The Obama administration has been stoking the fires of fear about a cyberattack on America’s infrastructure for well over a year now, but a little-discussed physical attack on a power plant earlier this year suggests we shouldn’t ignore more traditional threats.
The attack, recently chronicled by Foreign Policy, sounds like something out of a George Clooney movie. FP sums it up thusly:
Around 1:00 AM on April 16, at least one individual (possibly two) entered two different manholes at the PG&E Metcalf power substation, southeast of San Jose, and cut fibre cables in the area around the substation. That knocked out some local 911 services, landline service to the substation, and cell phone service in the area… The intruder(s) then fired more than 100 rounds from what two officials described as a high-powered rifle at several transformers in the facility. 10 transformers were damaged in one area of the facility, and three transformer banks — or groups of transformers — were hit in another…
Cooling oil then leaked from a transformer bank, causing the transformers to overheat and shut down.
Imagine if such an attack had targeted San Francisco or New York City. It could easily be timed to interrupt train service, possibly causing a derailment or collision. A water treatment plan could lose power, leading to toxic chemicals spilling into the drinking water. Thousands, if not millions, of lives could be on the line.
That train-derailing, toxic-chemical-spilling scenario is exactly what President Obama warned about last summer in an editorial column about the threat of a cyberattack on our infrastructure, published in the Wall Street Journal. Such an attack could be caused by a batch of really bad malware — or by a bunch of bad guys with guns, just like in the old days.
Gizmodo got in touch with Andrew Blum, author of Tubes, to ask about his own research into the physical vulnerabilities of the internet. In his public appearances for the book, Blum has mentioned something called the “Four Manhole Theory,” about four particularly well-placed (or is it ill-placed?) manholes that could be targeted to shut down the internet in the United States. Might the attack described in Foreign Policy have been an early, failed indication about what a Four Manhole Attack might look like? Blum was sceptical, likening the very existence of these manholes to an urban legend.
As Blum explained to Gizmodo:
Several times in my research for Tubes, I heard murmurs about the “Four Manhole Theory”: the idea that there were just four manholes in the U.S. that served as choke-points for the Internet. But it never checked out. It’s the kind of urban legend that network engineers and data center operators love — particularly if one of those supposed manholes is just outside their building. Certainly, there are a half-dozen buildings in the U.S. that are far and away the most important meeting points of Internet networks (I visit them in the book). But they’re served by multiply redundant fibre-optic cables. It’s not four manholes. It’s probably not even 16. Maybe it’s 64. But the “64 Manhole Theory” doesn’t have the same ring to it.
So, with the federal government investing billions of dollars beefing up our nation’s cybersecurity, it’s important to remember that old-fashioned criminals still have their ways. As the Federal Energy Regulatory Commission chairman Jon Wellinghoff suggested last month, defending against these kinds of attacks could be as simple as building bigger fences. Wellinghoff said it would only cost a “couple hundred bucks” to install protective metal sheets around transformers.
Funny how the scariest problems sometimes have the simplest solutions. [FP]
Picture: Flickr / go_nils