Hacker News Reader

Comment by belorn | Hacker News Reader

Spreading malware is a big deal, and I am sure many people would get quite upset if important US infrastructure was targeted. What would the reactions be if the 911 system got hit by untested malware, or some traffic control systems crash because of spying activities.

What repercussion should the US have received if the Iranian uranium enrichment had exploded and thrown fine radioactive dust into the environment? Would NSA take responsibility for the deaths and environment damage for their spying, or would they hide and put the blame on a third-party?

The answer to your question is that the potential for damage that malware has, and the responsibility we expect from those who make it is extremely disproportional. It is a big deal, and the risk/cost to human lives is why we should be very careful allowing organizations to spread malware.

View on HN

I don't know what repercussions there should be for that, but any consideration of repercussions has to consider the alternative to electronic attack, which is airplanes dropping munitions from great heights onto buildings with people in them.

People should probably not kid themselves about geopolitics and military competition vanishing if we somehow manage to regulate "electronic warfare".

>which is airplanes dropping munitions from great heights onto buildings with people in them.

I know that you didn't mean for your comment to be taken literally but there is literally zero chance of enemy airplanes invading US skies and dropping munitions from great heights onto buildings with people in them. It is a silly thing to say and it does nothing to justify the current situation vis a vis the NSA et al. Try not to hyperventilate.

No, I mean literally: if Stuxnet really did target the Iranian nuclear project and really did set Iran back by a year or so, then Stuxnet forestalled an aerial bombardment of Iran by a year or so.

It's an ugly situation, since Iran's geopolitical strategy involves gaining concessions through a game of chicken with the US counter-proliferation regime. At some point, unless it's resolved in a way that ends the Iranian nuclear arms program, it is going to end in explosions, and scores of lost lives.

This is a descriptive observation, not a normative one.

It is also true that if Iran somehow arranged for explosions at US nuclear facilities, the USG's response would be world- historically horrific. Any reasonable observer knows this to be a fact, so we can acknowledge it without getting into philosophy and move on.

Of course there isn't. The US would be the attacker in this scenario. And we most certainly still do bomb people with aircraft.

We recently had a article from Schneier that made a similar observation comparing electronic attack to airplanes dropping munitions from great heights, which is why the conclusion was that electronic attacks should be under the control of the military and not by NSA. We expect the military to strike other nations civil infrastructure (or at least the subject can be debated), but we also expect them to take responsibility for it.

That makes a lot of sense to me, too. Also: this isn't to say that there aren't grave concerns with using self-propagating malware as a vector for attacks. It's just to keep things in perspective.

The chances of a full-blown Iranian nuclear weapons program not eventually bearing an attack by explosive munitions are pretty close to zero; see Osirak. If malware that only really impacts centrifuges forestalls that for a couple years, I see it as a good thing.

Schneier is also the one who said these are the types of things the NSA should be doing[1].

[1] https://www.schneier.com/blog/archives/2013/12/more_about_th...

The NSA is subordinate to the Department of Defense - it is part of the military.

This is a false dichotomy of the most offensive kind.

Please explain. I am still on the fence about Stuxnet, but the conventional wisdom is that it did exactly what I suggested that it did: it forestalled a military attack on Iran's nuclear program. And "forestall" is all it did; we're presumably a phone call and double-digit seconds away from that attack today.

> alternative to electronic attack, which is airplanes dropping munitions from great heights onto buildings with people in them.

I'd actually like to see the outcome of that. By all means, please go ahead and do this -- in Brussels.

> or would they hide and put the blame on a third-party?

That's usually the point of this sort of work, yes. Espionage isn't just about acquiring information, it's about spreading false information, and dragging your enemies through the mud.

I don't approve of this shit, but "the them" have been up to it since forever, and the answers to your queries are a straightforward: "None", "No", "Yes" - unless someone else's intelligence agency outwits them, and has a media mouthpiece that can't be drowned out by chaff.

Edit: Your post got me thinking about Chernobyl and Reagan. The CIA had a programme to export defective technology to the USSR - which (apparently) culminated in http://en.wikipedia.org/wiki/Siberian_pipeline_sabotage

One has to wonder. Yes, I'm aware that the questions as to how Chernobyl are well answered, and all the rest, case closed, etc. - but one still has to wonder. Nothing should be trusted 100%.

Reply on news.ycombinator.com