"A Declaration of Cyber-War," Michael Joseph Gross

The April issue of Vanity Fair will include a lengthy piece on what is known and suspected about the Stuxnet worm.

Subject matter experts will find parts of the article a little irksome (what exactly is a "stolen" digital signature, for instance? Does it refer to a document signed with a stolen private key?), but if cops and doctors can cope with the absurdities of how their lives are dumbed down for the rest of us on TV, well, infosec types can develop coping strategies too.

Much of what is "known" about Stuxnet is actually informed speculation, the product of analysts' suspicions as to how Stuxnet's construction and behavior fit the supposed goals of certain nations. (That the worm must have been the product of a government rather than a band of crackers seems to be the consensus.) Informed speculation, a step above wild-ass guessing, to use a favorite colloquialism of a former colleague, makes for an entertaining read, but it's a dangerous guide to the future, whether it's the future to fear or the future to embrace.

Putting it less nebulously, Gross tells a good story, but it behooves us to remember that much of what he's telling us is guesswork. The experts whose insights he shares might be right in every detail, but we don't know that (yet). We would do well to remind ourselves of this if Stuxnet is used to sell us on some exotic strategy to combat information warfare, or whatever they're calling it these days.

That said, I do agree with one of Gross's conclusions.

In the end, the most important thing now publicly known about Stuxnet is that Stuxnet is now publicly known. That knowledge is, on the simplest level, a warning: America’s own critical infrastructure is a sitting target for attacks like this.

I've said as much before. And note that it didn't require a Stuxnet to trigger a lot of trouble in that critical infrastructure in 2003.