Since the invention of the first computer-assisted industrial control system (ICS) device over 40 years ago, both the technical and national security communities have voiced concerns about software and hardware vulnerabilities and potential security risks associated with these devices. Such concerns have generally involved the infiltration of a computer system for purposes of degrading its capabilities, manipulating data, or using the device to launch cyber attacks on other systems. The Stuxnet worm, which was first reported in June 2010 by a security firm in Belarus, appears to be the first malicious software (malware) designed specifically to attack a particular type of ICS: one that controls nuclear plants, whether for power or uranium enrichment. The malware attacks and disrupts a Microsoft Windows-based application that is employed by a particular ICS produced by the German company Siemens. The worm can be spread through an air-gapped network by a removable device, such as a thumb drive, and possibly through computers connected to the Internet, and it is often capable of remaining hidden from detection. It is difficult to determine the geographic origin of the malware, as cyber attackers often employ sophisticated methods such as peer-to-peer networking or spoofing IP addresses to obviate attribution. Likewise, malware placed on a removable device may contain no signatures that would identify its author. Some security analysts speculate that Stuxnet could have been developed by a Siemens insider who had direct access and knowledge of the system; others contend that the code's sophistication suggests that a nation state was behind the worm's development, either through proxy computer specialists or a government's own internal government and military capabilities. To date, numerous countries are known to have been affected by the Stuxnet worm to varying degrees of disruption in their technology systems. These include Iran, Indonesia, India, Pakistan, Germany, China, and the United States. A lack of publicly available information on the damage caused by Stuxnet in these countries makes it difficult to determine the malware's potency. In attempting to assess the Stuxnet worm's potential targets and ascertain how best to identify and slow progress of its spread to other ICSs, numerous researchers have speculated as to the identity of the software code's developer. To date, no country or group has claimed responsibility for developing what has been termed by some as "the world's first precision guided cybermunition." Given the Stuxnet worm's reported technical sophistication, numerous researchers and media outlets have speculated that a government most likely produced it. According to these accounts, the developer had to be financially well resourced, employ a variety of skill sets (including expertise in multiple technology areas), have an existing foreign intelligence capability in order to gain access and knowledge of a foreign system, and be able to discretely test the worm in a laboratory setting. Moreover, states appear to possess a motive to develop Stuxnet because, unlike other forms of malware, the worm is not designed to steal information, but rather to target and disrupt control systems and disable operations. Countries thought to have the expertise and motivation of developing the Stuxnet worm include the United States, Israel, United Kingdom, Russia, China, and France. In addition to speculating on the developer's identity, observers have formulated theories about the worm's intended purpose. For example, some argue that Stuxnet's developer may not have intended the worm to spread beyond its desired target, thus bringing unwarranted attention to this emerging cyber capability. Furthermore, it is likely the developer did not consider the unintended consequence of the worm becoming widely available and subject to manipulation to make it less identifiable and more potent. A terrorist organization intent on carrying out attacks on a nation's critical infrastructure may also be interested in targeting a type of ICS known as supervisory control and data acquisition (SCADA) systems. It is widely believed that terrorist organizations do not currently possess the capability or have made the necessary arrangements with technically savvy organizations to develop a Stuxnet-type worm. However, the level of attention the Stuxnet worm has received creates a possible proliferation problem and what some have termed a "cyber arms race." The Stuxnet code itself is now freely available on the Internet, as are the particular vulnerabilities it exploits, as well as the web addresses of unsecured SCADA systems. As software developers often revise and reformulate existing code, Stuxnet's design revelations may make it easier for terrorist organizations to develop such capabilities in the future. Melissa Hathaway, former acting senior director for cyberspace for the National Security and Homeland Security Councils, was recently quoted as saying, "Proliferation [of cyber weapons] is a real problem, and no country is prepared to deal with it. All of these [computer security] guys are scared to death. We have about 90 days to fix this [new vulnerability] before some hacker begins using