Chinese Researcher Says US Power Grid Is Vulnerable, Strategist Overreacts 203
An anonymous reader writes with a story about Wang Jianwei, a grad student in China who recently released a paper detailing a vulnerability in the US power grid. Despite the paper being rather typical for security research, its origin set off alarm bells for military strategist Larry M. Wortzel, who testified before Congress that the student was a threat, despite the fact that the published attack wasn't really feasible. Quoting:
"'We usually say "attack" so you can see what would happen,' [Wang] said. 'My emphasis is on how you can protect this. My goal is to find a solution to make the network safer and better protected.' And independent American scientists who read his paper said it was true: Mr. Wang's work was a conventional technical exercise that in no way could be used to take down a power grid. The difference between Mr. Wang's explanation and Mr. Wortzel’s conclusion is of more than academic interest. It shows that in an atmosphere already charged with hostility between the United States and China over cybersecurity issues, including large-scale attacks on computer networks, even a misunderstanding has the potential to escalate tension and set off an overreaction. 'Already people are interpreting this as demonstrating some kind of interest that China would have in disrupting the US power grid,' said Nart Villeneuve, a researcher with the SecDev Group, an Ottawa-based cybersecurity research and consulting group."
typical military response (Score:5, Insightful)
Yes, it would've been much better for this guy not to publish his research so we wouldn't know about this problem and leave it wide open. We should be thanking this man for his hard work, not lambasting him just because he happens to be Chinese.
If the Chinese government were interested in disrupting our power systems, wouldn't they be a little more secretive about their intentions than shouting out our flaws to all the world?
Why would they turn the lights off... (Score:3, Insightful)
Re:Still doesn't make it a non-threat. (Score:1, Insightful)
Scapegoating abounds and we all suffer (Score:4, Insightful)
From the liberal in the 1950s branded as a commie pinko, to the
19 year old with a 15 year old girlfriend branded as a pedophile, to the
Casual torrent downloader branded as the biggest threat to Hollywood ever, to the
Security researcher branded as an enemy of the state,
we all suffer when people are scapegoated so someone can get his time in front of a microphone.
Would someone please dig up J. Edgar Hoover's body and make sure he's still dead? Methinks his ghost never left us.
Public security research is not a threat (Score:5, Insightful)
Re:Scapegoating abounds and we all suffer (Score:2, Insightful)
we all suffer when people are scapegoated so someone can get his time in front of a microphone.
Conversely, we all suffer when truly guilty persons are portrayed as innocent martyrs so some bleeding heart can get his time in front of a microphone.
Re:The pro-China modbombers are out in force today (Score:5, Insightful)
I'm also not sure how it's a big deal (Score:5, Insightful)
All power grids are always vulnerable to physical attack. There are few generation stations, relative to the number of customers and many large scale distribution lines. Take those out, and you've disabled power for a long time since they have to be rebuilt. A big, distributed, power grid like we have that does not have tons of excess capacity is just going to be at risk of having large parts taken off line by physical means. Ask anyone who lives in an area of heavy snow.
Now, I understand that an electronic attack could be done remotely, in theory without warning. Ok... To what end? In case people haven't noticed there's a big ole' swath of ocean between the US and China. So if China was to try that as a precursor at an attack, it wouldn't do any good. We'd either already know about the attack, having seen the ships on the way, or it would be way too early, since the ships would take a long time to get here, and it would be back up by the time they got here.
Not that any of that is very relevant to defense. It isn't like aircraft carriers are on the power grid, they've got their own nuclear reactors (2-4 of them in fact). You discover a good deal of important stuff has its own power backup since it isn't like power doesn't go out all the time anyhow. Hell we lose power to our building at work probalby 3-4 times per year, hence there's a generator on critical systems.
I just don't see how this sort of thing is that big a deal. Now please understand, I'm not saying we shouldn't try to secure it. When you find a security hole, you should fix it. Just a good idea over all so you don't have problems in the future. However I don't see it as being a military threat. I see it as being more of a script kiddie type of threat. Some asshole takes power out because they think it is funny. I don't see China trying to knock it out because I can't see how it would be useful, and it would have some rather large negative repercussions if they did and the US found out who was responsible.
