Someone is trying to take entire countries offline and cybersecurity experts say ‘it’s a matter of time because it’s really easy’

Gatwick Airport is Britain’s second busiest by passenger volume, and Europe’s eighth. And yet it was brought to a standstill for two days by two people and a single drone.

Its vulnerability reminded me of a conversation I had two years ago, at the Web Summit conference in Lisbon with cybersecurity investor Sergey Gribov of Flint Capital. He was talking up one of his investments, an industrial cybersecurity firm based in Israel called CyberX. Half-bored, I girded myself for his pitch. They usually go like this: “The internet is full of hackers! They want to steal your data and your money! If only companies used my company’s awesome product, we would all be safe!”

I have heard hundreds of pitches like this.

But my conversation with Gribov was different. It was … extreme. The criminals who break into the web sites of banks or chainstores and steal personal data or money are not the scariest people out there, he told me. The hackers we really ought to be worrying about are the ones trying take entire countries offline. People who are trying to take down the internet, switch the lights off, cut the water supply, disable railways, or blow up factories.

The West’s weakness is in the older electronics and sensors that control processes in infrastructure and industry. Often these electronics were installed decades ago. The security systems controlling them are ancient or non-existent. If a hacker can gain control of a temperature sensor in a factory, he — they’re usually men — can blow the place up, or set it on fire. “The problem people don’t realise is it becomes a weapon of mass destruction. You can take down a whole country. It can be done,” he said.

And then, how do you respond? Does the country that was attacked — the one struggling to get its power grid back online — launch nukes? Probably not, he said, because “you have no idea who did it.”

“You can have a team of five people sitting in a basement and be just as devastating as WMDs,” he said. “It’s really scary. In some sense it’s a matter of time because it’s really easy.”

At the time, I discounted my conversation with Gribov. His VC fund was invested in CyberX, so he had an obvious interest in propagating the idea that the world is full of bad guys.

But in the years since we talked, two unnerving things happened.

• In December 2017, three men pleaded guilty to causing the largest internet outage in history – a distributed “denial of service” attack that blacked out the web across most of the US and large chunks of Northern Europe for about 12 hours. They had disabled Dyn, a company that provides Domain Name System (DNS) services — the web’s directory of addresses, basically — to much of the internet.
• And then, in April 2018, the African country of Mauritania was taken offline for two days when someone cut the single undersea cable that serves its internet.