it." It is also worth noting that, in the future, a non-state actor may not necessarily need to possess the Stuxnet code in order to use the worm. Cybercrime organizations have been said to "rent" networks of infected computers, known as "botnets," for use in politically motivated cyber attacks on government websites and computer networks. It may become possible for organizations to develop and either rent or sell malware such as Stuxnet or access to infected computers for malicious use against government or civilian infrastructure. In addressing concerns about threats emanating from cyberspace from a variety of potential actors, Deputy Defense Secretary William J. Lynn III noted, "Once the province of nations, the ability to destroy via cyber means now also rests in the hands of small groups and individuals: from terrorist groups to organized crime, hackers to industrial spies to foreign intelligence services." Early reports indicated that the intended target of Stuxnet may have been SCADA-controlled nuclear facilities in Iran that used the Siemens product. If a country developed Stuxnet and the target was a single country's infrastructure, the worm's spread to multiple countries has implications for the lack of precision targeting of cyber weapons, their unknown secondary and tertiary effects, and for the rules of engagement for responding to a cyber attack. Iran has apparently suffered the most attacks by the Stuxnet worm and, as noted, may well have been its main target. A September 2010 study by Symantec argued that the "concentration of infections in Iran likely indicates that this was the initial target for infections and was where infections were initially seeded." As of September 25, 2010, Iran had identified "the IP addresses of 30,000 industrial computer systems" that had been infected by Stuxnet, according to Mahmoud Liaii, director of the Information Technology Council of Iran's Industries and Mines Ministry, who argued that the virus "is designed to transfer data about production lines from our industrial plants" to locations outside of Iran. Iranian officials have indicated that the worm infected computers associated with the country's nuclear power plant under construction near Bushehr. Dr. Mohammad Ahmadian, an Iranian Atomic Energy Organization official, stated in October that the worm may have been transferred to computers at the reactor site via "CDs and Flash memory sticks," adding that the affected computers have since been "inspected and cleaned up." Some of those responsible for transferring the worm were "foreign experts who had been frequenting industrial centres," Iran's minister of communication Reza Taqipur stated in October. Iranian officials have indicated that the reactor, which is not yet operational, has not been affected by Stuxnet. Olga Tsyleva, press-secretary of the Atomstroyeksport, the Russian contractor for the Bushehr project, confirmed October 5, 2010, that the worm had spread to the Bushehr facility's computers but had not caused any damage. In addition to Liaii's description of Stuxnet's purpose, reports of the Stuxnet infections in Iran have, as noted, fueled speculation that the virus was part of an effort by some countries, including the United States and Israel, to sabotage Tehran's nuclear programs. In addition to the Bushehr reactor, Iran has constructed both a pilot and a commercial gas centrifuge-based uranium enrichment facility near Natanz. Tehran continues enrichment operations at the Natanz facilities, according to a November 23, 2010, report by International Atomic Energy Agency Director-General Yukiya Amano. Uranium enrichment can produce fuel for nuclear reactors, but can also produce fissile material for use in nuclear weapons. Iran's uranium enrichment facilities seem to be a more likely target for a cyber attack than does the Bushehr reactor. Mark Fitzpatrick, former acting Deputy Assistant Secretary of State for Non-proliferation, argued in September that such an attack would not make sense because the reactor is not a prime proliferation concern, the Financial Times reported. Iranian officials have themselves indicated that the Bushehr reactor may not have been the worm's only target. For example, an October 5 statement from Iran's Foreign Ministry spokesman Ramin Mehmanparast appeared to reference Iran's uranium enrichment program. Moreover, Ali Akbar Salehi, the head of Iran's Atomic Energy Organization, suggested September 29 that "enemies" had attempted to infect nuclear facilities other than Bushehr. More recently, some experts have argued that, because Stuxnet was designed to manipulate equipment used in centrifuge facilities, the worm may have been developed to sabotage Iran's enrichment plant. Whether the Natanz facility contains Siemens components that would be affected by the virus is unclear. The presence of such components in the Bushehr reactor appears to be more likely because Siemens originally worked on the project. Stuxnet's impact on Iran's nuclear facilities is unclear. Although, as noted, some Iranian officials have stated that the Bushehr reactor was not affected, some accounts suggest that the malicious software may have slowed down or disabled operations at Iran's enrichment facilities.