Mercy! Mercy! That Dang Nabed PERCY!

Cyberwar: A discussion of Facts

In case anyone in my “Army of Readers” has doubts and thinks I might be making this up, I invite you to read Sanger’s Book. In my blog two days ago I promised to discuss the facts and assumptions bearing on the issues he identifies. This discussion will examine the facts. I will state a numbered fact, use material from Sanger’s book to illuminate it and make a brief comment.

Facts Bearing on the Problem

1. Up to Natanz, cyberwarfare has been limited to hacking into computers, implanting viruses, monitoring and information gathering.

“Previous cyberattacks had effects limited to other computers.” Here Sanger is referring to Michael D. Hayden, a former head of the CIA. “This was the first attack of a major nature in which a cyberattack was used to effect a physical destruction….”

The point is that cyber warfare has gone from hacking computers to destroying the hardware they control. It is a logical step from passively knowing something about an enemy to actively trying to destroy them.

2. At Natanz cyberwar was taken to a new level. It was expanded to include the physical destruction of industrial capacity

“…Somebody had crossed the Rubicon,” Hayden observed. “We have a legion on the other side of the river now. .. this is like August 1945, the month the world saw capabilities of a new weapon dropped over Hiroshima.”

The point here is that the United States is a pioneer in developing this new cyberwar capability and has been at it for some time. An analogy is the development of drone technology. Initially the mission was information gathering but the logical step that followed was adding Hellfire missiles to kill terrorists.

3. Most worldwide commercial industrial capacity has only a limited capability to withstand a cyber attack.

“The good news for the American cyberwar strategists (Technicians? Tacticians? Have we really grown any cyberwar "Strategists" worthy of note?) was that these controllers are virtually undefended; like the first personal computer they were designed in an era when no one thought that they might come under attack. They carried no virus protections, not even something as simple as Norton 360. Greg Shaffer, a DHS official said. “We’re connecting equipment that has never been connected before to this global network. As we do we have the potential for problems. That indeed, is a space our adversaries are paying attention to. They are knocking on the doors of these systems. In some cases, there have been intrusions.”

The message here is that civilian commercial infrastructure is extremely vulnerable to a cyberattack. In my series, The Car Maker and the Real Estate Agent, young women are being recruited to run a sensitive criminal enterprise. This enterprise is conducting operations and securing illegal business records. (Cautionary Note: The training cycle of these young women involves sexually implicit prose… so be forewarned of the graphic content, if you decide to examine these episodes to get to the underlying purpose of the screening process.) What it will take to protect commercial facilities is something similar to what Harden and Associates are doing in the basement vaults of their real estate empire. It is a process that involves 3 by 5 cards, couriers and old technology.

4. Once the STUXNET got loose on the Internet any nation with cyber savvy had an opportunity to pull it apart and study its configuration.

“Then in the early summer of 2010 big trouble hit.” The bug operating inside Natanz got loose and into the Internet. “Within days the code was being picked apart by experts from Silicon Valley to Germany, where Ralph Langer, an independent computer security expert, began dissecting the bug... the very fact that he had a copy…” was a problem. “As Langer later said… The STUXNET virus provides a sophisticated model for constructing an offensive cyperweapon."

There are questions regarding who is to blame… “but no question that the unexpected leak was a “major f***-up." "Now that STUXNET’s in the wild,” Langer said, “you don’t need to be a rocket scientist. You have a blueprint for how to do it.”

The thing to remember here is that the STUXNET virus is a worm we developed hand in hand with the Israelis. It is a "How to" model floating around cyberspace, showing the state of the art in sophisticated cyber weaponry.

Another point to keep in mind is that STUXNET has a lot of artificial intelligence built in. It is like a hungry baby waking up in a crib--- who climbs out, looks about and crawls off in search of a bottle.

5. While Military Command and Control infrastructure in developed countries have firewalls to resist cyberattack, commercial facilities worldwide are extremely vulnerable.

“In September of 2011 Department of Homeland Security (DHS) invited reporters for the first time to the cyber-emergency response center it built in Idaho Falls…DHS installed a simulated chemical company and connected its equipment to computer controllers built by Honeywell, Siemens, and other major manufacturers.” A team of “defenders” trying to protect the mock company from cyberattack was quickly overwhelmed.”

The point here is that civilian commercial infrastructure which includes power grids and industrial manufacturing is extremely vulnerable to interdiction and disruption.

6. Simply having a facility disconnected from the Internet is no real defense against cyberattack.

“It had already occurred to the Iranians that the computer systems running the centrifuges at Natanz were huge targets. But they solved that problem in the same naïve way that many American corporations, power stations or even the US military once relied on in a more innocent age: They made sure to not connect them to the Internet.”

The idea to protect sensitive facilities begins with a moat or "Airspace" around the physical plant that is DEFINITELY NOT connected to the Internet. However, just as we send texts over the airspace of the Internet and pictures from one cell phone to another, this space is readily breached. At Natanz (we're told) it was accomplished the old fashioned way when thumb drives used on laptops were carried across the moat and used to infect the controller programming hardware that operated the centrifuges.

7. Just because information exists does not mean those who gather it, understand its meaning, appreciate its importance, see it in broader context or realize its consequences.

This is such a huge fact that a single passage or two cannot do it justice. What it means is that just because a fact is known does not mean that it will jump out at an analyst or even if it does find its way up the chain (through a sea of tier three intellects) and eventually get noticed by somebody with the intelligence, power and willingness to use it.