Episode  MSP53  The Fragile Earth
Episode  MSP53  The Fragile Earth
A combination of natural disasters and cyber-attacks has shown how fragile our way of life is. Are we heading for chaos? Or will the better side of human nature prevail?
These shows are dictated to and transcribed by machines, and hurriedly edited by a human. Apologies for the minor typos and grammar flaws.
Recent natural disasters have started to show how delicate the web of technology that holds the world together actually is, reckons Kulturpop’s Matt Armitage. But what if those natural disasters were followed up by cyberattacks from a hostile nation? On that happy note, it’s time to ask Matt to explain.
Where are we starting, natural disasters or cyber-attacks?
· This is one of those weeks where a bunch of stuff comes together.
· Listened to a recent episode of the 99% invisible podcast earlier this week which focused on Puerto Rico’s electricity grid.
· I know that might not sound fascinating, but it was.
· The podcast is adapted from a longform article in wired magazine about the year long struggle to get Puerto Rico’s electricity grid back online after Hurricane Maria last year.
· We’re facing increasing numbers of extreme weather events and natural disasters. The recent earthquake in Indonesia. Flooding in Italy, which affected your recent trip, to name some of what’s happening.
Is it climate change?
· Honestly, I don’t want to bang that drum.
· I think it is but that’s not the purpose of the podcast.
· So I don’t want people to switch off because they don’t believe my take on things.
· Today is about our infrastructure and how delicate it is and how we take so much for granted.
Let’s start with Puerto Rico
· Ok. We’ve heard a lot over the past couple of years about how easy it has been to hack into electricity grids and other critical infrastructure projects.
· Now, it is perfectly possible to imagine parts of a grid being ruined. Turbines in a power plant being run in a way that might physically damage them, that kind of thing.
· But most plant has physical overrides. You could potentially send surges down individual lines that might damage them or upset substations downline.
· But from what I understand, most hacking of these systems is for short terms disruption. Days, weeks, months if they get really lucky.
It’s the command and control mechanisms rather than the infrastructure itself?
· Exactly. It isn’t bringing the towers or the cables down.
· Water pipes aren’t collapsing.
· But weather events are causing that kind of damage.
· So we’re seeing this non-fortuitous convergence of conditions.
· At a time when we’re increasingly putting these systems online and trusting them to automated control systems…
· We’re in this situation of growing geopolitical uncertainty where countries are increasingly prepared to meddle in one another’s affairs
· And the planet is having its own series of wobbles in terms of extreme weather events and natural disasters.
You see the potential for the two to collide? For, say, a hurricane to be followed by a hacking operation?
· When we say phrases like cyber war, it can feel a bit remote.
· We think of wars as being something out in the open.
· Country a declares war on country B and they start throwing missiles at each other.
· There are battle plans and there are goals. Such as winning territory.
· But the current reality is a lot more nuanced. Cyber warfare has an economic edge as well as a political one.
· That’s not new – war has always been about money and power – but the more information we put online, the more that data can be weaponised, both for and against the people who are on our team.
Can we tell who’s on our team anymore?
· That’s a really good question.
· One of the things that come out of the Jamal Khashoggi disappearance and murder in Turkey is the extent to which Turkish security services had the Saudis under surveillance.
· Obviously, their surveillance capabilities were far greater than the Saudis assumed.
· Turkey is still being coy, releasing a steady drip feed of information, but it seems likely that there were listening and possibly video recording devices inside the Saudi Consul in Istanbul, and possibly inside the Consul General’s home too.
· And either the Saudis were communicating on unsecured telephone lines or Turkish security services had compromised those too.
· Turkey and SA are rivals in that region, with competing visions of how its future should be shaped, so you would expect them to be conducting surveillance on each other.
You mentioned that this kind of warfare is more nuanced…
· I’ve read quite a lot of reports by Technology and defence analysts over the past couple of years that make a case that the superpowers are in a state of continuous cold cyber war.
· And it’s really hard sometimes to figure our friend from foe.
· Especially when it comes to industrial espionage.