This has always been the problem with the U.S. (Score:3, Insightful)
The U.S. is reactive and not proactive. The U.S. always has to wait until after the fact to admit that there was a threat. This is nothing new to me. Just read Unrestricted Warfare [c4i.org]. The Chinese have been stating this for years now. Yes everything will be fine until the lights go out.
Re:The pro-China modbombers are out in force today (Score:5, Insightful)
Because the USA is the land of the free and the home of the brave!
Re:This has always been the problem with the U.S. (Score:4, Insightful)
Re:This is just silly, but no harm done. (Score:3, Insightful)
And yet his name will probably live forever on a No Fly List. Still, no harm done to you anyway.
Re:The pro-China modbombers are out in force today (Score:5, Insightful)
The issue of vulnerable power grid is a legitimate threat, but the individual creating a study about it is not. You get it backwards when you say the individual is a threat and paper (or the vulnerability) might be harmless. A grad student won't have capability or interest in taking down US power grid, instances with capability to harm US power grid have also means to create similar study on their own. I'm sure even US military has created similar study and have planned on supplying electricity to critical locations without the electric grid.
There are many valid reasons why US electric grid was chosen to be target of the study. Creating similar risk analysis on Chinese electric grid could be a serious offense in China, or information about US electric grid was more available than any other major electric grid in the world. Most likely this student has interest in working at the electric grids and wants to help to build one that is more secure.
Re:I'm also not sure how it's a big deal (Score:5, Insightful)
It is a big deal because, timed correctly, you can cascade a failure and shut down a huge chunk of the grid. Maybe your building has a generator for critical systems, and it can run for 72 hours on its propane tank.
But can the next shift show up, if the trains aren't running? Traffic control is down?
How many hours can you last, with no food and possibly limited and no water? So your server room is running; who is there to man it?
Just talk to the people who weathered Andrew, Hugo and such. Having your own power backup does little good if you also don't have all of the people there to put it to use.
Anyway, this is clearly not a threat. It's a vulnerability, and should be addressed.
OTOH, the intelligence community has a different definition of "threat" from most people. A "threat" is what your opponent *could* do, not what they *intend* to do.
So the intelligence people analyze "threats" from Canada, UK, etc. Certainly UK or Canada are "threats" in that they have the location and/or the military might to cause the US significant damage. It has nothing to do with their "intent"; that's for the politicos to decide.
It's far more than an over reaction (Score:5, Insightful)
(from his webpage)
The guy is a member and servant of the circle of elites who profit, and enjoy enormous social success from their support of our militarized social and economic system. Pursuading a population of relatively free and relatively educated person to support an political system which can afford to spend $3 trillion dollars (washington post estimate) [washingtonpost.com] on an injust, unjustified terrorist war against an impoverished nation, against a dictator we incidentally empowered and supported through the worst of his crimes, and over the objections of its own citizenry, but quails at spending $1 trillion to ensure health care said citizens.
Wortzel enjoys a position of prestige and wealth for his support of the forces of that are destroying us, as do the reporters and editors of the New York Times for parading his observations without the criticism they deserve.
For anyone with a certain amount of research background, or even basic knowledge of network security and stability issues (in this case network in question is power network), the appropriate response to the paper would be analysis, and investigation and applicatoin of measures to improve the stability. The U.S. power grid has in recent years suffered from such cascading network failures several times in the last decade, and we Americans should be grateful that someone is investing the resources to investigate these issues. By publishing his results in a peer reviewed scientific journal, Mr. Wang has done us a service, and deserves our gratitude. Instead he's getting caught up in this policy wonk's latest search for enemies.
Re:typical military response (Score:5, Insightful)
The problem is confirmation bias. The U.S. has been concerned that the Chinese are going to threaten U.S. security by using computers. When the U.S. found a paper written by a Chinese researcher that talked about using computers to attack the U.S. power system, they thought they found someone who was threatening U.S. security. In other words, when they found "evidence" that looked on the surface that it was what they were looking for, they jumped to the conclusion they had found it.
