## 1 Introduction  
In fall 2010, not long after initial reports of Stuxnet hit the press, I began seeing headlines and stories declaring Stuxnet a game changer. In an article titled \"STUXNET--Game Changer,\" [PERSON], cyber-warfare correspondent for Defense Tech, said it represented a \"threshold level event\" and \"new model of reality\" [1]. The head of the Cybersecurity Center at the US Department of Homeland Security told Congress that it was a \"game changer\" [2], while the European Network and Information Security Agency characterized it as \"a game changer for malware defence\" [3].  
But if Stuxnet was a game changer, what changed?  
Like other computer worms, Stuxnet spread indiscriminately from one vulnerable computer to the next. What set it apart from the thousands of other worms that went before it is that it was designed to unleash its payload only when it entered an industrial control system (ICS) matching the characteristics of Iran's nuclear enrichment facility at Natanz. And when it did, it tampered with the code of the programmable logic controller (PLC) used to control the centrifuges at Natanz, ultimately destroying about a thousand centrifuges and disrupting Iran's nuclear program [4,5]. No previously reported worm had done anything like that before, either in terms of precision targeting or causing physical damage through ICS manipulation.  
Is Stuxnet a forefather of future cyber-weapons? Will we soon see a rash of attacks against ICS components and devices, which include Supervisory Control and Data Acquisition (SCADA) systems, as well as PLCs? These systems are used, for instance, to operate electric power grids, distribute oil and gas, and control water treatment systems and dams. Are they adequately protected against cyber-attacks? Will we witness cyber-attacks that go beyond the usual data theft and service disruption in order to cause serious physical damage against specific targets? Will cyber-terrorists use Stuxnet-like tools to cause nuclear explosions, shut down power grids, blow up gas lines, cause floods, or otherwise weak havoc?  
According to _The New York Times_, Stuxnet was developed and deployed by the United States and Israel [5,6]. Does this mean that cyber-attacks have become an instrument of national power, augmenting other forms of national power, especially military power? Is Stuxnet a sign that cyber-warfare is already here or on the brink? Did Stuxnet's exposure and analysis bring cyber-warfare from the closed world of spies and covert operations into the public sphere?  
This article addresses these and other questions in order to determine how Stuxnet has changed the ongoing game of cyber-attack _vs._ cyber-defense. The approach is contextual, taking into account how Stuxnet fits into or alters cyber-related trends.  
The paper first reviews trends in cyber-weapons. Because Stuxnet targeted an ICS in order to wreak physical damage, focus is on weapons that manipulate systems of that type and produce physical effects. The paper then examines how Stuxnet impacts various domains of action where cyber-attacks play a role, including state-level conflict, terrorism, activism, crime, and pranks. For each domain, it considers the potential for new types of cyber-attacks, especially attacks against an ICS, and whether such attacks would be consistent with other trends in the domain. Finally, the paper considers the effect of Stuxnet on cyber-defense.