· We often hear that phrase ‘dual use technology’ used to put blanket bans or sanctions on certain types of product or technology.
· The most obvious example is the centrifuges that can be used to refine radioactive materials into a more fissile and weaponisable form.
This is where you remind us that all technology has multiple uses…
· Exactly. I’m not going to use my fork example today.
· I have been Watching a lot of violent TV shows the last couple weeks. Which always makes me very happy.
· So let’s look at the life-saving power of a tourniquet.
· Where would The Walking Dead be without tourniquets.
· But equally I’ve seen shows recently where those same strips of clothing or twine have been used as garottes to strangle people.
· Sorry if it’s getting gruesome…
· That same simple piece of technology can end a life or save a life.
· Or a car – you can use it to take an injured person to hospital, or you can use it to ram and kill and injure someone.
· Same device: life-saving and life-taking.
We’re a long way from Puerto Rico right now…
· I’m getting there.
· Was I said, when we talk about cyber war we think about strategic goals.
· But what if the goal is a simpler one: no open conflict, just constant attempts to make your enemies weaker.
· You steal as much patented technology as you can and feed it into your own industries and research institutes.
· You mess around with infrastructure to cause disruption and delay.
So it doesn’t have to be sustained or extensive?
· It doesn’t have to be much – jamming signalling gear on public transport during rush hour for example.
· Switching off sensors or monitors in a water plant. Even small contamination events can disrupt water supplies for days.
· Minor but frequent stuff that spread chaos and reduce public confidence in the people and institutions that govern the country.
· Things that are very hard to distinguish from the normal type of mechanical malfunction or human error events we typically experience.
And you think that natural disasters can provide cover for this kind of attack?
· We’re looking at a lot of cyber attacks being opportunity driven.
· When the goal is chaos,
· One of the most interesting things about the probes in recent elections worldwide is that by and large they haven’t favoured a particular side.
· Yes, right wing candidates have often benefited, but the goal is often much simpler than regime change.
· It’s discord. You aren’t going to spend so much time looking at what I’m doing, if you’re too busy bickering amongst yourselves.
· Coming back round to Puerto Rico, this is purely what can happen in a natural disaster.
· This is about how long it can take an advanced society to recover from weather impacts without even thinking about that additional threat of cyber assault.
I’m glad we’ve finally reached Caribbean. This has been a really long flight.
· It’s not a bad analogy.
· People often look like they’re suffering from jet lag after an hour in my company.
· When Hurricane Maria hit PR in September 2017, it was the third and most devastating of a series of storms that had battered the island in previous months.
· The island’s under-funded and under-resourced utility industries were still in the process of repairing the damage from previous storms.
· And the island has a slightly weird anomaly – most of the power is generated in the south of the island.
· Most of the people live in the north.
· Across the centre is a ridge of mountains.
Which means that all the cables and towers have to go up and over the mountains?
· And Hurricane Maria knocked a big chunk of them out.
· In Malaysia, we get local power outages reasonably often.
· I’m only speaking anecdotally here, but whenever a storm knocks the power out where I live, we’re usually reconnected within a handful of hours.
· And let’s not forget, Malaysia experiences pretty wild weather as a matter of course.
· We get strong winds and rain on a regular basis.
· So as much as we complain about the utility companies, the infrastructure here is pretty robust.
But then it doesn’t have to stand up to hurricanes and typhoons and earthquakes…
· Exactly. Do you remember a few years ago when a fishing trawler severed one of the undersea Internet cables that connected much of South East Asia to that part of the Internet in the West?
· I think it was somewhere out near Taiwan.
· We experienced broadband outages or massively reduced speeds for over a week.
· That was to repair one cable. Admittedly, in the middle of the ocean.
· Puerto Rico had pretty much its entire electricity infrastructure knocked out.
· And despite it being a part of the USA, or at least a protectorate, it took a year to get everyone back on the grid.
When we come back, we stay on the ground in Puerto Rico before heading off to space.
