Mercy! Mercy! That Dang Nabed PERCY!

STUXNET

STUXNET

Sanger’s book gives the reader a glimpse into how a computer worm was used to slow the development of the Iranian nuclear program. It actually happened and reads like a spy thriller.

Most anyone who keeps up with the news knows that the Israelis have long wanted to bomb Iran’s nuclear bomb making capacity. The White House felt this was a bad idea and to prevent it the President first tried the usual diplomatic and economic approaches. These were unsufccessful.

There was however an option that President Bush handed off to Obama. This was to launch a cyber attack on the Iranian enrichment facility at Natanz. The idea was to set the centrifuges to racing in excess of their design capacity. Imagine thousands of automobile engines running at normal operating speeds that suddenly get spun up two to three times that and begin tearing apart on the shop floor. That was what STUXNET was designed to do. It worked. Metal started flying and Iran’s nuclear efforts were slowed. If you want to read more go to Chapter 8 (Olympic Games) of Sanger’s book .

My interest is not the story line but rather the implications of what this all means. To facilitate this understanding I’ll use the problem solving process learned in Science 101.

Problem Definition: To determine the implications of the US/Isreali cyberattack on Natanz.

Facts Bearing on the Problem

1. Up to Natanz, cyber warefare has been limited to hacking into computers, implanting viruses, monitoring and information gathering.

2. At Natanz, cyber-war was taken to a new level. It was expanded to include the physical destruction of industrial capacity.

3. Most worldwide commercial industrial capacity has only a limited capability to withstand a cyber attack.

4. Once the STUXNET got loose on the Internet any nation with a remedial cyber security understanding had an opportunity to pull the virus apart and study it.

5. The STUXNET virus provides a sophisticated model for constructing an offensive cyber weapon.

6. While Military Command and Control Infrastructure has firewalls to resist cyber-attack, commercial facilities worldwide are extremely vulnerable.

7. Simply having a facility unconnected to the Internet is no assured defense against a cyber-attack.

8. Just because information exists does not mean those who gather it understand its context, appreciate its importance, grasp its meaning or realize its consequences.


Assumptions Bearing on The Problem

1. There is a distinction between offensive and defensive cyberwar activities.

2. Defensive cyber-activities include hacking, cyper snooping, cyber theft and other forms of cyberwar information gathering. It is a form of espionage that has ample precedent.

3. Offensive cyber-activites are defined as the willful destructive of Nation State’ cyber infrastructure or the hardware it controls.

4. That information gathering and defensive cybr-activities do not constitute an act of war. Espionage is a well known practice and a Nation has a right to protect itself.

5. That offensive cyber-activities certainly constitute an act of war. It is no different than any other form of physical attack. Making recourse to this option crosses the line between espionage/defense and is legally no different than exploding a bunker blasting bomb.

6. The United States should consider getting Congress to formally declare a war on terrorism. This provides a justification for using offensive cyber-weapons against Nation States that aid and abet terrorists. We need to wake up an begin using our legal talent offensively, to explain why this recourse is necessary rather than letting it become a roadblock.

In future blogs I will be discussing these facts and assumptions.