This is just the same as the "quote mining" we've seen from, say, intelligent design supporters who are continually on the lookout for evidence that evolution is wrong. It's also the reason that the hacked CLU emails are being misinterpreted to mean that AGW is a hoax. If you set out looking for evidence to support your idea, you need to make sure you also look for evidence that supports the opposite of your idea, and make sure you are interpreting the evidence you find correctly and neutrally.
Re:Couldn't Happen (Score:3, Insightful)
since you guys beat the Russians financially I think that is debatable.
We didn't beat them financially. They imploded with a coup de etat. It was an internal affair that the US intelligence community later took credit for orchestrating. Which is part bullshit because if it hadn't have had the support of people within the former Soviet Union to begin with, it never would have succeeded. And I question that we "beat them financially" -- because we've lost in a lot of other areas. International opinion of our country, social services, and other domestic areas. There are large tracts of land in our country that resemble third-world countries economically. Our wealth distribution model is one of the most unbalanced in the world, and we have an entire generation being slaved to the lifestyles of those who are increasingly unable to contribute anything but advice and financial services and rapidly approaching retirement, which will further drain the future of our country, reducing our economic powerbase and status as a world leader.
We won? Hardly.
Re:Couldn't Happen (Score:1, Insightful)
So how does having your whole infrastructure go down result in better profits? Your conclusion seems flawed here. Security does in fact fit with capitalism because time is money and if the system goes down for any length of time, money is lost.
The danger is allowing Marxists to run important infrastructure because they won't loose money when the grid goes down.
Re:WHIP EM OUT !! BIGGEST ONE WINS !! (Score:1, Insightful)
Whichever country has the "biggest" nuke or even the largest supply of nukes is irrelevant. It only takes a single nuke to completely ruin your day.
Aside from that, this is yet more proof that the terrorists have won. When American people are so skittish, paranoid and scared like this Wortzel fool, there is no other conclusion that can be drawn.
Re:It would be better (Score:3, Insightful)
I was thinking more along the lines of "effing great, kill the messenger".
Here's your "enemy" telling you where a critical resource of yours can be attacked. This alone is a boon, not a threat. Assess his attack vector and there are two possible reactions: Either you notice that he is wrong and you keep it at that, hoping that your enemy will believe that this is a feasible way to attack you. When they do, it fails but gives you a the psychologic and diplomatic upper hand. Or he is right and you should get your ass in gear to protect yourself, because now you know how your enemy thinks and how he would execute an attack.
Either way, this is about the best thing that could possibly happen to you.
But leave it to military intelligence to react with ballistic stupidity.
Re:Public security research is not a threat (Score:4, Insightful)
Public security research is not a threat. Vulnerable infrastructures that go unchecked are. The trend is to penalize security researchers for publishing their findings will only increase underground security research that will then just be sold to the highest bidder.
Public security research is a threat. But it's not the researcher's fault; It's the people who wait for research like this to be published and then use it (open source intelligence gathering) to develop attacks. It's easier to target and blame the researcher for publication than to attempt to find the malignant factors, who are increasingly operating independently and lack connections to an organization. Which means, in short, they're operating under the radar. Conventional intelligence-gathering efforts depend on the fact that as the number of criminals cooperating increases, the chance of mistakes being made which expose them increase exponentially. Also, the number of communication channels between people increase geometrically, resulting in a larger signals intelligence footprint.
So basically, it's cheaper, even if it's not ethical. And ethics, as you know, are decided by those in power. So there will always be a rationalization to discredit and imprison people who come forward with security problems, simply because it's cheaper to do so than fix the underlying problems, which they are already well aware of and would prefer you not tell them that the emperor has no clothes.
Unfortunately, the logical conclusion for this kind of reactionary thinking is that eventually a backlash will build up and people will begin independently engaging in small-scale acts of sabotage in an attempt to bring attention to these problems (which has recently started to happen domestically). The government's over-reaction to these attempts by the citizens to excercise the only recourse left to them by creating harsher penalties, more survillance, and secret courts, will eventually result in larger targets being attacked and destroyed, by independent citizens or small groups.