Before the break we were looking at the damage that natural disasters can do to our modern way of life, and how those disasters can be hijacked or exacerbated by cyber war.
Let’s reiterate. Puerto Rico wasn’t under cyber attack.
· No. It didn’t need to be.
· Infrastructure is a little like dominoes.
· The hurricane damaged property, ravaged entire cities and villages, blocked or swept away roads.
· Tens of thousands were made homeless.
· Water supplies and sewage were disrupted.
· Food distribution was hampered.
· And the island went dark.
Unless you had your own generator?
· Obviously, many people had their own but generators are only useful as long as you have fuel.
· Roads have to be clear to transport petrol and diesel.
· Puerto Rico was a bit like a microcosm of what could go wrong in a modern society.
· In order to get the power on you have to clear roads.
· To clear roads you need fuel. To get fuel you need clear roads.
Without power there are no communications…
· We totally forget what happens when the power goes out.
· For starters, you can’t charge your phone.
· Secondly, there’s no electricity powering the telco towers.
· Many of them have back up systems or generators, but that fix requires regular maintenance which relies on cleared roads and availability of fuel.
· No phone calls, internet, texts or WA.
· Walkie talkies will only work as long as you can keep them powered.
· It’s funny how in shows like TWD and FTWS, characters keep finding walkies years after the apocalypse that still have a charge in the batteries.
Hospitals can’t function, either…
· These are other things we forget about disasters. The enormous pressure they place on health services.
· You have people who are injured in the storm itself.
· You have people with existing medical conditions whose situations are worsened by inadequate housing and poor sanitation.
· Babies struggling to cope with the heat because there are no fans or air conditioning.
· If roads are blocked, or ambulances don’t have fuel, then people can’t get to the hospital.
· Minor conditions become major ones.
· A lot of modern medications and drugs need to be refrigerated.
· On top of which, you have no power or insufficient power.
· So you face that heart breaking and brutal decision to prioritise some patients over others.
And I guess people can’t get to work…
· Manpower shortages were a chronic issue in Puerto Rico.
· Look at KL. How many of us live near where we work?
· Block the roads and we can’t get there.
· Fine, if you’re a barista or a radio producer.
· The world isn’t going to end.
· What if you’re a surgeon? Or a water engineer? Or an ambulance driver? Or a fisherman or farmer?
· If you can’t get to work then you can’t help. This is the kind of situation where being a short order cook in a diner can really have an impact on people’s lives.
· If you’re not cooking, people may not be eating.
And if you aren’t working, you aren’t earning.
· That’s another factor.
· In developed countries we take on increasing amounts of debt.
· Our savings will generally only cover us for a few weeks.
· Imagine facing mortgage payments for a house
· And we’re used to electronic payment systems.
· How many of us now pay for stuff like a bottle of water with a card or an e-wallet?
· In a disaster, all those payment systems will be offline too.
There are worse things than waiting in line at the bank for cash.
· If you can get to a branch that can actually open.
· Where staff can make it in.
· Where that branch has power and an Internet connection to check your balance.
· Where that branch can actually be stocked and supplied with cash.
· Things are bad enough with nature in the mix.
· Throw in some DDOS attacks on news and government information sites, a bit of radio jamming, or even some spoof broadcasts on radio, TV or Net channels and you have the recipe for chaos.
Still, a year to get the lights back on is a long time.
· Of course, it was a gradual thing. Power came back in stages.
· Some towns formed their own power teams, repairing poles and lines themselves, coordinating with the utility companies to hook them into the grid.
· Other towns were helped by NGOs specialising in solar power, so they were able to meet basic needs while the repairs to the grid caught up to them.
· In fact the Wired piece and the 99 PI show both mention how Hurricane Maria defied some of our darker predictions.
That we’ll be eating our neighbours’ kids after 3 days without power?
· Yeah, in my case the neighbour kids will have been turned into cat food after the first gust of wind.
· I think this is my favourite part of the story.
· PR didn’t descend into chaos.
· People were short of food and water and medicine.
· But they helped each other out.
Like volunteering for rescue and salvage teams?
