Recent fears about North Korean cyber attacks against American power grids as well as the publishing by WikiLeaks of advanced CIA and NSA hacking programs have proven again that any computer system is potentially vulnerable to an attack over the internet, no matter how advanced its cybersecurity may be.
If an internet of everything means everything is exposed to sabotage then the time is now for security analysis of what strategically vital assets and infrastructure should either be removed from the control of computers, in part or in total. Because what can be hacked ultimately will be hacked given enough time and enough malicious nerds with too much time on their hands. There are many of these sinister forms of nerd; or at least enough for a nuclear power plant, or more, to suffer a core breach because ransomeware was not paid.
Of course, a full return to non-computer machinery and manual processes is unlikely. Even inadvisable: If dams cannot be programmed into failing by some psychopath, another psychopath will try to destroy it with a hijacked plane, bomb, or some other traditional device. But that will at least require a different type of psychopath, a psychopath able to leave his room and handle exposure to sunlight. And, unlike a computer vulnerability across a shared network, without computers or a shared network the manual destruction of one dam cannot be part of a simultaneous electronic chain reaction in the computers of other dams.
It does, afterall, pay to hedge one’s bets. Hedging the mix of digital and non-digital bets we’ve made in our portfolio of high priority systems is overdue now that there is good reason to think we have excessively slanted their operations in favor of automation.
Some systems that deserve to have their degree of computerization reconsidered include:
- Prison Doors
- Power Grids
- Nuclear Plants
- Water Systems
- Nuclear Weapons
- Traffic Lights
For the military decomputerization of their programs should be a highlight of their threat analysis. Should certain types of classified documents be written up on paper with typewriters and saved in filing cabinets instead of databases? Does Morse code have a future in military communications?
The ordinary consumer market also must weigh balancing the risks and rewards of computerizing their products. Is it better for the manufacturers of digital clocks to have them operate on computer chips with pre-installed, non-updatable (i.e., not connected to the internet) computer code? Or no computer chip at all? Or car navigation systems. How vulnerable are they to having malicious code take control of the wheel?
Like all tradeoffs there is no definitive answer; only the weighing of different kinds of risks against others. But the probabilities will have to be weighed with the understanding that greater reliance on computers brings proportionally greater risks of its own.