Stuxnet and the Future of Cyberwarfare

Gunpowder led to guns, electronics led to electronic warfare, and now we can expect cyberspace to breed its own versions of armed conflict. This month, Wired Magazine published an online tale that rivals any James Bond flick in its twists, turns, intrigue, and drama. It’s the story of Stuxnet: the first computer virus explicitly designed to do physical sabotage to a target of international significance. And it probably worked.

There’s no room here to do justice to the whole story, but the essentials are these. In June of 2010, a computer security firm in Belarus got a call to investigate a persistently rebooting computer. The cause turned out to be an unusual virus that exploited what is called a “zero-day” vulnerability: one that the hackers themselves discovered, and neither the software maker nor antivirus firms know about yet. As both the Belarus firm and investigators at Symantec studied the virus, bearing the name “Stuxnet,” they became more intrigued, because it appeared to be a large, sophisticated virus designed to look for a particular kind of software made by Siemens. This software operated PLCs, which are industrial minicomputers that directly interface with electromechanical gear such as pumps, valves—and uranium-enrichment centrifuges.

After about a dozen cyber-sleuths spent the equivalent of several man-weeks on the problem, they determined that Stuxnet counted on infecting USB drives in a facility using the targeted Siemens software. Once it found its target, it would silently wait until a certain date, and then suddenly increase a motor-drive speed far beyond its rated maximum, all while generating fake signals to the control room making it look like everything was OK. The operators at the target uranium-enrichment facility would be clueless until their centrifuges blew up.

Six months earlier, in January of 2010, International Atomic Energy Agency personnel reviewing security-monitoring camera data for an Iranian nuclear facility at Natanz noticed that over a period of only a month or two, the operators had to replace over 1,000 centrifuges, far more than routine maintenance would require. So far, this is the most direct evidence that the Stuxnet virus was at least partially successful. Iran has obvious reasons for not giving out a lot of details, and whoever developed the highly sophisticated Stuxnet virus has even less motivation for coming forward and admitting that they did it. But internal evidence points to either the U. S. or more likely Israel as the probable source of the malware.

This story is bristling with so many ethical issues I don’t know where to start. For one thing, how does a company with worldwide branches in countries at cyberwar with each other treat information that could potentially ruin a planned cyberattack if it was disclosed? Symantec, where much of the deciphering was done, did not stop their employees from publishing basically everything they found out about the virus almost as soon as they figured it out. This is the customary way cybersecurity firms work, and so far it seems to be the best way to stem the ever-flowing tide of malware that the companies exist to fight. One of the principal engineers involved, Liam O Murchu of the firm’s Culver City, California office, said that the one thing which might have made him hesitate about publishing is if they had found evidence for “100 percent attribution who was behind it.” But because no such evidence emerged, the firm went ahead with their announcements.

In the event, the investigators figured out Stuxnet after it had apparently done most of its damage. This is hardly reassuring to those of us who don’t worry about cyberattacks on PLC-controlled infrastructure such as power grids, water delivery systems, gas mains, and so on. The resources needed to develop Stuxnet, although substantial, are estimated at less than a million dollars. What it took besides money was cleverness, some auxiliary secret information probably known only to a government security operation, and lots of guts. None of these commodities are in scarce supply in various places around the world, so the fact that Stuxnet got as far as it did is a cautionary tale for everyone who has an interest or stake in these matters, which these days means nearly everyone.

Another issue that this raises is the question of where cyberattacks fit on the moral spectrum of war. In a way, a cyberattack designed to do nothing more than disable a plant is the best kind of weapon: no one gets killed, there’s no collateral damage to speak of, and you surgically strike at exactly what you want to take out. If you compare the consequences of a Stuxnet-style attack to something more crude, such as dropping a bomb on the whole facility, the cyberattack looks a lot better when judged by criteria of the just-war theory: it is specifically targeted, it leaves no unnecessary civilian deaths, and it can be proportionate to the situation provoking it.

But by the same token, Stuxnet is now common knowledge among those whose interests it is to guard their own targets of military importance and attack those of the enemy’s. This lesson will be learned, and it’s a very good chance that we’ll see something like Stuxnet happen again. Only the next time it may not be an Iranian nuclear facility. It could be a U. S. power plant, or a German steel mill, or any number of other places. We have taken a long first step down the cyber-warfare road with Stuxnet, and there is no telling where it will lead.

Sources: The excellent article by Kim Zetter entitled “How Digital Detectives Deciphered Stuxnet, The Most Menacing Malware in History,” appeared on July 11, 2011 in Wired’s online edition at http://www.wired.com/threatlevel/2011/07/how-digital-detectives-deciphered-stuxnet/all/1. The article also mentions a widely reported but apparently unverified 1981 incident in which the U. S. Central Intelligence Agency reportedly destroyed a natural-gas pumping station in the old Soviet Union with malware.

