Stuxnet

Stuxnet, a computer worm, discovered in June 2010, that was specifically written to take over certain programmable industrial control systems and cause the equipment run by those systems to malfunction, all the while feeding false data to the systems monitors indicating the equipment to be running as intended.

As analyzed by computer security experts around the world, Stuxnet targeted certain “supervisory control and data acquisition” (SCADA) systems manufactured by the German electrical company Siemens AG that control machinery employed in power plants and similar installations. More specifically, the worm targeted only Siemens SCADA systems that were used in conjunction with frequency-converter drives, devices that control the speed of industrial motors, and even then only drives that were made by certain manufacturers in Finland and Iran and were programmed to run motors at very specific high speeds. This combination indicated to analysts that the likely target of Stuxnet was nuclear installations in Iran—either a uranium-enrichment plant at Naṭanz or a nuclear reactor at Būshehr or both—a conclusion supported by data showing that, of the approximately 100,000 computers infected by Stuxnet by the end of 2010, more than 60 percent were located in Iran.

The worm was found to have been circulating since at least mid-2009, and indeed in the latter part of that year at the Naṭanz plant an unusually large number of centrifuges (machines that concentrate uranium by spinning at very high speeds) were taken out of operation and replaced. The Iranian nuclear program, which most foreign governments believed was working to produce nuclear weapons, continued to suffer technical difficulties even after discovery of the worm.

Speculation then centred on where the worm may have originated. Many analysts pointed to the United States and Israel as two countries whose assessments of the threat of Iranian nuclear weapons had long been particularly severe and whose expertise in engineering and computer science would certainly have enabled them to plan and launch such a cyber attack. Officials of both countries refused to discuss the issue. Meanwhile, the Iranian government declared that a foreign virus had infected computers at certain nuclear facilities but had caused only minor problems. The consensus among experts was that Iran’s problems were far from minor; some speculated that the country’s nuclear program may have suffered a serious setback.

Though it was impossible to verify that the Stuxnet worm had caused those difficulties, it became clear to cybersecurity experts that Iran had suffered an attack by what may have been the most sophisticated piece of malware ever written. By taking over and disrupting industrial processes in a significant sector of a sovereign state, Stuxnet was a truly offensive cyber weapon, a significant escalation in the growing capability and willingness of states and state-sponsored groups to engage in cyber war.