How much damage did the Stuxnet virus do?
A new report from the Institute for Science and International Security examines the impact of the Stuxnet computer virus on the centrifuges in Iran's Natanz facility. The authors conclude that there's some ambiguity with respect to just what the virus did, but they issue this warning:
For many years, governments have pursued methods to disrupt Iranâ??s ability to procure goods illegally overseas for its nuclear programs, particularly its gas centrifuge program. Such overt and covert disruption activities have had significant effect in slowing Iranâ??s centrifuge program, while causing minimal collateral damage. In contrast to overt military strikes, there is an appeal to cyber attacks aimed at a centrifuge plant built with illegally obtained, foreign equipment, and operating in defiance of United Nations Security Council resolutions. However, Stuxnet appears to have spread unintentionally and well beyond its targets. Part of the reason is in the design of Stuxnet, which needs to spread in order to increase its chance of infecting an industrial control system via a removable drive used with an infected computer. It is important for governments to approach the question of whether using a tool like Stuxnet could open the door to future national security risks or adversely and unintentionally affect U.S. allies. Countries hostile to the United States may feel justified in launching their own attacks against U.S. facilities, perhaps even using a modified Stuxnet code. Such an attack could shut down large portions of national power grids or other critical infrastructure using malware designed to target critical components inside a major system, causing a national emergency.
I think as long as the majority of the damage and havoc caused by Stuxnet is confined to Iran's facilities, the attack should be deemed a success. Putting time back on Iran's nuclear clock without having to court another war in the Middle East is all to the good. However, if the virus winds up causing major damage to other countries' nuclear infrastructure, then obviously the 'collateral damage' issue becomes much more significant.
