The Internet Might Kill Us All
steveblank.com
steveblank.com
Think of it. We are blessed with technology that would be indescribable to our forefathers. We have the wherewithal, the know-it-all to feed everybody, clothe everybody, give every human on earth a chance. We know now what we could never have known before – that we now have an option for all humanity to “make it” successfully on this planet in this lifetime. Whether it will be Utopia or Oblivion will be a touch-and-go relay race right up to the final moment.
--Buckminster Fuller, 1980
What if (say) Iran did it, and made it look like China. They don't care if both China and the USA are destroyed, in fact they might see it as getting two enemies to destroy each other.
"...partner Marc Andreessen (the founder of Netscape and author of the first commercial web browser on the Internet)..."
Just to be correct: The founder of Netscape was Jim Clark. He hired Marc as first (or one of the first) employees. Marc did not write Netscape himself. It was the effort of a large team.
Don't distort reality!
Whoever did not read Jim Clarks book about Netscape (Netscape time): drop whats in your hand, buy it and read. You will have a good time!
This third article starts out by saying "tech companies are expensive again" and then goes and talks in-depth about network and communication based warfare.
Is it me or is this not addressing the topic at all? Very interesting read, but seemingly random when compared to the rest of the series.
Ben's point was that if the bubble burst is 10 years out, then right now, the right thing to do was to invest -- that there was still a lot of real growth coming before over-exuberance set in, and I think that Steve is implicitly agreeing with him.
If you say 10 years, people start pulling out 9.5 years in. But, knowing that, smarter people will pull out 9 years in, hoping to beat out the people pulling out 9.5 years in. Then...well, you get it. Game theory. And that's how bubbles become unraveled.
If the right move now is to continue to invest -- then that means that the valuations are not bubbly.
So, 10 years to a burst is way too far out to cause you to divest right now, if we are going to have 10 years of growth before then. Even 5 doesn't mean we're in a bubble now, so Steve saying 5-10 years is the same as saying, "we're not in a bubble" (according to what I think Ben means). I think Steve understands that too -- and that's why he changes the subject.
Almost had me convinced until this line.
If facebook and twitter break, it won't bring down banks, governments or corps, it'll just bring down facebook inc. and twitter inc. This is y2k level hysteria.
Imagine all your electronic savings gone... that leaves you with all your skills, health, your physical assets, what ever IOU you and everyone else can agree on the day after all banks information is wiped.... all hugely stressful and super inconvenient, but nothing like getting shot or bombed and killed.
After the financial system is zeroized, how do you get paid? The company you work for has no money with which to pay you. They have no way to make money, because none of their customers have money to pay them with. If you're not getting paid, what's your incentive to show up to work? Everybody would be in that conundrum, so commerce would grind to a halt and cities would start to starve. The government would order law enforcement and the military to keep working even without pay, and they could probably force workers in key industries like power companies to keep going to work, but they couldn't do that for everyone. Even if you had cash to buy groceries with, the grocery store probably wouldn't have groceries to sell to you because they would have no money with which to buy them.
The government could magically set account balances, putting money into everyone's pocket based on some sort of guesstimate, but that wouldn't really work, either. Fiat money is based on trust: the assumption that if you accept a dollar in exchange for goods, you will be able to turn around and exchange that dollar for a comparable quantity of other goods. If the financial system is zeroized, that trust is broken. People would rather have tangible assets instead of money of dubious origin that has demonstrated the capacity to literally vanish overnight. Hoarding and hyper-inflation would ensue.
The punchline of all of this is that millions of people would starve to death in the cities within a matter of weeks. Millions more would pour out into the countryside, looting and pillaging. Law and order would break down completely in all but the most remote places. Remote places would probably degrade much more gracefully to lower levels of technology, and bounce back quickly as well after the dust settled, but the cities and suburbs would literally be wiped out. An event like this would probably result in a death toll comparable to a widespread nuclear strike, and would equally destroy the nation as a functioning political and social entity.
While we're on the subject of apocalyptic scenarios, it's important to remember that there is an abundance of guns in the countryside, so any of us "city folk" hoping to loot some tasty country cooking are in for a different sort of treat.
An event like this would probably result in a death toll comparable to a widespread nuclear strike, and would equally destroy the nation as a functioning political and social entity.
I'd like to think that a new system of logistics would evolve very quickly after a total financial disaster, so long as the food supplies didn't get so low that peoples' low blood sugar diminishes their ability to control their anger.
