6 ms·

What I am starting to appreciate about these digital infrastructure attacks is that they may be reversible and or temporary. It can be a nice feature.

jacquesm 8mo ago
Then you're missing the point. If they succeed they may well not be reversible. The question is if this had succeeded would we have shrugged it off again or responded appropriately?
- tosapple 8mo ago
  I wasn't commenting on any particular case. I was stating that flipping a switch is less costly to reverse than blowing up a dam.
  - jacquesm 8mo ago
    These attacks are not at the level of 'flipping a switch'. If they succeed they can destabilize the grid and that has the potential to destroy gear, and while not as costly as blowing up a dam it can still be quite costly.
    - tosapple 8mo ago
      During WW2 both germany and the UK as example were carpet bombed to assail industry, does that help you to understand my position better? Vietnam too.
      - shakna 8mo ago
        Not really. If you succeed in attacking the grid, you achieve the same widespread industry impact, without the cost of the munitions. It can take decades to recover from a cyber attack like this, if it succeeds.
        tosapple 8mo ago
        Again, not endoring any specific case just endorsing SPECIFICITY, COST, and "Collaterals".
        shakna 8mo ago
        I was not speaking to just one case. Today's incident, is _the norm_. These attacks are widespread, damaging, and the repercussions are felt for decades in their wake. We _are_ being carpet bombed, and the costs for the victims are ongoing and growing. The collateral damage is everywhere. Do you really think there's no impact? > Cyber units from at least one nation state routinely try to explore and exploit Australia’s critical infrastructure networks, almost certainly mapping systems so they can lay down malware or maintain access in the future. > We recently discovered one of those units targeting critical networks in the United States. ASIO worked closely with our American counterpart to evict the hackers and shut down their global accesses, including nodes here in Australia. > https://www.intelligence.gov.au/news/asio-annual-threat-assessment-2025 https://www.intelligence.gov.au/news/asio-annual-threat-asse...
        tosapple 8mo ago
        [flagged]
        idiotsecant 8mo ago
        'I appreciate that these scammers are just stealing old people's money online instead of killing them and taking it'!
        shakna 8mo ago
        I guess I shouldn't be drawn by someone calling me an idiot... But one last try. You suggested that the cost of cyberattacks on industry, is not so great as when we were destroying it with bombs instead. However, every time we have power outages, people die. Then we have the cost of securing the infrastructure. And the cost of everyone else affected, who has to increase their resilience. Your bank is collateral damage, as is the people freezing to death in their homes. Entire industries are on the verge of collapse - getting a new turbine to help stabilise your grid has a lead time of _years_, not days or weeks. And if you hit weeks, people die. Insurance responds to attacks, and that trickles out to everywhere that is touched. VISA and MasterCard have to prepare for eventualities, because of attacks not aimed at them, but at power infrastructure. When power is hit... There is nothing unaffected. Volt Typhoon hit the US power grid, and required a massive multinational effort to extract them, that took almost a year... And VT wasn't intended to do damage, just look for weak spots. So that next time, they can cause damage. As part of that survival process, various hardware partners were kicked to the curb, and the repercussions are still in the process of being felt. Half the industry may have issues surviving because of it. Industroyer is one of the reasons that Kyiv got as bad as it did. Malware is not some hand-wave and fix thing. Half the city's relays were permanently damaged. Then of course, there was Stuxnet. Which blew up centrifuges, and the research centres hit are still trying to recover from where they were, then. Cyberattacks are a weapon of war, people die, industries die, and there is no easy path to recovery following it. An entire industry exists, just to defend against these kinds of attacks. The money spent on that, is counted, which means it has to be less than the cost of the attack succeeding. Trillions are spent, because there is absolute weight behind surviving these attacks. If things were easier, it'd be an industry solely focused on backups and flipping a switch. But it's not.