· And not just for a few days. Some of the projects took weeks and months.
· People went above and beyond.
· For example, back to the island’s power company, Prepa, it was underfunded and understaffed.
· It had no social media presence and no real way to inform the public what was happening.
· So it fell to company employees like Jorge Bracero to start posting raw data about what they were doing at work, explaining why things took so long, what challenges they were facing.
I think we sometimes take for granted how difficult it is to repair things.
· One of the things we’ve definitely lost sight of is how to be patient.
· A couple of months ago there were repairs to the water treatment plant in my area and we were without water for a couple of days.
· We hadn’t stocked up because we don’t really read local news so much anymore.
· We don’t get newspapers. It was doubly unpleasant as I had a stomach upset but we eked out the water in our tank.
· But the day the water was supposed to come back on, I was rushing around like an idiot, turning the taps on every few minutes to see if any H2O was surging its way through the pipes.
Because in a smartphone world, you fix everything by rebooting it.
· Exactly, so it took people like Bracero to point out that you had to hike into the mountains with heavy equipment to get to some of these towers.
· If you were lucky you could maybe get a 4WD up there, if the roads and paths weren’t swamped with fallen trees or eroded by landslides.
· In one video Bracero posted a worker balancing on the skid of a helicopter to try and repair a cable.
· Bracero himself was running a three-storey boiler, running up and down.
· If the turbines tripped out, it could take him an entire shift to get the boiler back online.
· These were dirty, dangerous jobs done with little thanks in fairly unpleasant conditions.
What should the world have learned from Puerto Rico, or any of this year’s natural disasters?
· That for all the devastation and death and misery, what happened in PR, or the Carolinas or Indonesia this year.
· Those were imperfect storms.
· Those places were all decimated by what nature threw at them but they weren’t under attack.
· No one was actively trying to make those situations worse.
· But they could have done, potentially quite easily.
· Some dark Facebook posts about minorities and terrorists being smuggled in under cover of the disaster.
· Rumours that FEMA’s rescue centers were concentration camps for the UN.
· All that kind of nonsense. Add to that underfunded companies like Prepa and you have the wrong kind of recipe bubbling up.
It’s strange to look at how fragile our way of life is.
· We take so much for granted.
· There’s always someone who’ll tell you something like that couldn’t happen here.
· And next week you see their office disappear into a sinkhole.
· Back to your statement: you’ll hear people say that we live on a fragile planet.
· We don’t: we live on a very robust planet that has a fragile ecosystem.
· The biggest problem is that we live an even more fragile and perilous existence within that ecosystem.
· And we are chaining ourselves to ever more fragile systems.
So we should all pack a bug-out bag, start prepping for the apocalypse and eat the neighbours’s kids?
· You know my brother in law is one of your neighbours right?
· I can get probably get you his kids, freezer prepped.
· I don’t think we should be preparing for disaster in that way.
· We have to make our societies and communities more robust.
· We’ve outline a natural disaster and the instability that comes as result.
· A perfect storm, where you have nature and a concerted cyber assault doing their worst.
· That state of instability being extended almost indefinitely.
· Hardware might be repaired but the command and control systems might remain offline.
· Or, command signals could be rewritten or delayed as parts of the network were brought back into operation, tripping them out or damaging components.
You think we should give more thought to the kind of systems we install?
· We need to pay more attention to cyber security.
· We should be looking at which systems we wire up to one another.
· It’s great to pool data but are you just building a massive highway to let hackers take over everything.
· And we should be looking at systems like electricity and water as though it’s inevitable that they will get hit by a storm, or a flood or an earthquake.
· As we move into an area where the climate is less stable, we should be paying more attention to the structure of our infrastructure.
· We should be designing it in ways that it can continue with parts knocked out.
· We should be looking at ways for those sections to be repaired and brought online more easily.
· And we need to figure out how much it’s all going to cost.
· I love Netflix. I spend hours watching cat videos on Instagram.
· I have no intention of spending the twilight of my years in a cave eating 20 years old tins of cat food.