While the ratio of guns/people is much higher in the countryside, the absolute number of guns in a big city is orders of magnitude higher than the absolute number of guns in any rural county. Even if there were no guns in the city, a mob of desparate people will charge a smaller number of better-armed people if starvation is the only other alternative. Also, rural populations are, by definition, spread out, making it easy for large mobs of looters to pick them off one homestead at a time. Those well-armed country folk aren't going to fare so well unless they are really far from the nearest big city.
>I'd like to think that a new system of logistics would evolve very quickly after a total financial disaster, so long as the food supplies didn't get so low that peoples' low blood sugar diminishes their ability to control their anger.
I'd like to think so, too. In areas with lower population density, it will probably work out that way, in large measure because it is possible in a small enough community to know almost everyone, making trust and barter a lot easier. In cities, where trade relies on cash because there are too many strangers, and where the logistical system is much more complex, I don't think it's likely for a viable alternative to evolve quickly enough to prevent mass starvation and the accompanying violence.
On its own this would not bring down civilisation.
Now imagine your electronic savings gone, the supermarkets' delivery computers gone (so they don't know what food to send where), the oil refineries gone (so fuel has run out), the power stations down, and above everything else, the communications net down so people can't co-ordinate to get everything up and running.
Oh no, they'd have to use the phone and or maybe messenger pigeons, or just guess - roughly that much food. How did all of this work in the early 1900s and earlier - magic? We couldn't possibly fall back to that, could we!
the oil refineries gone
All of them? They all had centrifuges or what not, connected to the Internet, and all of them were destroyed by a stuxnet style of attack, all at the same time?
the power stations down All of them too? Really? How likely is all of this to happen at the same time, in such a totality?
NY lost power for 48 hours in the middle of summer not that long ago, almost all of the North East did - no riots.
If all of what you describe happens, we might see a lot of food riots. But I don't think millions would die, people would feverishly work to bring the power plants and refineries back up.
But ALL of what you describe happening at the same time is an extremely unlikely scenario, and I mean extremely unlikely.
the communications net down so people can't co-ordinate to get everything up and running.
Short wave radio too? Really? Absolutely no way to communicate, let me throw some ideas out - Morse code and mirrors?
Great post.
Dug is absolutely right in saying that our present difficulties in computer security lie not with brute-force flooding of pipes (i.e., DDoS), but rather with targeted, strategic attacks on smaller subsets of systems (think Stux).
However, I would disagree with the statement “users are the new target”. Indeed, it is far easier to gain access to resources by attacking the users who control those resources. But I think it is far more damaging (and therefore lucrative to the adversaries) to attack infrastructure systems on a wide-scale. People may be the initial entry point of the attack, but I still think the greater target is technology behind our infrastructure. Steve, you have addressed the very important point that much of our infrastructure (economic, transportation, military, …) is based on on solid systems operating securely and reliably. Let us call these critical systems. These are the ones that are vulnerable to crippling cyberattacks.
I posit that our infrastructure should not be based on these systems at all.
Any critical system should have no connection to the Internet. In fact, it should have no concept of the Internet. One might go so far as to say that any critical system should have no I/O with the rest of the world. (Recall that Stuxnet was thought to be propagated initially by USB.) This would help ensure that infrastructure-crippling cyberattacks do not propagate. Though preventing a system from communicating with the outside world will drastically reduce its value in controlling our infrastructure. This is the unfortunate nature of the security-versus-usability problem.
How do we secure ourselves? Let us hope that we will simply enjoy a “new spring”.
I loved this quote. Would "irony" define this construct or is there a more specific term that would apply here?
I'd suggest the word pathetic. Although a bit extreme, I do find our progress to be pathetic at times. We are still barbarians.
I know Steve read all the top secret manuals when he worked for a military contractor, but is this true? Specifically the part about weapons systems? Doesn't the military have a proprietary satellite communication system for that stuff?
I'm a lot more worried about the US overreacting to a cyber attack, or reacting to a forged country of origin. That seems much more likely than overthrow of the government. The day the US government said that cyberattacks could be considered an act of war, I'm sure there were numerous smaller countries and non-state actors scheming ways to make it look like Russia and/or China wiped out the US financial, government, military, and SCADA computer systems, triggering a physical war. It's kind of like the supposed automated USSR doomsday retaliation scenario, except anyone can pull the trigger.
Good read, good points, reasonable possibilities... but a bit hyperbolic.
Looking on the bright side...
Scenarios depicted could end in massive death and destruction...
But wouldn't kill us all.
Not much consolation, but at least leaves some hope for a later and better iteration...
Though it might take another few thousand years to get back to facing the problem again.