We've been here before -- in the late 1800s, in the 1960s and 70s, and briefly again in the late 90s. It's cyclical. The problem is, each time it happens, it gets worse, and the government refuses to acknowledge this systemic failure of its domestic intelligence policies. Eventually, we're going to have another 9/11, but we won't be able to blame anyone but ourselves when angry citizens start taking out government buildings.
And the reason is we've left them with no alternative: Terrorism is, in fact, a valid way of promoting change when all other methods have failed. The strength of a democracy is the fact that we have all those other methods open to us. Close them off, like we're doing now by punishing people who have knowledge and publicly state the failings of the system and draw attention to needed repairs... And it will come to our own soil with a vengance. And we'll have nobody to blame but our ill-designed domestic policies for it.
Perhaps the intelligence community needs a better way of accepting reports of these problems and rewarding citizens for being diligent, instead of imprisoning them and invading their privacy as potential subversives. And perhaps expanding the definition of citizen to include anyone who works to secure our future, domestically or internationally. How about the concept of honorary citizen? These are the principles and actions we should be striving for -- not this goddamned police state bullshit.
Re:The pro-China modbombers are out in force today (Score:5, Insightful)
I suspect this is about the military definition of threats.
(Warning: I've worn that particular hat, as a former MI assigned officer in an S2 shop for a cavalry regiment. I've never been a politician, so what you're getting here is definitely only one side of the argument).
The way Military Intelligence is supposed to work, reports consider capabilities, but they deliberately don't consider intentions. MI is never in command and NEVER makes command decisions, but reports to commanders, or at higher levels, to civilian overseers.
For example, an high ranking Army Intelligence officer might be supposed to give the US Congress a good answer to whether country X has missiles with enough range to reach the US. He or she can't give a good answer, and so shouldn't comment, on whether country x has intentions to use them on the US or on someone else (at least unless there's a real obvious 'smoking gun', like the officer has found a copy of the orders where all the missiles are suddenly being retargeted at country Y and the job has to be completed by 1300 hours when "Operation Obliterate Country Y" begins).
It's up to civilian oversight to determine whether a threat (potential) becomes an enemy (actual). The military is not supposed to decide when to go to war, that's the job of civilians. If you want congress or the president to be the ones to decide whether the US needs to go to war or not, you can't have the pentagon declaring in advance who is an enemy and who isn't.
Right now, Great Britain has pretty serious threat potential (They have weapons which could damage the US, and ways to transport them to us). They don't suddenly count as an enemy just because of that. Pakistan has less threat potential (not as many weapons or delivery systems). Imagine a coup puts militant Taliban related forces in charge of Pakistan's nuclear weapons. They might suddenly be classed as an enemy nation, but what happened to the threat assessment? Nothing! They are exactly the same threat, from a Military Intelligence assessment, as before. Same number of bombs and missiles and troops, same threat.
Put that way, a person who can figure out a good way to attack the US is a threat, or a small part of a threat. That he's shared his info with us should make the civilians who are supposed to decide what actions to take figure he's not an enemy, and that any potential threat here is not likely to become an actualized attack. Common sense tells normally rational people that if this person was part of a secret plan that would eventually use his information against us, he wouldn't have mentioned it all publicly. The people he was connected to in China would be unknown to us, not publicly accessible, and so on. But that means any intelligence system which discovered threat potential here probably reported it right, it's just civilian overseers acted like paranoid fools.
For another analogy. Let's say you have two people nearby who can both lift over 300 pounds. They both represent similar threats to you, in the most technical sense. One is there to help you move your furniture, the other is an escaped convict looking for a hiding place. Only one of them is at all likely to attempt to harm you, and it's quite possible he has no intentions against you either. You might classify the mover as an ally, and then it's a judgement call if the convict is an enemy at that point, but both technically have near identical threat potential from what you know. This whole matter sounds like a case where someone is conflating the facts and the conjectures, to try and make people be equally worried about 'moving men' and 'escaped convicts', and then assume the worst possible scenarios are inevitable and not just possible for the convicts as well.
