ORIGINAL: Cannonfodder
I'd also suggest that the idea that plants with manual backups will be able to avoid the sequelae of such attacks is misguided. Humans work at a particular speed and no faster both in terms of cognition and physical action. The people who designed this malware, almost certainly in America, would have no trouble at all getting the sort of military and psychological input to ensure that the cascade of failures that would be engendered would be such that it would overload those attempting to counter the effects and
Nemo, I agree with you partially. But there is a bright side. I believe it is very hard to find a plant that is relying ONLY on software and human input. The critical systems usually have mechanical fallbacks.. Those cannot be influenced by a virus. Most common failure reason for those is -- bad maintenance...
I do believe you can shut a system down, or even damage parts of a process - it will just be very hard to cause catastrophic damage. If you are able to cause catastrophic damage manipulating a PCS/DCS the plant probably has design flaws... (A certain rig in the gulf of mexico anyone?)
The problem is not so much the issue of whether the plant has mechanical backups or not, it is more in the issue of interconnectedness now controlled by computers.
I write Role Playing Game supplements and, a couple of years ago, wrote one based on a long time interest in this sort of issue (no plug! just fact) and while doing research for it found out some interesting things from official US government sources.
They were surveys by various USG instrumentalities into the damage that could be done to the US by various levels of nuclear strikes and, more importantly, how readily the US would be able to "recover" (for some definitions of "recover") from such, economically and industrially.
Now, given that these scenarios are, I believe, insanely optimistic, it was interesting that the older ones from the 60's and 70's were, in some ways, more optimistic than the most recent one(s) from the 80's and later ... now, I am currently in Auckland, NZ, after 10 weeks on Holiday in the US, and so don't have access to all my research notes, but, from memory, let me explain why ...
According to the most recent studies, the institution of "just in time" inventory control systems was a
major reason for the change in attitudes towards the rate of recovery (or whether recovery would be possible at all before total economic collapse) ... the earlier era estimates assumed large on-hand stocks that could be used to replace disrupted or destroyed production for long enough for what factories were left to swing back into operation at a level that would sustain the much reduced population and economy surviving the nuclear strike.
The more recent estimates made the clear point that JIT inventory control meant that there was no longer any such buffer and that this had *serious* implications for the possibility and/or likelihood of any successful reconstruction effort as it was, the authors of the studies implied, at least somewhat likely that there would not be enough of a buffer to tide over the survivors of such an event until they could get production etc. back on track enough to prevent societal and economic collapse.
Now, from memory, the most recent of those was late 80's, and the world has grown *much* more interconnected since then ... and is growing more and more interconnected every day.
So, if a cyber attack was able to bring down the Internet Backbone ... or disrupt it ... for long enough, the knock on effects could be quite devastating.
My personal opinion is that it is not at the stage at the moment where that is likely, and that the possibility of such a devastating attack is quite low even if you are very pessimistic, but YMMV.
Phil McGregor