Nintendo and the Small Boy: One Uncle’s View

As I mentioned earlier, my ten-year-old nephew is staying with us this summer, and his visit has opened my eyes to a variety of things that would normally remain completely below my radar. Among these is the pervasive phenomenon of video games, specifically the portable Nintendo Game-Boy variety. Because it has become somewhat a bone of contention in our domicile, I won’t pretend to give an even-handed analysis of the ethics of video games here. Instead, you will get an uncle’s thoughts on what one particular video game does to a boy and his relationships to others.

Starting from the legendary Donkey Kong of the early 1980s, Nintendo has pioneered the video-game business and played a major role in its growth from a niche market to the multi-billion-dollar industry it is today, rivaling the motion-picture industry in terms of total revenue. Appealing primarily (but not exclusively) to preteen, adolescent, and young males, it furnishes millions around the world with countless hours of something or other that players seem to want a lot of, and will pay good money to get. “Entertainment” is probably the best word for it, but that doesn’t cover everything.

What exactly does a user do when he plays the Nintendo Super Mario Brothers game that my nephew has? Understand that I haven’t played it myself, except to fail miserably at a two-console option that he tried with me for a few minutes before it became clear that I did about as well as an elephant would fare in the Kentucky Derby. Well, there’s these two little characters intended to represent Italian plumbers, and they scurry around a planarized landscape and do a variety of improbable things to an even more improbable array of other creatures: a large spike-backed turtle, some things that look like animated mushrooms, and other vaguely human-looking beings intended to represent females. There are weird cheesy-sounding sound effects, some meaningless babble-chatter when the characters emit speech balloons, and a score-accounting system that makes the IRS tax forms look like a trivial exercise in addition. I am clearly not Nintendo’s target audience.

But my nephew is. So much so that when we ask him to stop playing it for a legitimate reason, such as going out to dinner or taking a bath, this often provokes a furious flurry of activity accompanied by the desperate plea, “I’ve got to get to a saving place!!” Evidently with this particular game, you can’t just close the lid and pick up later where you left off—it deterioriates somehow, or you lose health points, or Bowser burns your house down, or something else bad happens. You have to play till you get to a designated “saving place” and then you can save the state of the game and go on with the rest of your life, trivial as it may seem in comparison to Nintendo-world.

I will not even mention the amount of time that I, as an adult, have spent waiting for a computer to start up, or shut down, or finish saving, or complete some operation indicated by a blue bar creeping ever so slowly across the screen. My work requires this sort of thing, and it is apparently just the unavoidable price of benefiting from computers, just like taxes are the price of living in a secure country. But for ten-year-old kids to have the same kind of problem already—my gosh, isn’t there some age below which they should be exempt from the tyranny of the digital? With a board game (he likes Monopoly, it turns out), we can simply stop and put the pieces down. Not Nintendo, with this game, anyway. For however long it takes between he hears our cease-and-desist order, and the appearance of the next saving place, the entire family is held hostage to the dictates of some not-especially-well-meaning programmer in Japan or Austin or somewhere, who has decided where and how many saving places a particular game will have. We have taken to monitoring how much time he spends on the thing, and this obliges me to follow him around with a little notecard I record his time usage on. (Yes, I know I could do that better with a BlackBerry, but then I’d have to wait for the BlackBerry to start up. . . .) Once he hits the maximum daily limit, that’s it—no more Nintendo. After some initial protests about this policy, he’s calmed down, and has willingly if not cheerfully abided by our restrictions.

I won’t hunt up a bunch of statistics on how video games make kids more violent, or improve their fine motor skills, or make them eat their broccoli, or any of that stuff. I’m simply interested in how it affects the way they relate to other people. While his talk is full of Nintendo references (he even called himself by the name of a game character this evening), it’s possible that small boys have gone way overboard for brief times over all kinds of things in previous generations. Mark Twain’s descriptions of how Tom and Huck played cowboys and Indians in his fictional version of the 1840s involve more physical movement and imagination than is required to play Nintendo, but the total absorption, the competition, and the on-and-off-again way that boys go after first one enthusiasm, then a different one, does not seem to have changed in all that time. Already the Beyblades (see my blog two weeks ago) are lying neglected under the bed, and one can hope for a similar fate to befall the Nintendo device after a while. I can only guess what will come next, but whatever it is, I can reassure myself with the reminder that this too shall pass—as all of boyhood does too quickly.

Sources: I consulted Wikipedia articles on “Modern cinema” and “Video game” for the comparative sales figures of the two industries.

