The race to prevent an ‘electronic Pearl Harbor’
The latest phase of the Iran war has already hit the home front—even in countries that are not fighting. This week, news broke that Iranian hackers shut down a British power plant for several days last month at the same time water plants in 12 American states faced significant cyberattacks. The entry into the British plant, which was relatively unsophisticated, was nonetheless the most successful known attack of its kind.
The power plant seems to have been a relatively minor one, so little damage was done. Power utilities in this country are often as small as British ones, and the distributed nature of the grid has previously afforded Americans some extra degree of protection. But that advantage may soon come to an end.
Governments have long known about the threat of cyberattacks to critical infrastructure, the systems that control vital functions like the electrical grid, water treatment, health care, and transportation services. Warnings about an “electronic Pearl Harbor” or the newer variant, “cyber Pearl Harbor,” have abounded since the first infrastructure was connected to the Web. Mitigating that danger is very difficult: An attacker may only need to find one vulnerability, and people invariably make mistakes in designing or employing systems. Small utility companies, moreover, tend to not have the resources to get top-line protection.
But, paradoxically, the decentralized nature of much American critical infrastructure turned out to be helpful for defending the entire system. The bad guys sometimes shut down highly visible or important assets, like when cybercriminals hacked the Colonial Pipeline in May 2021 and stopped access to roughly 45 percent of the East Coast’s fuel until they received millions of dollars in ransom payments. But causing a societal-level collapse required intricate knowledge of the systems operated by many different companies. For example, electricity is relatively centralized, but it still has 3 power grids, 101 regional electricity-balancing authorities, and thousands of utilities that plug into them.
That knowledge was very hard to acquire and probably beyond the reach of all but the most capable of America’s adversaries, like China and Russia, which can be deterred. Russian hackers grew increasingly brazen during the Obama administration, but Donald Trump scared their bosses in his first term by selectively leaking stories that Cyber Command had penetrated the Russian electrical grid and could retaliate. American hackers also whacked a Russian propaganda farm.
Decentralization might not be the shield it used to be, though, thanks to artificial intelligence. So far, AI hacking programs do not seem to be coding virtuosos that astound and amaze with the elegance of their exploits. But they can try out thousands of simpler attacks, like the ones the Iranians succeeded with, and could still cause a lot of damage by getting lucky.
And they might be able to multiply that damage. Former Federal Energy Regulatory Commission chair Jon Wellinghoff discovered that “if you knock out nine total substations among those three [electrical] grids, you can black out the entire United States” for more than a year and a half. Wellinghoff thinks an enterprising group of middle-schoolers could figure out which ones to hit. Presumably, as more powerful AI reaches the market, nefarious actors will be able to more accurately model U.S. and allied infrastructure and learn how to do the most harm. Most criminals are more interested in making money than inflicting damage, but smaller states like North Korea are game for both.
Those AIs are already available. As this column mentioned two weeks ago, the Chinese have used autonomous hacking programs against Taiwanese government websites. While testing new models to understand their ability to cause damage, OpenAI, Anthropic, and Meta all discovered their programs escaped the testing area and led to real hacking incidents. A Chinese company called Z.ai released on Friday an open weight model that has similar capabilities.
The Trump administration is addressing these problems in a few ways. At the beginning of August, it finalized a framework for reviewing new AI models. The leading AI companies have been briefed on the framework, participation in which is voluntary. A couple of weeks later, it authorized U.S. companies to play more aggressive cyberdefense and hack back in some circumstances.
That said, the threat of retaliation is not fully protecting the home front against state actors like Iran, and it is not clear how much American critical infrastructure will work if China attacks. And the frequency with which the federal government gets hacked does not inspire confidence in its ability to protect other networks it does not own.
State and local governments will likely need to redouble their efforts to protect their citizens. AI that enables cyberattacks can also enhance cyber defenses, so it is possible for the proliferation of new models to benefit American society. New York City created a cyber command in 2017, and Texas instituted its own last year.
Others need to follow suit fast.
Read the full article here
