As someone who makes a living in the Internet technology world, it is both alarming and discouraging to see a headline like I saw today. That headline: “Computer Virus Stuxnet a ‘Game Changer.’”
Those were the words used by Sean McGurk, head of the Department of Homeland Security’s Cybersecurity Center when he testified before the United States Senate yesterday. The virus, generating a highly complex computer attack that may have been targeting Iran’s nuclear power plants is now posing serious security threats to critical infrastructure across the world. By critical infrastructure, he was referring to electric power grids, water treatment and oil and gas pipelines.
There is insufficient knowledge at the moment to identify what specifically was the target of the attack. There are an approximate 44,000 unique Stuxnet infections worldwide currently, with 1600 of them in the United States. Who was behind the attack also remains a mystery.
Congress has been sitting on legislation critical to cybersecurity for more than a year, and it would seem that legislation will be waiting for the new Congress to convene next year before it’s discussed or considered for passage. Neither the Obama administration nor any committees of Congress with jurisdiction over such a bill have stepped up to move things along.
It is the nature of software protection, for the most part, to be reactive rather than pro-active. Anti virus and spam filters are programmed to block known viruses and known spammer habits, and since those filters are not adaptive on their own, they remain susceptible to new virus strains and new spam “tricks.” Hardware protection is not invulnerable, either.
In a report released last week, we learned that two incidents earlier in the year showed China showed the ability to substantially manipulate the Internet. In one, traffic to 15 percent of the world’s web sites was redirected through Chinese servers for about a half an hour. The Internet security firm McAfee provided the U.S. government with a list of 53,000 websites that were hijacked for 18 minutes on April 8 – - data headed for the U.S, Senate, the Army, the Navy, the Marine Corps, the Airfore, the secretary of defense, NASA, other government offices, and such commercial entities as Dell, Yahoo, Microsoft and IBM.
In short, we remain quite open to ever-more-sophisticated types of attacks to our major infrastructure such as the Stuxnet virus. It doesn’t matter what the Stuxnet’s primary target was anymore except as a way of finding any breadcrumb trail that target might provide to its source of the virus. What does matter is that is now exists, and all potential targets are in jeopardy. It’s a dangerous world we live in today.
A crippling attack seems inevitable in our future, whether to power grids or potable water supplies or financial networks or defense systems. It is a frightening notion, and it was a scary headline to read this morning. That neither the White House nor Congress has beefed up legislation and funding to prepare defenses is criminal.

United States