Re:What is it with you filthy Republicans? (Score:5, Insightful)
Actually, I am American, and I love America - enough to have served her armed forces for 8 years, and to raise both a soldier and a sailor. But, I agree with AC. WTF is it with torture? Torture was almost universally condemned throughout the western world, until Herr Shrub came along. FFS, any competent intelligence officer will tell you right out, he can get better results by buddying up to a suspect, rather than torturing him. Offer the guy a cigarette, a beer, ask about his wife and kids, tell him how beautiful his wife and daughters are (even if they are Sumo heavy weights whose faces have been used for dart boards) - sugar catches more flies than vinegar ever did.
Re:I'm also not sure how it's a big deal (Score:4, Insightful)
Assymetric warfare. The Chinese have little intention of attacking us openly, physically. Their conventional warfare forces are being developed more to deter us from attacking for revenge, than to be used against us.
Assassin's Mace.
There is so little good information on it - but it's real.
Re:What is it with you filthy Republicans? (Score:4, Insightful)
I am not only American and love America, I have (almost) always voted Republican.
Gitmo needs to be closed as a detention facility. I'm not even sure it needs to exist as a naval base, but that's a different issue.
The "detainees" are either criminals or they are prisoners of war.
We have rules for dealing with both. A determination needs to be made, one by one, in an expedited manner, which is which, and those rules followed.
If we can't assign a person to either group then maybe they should be released wherever they were captured, with a change of clothes and an apology for the water boarding and genital chewing.
The fact that we are apparently incapable of doing so and would rather continue the water boarding and genital chewing is an embarrassment.
Instead, if the Chicago Tribune is to be believed, we're going to start sending them to Bagram (Afghanistan) instead. (Today's paper, section 1, page 25.)
The whole point of "closing Gitmo" is supposed to be to do the right thing - not to do the wrong thing again, just somewhere else. Some quotes:
From my perspective, that is kind of the point. If the U.S. government is holding someone, that person should have access to U.S. courts, or they should be subject to the Geneva Convention rules. Period.
This kind of behavior is not what the United States is supposed to stand for - it isn't even what we are supposed to tolerate in other countries.
Re:I'm also not sure how it's a big deal (Score:3, Insightful)
Pretty damned good find. You deserve a mod point or two, just for taking my post seriously enough to look! ;^)
As the article makes obvious, no one in Washington takes the concept seriously. So, WTF are they doing in Washington? Send them all packing, I say.
The article falls a little short, though. There was a quote from some insider or another in the Chinese government, which defined the Assassin's Mace better. Their plan is, dominating us politically, economically, militarily, AND technologically, within a 20 year period. We are something like 6 or 8 years into that 20 years. It might even be ten years on - no one that I know of knows for certain when the plan was formulated.
Unless our government takes the threat seriously, then China will succeed. I mean, anyone who sets themselves a goal, and meets zero opposition, will indeed reach that goal.
The fact is, we are actively aiding and abetting them in reaching their goal. Every year, we export more jobs to China, we export more technology, we export more corporate secrets - everything which they need to reach that goal.
Hell, Bill Clinton took the first step, by selling them missile technology.
Maybe I'm just paranoid, and I take those rumors to seriously. After all, the Chinese must have a sense of humor, right? They were only joking when the said they meant to dominate the United States, right?
Re:What is it with you filthy Republicans? (Score:3, Insightful)
You, sir, are quite likely a real "Republican", as opposed to the "neoconservative" crowd that is so fashionably popular today.
I salute you. I could almost have been a Republican, because I am a conservative at heart. To bad the party has been hijacked.
Re:typical military response (Score:3, Insightful)
Re:I'm also not sure how it's a big deal (Score:2, Insightful)
China doesn't have the capability to attack the US militarily but it can cause a significant amount of damage by attacking the US economy and promoting anarchy amongst the US population. The bonus is the possibility of carrying out this attack anonymously. Once the electrical grid is down, not only does the US economy take a hit but people start rioting and looting. The police and military would crack down on its own population and start fueling rage directed towards the authorities. Instead of everybody coming together against a foreign military, the population would focus their anger against their government and each other. Don't forget that the USSR was brought down by having its economy slowly crushed and having the people turned against the government.
