5 ms·

I'm neither a national security expert nor a terrorist, but if I wanted to pull off an attack like this, I'd be concerned that a test run—especially of this sop

I'm neither a national security expert nor a terrorist, but if I wanted to pull off an attack like this, I'd be concerned that a test run—especially of this sophistication, which would likely get a lot of attention in certain quarters—would result in measures that'll make future attacks more difficult. Nobody's going to make the grid impregnable overnight, and—depressingly—it may well be that security is so pervasively bad that the attackers don't believe any immediate attempts to fix the situation can stop them. I'd think, though, that additional security at even a few more sensitive spots could change the situation enough to make whatever was learned by the test run less useful. An attack like this would only serve to tip one's hand and underscore the threat (my personal suspicion of why this was done). It seems a little like testing a valuable 0-day by defacing one government website; okay, that worked, but now everybody's going to start thinking about fixing that vulnerability.

areoform 6y ago
The time span for a deployed "patch" IRL is between years and never. What matters to these unnamed, unknown operators is practise and training. It is a pattern repeated for most covert ops. Semi-software example, Stuxnet (and I'm sure different deployment methods) were tested in Israel pre-deployment - https://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html https://www.nytimes.com/2011/01/16/world/middleeast/16stuxne... For Neptune Spear, the Bin Laden raid, they created different layouts and practiced every part of it, https://special-ops.org/operation-neptune-spear-killing-osama-bin-laden/ https://special-ops.org/operation-neptune-spear-killing-osam... Adm. McRaven's interview is highly recommended to understand their psychology https://www.cnn.com/videos/politics/2016/05/02/bergen-mcraven-bin-laden-training-helicopter-origwx-js.cnn https://www.cnn.com/videos/politics/2016/05/02/bergen-mcrave... The value gained by practicing on US soil to execute such a mission likely outweighs tipping their hand.
- yourapostasy 6y ago
  > The value gained by practicing on US soil to execute such a mission likely outweighs tipping their hand. There is tremendous operational value in carrying out the logistics and process of such a test. The lessons learned can be applied not just to the electrical grid, but many other reserves-sensitive infrastructure. Long rant ahead that comes as no surprise to Taleb and principal-agent problem space cognoscenti which most HN readers are, so freely ignore. The US lacks reserves of nearly every kind except in the crudest forms like the Strategic Petroleum Reserve. As already noted elsewhere, the leadership-think that in the US permeates both private and public sector leadership to treat redundancy as deadweight losses still outweighs any and all national security considerations. This is absolutely rampant everywhere, and not a national secret. It is so severe that even companies like 3M who actually plan ahead and do what they're supposed to do (set up emergency production lines, materiel, procedures, and staffing that are mothballed until needed, urge customers to keep a working reserve on hand suitable for continuity planning) get unjustifiably crucified [1]. Because...tada!...leadership in hospitals ditch working reserves who then turn around and blame 3M when the shit hits the fan for their lack of continuity planning. Then these same leaders who utterly failed their continuity planning lean in on government. And...tada!...leadership in government let working reserves exhaust from SARS who then turn around and blame 3M for their lack of continuity planning. Of course this happens because the incentives are misaligned; leadership are not an evil cat cabal, they're just min-maxing to incentives they've been handed like everyone else. There is no tail risk governance of life- and national-security-critical infrastructure to maintain continuity. There is no clawback for intentionally ignoring pointed out tail risk, nor is there an emphasis upon leadership in the same organization across a long period of time to expose and correct misalignments. Tail risk decisions are not tracked and evaluated in most organizations. Raising the