Imagine nation-state X. It is a small country, a cultural and religious misfit among the dozens of larger nations that surround it. Despite its size, X has amassed a disproportionately large military force to protect itself from potential threats from its unstable neighbors – one of which, Y, is a controversial theocracy that openly opposes the existence of X.
Y is known to be developing nuclear technology, a prospect that clearly threatens X. Fearing that Y will develop weaponry capabilities, X develops a piece of malware – surreptitious software designed to interfere with another computer’s normal functions – to infect computers in Y’s nuclear plants and delay its production of nuclear technology. Computers in Y and other nations around the world are temporarily crippled by the sophisticated contagion of X’s malware.
Years ago, such a crisis would have seemed to be an excerpt from a preposterous piece of science fiction kitsch, grounded in fanciful perceptions of computer capabilities. Last month, however, the inevitable occurred – a piece of malware, Stuxnet, demonstrated that such futuristic fantasies have already become reality.
It is not hard to guess that X is Israel and that its suspected aggressor, Y, is Iran, set within a turbulent Middle East. Although roughly 62,000 computers in Iran were recently attacked by “the most complex piece of malware in the history of computing,” it cannot be confirmed that the engineer of the malware was Israel. According to Graham Cluley, a computer security expert at the British firm Sophos, it is “very hard to prove 100 percent who created a piece of malware, unless you are able to gather evidence from the computer they created it on.”
Still, Ralph Langner, a computer scientist at Langner Communications, points out that “because the development requires much more resources than any … hacker group could afford,” Stuxnet must have been constructed by a wealthy and resourceful government with “insider information” concerning the computers targeted. The list of governments with the motive and the capability is not very long.
Identity of the perpetrator aside, this incident raises an important possibility – that such malware should in fact be used to sabotage malevolent nations’ facilities when international sanctions and other methods of warning fail to suffice. A more professionally designed malware program, under careful management, could serve as an excellent last resort to prevent violent actions from aggressor states, as well as threatened states who might take preemptive military actions.
How advanced could this malicious software be, and how do its capabilities inform the perpetrators’ motivation behind its production? Sean McGurk, the head of the National Cybersecurity and Communications Integration Center, demonstrates that the Stuxnet virus can be contained in a single “blue rubber-clad swivel-style USB thumb drive.” This virus could, he explains, infiltrate any software that uses Supervisory Control and Data Acquisition, or SCADA.
Most automated plants, including oil refineries, food production facilities, and nuclear reactors, use such software and are thus susceptible to the virus. Once planted in these computers, Stuxnet can modify the programs’ functions while remaining hidden, rendering any changes invisible.
Given that over 60 percent of the computers infected by Stuxnet were located in Iran, it is plausible that the virus’ engineers had targeted the nuclear facilities at Bushehr and Natanz, which, according to Mahmoud Ahmadinejad, its president, are being used strictly for civilian energy purposes. Siemens AG, the German control systems conglomerate that built the Bushehr facility for the Shah of Iran in the 1970s, has confirmed the Iranian government’s claim that no significant harm was inflicted upon the facilities. Although no permanent damage was done, Alan Bentley of Lumension said that the Bushehr plant “was not working properly for months.” Stuxnet’s perpetrator had therefore been successful in disabling the epicenter of Iranian nuclear innovation.
According to computer security experts, the Stuxnet virus is under control and no longer poses a threat. The question that remains in its wake, however, is whether such cyberwarfare ought to become an accepted tool in the arsenal of warring states.
Indeed, other potential aggressors, from national governments to multinational corporations, could potentially use Stuxnet as a platform to build and launch their own malware. Such tactics could ultimately become commonplace methods of espionage and sabotage from state and non-state actors alike.
Given its insidious ease and speed in “infecting” computers on a global scale, cyber sabotage is often decried as dangerous and cowardly. But the Stuxnet incident also opens a provocative angle: if the malware is used to reduce the aggressive capabilities of a government that is internationally recognized as structurally backwards, defiant, and malevolent in its policy, then non-militaristic means of sabotage such as Stuxnet should perhaps be applauded for their ability to temporarily cripple their military potential.
With the advent of government-funded malware, aggressive or defiant nations could be neutralized without violence when diplomacy has failed. North Korea, a nation that has flagrantly defied international sanctions and diplomatic agreements, could be paralyzed with advanced malware. This would bypass the violence and almost certain loss of life associated with military force.
Naturally, such an approach remains contentious, and this must be addressed at both the national and international levels. Leaders must weigh carefully the implications of such a frighteningly effective method of preventive action. Governments should work together on joint regulations, which could be modeled after nuclear disarmament treaties.
Domestically, America should improve its cyber security to ensure that it is not susceptible to sabotage from abroad or within. Bugs must be ironed out of any malware to prevent civilian computers from being accidentally attacked.
Despite these difficulties, we should consider the potential peaceful efficiency afforded by cyber sabotage. Imagine a world in which defiant and malicious military actions can be stopped before they have begun. Warfare fought by lifeless computers with viruses may ultimately prove to be better for us all than war fought by young men and women with guns.


