Fifth Domain Electricity

There's been more than a few news articles this past week about Facebook and Cambridge Analytica and how user data was used to (maybe (almost certainly)) swing the 2016 election.  Enough coverage that I'm not going to talk about it here.  Suffice to say that anything you put on social media can and will be used in ways that you may not intend.  Including rambling blog posts.

Instead, I want to discuss another item that is not getting as much traction, but may be much more serious.  It's this opinion piece from The Hill that warns of Russia's ability to attack our infrastructure through the internet.  It sounds like something from a spy thriller and would be easy to dismiss if they had not already done it once.

Because Chernobyl Wasn't Enough

The previous attack was against Ukraine, a former part of the USSR that has been trying to join the western block for the past several years.  Read the Hill piece for the details, but the short version is that they used spam emails to the employees of the Ukrainian electrical utility to then gain access to the grid controls.  They shut down the Ukrainian power grid and coupled it with a DDOS attack on the phone system to keep anyone from calling for help.

The reason that I classify this as a more serious threat is that, should it happen, it is a 'hard' attack.  It targets physical things made of metal and concrete.  The Cambridge Analytica thing targeted 'soft' things: opinions and feelings and thoughts.  Without the 'hard' things, the 'soft' things become hard to have in the first place.  Harder to influence, sure, but also harder to correct, harder to share.  It becomes harder to be a human in the twenty-first century.

Soft is Bad, Hard is Worse

Don't get me wrong, the direct manipulation of Facebook data to influence an election is deeply damaging.  It brings into question who we are as society: are we people or data to be used?  Are we the thoughts inside of our heads or have those all been planted there for some outside reason?  Those kinds of thoughts can drive people mad; can drive them to suicide (if you are having those kinds of thoughts, please seek help).

However, even with all of that, we can still wake up in the morning, brew coffee, eat breakfast, drive to work and live our lives.  The infrastructure that allows us to be Western Civ Peeps is still there.  The lights work, the tap water runs, the traffic lights give us turns in the proper order.  The attack that Morgan Wright warns of in the piece from The Hill threatens all of that.

This is now being termed 'War in the Fifth Domain': cyberspace (land, sea, air and space being the first four).  It has been going on since at least 1982, but escalates every year as more and more stuff gets connected to networks and those networks then get remote access.  Think of the attack on the Iranian uranium enrichment centrifuges by Stuxnet.  Nation states are using this incredible tool, the Internet, that we/they created to further their own national interests.  And the weapons that they are using are not that hard for others to recreate (or outright steal).

Hard Solutions

What's to be done?  First, push the bureaucracy.  Much of the equipment controlling this critical infrastructure is very much out of date, leaving it open to old attacks that have been handled years ago.  This costs money for upgrades and technician time, but it keep the lights on.  No one is doing anything if they are off.

Secondly, much of the controls over this infrastructure needs to be decentralized.  Not just across regions or companies or departments, but down to the individual user level.  Things like the Brooklyn Microgrid put much of the control into the hands of the end user (and producer).  This concept helps by adding more complexity that the hackers need to punch through in order to be disruptive.  Couple that with either Blockchain or an Etherium style Smart Contract and who is doing what when becomes more exposed and increases the risks to those with nefarious intent.

Thirdly, and finally for the sake of this post, humans need to be removed from the basic decision making process.  Much of the reason that the Ukrainian grid went down is because someone clicked an attachment in an email that asked to open MS Office macros.  That was how the hackers made their initial breach.  Without humans to make those kinds of 'soft' mistakes, the 'hard' equipment is safer.