America the Vulnerable: The Attacks That Could Shut Down Society

We’ve all thought about it, even if we don’t like to talk about it: How our technology leaves us vulnerable. How fragile modern life feels.

What happens if the internet goes down? If the grid shuts off? If we can’t even get clean water?

You’ve probably considered the scenarios that could get us there.

Nuclear war?

Natural disaster?

Maybe.

But also … it could just be this guy.

[OPENING SEQUENCE]

In the 21st century, normal, everyday life … requires a lot of things to go right. Power plants have to get electricity into your home. Treatment facilities have to keep your water safe. The technology in your local hospitals has to work.

Now, most of the time those systems are so reliable that we barely give them any thought. But if even one of them goes down … life can get pretty complicated pretty quickly. And, let’s be honest … pretty dangerous.

That’s why the federal government refers to these kinds of physical or cyber assets as “critical infrastructure.” ⁱ Because without them modern life becomes almost impossible. Which is also why some of America’s adversaries have them in the crosshairs.

In just one two-year window, China managed to hack into at least 13 American pipelinesⁱⁱ — breaches that, had they gone undetected, could have left the country shivering.

In 2018, Russian hackers were able to get into the control systems of American electrical supplies, giving them the potential to cause blackouts.ⁱⁱⁱ

Iran attempted a cyberattack on the Boston Children’s Hospital. ^iv

North Korea even hacked healthcare systems and left some American patients unable to get their chemotherapy.^v

(Although those same hackers also stole over $1 billion in crypto, ^vi so, don’t worry, they got their comeuppance.)

Now there’s an obvious question here: America is a wealthy and powerful country. So, why are we so vulnerable on this front?

Well, for one thing there’s a lot of critical infrastructure to defend. And the responsibility for it is spread across both the public and private sectors.

The U.S. has over 6,400 power plants,^vii for instance, and around 54,000 drinking water systems^viii — which is great insofar as it makes it a lot harder to take the whole country down, but problematic because of how many targets there are to defend.

It's also the case that not all of those institutions have the expertise necessary to guard against attacks — and that no one can even agree on which ones should count as “critical infrastructure.”

When the Department of Homeland Security first attempted to put together a comprehensive list, it mushroomed from 160 key assets to over 77,000 in just three years.^ix That list ranged from things that probably make sense, like nuclear power plants, to … petting zoos.

So, yes, it’s complicated. But we’re going to have to sort it out quickly, because these vulnerabilities are starting to have real-world consequences.

In 2021, drivers on the East Coast faced widespread gasoline shortages. The reason: because hackers had shut down the Colonial Pipeline, which provides nearly half of the fuel to the eastern U.S.^x And they were able to get in … by stealing a single password.^xi

That was only a few months after law enforcement reported that a water treatment facility in Florida was hacked and programmed to release toxic amounts of lye into the water supply.^xii And while it’s recently been disputed whether it was a genuine hacking or a problem within the facility,^xiii that doesn’t change the underlying fact: We’re running some big risks here.

A 2021 government study found that one in 10 of America’s water and wastewater treatment facilities had critical cybersecurity vulnerabilities^xiv — and that approximately 80 percent of those were because their software hadn’t been updated.

Then there’s the threat to the country’s power supplies.

The wakeup call there came in 2013, when snipers attacked a power substation in San Jose, California, destroying six circuit breakers and 17 transformers. ^xv The attack caused over $15 million of damage and shut down the facility for about a month … but it could have devastated the entire region.

In just the last few months of 2022, there were similar attacks in North Carolina,^xvi Oregon,^xvii and Washington. Shortly before, the Associated Press obtained a Homeland Security report indicating that domestic extremists were intentionally targeting the grid in an attempt to destabilize the country.^xviii

Now, there is good news on this front: Which is that America’s energy supplies are so decentralized that it’s hard to generate nationwide chaos. The country has over 55,000 substations.^xix There’s bad news, however, too: Which is that government analysis found that taking out just nine of them could cause the whole country to lose power.^xx

And we are not telling you where they are.

It’s also probably worth noting that these vulnerabilities to our critical infrastructure don’t just create opportunities for enemy nations, international terrorists, and domestic extremists. They also create opportunities for … well, for morons.

One of those grid attacks in Washington state: It was committed by a couple of burglars who wanted to steal money from a cash register … and got the idea from watching tv.^xxi

In 2019, someone shut down a water treatment facility in Kansas and disabled its filters. The perpetrator: an employee who managed the facility remotely via his cell phone — and committed maybe the worst drunk dial of all time.^xxii

So, yes, we’re running serious risks. And while we don’t need to go full doomsday prepper, all of us ought to think through how we’d take care of ourselves and our families in the case of an emergency — whether that’s having a generator or some extra food & water or some spare cash; the same kinds of precautions you’d take for a hurricane or an earthquake.

We need to take the initiative to prepare for dangerous scenarios. We need to pressure our political leaders to secure our critical infrastructure.

And, for the love of God, guys, we need to change the password to the Colonial Pipeline every now and then.