## 2 Cyber-Weapons  
To appreciate the impact of Stuxnet on the development of destructive ICS cyber-weapons, it is necessary to look at what ICS weapons had already been developed and deployed. If Stuxnet were merely an incremental improvement over previous weapons, it would not qualify as a game changer in this area. Prior to Stuxnet, the most sophisticated and damaging cyber-attack against an ICS was commonly regarded as the months-long attack launched by [PERSON] against the Maroochy Shire Council sewerage control system in Queensland, Australia in 2000. A former employee of the contracting company that developed the system, the 48-year-old Australian used equipment and software he had taken from the company in order access the ICS network and alter data. His attack caused pumps to malfunction and alarms to turn off, resulting in raw sewage overflows that killed marine life and harmed the environment [7]. While not to diminish the seriousness of [PERSON]'s attack, it was nonetheless considerably less sophisticated than Stuxnet in at least three areas: access, command and control, and stealth. With respect to access, because the network controlling the centrifuges at Natanz was not remotely accessible or even connected to the Internet, Stuxnet was deployed in the form of a complex computer worm that spread across Microsoft Windows machines via USB memory sticks and local network links, exploiting several unknown (\"zero-day\") vulnerabilities in the systems it hit and using fraudulent digital certificates to trick the systems into running its code [4]. As it spread, it had to examine the hardware, software, and settings of each system to determine if they matched those at Natanz, unleashing its payload only when they did. By contrast, [PERSON]'s equipment gave him immediate and direct access to his target. Second, with respect to command and control, Stuxnet needed to operate autonomously, with its commands and data wired into the code, although it also had the capability to receive new code over the Internet if so connected. [PERSON], on the other hand, was able to issue commands directly from a laptop, without the need to preprogram his entire operation. Thus, while Stuxnet's authors needed to get it right the first time, [PERSON] had the opportunity to try things out and adjust his tactics. Further, whereas much of Stuxnet's code had to be developed from scratch and carefully crafted so as to recognize its intended target, [PERSON] was able to use code he had taken from the contracting company and apply it directly against his target. Third, with respect to stealth, Stuxnet needed to conceal its presence long enough to cause the desired damage. It did this by hiding its code and effects, leading network operators at Natanz to believe that the centrifuges were operating normally, even as they were being manipulated in harmful ways. [PERSON], by contrast, did little to hide his actions. Operators monitoring the network were aware of the problems he was causing, but initially did not know their source. There have been reports of cyber-attacks affecting other ICS devices, including those operating electric power grids, but I have not seen any information suggesting that any of these attacks was at the level of Stuxnet. At Idaho National Labs, researchers demonstrated how a cyber-attack could cause a power generator to self-destruct [8], but neither code nor details were released, making it difficult to compare with Stuxnet. Nevertheless, it seems unlikely that the code would have been as complex as Stuxnet, as it did not have to spread, recognize its target, or hide its presence and effects over an extended period of time. Thus, it seems reasonable to say that Stuxnet represented a considerable advance over previous cyber-attacks or demonstrations against ICSs. As a cyber-weapon, it was a major innovation. Still, for Stuxnet to be a game changer, it has to make a noticeable mark on the future. This might happen through two avenues.