One of the strangest and most interesting stories of the last week has been the apparent cyber attack on Iranian computer systems that may have targeted the nuclear plant at Bushehr. The malware virus, Stuxnet, also struck parts of China, Indonesia, India and Pakistan, but was largely focused in Iran.
The malware, Stuxnet, attacks Siemens Windows OS software and is incredibly aggressive. Stuxnet, unlike other forms of malware that extract information, allegedly can take control of an automated system and change it. What makes Stuxnet frightening is the level of sophistication. It is complex, targeted and massive, a completely new virus that has the feel of a cyber warfare weapon.
Iranian officials stated the malware had infected 30,000 computer systems, including personal computers for personnel who work at Bushehr. Officials stated it will take a month or two to root it out. It is unclear if the virus directly attacked the power facility or if the virus attacked other Iranian nuclear facilities. It is also unclear if it is the main reason for the now three month delay for startup at the Bushehr plant.
What makes the story interesting is the level of sophistication is only possible by a government or a highly trained group, leaving speculation that the attack came from the United States or Israel. However, no government or organization has claimed responsibility. So, the question remains, who dunnit?
The immediate response is the United States or Israel committed the attack. This morning John Markoff and David Sanger of the New York Times authored a piece offering the idea that perhaps the Israelis, specifically their Technology Intelligence section Unit 8200, launched the virus. However, the sole link to the Israelis is the mysterious word “Myrtus”, embedded in the virus, a possible reference to the Biblical Book of Esther, and a Jewish preemption of a Persian attack. The evidence is mere speculation, but offers some possible clues.
There have been previous reports of efforts to covertly sabotage Iran’s nuclear program, which may explain the decline in the number of Iranian centrifuges at the Nantanz plant. These efforts involve stories of faulty centrifuge parts and stopping shipments from arriving in Iran. The NYT story today did not directly link the virus to the Natanz facility, but linked it to an ongoing effort by Western governments to covertly sabotage the Iranian program.
But, maybe laying blame at the U.S. or Israel is too quick a judgment. Other states like India, Russia, an Arab state like Saudi Arabia, or a European state could have also created Stuxnet. Each has their own motives for slowing an Iranian program. Also, while not outside the realm of possibility, highly sophisticated Iranian dissident groups could have created and launched the virus.
There are many unanswered questions, like the true target of the attack, if the virus just spiraled out of control, which led it to affect other systems in other countries, and extent of the damage. There is not enough information to accurately pinpoint the guilty party or the true motivation.
However, if the Stuxnet attack was government sponsored and not a third party, then perhaps it is an example of the impact of cyber warfare. The debate for potential containment of Iran is usually framed in a kinetic military component, military strikes, arms deals to Saudi Arabia, etc. Perhaps, this latest attack is a glimpse of the behind the scenes world of cyber warfare and exploiting another country’s infrastructure.
In moving forward with discussions on the Iranian nuclear program, the Stuxnet virus may provide analysts another variable in calculating possible deterrence and containment with Iran. If it is a cyber attack weapon, what are its implications on military strategy? On diplomatic strategy? Is an attack fully untraceable, or can Iran attribute an attacker? How would Iran respond to a cyber attack on its nuclear facilities? Would Iran immediately assume Israel or the U.S. launched an attack even if both did not launch the virus? All are interesting questions looking forward.
