The Column – Cyber Security Week
Many years ago, almost a decade now, I created a video presenting an information journey dedicated to the risks of the information society. It was called Like fish in a net (you can find it here) and concluded with a rather singular promise: «Finally, we will show you a way in which your worst enemy could become your home refrigerator». I imagine someone smiled at the time. After all, attributing hostile intentions to an appliance intended for storing milk and yogurt might seem like an exercise in imagination. Today, reading the news coming from France, that ending came back to my mind. With a certain intellectual satisfaction, accompanied by a decidedly greater dose of concern. Beyond the Alps, hundreds of supermarkets have been involved in cyber attacks on the systems that control refrigeration systems. The most conservative reconstructions speak of over 350 businesses, while others reach around 700. We are not talking about the home refrigerator, but about industrial equipment that must guarantee the correct preservation of food. The difference is significant, but the principle remains identical: machines that perform physical functions are governed through computer systems accessible remotely. When someone manages to compromise them, the consequences can go off the screen and materialize in the real world and this is the first issue that, evidently, we still struggle to understand.
The second is even more interesting. According to what emerged, numerous devices involved were using obsolete software or had reached the end of their technological life cycle. In essence, they continued to do their job as refrigerators very well, but they were no longer adequately protected and here one of the most singular contradictions of digitalization manifests itself. An industrial machine can work for twenty years, while the software that governs it can become vulnerable much earlier. The owner sees an efficient system, the cybercriminal an open door. Both are right, but only one of them risks paying the consequences.
As if that weren’t enough, it appears that the compromises affected technologies from different manufacturers. This suggests that the problem may not lie in a single vulnerability, but in the ways in which the systems are managed. Supermarkets purchase refrigeration services from specialist companies, who install, check and maintain the equipment, often via remote connections. A reasonable choice from an economic and operational point of view. However, at this point a consideration arises spontaneously: if I entrust the house keys to a maintenance worker, I normally want to know who owns them, how many copies exist and what happens when the relationship ends. In the digital world this elementary prudence seems to become a luxury.
Of course, investigations are still ongoing and we don’t know for sure which vulnerabilities were exploited, nor whether the attackers retained hidden access to the systems. It would therefore be premature to distribute responsibility or formulate definitive reconstructions. However, what has already emerged is enough to reiterate a question that I have been insisting on for years. We’ve built a world where almost any object can communicate with anything else, but we continue to think about security as if it were only about computers, passwords, and personal data. We worry about someone reading our email, much less changing the behavior of a machine on which an essential business depends. It is a form of technological myopia that has been with us for too long.
In the old video I argued that humans are biologically unsuited to the digital world. Our species has learned to recognize danger when it sees a lion, smells burning or finds its front door forced open. However, it does not have any instinct capable of signaling that an industrial controller connected to the Internet, perhaps with software that has not been updated for years, represents a threat. This requires knowledge, organization and above all responsibility. Not necessarily new technologies, but people capable of deciding who should deal with it, how and with what controls. Ultimately, it’s about governing what we’ve built, rather than just admiring how it works.
When I imagined the refrigerator transformed into our worst enemy, I certainly didn’t think that it would develop a particular dislike for its owner. I wanted to show how a seemingly harmless object could become dangerous precisely thanks to those characteristics that made it more useful and the French story confirms that the question was not that imaginative after all. The real problem, however, does not concern the refrigerator, which continues to do what it was built for, but rather us, who have had years to understand the consequences of our technological choices. In summary: we imagined the future, but we forgot to prepare.
