No natural disaster in the last several years has passed without a government official or civilian “expert” using it to raise fears of cyber threats. That is why, after a series of snarky tweets over the last couple days by Rob Rosenberger, I was inspired to create a Google alert for any news item mentioning both the words “cyber” and “Sandy” in the same article.
I created the alert this morning and waited. How long would it be before someone exploited this disaster to promote cyber fear? And who would do such a thing?
This evening I got my answer. Less than twelve hours after creating the alert and in the midst of a still-unfolding crisis, it was the Secretary of Homeland Security, Janet Napolitano, who, as far as I can tell, gets the honor of being the first to use Sandy to stoke cyber fears.
The Hill reported that at a “cybersecurity event hosted by The Washington Post today, Secretary Napolitano said,
After Hurricane Sandy wreaked havoc on the East Coast, Napolitano said people should look than no further than the damage caused by the massive storm to understand the need to boost the nation’s cybersecurity protections.
“One of the possible areas of attack, of course, is attacks on our nation’s control systems — the control systems the operate our utilities, our water plants, our pipelines, our financial institutions,” Napolitano said. “If you think that a critical systems attack that takes down a utility even for a few hours is not serious, just look at what is happening now that Mother Nature has taken out those utilities.”
“The urgency and the immediacy of the cyber problem; the cyberattacks that we are undergoing and continuing to undergo can not be overestimated,” she said.
Rosenberger’s comments and my own inclination to set up an alert come from having seen this tendency repeatedly. As I have noted previously, the public policy discourse about cybersecurity in the United States is exhibits a tendency to focus upon the most exotic, hypothetical causes of our misfortunes while ignoring the actual causes. In some of the most egregious examples, commentators have used the financial crisis and even the 2011 Japanese eathquake and tsunami as vehicles for promoting fear of cyber attack.
This tendency to use an ongoing crisis to raise fears of hypothetical threats is distasteful, but is also a dangerous and unnecessary distraction. As I have written previously, our leaders sometimes have a hard time distinguishing between what is happening and what might happen, between what they can imagine and what is possible and/or probable. This was the case during the months and years prior to the terrorist attacks of 9/11, when American officials worried about hypotehtical cyber attacks while missing signs of the 9/11 attack. Some even expressed surprise afterwards that al-Qaeda had not launched a cyber attack instead.
The sad thing is that such dangerous distractions are unnecessary. If anything, an event like Sandy should help us to have a more realistic understanding of the threats we face. A cyber attack is not going to cause the kind of physical destruction we have seen in Sandy. It will not sweep homes off their foundations, uproot trees, smash cars, carry roller coasters out to sea.
One recent estimate puts Sandy’s cost in terms of property damage and lost business at nearly $60 billion. A recent breakdown of the “ten most expensive network attacks in history” indicates that we have yet to see a cyber attack that comes anywhere close to causing the kinds of losses estimated to have been caused by Sandy. Another investigation has revealed that oft-cited statistics about the supposed cost of cyber crime are largely baseless.
Finally, Sandy has demonstrated for us once again what researchers have discovered repeatedly: During disasters, people come together and help one another. We do not see panic, paralysis, or social collapse. Even if a cyber attack were to cause the kind of devastation that we have seen in Sandy, which is unlikely, it is also unlikely to cause the “panic” and “paralysis” about which Secretary of Defense Leon Panetta recently warned in a speech that some have seen as an indicator that the Department of Defense is essentially taking over cybersecurity for the nation.
On the heels of Secretary Panetta’s speech, the experience of Sandy should indicate that the fear of cyber-doom scenarios that is driving much of our thinking about cybersecurity challenges is not only unrealistic but leads us to inappropriate and potentially dangerous responses to the cyber threats that do exist. Instead, and as suspected, Sandy is being used to promote fear of hypotehtical, exotic attacks even in the midst of actual, ongoing suffering from the second hurricane to hit this part of the United States in the last year.
