Why cybersecurity is on our minds this 9/11
This article originally appeared on Engadget.com on Sept. 6, 2016
This September 11th marks the 15-year anniversary of the worst terrorist attack on American soil. The death toll from the World Trade Center, the Pentagon, and United Airlines flight 93, which went down in a cornfield in rural Pennsylvania, lies at 2,993. The attacks led to a war in Iraq and Afghanistan. But the effects of the attacks were so much more pervasive than that: airline and national security were completely overhauled, international relations were forever disturbed, and the very concept of personal privacy as put into question.
But thankfully, there has not been an attack on the US of that magnitude since 9/11, due in large part to great efforts from law enforcement and national security programs. In fact, the chances for another large-scale terrorist attack on an American structure are quite small. But the truth is, if there were another devastating attack in our country, it wouldn't occur with missiles, explosions or hostages. The next major terrorist attack on our country - and make no mistake, there will be one - will take place on a different battlefield: the internet.
As more and more of our critical infrastructure has become dependent on wireless connectivity, the threat of a potentially catastrophic cyberattack on our major cities has become severe. The risks of cyberterrorism extend far beyond disrupting our internet connections. A properly-positioned attack has the capability to wipe out an entire region's energy grid, food and water supply, sanitation, medical services, as well as emergency communications. In just a few days, the death rate would double, then triple, after a few weeks, it would rise exponentially. In short, a cyberattack could make all other terrorist attacks pale in comparison.
The Growing Number of Cyber Threats
Cyberattacks around the world have been increasing at an alarming rate both in scope and severity. In 2008, a cyberattack in Turkey caused a gas pipeline to explode. Across the middle east, the destructive malware known as Shamoon and Flame have been wreaking havoc on many different sectors. In 2015, an attack on the Ukraine's power grid left 225,000 people without electricity or communication. In March 2016, a major attack arrived stateside: an Iranian cyber terror group coordinated an attack on 46 major financial institutions, and a dam outside of New York City. What is most disturbing about the recent trend of cyberattacks is not that they are increasing in number, it is that they are increasing in severity.
Fear of Cyberwarfare
According to a recent survey of major U.S. defense officials, cyberwarfare was considered the single greatest threat to national security, ranking 20 percentage points above terrorism. Leon Panetta, the US Defense Secretary, has spoken openly about concerns he has of a 'cyber-Pearl Harbor'. Many of the most destructive cyberattacks in recent history have been attributed to warring, adversarial governments organizations. And the United States has made several enemies, both overtly and covertly.
The biggest of these enemies is China, with Russia coming in a close second. China employs thousands of brilliant software engineers who design malware directed at America's Fortune 100 companies. What's surprising is the fact that the micro-aggression is two-sided; The Stuxnet worm, which paralyzed centrifuges in Iran's Natanz uranium-enrichment plant, was designed in either America or Israel, or most likely, a collaboration between the two allies.
An Impending Attack on US Critical Infrastructure
A cyberattack on critical infrastructure in the US could have devastating ramifications. A note of optimism is in the fact that the US grid is made up of a network of utility companies, transmission networks and distribution hubs, making it difficult to disintegrate from one cyberattack. According toThe Energy Sector Hacker Report, by the Institute for Critical Infrastructure Technology, the US energy sector contains several vulnerabilities, which can be exploited in countless ways.
Most utilities were designed to be flexible, not secure. The legacy industrial control systems and supervisory control and data acquisition systems are practically obsolete. And trying to add external cybersecurity measures usually results in inadequate and mismanaged security. In addition, the US power grid relies only on about 2,000 high and extra high-voltage transformers, that if targeted, would result in months of outages in large areas. The effects of a major outage would be loss of life, crime and general chaos and anarchy.
Where Do We Stand Now?
For all the concern being shown by our leaders, the fact is that government policies regarding cyberterrorism remain confused and secretive. There is no sweeping legislation yet dedicated to comprehensive national cybersecurity, mainly because several US legislators feel that it would be too great a burden on industry. In response to this indecision and stagnation, the Obama administration has created directives which contain guidelines regarding cyber activity, which are also classified. A glowing problem with these directives is that they should not be considered legislation, as they are made up of suggestions rather than laws.
The bottom line is that while the US government operates as a slow-moving bureaucracy, cyberterrorists do not. It is the responsibility of lawmakers as well as private corporations to develop ever-evolving defense strategies to thwart those cyber attackers. So that in 15 years' time, when looking back on today, we won't be mourning another, even more tragic, attack.