Manned U. S. Space Flights and E Pluribus Unum

As I write this, the last flight of the last operational Space Shuttle is in progress, and there is only about a week to go before Atlantis lands and retires to a museum. It is a good time to take a retrospective look at the way the United States has gone about doing manned space flight over the last generation.

In aid of this retrospective, I viewed a reissued DVD of the old Disneyland TV show aired by the Walt Disney organization back in 1956. This particular episode was dedicated to the future of man in space, and featured interviews with space-flight popularizer Willy Ley and rocket designer Wernher von Braun. In less than an hour, anyone who was watching ABC that March evening (only one of three networks back then, remember) learned about Newton’s law of action and reaction, what type of fuel space rockets could burn, how staging works, and the amusing problems of eating in a weightless environment.

By today’s standards, the artwork was crude, the animation primitive, and the slow pace would be snore-inducing, especially to young people. But the remarkable thing about this show was that the producers, with the obvious help of von Braun and other rocket scientists and engineers, managed to predict most of the high points of the U. S. space program for the next forty years. The viewer saw giant versions of von Braun’s V-2 rocket engines boost a multi-passenger spacecraft into orbit after a night-launch countdown; maneuvers to dock with an orbiting earth-sensing solar-powered satellite; and a manually-steered landing of a Shuttle-like vehicle carrying the astronauts safely back to earth. A later show in the series went into more detail about how man would eventually fly to the moon and back. Von Braun confidently stated that if we devoted enough resources to the project, we could put humans into orbit and return them safely to earth within a decade.

Of course, history proved him right, but since von Braun was a pivotal figure in the entire space program, it was a bit of a self-fulfilling prophecy. Still, without the advance preparation of visionary productions such as those Disney TV programs and allied magazine and newspaper articles, it is unlikely that the general public would have stood for the tremendous expense of the Mercury, Gemini, and Apollo programs that landed men on the moon by 1969. Not only did the public stand for it, but throughout the 1960s the U. S. space program was generally one of the most popular government activities going: an island of unity in a decade that was characterized by increasing dissent and social unrest.

Over half a century later, I cannot imagine any combination of media effort costing less than billions of dollars that would present a similar idea to the public as effectively as von Braun and his colleagues presented their visions in the 1950s. Back then, technological limitations limited the media options, and anyone who managed to get on national TV at all was guaranteed at least a third or so of the viewing public. In today’s atomized media world, gaining some access is easy—my ten-year-old nephew has a website than anyone in the world can view with the right URL. But addressing a large audience in a single large country such as the U. S., now divided by so many factors­­­—political, social, economic, religious, and otherwise—is a feat that even the largest corporations can’t accomplish without spending billions. And even then there’s no guarantee it will work.

The fragmentation of media has made a number of things harder, not just getting a consensus about the space program. This fragmentation, itself a product of engineering advances, has radically affected how politicians run for office, necessitating their devotion of huge amounts of time and effort merely to raise enough money to be re-elected, along with the potential for corruption that goes along with that. Space enthusiasts have now become just another one of thousands of special-interest groups with their own websites, politicians, organizations, and like-minded supporters who can isolate themselves by selecting the media they pay attention to and ignoring everyone else. It is an unintended consequence of advances in electronic media that national unity about anything, let alone the space program, has become much more expensive, more difficult, and—paradoxically—more necessary.

It is necessary because the vastly more complex world we live in requires a political and cultural environment in which certain basic things get done right, or else the whole mess unravels. A dystopic vision of what the U. S. might become if national unity continues to decline can be gleaned from countries like the Philippines, where the advantages of high technology are limited to a small fraction of elite families, while the vast majority of the populace lives in underemployed and undereducated poverty. We are far better off than the Philippines in many ways, but there are disturbing trends such as continued high unemployment, the shrinking of the middle class, and the breakdown of the family that are moving us in that direction.

Adages become adages because they embody durable wisdom. E pluribus unum (“from many, one”) and “United we stand, divided we fall,” are as true now as they were centuries ago. I am glad that the United States were united enough to achieve the historic breakthroughs in manned space flight of the 1960s through the 1990s. But I can’t help wondering whether we are watching the torch of manned space flight pass from this country to others, perhaps never to return again.

Ethics of Engineered Toys: Beyblade

Most of my readers, unless they are teenage or younger boys, can be excused for not knowing the meaning of the last word in today’s headline: Beyblade. It is an English transliteration of the Japanese word “Beiburedo” which is itself derived from “beigoima,” meaning a spinning top toy. I myself had no clue about this concept until a month ago, when my ten-year-old nephew I shall call here Nate arrived in our house for the summer with a set of Beyblade tops and a full-blown obsession to match. In almost no time, we got familiar with the semi-destructive buzzing and rattling sounds of two metal-ringed tops engaged in a battle royal inside a plastic “stadium” that resembles nothing as much as a glorified dog’s food bowl. And I have competed with Nate in this game, spinning up the tops with a simple plastic rack-strip-and-pinion device that releases the Beyblade into the stadium for its time of combat, which can last as long as two or three minutes.

