Cyberworm that Knows no Boundaries

摘要

Iran s announcement that a computer worm called Stuxnet had infected computers that controlled one of its nuclear processing facilities marked a signal event in cyber attacks. Although such attacks were known to be theoretically possible, the Stuxnet incident proved that a cyberworm could indeed be planted in a system and produce physical damage. Furthermore, the sophisticated nature of the worm and the resources that would have been required to design, produce, and implant it strongly suggest a state-sponsored attack. Although the implications of the attack are still unfolding, three are immediately discernable. First, it ends the debate about whether such worms are feasible. Clearly, they are. Second, Stuxnet-like worms pose a serious threat. The creators were able to implant the worm on computers that were almost certainly not connected to the Internet, and they were apparently able to mask its presence even while it was modifying the signals that the industrial control systems were sending. Reportedly, the worm damaged hundreds of gas centrifuges. Industrial control systems are ubiquitous; they control electrical power, gas, refineries, and many other systems. The ability to tamper with them and cause physical damage is worrisome. Third, the fact that Stuxnet apparently required the resources of a nation (and perhaps more than one) suggests a new willingness on the part of governments to use cyber attacks to further national goals. This paper explores the implications of Stuxnet-like worms for the United States and specifically for the U.S. Department of Defense. It discusses what makes cyber defense difficult and outlines the bureaucratic and legal issues and boundaries in the United States that can compound the problem. It then offers some conclusions and recommendations for how the United States can confront the increasing risk posed by such threats.1.