The big mitigating factor of course is that China's own economy and foreign reserves depend on the health of the US economy.
Re:I'm also not sure how it's a big deal (Score:1, Insightful)
> Their plan is, dominating us politically, economically, militarily, AND technologically, within a 20 year period. We are something like 6 or 8 years into that 20 years. It might even be ten years on - no one that I know of knows for certain when the plan was formulated.
IMO, based on where China was ten years ago and where it might be ten years from now, the only one of the four they have any chance of achieving in the next 10-13 years or so is the economic one. And even then, I'm interpreting "dominate" extremely loosely - China might hit around 80% of the US GDP. (And that's fairly optimistic, since some of it has been achieved more by tricky manuvering than by actual concrete work, and that can be undone by changing circumstances fairly quickly. There was an article today on CNN suggesting that China's own analysts are predicting they'll have a trade deficit this quarter.)
Politically? Depending on your point of view, they're already equally politically potent (via things like their UN veto and being douchebags at climate conferences). The thing is, that's about as powerful as any nation *can* get politically with the way the world is today. There isn't really any expansion headroom. You can get slightly more pull by being disgustingly far ahead of everyone else economically/militarily/technologically, but I don't see China reaching that either; at a stretch, rough parity, but not leadership. Just like, throughout the cold war, *politically* Russia and France didn't really lose much ground, nor did the US gain much ground. And this is assuming no other nations rise to the same level and thus dillute the power further.
Militarily? It's not in the cards. Their modernization plans are well enough known to see that they won't take the lead in the next 20 years. It's entirely plausible that their ground forces will be respectable by then, but they lack the air and sea programs to catch up to the US, EU, or Russia. Those are the kinds of things that can take more like 20-40 years to close the gap in (and the current leaders haven't stopped their own development programs). This is tied closely to technology. It's also tied to politics and war; China has long since run out of neighbors it can conquer or push around much without a painfully escalating pushback, and winning a large scale non-nuclear ground war would still by pyrrhic for China in terms of its other goals.
Technologically? China's still on the copycat plan. It's gotten them cheap manufacturing and is gradually getting them physical infrastructure, but the educational infrastructure is still lagging behind. Even if they go absolutely crazy about fixing this starting TODAY, it will take another 15 years even in ideal circumstances just for the changes to propagate through the school system. This isn't really a China-specific criticism - it's the same problem any country faces when it wants to push ahead, and it's the problem the US is going to face with revising its own school systems and research climate. And we have modern examples like Japan, South Korea, and Taiwan, where it took 30 years or more from when they started to really get serious and when the results came to fruition. (The nations currently in the lead are the ones who got serious a full century ago and never let up in between.)
This is the gap between nationalist dreams and reality. Even if we assume China really does want to kick everyone's ass and everything really does go smoothly for their effort. Of course my post glosses over the details, because it's a topic worth writing a bunch of full books about, but there's the summary version.
Re:I'm also not sure how it's a big deal (Score:3, Insightful)
Project Manhattan was a desperate gamble in the middle of the war, with the added benefit that America wasn't being bombed on its own soil like Germany was.
We might also note that the US and UK were bombing Germany's research sites, and especially targeted facilities that dealt with things like isotope separation and heavy water. Roosevelt's administration was actively trying to prevent German development of the atomic bomb. It was a lot harder for the Germans to target American research sites.
Of course, there's also a bit of historic irony that a in the 1940s, a surprising number of the physicists with knowledge related to atomic bombs were Jewish. So Germany was killing or driving into exile a good part of the technical crowd that could have built them an atomic bomb. The US was picking up as many of them as it could entice to cross the Atlantic. Enticing them was fairly easy, of course, for obvious reasons.
(It occurs to me that I haven't read of Jewish physicists who fled to Britain and worked there. I suppose there were some. Or maybe not. After all, America was far from the battlefields, and would have been a much safer place to continue your research. ;-)
Re:Tea Party Commies (Score:1, Insightful)