      - ben_w 8mo ago
        The reason everyone used carpet bombing in WW2 was the inability to aim competently. This even persisted after WW2, leading to some tests of air-to-air nuclear weapons just to give the missiles a decent chance to actually disable the target they were fired at. The counter-strategies that the British used to defend against German strikes included "switch off all the lights at night so they don't know where they are" and "order newspapers to lie about which part of the city was damaged in order that spies reading British newspapers and reporting back to HQ said missiles fell short/went too far, causing HQ to incorrectly compensate on the next strike". I don't know if the reverse was true, despite now living in Berlin. Everyone's supply chains were also much shallower, and equipment much cruder and therefore easier to make (though also less efficient). Half of London or Berlin losing electricity makes a much smaller difference when far less was electrified in the first place, e.g. loss of electricity for a heat pump doesn't matter so much when the terraces and apartment blocks have internal fireplaces and regular coal deliveries. Also re Vietnam, it took until 1997 to return to the per-person energy use it had in 1970: https://ourworldindata.org/profile/energy/vietnam https://ourworldindata.org/profile/energy/vietnam And until 1993 to reach the not-adjusted-for-population level. And the electricity graphs don't even go back far enough to see what that war was like, that's all energy.
- K0balt 8mo ago
  Can you give some examples of? I can imagine that under the right circumstances you might succeed in blowing up some transformers or even a turbine, but it seems like you’d be up to speed within a month or two on the outside? Or am I missing the gravity somehow?
  - 3eb7988a1663 8mo ago
    Pardon? A month or two without power does not seem like an enormous crisis? Stuxnet destroyed centrifuges. It does not seem impossible that a sophisticated attack could shred some critical equipment. During the Texas 2021 outage -they were incredibly close to losing the entire grid and being in a blackstart scenario. Estimates were that it could take weeks to bring back power - all this without any physical equipment destroyed or malicious code within the network. Edit: Had to look it up, the Texas outage was "only" two weeks and scattershot in where it hit. The death toll is estimated at 246-702. https://en.wikipedia.org/wiki/2021_Texas_power_crisis https://en.wikipedia.org/wiki/2021_Texas_power_crisis
    - K0balt 8mo ago
      A month or two of isolated outages should not be a crisis in a developed nation with resources and infrastructure. The fact that the Texas outages killed anyone is a testament to the fact that the USA is, apparently, a developing nation, possibly going through a rough patch. It’s not like there wasn’t enough generators or fuel in the nation to ameliorate that crisis. It was that, like all developing nations, resources are not available at the point of need despite their widespread availability.
  - applied_heat 8mo ago
    Transformers and turbines of any significance are not off the shelf parts and can have lead times of years
    - esafak 8mo ago
      How do they not have backups??
matkoniecz 8mo ago
Deaths resulting from such attack are not reversible.
arter45 8mo ago
Time matters. Imagine the power grid fails in an entire city for 48 hours. How many apartments or shops have backup power for 48 hours? What about hospitals or cellphone towers or traffic lights? How long before someone cannot make a 911 call or hits another car at night or dies in intensive care because the machines don’t work anymore? What about all the food in a refrigerator, or CCTV cameras, or POS payments or a thousand other things? And if sometimes physically fails, how long before a technician (who was himself relying on that power grid) is able to reach the place, carrying whatever spare part they have, and fix the thing? Or, take a dam. I’m no dam expert, but how long does it take before a flood happens? And when water starts flooding the streets, how long before people can’t get out of their homes, cars are swept away, and so on? How long before standing water starts carrying diseases?

