As the ball dropped in Times Square and bells across the globe rang in the new year, the cyber world reminded us, yet again, that the new year brings significant new challenges.
To recap quickly, Stuxnet was a wild, malicious computer virus that infected the Iranian nuclear program, causing the machines that Iran uses to purify nuclear fuel to malfunction. By all accounts, Stuxnet set back the Iranian nuclear weapons program by a year. But it also infected servers around the globe in India, Indonesia, and the United States. Nobody knows who unleashed Stuxnet, but speculation centers on Israel or America.
Then came Duqu, a “cousin” of Stuxnet that operated using much the same internal structure and logic. Duqu didn’t cause machines to run poorly; it just got inside their systems and stole information (perhaps as reconnaissance for a later attack).
Now, we learn that Stuxnet and Duqu have some cousins—maybe as many as four of them. There are enough of them now that the entire family gets its own name: Tilded. These other cousins are mysterious guests in our computer systems, and nobody is quite sure yet what they will do.
But we can see some of the effects already. Duqu, for example, hijacked a server in Mumbai and used the server as a “command and control” center for its operations. Indian authorities were forced to shut the server down.
The challenges of our new cyber world are becoming increasingly clear: The Internet is a borderless, global domain, and security is only as strong as the weakest link. American security depends, in no small part, on cybersecurity in Mumbai and around the world.
This creates a profound challenge for American policy. The reality is that cybersecurity is an international issue. If there ever is a cyber war, America’s enemies will launch their attacks from overseas sites that, initially, are beyond U.S. control. We need to start developing a policy that induces bad actors in cyberspace to clean up their act. If we don’t, then next year’s New Year’s celebrations may be much less merry.
