A Squirrelly Argument Regarding Critical Infrastructure And Our Resilience In The Face Of Attacks

THE NATIONAL SECURITY COMMUNITY TENDS TO ATTRACT DOOMSDAY TYPES, WHILE THE UTILITIES SECTOR TENDS TO ATTRACT PRETERNATURALLY CALM ENGINEER TYPES - GO FIGURE! That's the just the nature of their respective businesses, so no big surprise that, when national security officials highlight the hacking threat to critical infrastructures (most frequently, electrical grids), plenty of practitioners in the utilities arena counter that "alarmism" with more prosaic examples of power outages - namely, those caused by rodents and birds. This is a classic argument between those who focus their professional attention on low-probability/high-impactevents (e.g., foreign military hackers attacking our critical infrastructure as a prelude to war-initiation) and those who must deal with high-probability/low-impact events - like a squirrel chewing through a wire and triggering a local blackout.

So, good on WAPO's The Switch column for running this story asking, "Are Squirrels a Bigger Threat to the Power Grid Than Hackers?" Yes, the use of the modifier "bigger" here is stunningly indiscrete (newspaper headlines tend to do that to pique your interest), but the author does provide a real-world threat "floor" to the notional threat "ceiling" routinely cited on WAPO's front page. On the latter score, I recall the near-constant drumbeat of fear-instigating stories (all presumably "leaked" by the Obama Administration), in the weeks leading up to the 2009 launching of US Cyber Command, about how seemingly everyone in the world was waging cyber-warfare against America, when, of course, we know full well that the U.S. Government itself is the preeminently offensive player in this arena - as it should be.

So, no, squirrels are not a "bigger threat." That's an idiotic notion (or - more politely - an imprecise notion). Significant cyber-warfare-capable nation-states and non-state actors are the bigger threat.  Squirrels are just the more common threat.

Another way to look at the difference: I am constantly subject to the common cold, but I still consider cancer to be the bigger threat to my health. Does that mean I ignore the cancer threat (lower probability but far higher impact) to focus more on the common cold? Hardly. Like everyone, I attempt to balance risk between the two.

I also most certainly do not discount the cancer threat merely because I find it stunningly hard to prevent my contracting the common cold on a regular basis, which is the implied argument here (Focus on real problems and don't believe the hype!). Wait long enough on today's national-security "hype" and eventually somebody nefarious will give that scenario a run for its money. And when they do?  The high-probability/low-impact skeptics will be nowhere to be found, while the public - and Congress - demands answers (and scapegoats) for this huge failure of national intelligence!