organizational risk profile way after the leader has left for another role, and disconnecting the organization's ability to systemically learn from those expensive and infrequent tail risk mistakes. Even worse, the US business culture and political culture itself severely punishes those who do prudently and competently assess tail risk. How the US arranged reserves is about right for nearly a century ago, but that means a successful attack on reserves-sensitive infrastructure will take us roughly back to that tech tree until we resupply. Precision coordinated infrastructure attacks through black-hat, memetic and specops combined force of arms can be far more effective than many stealth bomber runs, with the additional invaluable bonus of plausible deniability, and possibly economically eclipsing the US if it causes enough damage. It's a really effective asymmetric attack mode option. The US has long had people who thought about all this already, and encoded their thought experiments into various policy guides, with some updates from lessons learned like during SARS (and now COVID-19). Our policy leadership are choosing not to follow their advice because it involves unsavory spending decisions with negative political ramifications. COVID-19 has not sufficiently raised awareness about this, so it will likely take a Carrington-scale event to have these guides dusted off to see the light of day of implementation. Individually as a normal citizen, at least prepare for natural disasters as guided by FEMA, financially prepare as much as you feel prudent (if you see the rampant de-reserving in infrastructure going on, just what do you think is happening in the less-regulated parts of finance?), and just hope three standard deviations doesn't hit our asses in our lifetimes. [1] https://marker.medium.com/how-3m-gambled-its-reputation-on-the-n95-mask-e266a2fd8933 https://marker.medium.com/how-3m-gambled-its-reputation-on-t...
  - timeinput 6y ago
    Three standard deviations doesn't hit in our life times again
    - yourapostasy 6y ago
      The three standard deviations (or three-sigma) rule of thumb / guide relies upon a normal distribution to yield the 99.7%/0.3% probability tails. Humans are terrible at gut-feel statistics and probability due to a number of cognitive biases that seem nearly hardwired into us from birth, though. And exogenous factors can distort the normal distribution. This is just the normal landscape of highly complex interacting systems, but command-and-control style leadership's coping mechanism for simplifying complexity smooths out this information into lossiness. A lot of what people ascribe to tail risk, upon closer examination that brings out the nuances instead of smoothing it away, are not three-sigma events. They're just three-sigma for the duration of now-typically very short job tenures. Of leadership. What we have here, is a failure to communicate complexity. Get some Royal Dutch Shell-like cross-disciplinary Long-Term Studies-like [1] groups going on globalization, and they'll probably eventually figure out that globalization will accelerate human encroachment upon habitats, in turn accelerating introducing novel bugs into our civilization. Up until recently in the span of homo sapiens history, while we've always encroached into habitats, and ran across new infectious agents, without quick global travel they would usually wipe out a locality and leave the modified habitats intact for nearby people to take over. So the diseases would usually wipe themselves out, and seemingly "retreat" back into the well they sprung from. It should come as no surprise that we see increasing spread of infectious agents as globalization mechanizes the modification of habitats, and swiftly moves along the disease into the Amazonion flow of worldwide travel today. And we see an increased frequency of outbreaks of both old enemies and novel vectors. It might not come as a surprise to Sagan fans [2] that a large fraction of the US population's reaction to these complex systems is superstition and irrationality. [1] https://hbr.org/2013/05/living-in-the-futures https://hbr.org/2013/05/living-in-the-futures (two-articles-per-month-then-register-wall) [2] https://www.snopes.com/fact-check/carl-sagans-foreboding-of-an-america/ https://www.snopes.com/fact-check/carl-sagans-foreboding-of-...
  - cma 6y ago
deleted 6y ago
[deleted]