jacquesm 8mo ago

Then you're missing the point. If they succeed they may well not be reversible. The question is if this had succeeded would we have shrugged it off again or responded appropriately?

tosapple 8mo ago
I wasn't commenting on any particular case. I was stating that flipping a switch is less costly to reverse than blowing up a dam.
- jacquesm 8mo ago
  These attacks are not at the level of 'flipping a switch'. If they succeed they can destabilize the grid and that has the potential to destroy gear, and while not as costly as blowing up a dam it can still be quite costly.
  - tosapple 8mo ago
    During WW2 both germany and the UK as example were carpet bombed to assail industry, does that help you to understand my position better? Vietnam too.
    - shakna 8mo ago
      Not really. If you succeed in attacking the grid, you achieve the same widespread industry impact, without the cost of the munitions. It can take decades to recover from a cyber attack like this, if it succeeds.
      - tosapple 8mo ago
        Again, not endoring any specific case just endorsing SPECIFICITY, COST, and "Collaterals".
        shakna 8mo ago
        I was not speaking to just one case. Today's incident, is _the norm_. These attacks are widespread, damaging, and the repercussions are felt for decades in their wake. We _are_ being carpet bombed, and the costs for the victims are ongoing and growing. The collateral damage is everywhere. Do you really think there's no impact? > Cyber units from at least one nation state routinely try to explore and exploit Australia’s critical infrastructure networks, almost certainly mapping systems so they can lay down malware or maintain access in the future. > We recently discovered one of those units targeting critical networks in the United States. ASIO worked closely with our American counterpart to evict the hackers and shut down their global accesses, including nodes here in Australia. > https://www.intelligence.gov.au/news/asio-annual-threat-assessment-2025 https://www.intelligence.gov.au/news/asio-annual-threat-asse...
        tosapple 8mo ago
        [flagged]
        idiotsecant 8mo ago
        'I appreciate that these scammers are just stealing old people's money online instead of killing them and taking it'!
        shakna 8mo ago
        I guess I shouldn't be drawn by someone calling me an idiot... But one last try. You suggested that the cost of cyberattacks on industry, is not so great as when we were destroying it with bombs instead. However, every time we have power outages, people die. Then we have the cost of securing the infrastructure. And the cost of everyone else affected, who has to increase their resilience. Your bank is collateral damage, as is the people freezing to death in their homes. Entire industries are on the verge of collapse - getting a new turbine to help stabilise your grid has a lead time of _years_, not days or weeks. And if you hit weeks, people die. Insurance responds to attacks, and that trickles out to everywhere that is touched. VISA and MasterCard have to prepare for eventualities, because of attacks not aimed at them, but at power infrastructure. When power is hit... There is nothing unaffected. Volt Typhoon hit the US power grid, and required a massive multinational effort to extract them, that took almost a year... And VT wasn't intended to do damage, just look for weak spots. So that next time, they can cause damage. As part of that survival process, various hardware partners were kicked to the curb, and the repercussions are still in the process of being felt. Half the industry may have issues surviving because of it. Industroyer is one of the reasons that Kyiv got as bad as it did. Malware is not some hand-wave and fix thing. Half the city's relays were permanently damaged. Then of course, there was Stuxnet. Which blew up centrifuges, and the research centres hit are still trying to recover from where they were, then. Cyberattacks are a weapon of war, people die, industries die, and there is no easy path to recovery following it. An entire industry exists, just to defend against these kinds of attacks. The money spent on that, is counted, which means it has to be less than the cost of the attack succeeding. Trillions are spent, because there is absolute weight behind surviving these attacks. If things were easier, it'd be an industry solely focused on backups and flipping a switch. But it's not.
    - ben_w 8mo ago
      The reason everyone used carpet bombing in WW2 was the inability to aim competently. This even persisted after WW2, leading to some tests of air-to-air nuclear weapons just to give the missiles a decent chance to actually disable the target they were fired at. The counter-strategies that the British used to defend against German strikes included "switch off all the lights at night so they don't know where they are" and "order newspapers to lie about which part of the city was damaged in order that spies reading British newspapers and reporting back to HQ said missiles fell short/went too far, causing HQ to incorrectly compensate on the next strike". I don't know if the reverse was true, despite now living in Berlin. Everyone's supply chains were also much shallower, and equipment much cruder and therefore easier to make (though also less efficient). Half of London or Berlin losing electricity makes a much smaller difference when far less was electrified in the first place, e.g. loss of electricity for a heat pump doesn't matter so much when the terraces and apartment blocks have internal fireplaces and regular coal deliveries. Also re Vietnam, it took until 1997 to return to the per-person energy use it had in 1970: https://ourworldindata.org/profile/energy/vietnam https://ourworldindata.org/profile/energy/vietnam And until 1993 to reach the not-adjusted-for-population level. And the electricity graphs don't even go back far enough to see what that war was like, that's all energy.
K0balt 8mo ago
Can you give some examples of? I can imagine that under the right circumstances you might succeed in blowing up some transformers or even a turbine, but it seems like you’d be up to speed within a month or two on the outside? Or am I missing the gravity somehow?
- 3eb7988a1663 8mo ago
  Pardon? A month or two without power does not seem like an enormous crisis? Stuxnet destroyed centrifuges. It does not seem impossible that a sophisticated attack could shred some critical equipment. During the Texas 2021 outage -they were incredibly close to losing the entire grid and being in a blackstart scenario. Estimates were that it could take weeks to bring back power - all this without any physical equipment destroyed or malicious code within the network. Edit: Had to look it up, the Texas outage was "only" two weeks and scattershot in where it hit. The death toll is estimated at 246-702. https://en.wikipedia.org/wiki/2021_Texas_power_crisis https://en.wikipedia.org/wiki/2021_Texas_power_crisis
  - K0balt 8mo ago
    A month or two of isolated outages should not be a crisis in a developed nation with resources and infrastructure. The fact that the Texas outages killed anyone is a testament to the fact that the USA is, apparently, a developing nation, possibly going through a rough patch. It’s not like there wasn’t enough generators or fuel in the nation to ameliorate that crisis. It was that, like all developing nations, resources are not available at the point of need despite their widespread availability.
- applied_heat 8mo ago
  Transformers and turbines of any significance are not off the shelf parts and can have lead times of years
  - esafak 8mo ago
    How do they not have backups??

matkoniecz 8mo ago

Deaths resulting from such attack are not reversible.

arter45 8mo ago

Time matters. Imagine the power grid fails in an entire city for 48 hours. How many apartments or shops have backup power for 48 hours? What about hospitals or cellphone towers or traffic lights? How long before someone cannot make a 911 call or hits another car at night or dies in intensive care because the machines don’t work anymore? What about all the food in a refrigerator, or CCTV cameras, or POS payments or a thousand other things? And if sometimes physically fails, how long before a technician (who was himself relying on that power grid) is able to reach the place, carrying whatever spare part they have, and fix the thing? Or, take a dam. I’m no dam expert, but how long does it take before a flood happens? And when water starts flooding the streets, how long before people can’t get out of their homes, cars are swept away, and so on? How long before standing water starts carrying diseases?