On the front page of today’s New York Times, Defense Secretary Leon Panetta again sounds the alarm about a "cyber Pearl Harbor.
“An aggressor nation or extremist group could use these kinds of cyber tools to gain control of critical switches,” Mr. Panetta said. “They could derail passenger trains, or even more dangerous, derail passenger trains loaded with lethal chemicals. They could contaminate the water supply in major cities, or shut down the power grid across large parts of the country.”
Defense officials insisted that Mr. Panetta’s words were not hyperbole, and that he was responding to a recent wave of cyberattacks on large American financial institutions. He also cited an attack in August on the state oil company Saudi Aramco, which infected and made useless more than 30,000 computers.
Not hyperbole, hmm? It’s the usual cyber fear two-step. First lay out a doomsday scenario involving hackers remotely derailing trains full of lethal chemicals. Second, cite recent attacks as evidence that the threat is real. Except let’s look at the cited evidence.
Here’s how the New York Times itself described the recent attacks on banks:
The banks suffered denial of service attacks, in which hackers barrage a Web site with traffic until it is overwhelmed and shuts down. Such attacks, while a nuisance, are not technically sophisticated and do not affect a company’s computer network — or, in this case, funds or customer bank accounts. But they are enough to upset customers.
Explosive stuff. And what about that attack on Saudi Aramco? Serious, to be sure, even if no control systems were breached, but as Reuters recently reported,
One or more insiders with high-level access are suspected of assisting the hackers who damaged some 30,000 computers at Saudi Arabia’s national oil company last month, sources familiar with the company’s investigation say. …
The hackers’ apparent access to a mole, willing to take personal risk to help, is an extraordinary development in a country where open dissent is banned.
“It was someone who had inside knowledge and inside privileges within the company,” said a source familiar with the ongoing forensic examination.
What this shows is that one of the greatest threats to networks is not master hackers tunneling their way in, but good old fashioned spies. The cybersecurity legislation that Panetta and the administration are pushing cannot prevent a determined insider with access and permissions from carrying out an attack. It can, however, distort the incentives of businesses and hamper innovation.
A few weeks I wrote an [intentionally provocative post](http://jerrybrito.com/2012/07/25/how-copyright-is-like-solyndra/) comparing copyright to Solyndra. My argument was that just as Congress has a knowledge problem and a public choice problem picking the right technologies to subsidize, so does it have these problems when it comes to picking winners and losers when it comes to setting out the contours of copyright.
The Technology Liberation Front is the tech policy blog dedicated to keeping politicians' hands off the 'net and everything else related to technology.