Stuxnet was the Manhattan Project of the 21st century. This complex, subtle computer worm–detected in 2010–was designed to make the Iranian nuclear centrifuges malfunction ever so slightly, delaying Iran’s march towards a nuclear bomb without the Iranians even knowing why. It revealed the serious vulnerability of every automated industrial control system, and they’re almost all automated to some degree.
This is the computer virus as weapon. It did real, physical damage to equipment. It opened a new front in cyber warfare, and nothing will ever be the same again. Unleashing it–even on an enemy–was an incredibly irresponsible, perhaps even immoral, thing to do. There’s little doubt that it was created by the United States, working in collaboration with Israel.
We’re wasting our time with the TSA kabuki security theater. The next 9/11 won’t require any airplanes. A sophisticated virus can do more damage and claim more lives. Imagine a program that can knock out power grids, crash economies, wreak havoc on transportation network, and worse.
We’re already seeing the Sons of Stuxnet. Last year it was Duqu, which was almost certainly created by the same people behind Stuxnet. Like Stuxnet, it targets industrial control systems, but appears to only be collecting information. For now.
News is just emerging from the Middle East about a third major virus that appears to have been operating for about two years, also collecting information in ways reminiscent of Stuxnet and Duqu. The virus is called Flame, and it’s already appeared in Iran, Lebanon, Israel, Syria, Sudan, Egypt, and Saudi Arabia. Here’s what the New York Times is reporting:
[Flame] has been grabbing images of users’ computer screens, recording their instant messaging chats, remotely turning on their microphones to record their audio conversations and monitoring their keystrokes and network traffic, according to a report by Kaspersky Labs, a Moscow-based security research firm.
The researchers said Flame appeared to have been developed by a different group of programmers [than Stuxnet]. It contains 20 times more code than Stuxnet and is much more widespread than Duqu. Researchers believe Duqu hit fewer than 50 targets worldwide. Kaspersky’s researchers said they had detected Flame on thousands of computers belonging to individuals, private companies and universities across the Middle East.
“Flame can easily be described as one of the most complex threats ever discovered,” Alexander Gostev, the head of Kaspersky’s Global Research and Analysis team, wrote in a blog post on Monday. “It’s big and incredibly sophisticated. It pretty much redefines the notion of cyberwar and cyberespionage.”
Governments are doing this, not rogue hackers. They are playing with fire, and we’re the ones who are going to be burned. I have no doubt at all that America would unleash a weapon like this if it felt like it could achieve some geopolitical ends that would otherwise require military action.
That may seem like a fair tradeoff, but it’s short sighted. The potential for collateral damage is vast, with viruses migrating across systems throughout the world. Stuxnet was extremely sophisticated and precise: it targeted specific systems of specific hardware. (The German manufacturers of that centrifuge hardware had to collaborate with the virus programmers to make this possible.) Now that it’s being studied by our enemies, we can count on the next version being less picky about what industrial operations it targets. Perhaps our refineries? Or even our nuclear power plants?
Did the people who authorized the operation really believe there would be no blowback? It’s not like making a nuclear weapon, which requires sophisticated equipment, large physical plants, and rare elements. A team of talented programmers could create a devastating cyberweapon without ever even meeting each other. It wouldn’t even take that much anymore, now that people can study and copy Stuxnet. A Stuxnet-like virus can be created with only four lines of code, by anyone, and made to freeze an industrial control system, causing damage and even catastrophic failure. Governments have programs to counter cyber warfare threats, but will these be enough?
We are on a very dangerous path, and there is no turning back now. Cyber wars will affect non-military targets and civilians to a far greater degree than modern conventional warfare, which means they are morally regressive. In the 20th and 21st centuries, the major powers made an effort to minimize civilian casualties and collateral damage. Cyber warfare has the potential to reverse that trend, as civilians enter the line of fire. Knock out the power in large city or region for long enough, and we’ll lose clean water, refrigeration, hospital equipment, heating in winter or air conditioning in summer, communication, and all the other “little” things that make modern civilization possible. Add in widespread social unrest and looting, and the question isn’t whether or not people will die, but how many.
We always felt safe and secure in America, certain no foreign power could set foot on our soil in order to harm us or damage our homeland. Well, they don’t need to set foot on our soil any more. They can do it with from a distance, with a virus. Think of all the places our daily lives intersect with computers. Sure, they have their own security, but no protection is foolproof. Cyber warfare can hit civilian targets with astonishing ease. Our communication, transportation, power, and information infrastructure could be knocked offline without a missile ever being fired. All our military power and hardware can do nothing to protect us from a threat like this.
I’m writing this post on a laptop with a microphone and camera built into it. Flame can turn both of those on, record everything being said in this room, track all my keystrokes, capture all my email and messages, and I’d never even know. Do you think if an enemy government was given that power it wouldn’t use it?
Do you think if our own government was given that power, it wouldn’t use it?
Are you sure they’re not using it already?
Flame has been out there for two years. We only just found out about it. In all likelihood, we created it. We did: the country that reserves the right to drone kills and indefinite detention and torture of “enemy combatants” and roving warrantless wiretaps. Conservatives under Bush felt secure that these powers would only be used against “terrorists”. And then Janet Napolitano toddled into power and included pro-life activists in a report on domestic security threats. And then Obama declared the entire world, including the United States, a potential battlefield.
Cyber wars will be waged by foreign enemies on American civilians. They will also be waged by the American government upon its own citizens. It will happen. It’s already happening. Stuxnet let the genie out of the bottle. Duqu let it run free throughout the world. Flame gave it the key to virtually unlimited surveillance. Who knows what other viruses have been operating and will continue to operate without us even knowing? America let that genie out, and by the time the people in power realize their mistake and try to stuff it back in, it will be far too late.