The clearest sign yet that I am getting old is that two friends, in the space of a month, have texted me excitedly about their washing machines. Specifically, that each now has an app from which they can “watch” their laundry’s progress.
What utility this serves is not entirely clear to me. But what is becoming far more obvious is that the “internet of everything” – in which our cookers, fridges, cars and doorbells were connected to, and controlled from, servers in far-flung places – was never a good idea. I first had an inkling of this years ago, when a friend who worked in nuclear non-proliferation for the government got rid of his smartphone and moved to cash banking after being hacked a few too many times.
And this week we are beginning to understand what happens when the everything-is-connected model releases its sequel: everything-is-hackable.
On Monday morning, the Musgrave group, which owns Supervalu, announced that a “cyber incident” had hit the refrigeration systems in 13 of its Irish shops. As a result, fridge and freezer temperatures rose, meaning all chilled and frozen stock had to be removed in case it spoiled. It also impacted fridges in Belgian branches of Carrefour, Intermarché and Ikea; the Coop and ICA chains in Sweden; the Delhaize group in Luxembourg; Kesko in Finland and some shops in Estonia.
READ MORE
The head of the Belgian firm that runs Delhaize’s cooling systems stated that somebody got in remotely and switched the evaporators to defrost. This happened only three weeks after similar issues in France, where hackers seized the cold-chain controllers in roughly 700 of the country’s 10,000 supermarkets.
[ SuperValu says issues after cyberattack on its fridge systems ‘fully resolved’Opens in new window ]
The reason a fridge in Lucan can be turned into a radiator from anywhere on Earth is precisely the reason my middle-aged friends can watch their spin cycle from the pub. The fact that there was no financial incentive pointed to sabotage – undermining swathes of Europe’s confidence in their food security systems is an effective weapon. So who did it? Were Irish fridges hacked by state actors in Russia? Ukraine? Israel? China? North Korea? Or a bored 17-year-old in rural Ireland who found an unpatched controller on a search engine for exposed devices?
We don’t know. We are in what security experts call the “grey zone” – the liminal space between peace and war where aggression is deniable and incremental, and we may never be certain that it happened at all. While we often still think about the world in terms of the old model of security, in which threats were black and white – where tanks cross borders and everyone knows who is to blame – the grey zone works in much more complex ways.
Increasingly, grey-zone aggression forces us to ask not just “who did this to our supermarkets?” or “who was behind the bomb threat?” but whether anything real was at risk of happening at all. The advantage of sub-threshold aggression is that while the damage is concrete, the attack is almost impossible to see or understand clearly.
This week’s fridges were not the only example. Hoax bomb threats disrupted at least 27 flights across Europe, with an Aer Lingus Dublin–Rome service diverted by fighter jets to a French military airbase.
Staff at RTÉ, Newstalk and Mediahuis were evacuated on Friday morning following several security alerts. At RTÉ, staff got an email shortly after 9am claiming to be from the group behind the plane threats, which said a bomb would go off within 40 minutes.
A generic email, costing nothing, was able to scramble military jets, ground aircraft, put an armed response unit outside the national broadcaster, take Newstalk off air and consume Garda and ministerial attention – right before 55 heads of state arrive in Dublin for the European Political Community summit.
We probably won’t ever know who disrupted Ireland’s supermarkets, flights or media outlets – or be able to ensure that it can’t happen again. This is a disconcerting prospect. But increasingly, this is what adversarial hostility looks like: private actors doing the dirty work of states, at more than arm’s length from the unknown governments that will benefit from it.
This makes it extremely hard for governments to respond, because almost all of the contemporary legal and institutional frameworks in security and defence are written around a binary world of “war” and “not-at-war”. For example, Nato’s Article 5 needs an armed attack before a formal collective obligation response can be made. And for Ireland, even our neutrality needs actual belligerents to be neutral between.
What happens, then, if there is no bad guy? If a private company in a foreign state creates a, say, €50 million impact on a country’s food supply by breaking into a refrigeration contractor’s login, or takes media outlets off air, is this a crime, an attack, a regulatory failure or an act of war? Right now, it could be all of them, which ironically means it’s none of them – making a decisive response by the Government nearly impossible.
Just as cheap drones completely disrupted the economics of war, today’s grey zone security environment is disrupting the institutions and legalities of war.
And while most countries are struggling to adapt their binary institutions to the complexities of the grey zone landscape, Ireland is grappling with the fundamentals of the most basic national defence. The National Security Strategy, which was supposed to be delivered in 2021, has still not appeared. We spend around only 0.2 per cent of GDP on defence. And even if our spending is not necessarily a good assessment of whether or not we have the correct capabilities, it does demonstrate the small size of our commitment to the topic.
Ireland, which holds the EU presidency, is home to significant infrastructure that forms the bedrock of the global digital economy. It is also one of the economies in Europe most dependent on the tech companies defining the future of war. The strategic infrastructure that drives our budgets was built without creating the architecture of national security that is needed to protect it. In short, if you designed a country to most dangerously blur the lines between “crime” and “war”, you would struggle to design an example better than Ireland.
[ AI agents are hacking government agencies. It’s ‘really scary’ for cybersecurityOpens in new window ]
We have a long road ahead of us in learning how to respond to everything from hacked fridges to hoax bomb threats to espionage.
The challenge for Ireland is that responsibility for national security is fragmented across institutions, with no clear architecture for sharing intelligence, attributing threats or co-ordinating a response. We need to establish who is in charge, who has the authority to act and how the Defence Forces, intelligence and law enforcement agencies, government departments, regulators and infrastructure operators work together when threats fall between crime, espionage and warfare. At the very least, we need the most basic defence policy available: a unified strategy.
In the meantime, I’ll be leaving my washing machine offline. It only has one job to do, and getting a notification that it’s halfway through a spin cycle won’t make the next half go any faster.
[ Stop the bots: Six key steps to securing your smart homeOpens in new window ]