However, I'm more worried about an EMP attack than a devastating Internet attack. A couple of well-placed EMPs could take the US back to the Victorian period very quickly. One Second After is a great read on the subject.
Really? You can't imagine that people would fall back on their word and paper? And that after a huge shock we would shake it off and get back to work?
Imagine a trucker. All the "logistics" went poof on Monday, it's Wednesday. Imagine the trucker decided to drive anyway, stops at a gas station he frequents a lot, him and the manager agree on a handshake and he fills up, and truck on. Makes his delivery, the local store clerks are still working despite now knowing how or if they'd get paid and for how many hours. Imagine that despite the huge confusion and uncertainty and everything taking 100 times longer, life still goes on. Can you imagine that?
Or alternatively, OMG the internet's down, everybody starve to death!
Rodney King was beaten by LAPD officers and it was videotaped and the officers were acquitted.
http://en.wikipedia.org/wiki/Rodney_King
If anything, riots would be caused by people reading and understanding this article:
http://www.rollingstone.com/politics/news/the-real-housewive...
I am wondering how this is going to work, considering most financial institutions have cold-standby back up systems, often off-site or in another country and you cannot just overwrite backups like that.
This sounds way too much like SciFi FUD bla-bla and anyone using "logic bomb" as an argument is automatically suspicious. One of the beauties of the digital world is that given sufficient precautions, you can wipe all financial data as often as you like, you can always get it back from backups and those messages don't just exist at one point-of-failure but at a lot of nodes, very likely around the world. Data that took a whole department years to gather can be erased, transferred and made available again in a matter of seconds.
Banks have existed LONG before the interwebs and have only started to use network infrastructure during the last maybe 20 or so years - and though very limited, they would still be able to function without it by simply switching back to pen and paper like they did 40 years ago.
Contrast this to blowing up major infrastructure nodes like bridges, airports etc. which literally took years to build.
> At the same time, all cloud-based assets, all companies applications and customer data will be attacked and deleted. All of it gone. Forever.
It will be a grievous day... without petabytes of porn readily accessible at the click of my mouse, without news on LuLzSec and without the ground-noise of twitter and facebook updates about pets, lunch or bowl movements but I daresay I will survive that, thank you very much.
And companies storing that kind of critical information only in "the cloud"? They deserve to be gone. Forever.
Maybe they figure out a way to affect the paper systems too -- FAX machine infiltration, etc.
He's positing professional warfare and extreme secrecy of results -- not the lulz style hacks.
Whereas screwing over the whole banking system of north USA like that requires the kind of cracking you described but against maybe a few hundred different targets, likely all running different systems and posing different challenges - not un-do-able - but ultimately to not that great avail. So you have a lot of effort actually pulling the attack off to even make a dent and then it is probably going to be not much more than a scary headline in the newspaper.
Banks and governments are not the internet or in the internet. They are offering their services ALSO over the internet but not exclusively. And the really important backups need to be kept for years and years, off site. I doubt it is as easy and efficient to launch "cyber war" on the USA and then just "cyber nuke them back to the stone age" which is something this article subtly suggests.
Also, how many power plants, reactors, flood gates and traffic systems are controllable over the internet like that? At least here in Europe I have honestly no idea but strongly doubt they work like that.
Which is enough to cause tremendous damage. And a way more likely scenario.
I would trust more in the people who design our SWIFT and other transaction systems.
But the larger point is, even if you can mostly undo the damage, you have a much harder time restoring trust. The money doesn't need to be lost. If you create enough of a panic to trigger a run on banks, you've achieved your goal, too.
So for example, their are 9 major oil refineries in the UK. If they could all be put out of action with Stuxnet-style attacks (or maybe with precision cruise missiles), then 2 weeks later the UK runs out of fuel and supermarkets run out of food.
Or consider an attack on the internet infrastructure itself. Since we're envisaging an attack in the future, when TV, radio and telephones are just services that run on the internet, bringing down the net will destroy communications. And the end-pints -- computers in homes and offices -- will themselves be down.
Societies are only going to get more dependent on computers, and computers are only going to get more complicated (making logic bombs harder to find). The damage that a cyberspace attack could do, and the ease of pulling it off, will therefore both only increase.
You're right. These attacks can only be destructive if there are relatively few points of failure. I think our financial institutions can learn a lot from distributed systems like Bitcoin. I don't have a clue how it would work, but I can envision a distributed bank opening up one day, where all transactions and balances were distributed so that it would be impossible to destroy all that data, or any of it with enough redundancy.