Hacker News Reader

Allowing all of these probably-insecure systems to be built out and connected to the Internet is the problem, end of story.

You're essentially arguing that the US is paralyzed due to the possibility of unknown unknowns. It might make sense to think that way to write a book, or for brainstorming large-scale disaster planning. But every system has someone responsible for it, and that someone needs to be responsible for securing it to best practices.

From a policy perspective, we wouldn't just accept that a power plant's energy handlers hum along unsupervised and so could fail catastrophically due to some latent problems. Rather, there are inspection and maintenance schedules to do the diligence of adhering to best practices. That same diligence needs to be brought to bear on a plant's information systems, and if those information systems are hooked up to a WAN (for which there may not be a choice), then that diligence needs to be applied to handling abstract adversarial attackers.

Not doing that is a grave failure, and what seems to be going on here is a "nobody's fault" because it's not in the plant administrators' or vendors' interest to look down and see that they're already past the edge of the cliff. But allowing it to persist is simply kicking the can down the road in an unsustainable manner.

Vulnerability on cybersecurity for critical infrastructure is a known-known.

Best practices have been and continue to be the lowest common denominator and an abysmal failure. Compliance solves nothing, and it is a make work project for compromised jobsworth consultants who lack the standing to tell anyone they told us so.

What I am arguing is tech and poor management culture in energy and infrastructure companies is the weak link that gave away the empire.

Even if an organized adversary can reliably control whatever infrastructure they choose, it's still being institutionally treated as an unknown - otherwise it would be fixed.

I basically agree with everything you've written here, but saying it already "gave away" basically means giving up. Whereas this "cyberwar" meme is a call to action, and so I think it bears repeating that on the technical side the problems are extremely straightforward. Rather the real problems are organizational/institutional, and that's where blame needs to be directed - so that the call to action doesn't lead to further obtuse top-down measures like more procedure-bound certification-based consultants or a national firewall.

Worthwhile top-down things that could be done would be say a national bug bounty on any critical infrastructure (and indemnification for any incidental damaged "caused" by researchers, rightfully assigning it to plant operators instead), or perhaps even a wholesale repeal of the CFAA to stop papering over the fundamental nature of the Internet being hostile noise. Stop discouraging 12 year olds from playing around with infrastructure for the lulz, and make administrators have to deal with reality rather than continuing to ignore it.

If your cities immediately turn into "tribal warzones" when they lose utilities, you've definitely made some governance failures well before the cyberattack.

Can you be more specific? What governance processes counteract or prevent that failure?

Reduce wealth inequality through industrial and fiscal policy, don't stuff cities full of millions of culturally distant immigrants (distant from both each other and the existing population), encourage integration and patriotism instead of ethnic sectarianism via education and cultural pressure.

The 1860's are calling and the Irish would like a word. Are you arguing the Irish shouldn't have been allowed in the U.S.? Or that Americans should have been somehow coerced into accepting them? You think the Irish didn't want to be assimilated or you think Americans didn't want to assimilate them?

The 1860s when the Irish in NYC refused to fight for their new country, killing over 100 people and ethnically cleansing most of Manhattan? Or a few years later when two different subgroups of Irish killed another 100 of each other in the same city? These questions re-litigating history are immaterial to the fact that there is always some point at which putting groups next to each other will cause conflict, modulated by things like population density, culture, religion, tribalism vs. individualism, prosperity, etc.

This is just willful, boastful, ignorance, across the board. There are more examples of human cooperation, and there's more evidence that immigration and multiculturalism leads to long term stability, not the opposite. Next, you're going to tell me how the American Civil War had to do with immigration. Relitigating history is not indicated, but for starters you have to know some history.

That's funny, how do you link multiculturalism to a breakdown of society? If anything you want lots of strong societies overlapping so that everyone can find a group that can support them and each other. The "mosaic" concept has worked out fairly well for Canada, and I just can't get behind denying people their communities.

Even governance in the absence of utility can't stop human nature.

But you've also made an argument against professional standing armies, and civilian decadence. Turning cities into war zones is not a new strategy. When the U.S. was attacked at Pearl Harbor, the country instantly became motivated to enter the war. What percent of people now would give up their shopping, TV, jobs, family, to defend their country? The U.S. political and military class will avoid exposing how the entire civilian class is grossly unprepared, and unwilling to become prepared.

Is it possible that a US government agency is pushing an inflated threat assessment designed to raise its own budget? Did that ever happen in the past?

I agree, and this may arguably be a good thing. A relatively painless way of rolling back the empire of Team America: World Police. We may be trending back towards a time of strong regional powers rather than global hegemony.

> a time of strong regional powers rather than global hegemony

A.K.A. a time of war, like the ones that rocked Europe and the rest of the world through the 19th and early 20th century, as regional powers struggle to become the new global hegemony.

Those who desire an end to the Pax Americana, be careful what you wish for.

More likely an end to the nation-state, and a return to the more stable city-state. Once a society is on the path to regression, you don't exactly get to choose where the ball stops rolling. It's going to end up at the most stable location, and nation-states have a short history compared to city-states but also more volatile.

>The US isn't going to risk a dam flooding or a long term grid failure over a distant minor ally.

People are irrational. For the sake of transgressing a minor boundary, wars have occurred, even if the boundary has no strategic value. Suppose there are patrols into barren hinterland, that could still cause a war, even though the lands could not support permanent habitation.

It is theorized that Germany started WWI because of growing popular support for the socialist party.

>Its lack of a strong homeland defensive posture on infrastructure has emboldened regional powers like China, Russia, and Iran to assert themselves over local NATO allies without fear of US retaliation.

First, calling these issues "homeland defensive postures" makes no sense.

I don't understand how you can view the current situation as "regional powers asserting themselves." NATO now borders Russia and the US effectively controls two states bordering Iran. The only bold moves any of those states has made was Russia's move into Crimea, but even that was Russia preventing their port from switching over to NATO.

I believe by "homeland defensive postures" the commenter you are replying to was suggesting that, because our infrastructure (electrical, hydro, fuel) is largely controlled by internet-connected security holes, the repercussions of involving ourself abroad would be to face consequences at home - something we are politically and otherwise unprepared for. In other words, our lack of a 'defensive posture' on infrastructure (i.e., a lack of hardening against cyberattack) leads to our lack of countering actions by China or Russia abroad.