areoform 6y ago

The time span for a deployed "patch" IRL is between years and never. What matters to these unnamed, unknown operators is practise and training. It is a pattern repeated for most covert ops. Semi-software example, Stuxnet (and I'm sure different deployment methods) were tested in Israel pre-deployment - https://www.nytimes.com/2011/01/16/world/middleeast/16stuxnet.html https://www.nytimes.com/2011/01/16/world/middleeast/16stuxne... For Neptune Spear, the Bin Laden raid, they created different layouts and practiced every part of it, https://special-ops.org/operation-neptune-spear-killing-osama-bin-laden/ https://special-ops.org/operation-neptune-spear-killing-osam... Adm. McRaven's interview is highly recommended to understand their psychology https://www.cnn.com/videos/politics/2016/05/02/bergen-mcraven-bin-laden-training-helicopter-origwx-js.cnn https://www.cnn.com/videos/politics/2016/05/02/bergen-mcrave... The value gained by practicing on US soil to execute such a mission likely outweighs tipping their hand.

yourapostasy 6y ago
> The value gained by practicing on US soil to execute such a mission likely outweighs tipping their hand. There is tremendous operational value in carrying out the logistics and process of such a test. The lessons learned can be applied not just to the electrical grid, but many other reserves-sensitive infrastructure. Long rant ahead that comes as no surprise to Taleb and principal-agent problem space cognoscenti which most HN readers are, so freely ignore. The US lacks reserves of nearly every kind except in the crudest forms like the Strategic Petroleum Reserve. As already noted elsewhere, the leadership-think that in the US permeates both private and public sector leadership to treat redundancy as deadweight losses still outweighs any and all national security considerations. This is absolutely rampant everywhere, and not a national secret. It is so severe that even companies like 3M who actually plan ahead and do what they're supposed to do (set up emergency production lines, materiel, procedures, and staffing that are mothballed until needed, urge customers to keep a working reserve on hand suitable for continuity planning) get unjustifiably crucified [1]. Because...tada!...leadership in hospitals ditch working reserves who then turn around and blame 3M when the shit hits the fan for their lack of continuity planning. Then these same leaders who utterly failed their continuity planning lean in on government. And...tada!...leadership in government let working reserves exhaust from SARS who then turn around and blame 3M for their lack of continuity planning. Of course this happens because the incentives are misaligned; leadership are not an evil cat cabal, they're just min-maxing to incentives they've been handed like everyone else. There is no tail risk governance of life- and national-security-critical infrastructure to maintain continuity. There is no clawback for intentionally ignoring pointed out tail risk, nor is there an emphasis upon leadership in the same organization across a long period of time to expose and correct misalignments. Tail risk decisions are not tracked and evaluated in most organizations. Raising the organizational risk profile way after the leader has left for another role, and disconnecting the organization's ability to systemically learn from those expensive and infrequent tail risk mistakes. Even worse, the US business culture and political culture itself severely punishes those who do prudently and competently assess tail risk. How the US arranged reserves is about right for nearly a century ago, but that means a successful attack on reserves-sensitive infrastructure will take us roughly back to that tech tree until we resupply. Precision coordinated infrastructure attacks through black-hat, memetic and specops combined force of arms can be far more effective than many stealth bomber runs, with the additional invaluable bonus of plausible deniability, and possibly economically eclipsing the US if it causes enough damage. It's a really effective asymmetric attack mode option. The US has long had people who thought about all this already, and encoded their thought experiments into various policy guides, with some updates from lessons learned like during SARS (and now COVID-19). Our policy leadership are choosing not to follow their advice because it involves unsavory spending decisions with negative political ramifications. COVID-19 has not sufficiently raised awareness about this, so it will likely take a Carrington-scale event to have these guides dusted off to see the light of day of implementation. Individually as a normal citizen, at least prepare for natural disasters as guided by FEMA, financially prepare as much as you feel prudent (if you see the rampant de-reserving in infrastructure going on, just what do you think is happening in the less-regulated parts of finance?), and just hope three standard deviations doesn't hit our asses in our lifetimes. [1] https://marker.medium.com/how-3m-gambled-its-reputation-on-the-n95-mask-e266a2fd8933 https://marker.medium.com/how-3m-gambled-its-reputation-on-t...
- timeinput 6y ago
  Three standard deviations doesn't hit in our life times again
  - yourapostasy 6y ago
    The three standard deviations (or three-sigma) rule of thumb / guide relies upon a normal distribution to yield the 99.7%/0.3% probability tails. Humans are terrible at gut-feel statistics and probability due to a number of cognitive biases that seem nearly hardwired into us from birth, though. And exogenous factors can distort the normal distribution. This is just the normal landscape of highly complex interacting systems, but command-and-control style leadership's coping mechanism for simplifying complexity smooths out this information into lossiness. A lot of what people ascribe to tail risk, upon closer examination that brings out the nuances instead of smoothing it away, are not three-sigma events. They're just three-sigma for the duration of now-typically very short job tenures. Of leadership. What we have here, is a failure to communicate complexity. Get some Royal Dutch Shell-like cross-disciplinary Long-Term Studies-like [1] groups going on globalization, and they'll probably eventually figure out that globalization will accelerate human encroachment upon habitats, in turn accelerating introducing novel bugs into our civilization. Up until recently in the span of homo sapiens history, while we've always encroached into habitats, and ran across new infectious agents, without quick global travel they would usually wipe out a locality and leave the modified habitats intact for nearby people to take over. So the diseases would usually wipe themselves out, and seemingly "retreat" back into the well they sprung from. It should come as no surprise that we see increasing spread of infectious agents as globalization mechanizes the modification of habitats, and swiftly moves along the disease into the Amazonion flow of worldwide travel today. And we see an increased frequency of outbreaks of both old enemies and novel vectors. It might not come as a surprise to Sagan fans [2] that a large fraction of the US population's reaction to these complex systems is superstition and irrationality. [1] https://hbr.org/2013/05/living-in-the-futures https://hbr.org/2013/05/living-in-the-futures (two-articles-per-month-then-register-wall) [2] https://www.snopes.com/fact-check/carl-sagans-foreboding-of-an-america/ https://www.snopes.com/fact-check/carl-sagans-foreboding-of-...
- cma 6y ago

deleted 6y ago

[deleted]