Children have played with tops for probably thousands of years, but that was before the advent of mass-production manufacturing, global advertising and license deals, and coordinated multimedia campaigns involving print, video, and the Internet. The Japanese toy company Takara (now Takara-TOMY), developer of the famed “Transformer” toy line, coordinated their development and launch of Beyblades with a “manga” comic strip of the same name around 2002. Engineering-wise, the tops have progressed from the first all-plastic models to heavier and more complex ones incorporating both metal “fusion wheels” and interchangeable tips, labels, and other features too numerous to mention. The result is no ordinary top: in the stadium Nate has, the tops appear to “orbit” around one another, engage in complex maneuvers that look almost intelligent, and collide violently due to the textured and sculpted outer edges of the fusion wheels. The shaped wheels ensure that the force vectors resulting from collisions have a randomized element that makes for surprising and unpredictable results. While you would think there are too many random elements involved to make operator skill much of a factor, I have to admit that Nate manages to beat me most of the time. I still haven’t figured out how he does it.

If you ask him how he wins, he will launch into a five-minute spiel about balance versus attack and defense yellow stars, energy rings, spin tracks, performance tips, and strength gained from previous battles with Phoenixes, Eagles, Lizards, Ursas, and I don’t know what all. (There is a tie-in between the names of the various Beyblade models and astronomical constellations.) He has read several of the institution’s canonical works—that is, the original manga series penned by comic-strip and marketing genius Takao Aoki. I have tried reading one or two of these literary achievements. Once you get used to the fact that they are printed backwards (the back page is the front page and vice versa), they are all the same: highly stylized fragmented scenes of huge-eyed boys leaping about in dubious battle with giant tops, all of which is punctuated by jagged-letter sound effects (“KRAK!!!” “ZZZIM!!!”). No sign of plot, character development, or any of that other mushy stuff of no interest to ten-year-old boys.

The engineering ethics of childrens’ games and toys is confined in my experience to only a few topics. One is the question of violent or sexually explicit video games and their effects on the mental and moral development of children who use them. The other is the hazard factor: matters such as choking dangers of small parts, or the incident a few years ago when imported toys for small children were found to have lead paint on them. Beyblade-iana seems to avoid both of these problems. Although it involves small parts, it is not marketed to an age group that is likely to try swallowing them rather than playing with them. And as for the moral consequences of playing with Beyblades, as far as I know it is a matter of speculation, unless some sociologist has done a study on this specific toy.

There are a lot of things to be said in favor of Beyblades. As one would expect from a nation where most families live in tiny apartments, the space required for two kids to engage in Beyblade combat is only about six square feet. Yet a Beyblade battle allows boys to do several things they enjoy doing: exercise a certain amount of physical skill, compete with other boys, and make violent-sounding noises that in the end do little or no harm (it’s a lot better than a toy drum, believe me).

On the minus side of the ledger, I have some qualms about the mythology or backstories that the makers have conjured up to go along with the physical toys. My main knowledge of this mythology is gained through hours of listening to Nate talk about it, so bear that in mind. Apparently there is a spiritual, or at least non-material, aspect to the way Beyblade tops are presented. In this mythology, the tops have intelligence of a sort and some kind of aura or energy that can be enhanced or drained by both physical and non-physical means. I’m not expecting fine philosophical distinctions to be made by a ten-year-old, but the way he talks about his collection gives me the impression that he makes no distinction between changes or improvements that can rationally be expected to make a difference (e. g. changing to a better performance tip), and matters that violate physical law (e. g. things like the idea that one Beyblade he took to bed with him absorbed energy from him and plays better).

Maybe this is making a mountain out of a Beyblade molehill. But this arbitrary blend of the physical and the magical, if you want to call it that, combined with the winner-take-all bluster that he’s picked up from the manga series, are things that trouble me a little. All the same, it is likely that in a few years he’ll look at these toys from an entirely different perspective. They’ll be moved out to make room for a more age-appropriate interest, and will leave only subconscious traces in his mind, perhaps. In the great scheme of things, Beyblade toys seem to bring a great deal of harmless pleasure to children around the world, and so for that reason alone, we should probably cut them a good deal of slack.

Sources: Wikipedia has good articles on the Beyblade phenomenon (“Beyblade”) and a separate description of the toy itself (“Beyblade (toy)”) which I relied on for this piece.