Cyber War: Sabotaging the System

60 Minutes: Former Chief of National Intelligence Says U.S. Unprepared for Cyber Attacks

CBS All Access
This video is available on CBS All Access
At the Sandia National Laboratories, Department of Energy security specialists like John Mulder try to hack into computer systems of power and water companies, and other sensitive targets in order to figure out the best way to sabotage them.

It's all done with the companies' permission in order to identify vulnerabilities.

In one test, they simulated how they could have destroyed an oil refinery by sending out code that caused a crucial component to overheat.

"The first thing you would do is turn it to manual controls so that your automatic controls aren't protecting you," Mulder explained.

Asked what the main target would be, Mulder said, "The heating element and the re-circulator pump. If we could malfunction both of those we could cause an explosion."

"How would you do that?" Kroft asked.

"The first thing we had to do was actually gain access to the network and that's, we just got that as launch attack. And then we turn up the BTUs, and then we're turning off the re-circulator pump. There we go," Mulder said.

Mulder said this type is simulation is "very" realistic.

But the companies are under no obligation to fix the vulnerabilities, which was graphically demonstrated in a much more realistic fashion at the Idaho National Labs two years ago in a project called "Aurora."

A group of scientists and engineers at the Department of Energy facility wanted to see if they could physically blow up and permanently disable a 27-ton power generator using the Internet.

"If you can hack into that control system, you can instruct the machine to tear itself apart. And that's what the Aurora test was. And if you've seen the video, it's kind of interesting, 'cause the machine starts to shudder. You know, it's clearly shaking. And smoke starts to come out. It destroys itself," Jim Lewis explained.

Asked what the real-world consequences of this would be, Lewis said, "The big generators that we depend on for electrical power are one, expensive, two, no longer made in the U.S., and three, require a lead time of three or four months to order them. So, it's not like if we break one, we can go down to the hardware store and get a replacement. If somebody really thought about this, they could knock a generator out, they could knock a power plant out for months. And that's the real consequence."