destroyed the Natanz reactor but instead demonstrated “self imposed restrictions,” wrote Langer, both in order for the virus to remain undetected and, presumably, because the total destruction of Iran’s nuclear reactor would have resulted in nuclear as well as diplomatic fallout.
It’s just as presumable, though, that other actors will not operate by the same ethical measure.
“You think right now in Syria,” Col. Mark Hagerott (ret.), Deputy Director and Distinguished Professor of Cyber Security, said at the Defence One Summit. “Would there be any hesitation by the Syrian Government if an aeroplane was flying and one of the rebels was on the plane, and they could hack the plane and crash it and kill everybody to get that one person? They would probably do that, they used chemical weapons on their own people.”
“Our midshipman are trained to do the right thing, our officers are trained in proportionality, in the laws of war,” said Hagerott, “they would probably resign their commission before they did that.”
Langer’s reporting indicates the same sentiment, except on a larger scale:
Stuxnet-inspired attackers will not necessarily place the same emphasis on disguise; they may want victims to know that they are under cyberattack and perhaps even want to publicly claim credit for it.
And unlike the Stuxnet attackers, these adversaries are also much more likely to go after civilian critical infrastructure. Not only are these systems more accessible, but they’re standardized. Each system for running a power plant or a chemical factory is largely configured like the next. In fact, all modern plants operate with standard industrial control system architectures and products from just a handful of vendors per industry, using similar or even identical configurations. In other words, if you get control of one industrial control system, you can infiltrate dozens or even hundreds of the same breed more.
Throughout Langer’s Foreign Policy report he refers to Stuxnet as a “low yield” weapon, the implication being that there are higher yields.
“I don’t know if we really understand how vulnerable we are,” said Hagerott, citing a recent expert’s talk at the Naval Academy, which Hagerott said used information from a likely “classified” report.
“If our SCADA systems on our east coast were attacked and we could not restore them within about a month, he said we would be talking tens of millions of people dead,” said Hagerott.
The Trinity atomic test could pale in comparison.
“Nuclear proliferators come and go,” concludes Langer, “but cyberwarfare is here to stay.”
Analysts and scholars have begun to posit that the results of the cyber arms race will reach into the very DNA of the Internet, changing its shape, functions, and how humans interact with it.
“We have a militarized cyber policy, we have had it for 10 years,” said Healey, “and those goals are the ones we’re acting toward that have the most budget and least friction in trying of accomplishing what they want.”
“I am gravely doubtful that our kids and grand kids are going to have an Internet and cyber space that is fundamentally as awesome as the one that we had,” he said. “It’s probably going to be less free, less secure and less resilient than the one that we had.”
Business Insider Emails & Alerts
Site highlights each day to your inbox.