Morgan Wright is Chief Security Advisor for the cybersecurity company SentinelOne
No phones. No internet. No satellites.
Oil tankers running aground. Planes falling out of the sky.
Flamingos in the swimming pool. Zombie deer in the backyard.
Chaos without explanation.
Netflix’s apocalyptic thriller ‘Leave the World Behind,’ starring Julia Roberts, Mahershala Ali and Ethan Hawke is based on a book by Rumaan Alam and it has terrified U.S. audiences.
The film portrays a modern world in collapse. An unknown phenomenon – a foreign cyberattack, interstellar force or global cabal – knocks out vital U.S. infrastructure and, for some unexplained purpose, plunges America into a nightmare.
Barack Obama’s production company is behind the movie, and its director says the former president ‘was able to ground me a little bit on how things might unfold in reality.’
Does this dystopia have the stamp of presidential approval? Could any of this really happen?
In short, yes.
I should know. I’ve studied attacks aimed at creating real world chaos (minus the flamingos, of course), as the senior law enforcement advisor for the 2012 Republican National Convention.
As a former senior advisor in the U.S. State Department Antiterrorism Assistance Program, part of my mission was to help partner countries defend their own critical infrastructures.
Now, as the Chief Security Advisor for cybersecurity company SentinelOne, defense against ransomware and state-sponsored cyber strikes is my job.
Netflix ‘s apocalyptic thriller ‘Leave the World Behind,’ starring Julia Roberts (right) , Mahershala Ali (left) and Ethan Hawke (center) is based on a book by Rumaan Alam and it has terrified U.S. audiences.
No phones. No internet. No satellites. Oil tankers running aground. Planes falling out of the sky. Flamingos in the swimming pool. Zombie deer in the backyard. Chaos without explanation. (Above) Scene from the film Leave the World Behind – New York City is under attack
China and Russia are the only adversarial nation-states with the military and cyber capability to conduct total global warfare. These enemies of America don’t need to bring down passenger planes or sabotage supertankers to trigger mayhem.
Hackers affiliated with the Chinese military have already reportedly digitally infiltrated critical U.S. infrastructure, including a water utility facility in Hawaii, a West Coast port, and an oil and gas pipeline, according to the Washington Post.
Recall the panic set off by the Russian-linked ransomware group DarkSide attacking the Colonial Pipeline on May 7, 2021. The oil delivery system is the largest of its kind in the U.S. carrying 45 percent of the East Coast fuel supply.
News channels showed images of cars lined up for miles as gas stations from Virginia to Florida ran dry and were forced to close. North Carolina declared a state of emergency. It didn’t matter that the attack only lasted a few days. It didn’t matter that the oil supply wasn’t lost or that the government was cautioning everyone to remain calm.
The fear was real – and that’s a precursor to bringing a nation to its knees.
China’s President Xi Jinping recently warned President Biden that it’s his intention to ‘reunify’ Taiwan with the Chinese mainland. If Beijing does decide to invade the island nation then expect the Chinese armed forces to seek to bog the United States down in a domestic crisis.
Their first wave of disruption would likely target large population centers like New York City, Los Angeles, Chicago, Houston, Phoenix, or Philadelphia.
News channels showed images of cars lined up for miles as gas stations from Virginia to Florida ran dry and were forced to close. North Carolina declared a state of emergency. (Above) Cars wait for gas at Atlanta, Georgia Costco in May 2021
Recall the panic set off by the Russian-linked ransomware group DarkSide attacking the Colonial Pipeline on May 7, 2021. (Above) Exxon station runs out of gas after Colonial Pipeline attack in May 2021
Taking out power to 100 homes would generate little interest and have negligible impact. The goal of a power attack is to cause massive disruption and create the conditions to overwhelm public safety and the response of federal authorities.
Perhaps, the Chinese would take a page out of the Russian cyber playbook.
December 23rd marked eight years since Russia attacked Ukraine’s power grid with their BlackEnergy malware, a malicious computer virus that shut down the country’s energy supply. The attack took out power to over 250,000 homes and affected hundreds of thousands of people.
BlackEnergy was launched by a email created to look like it came from the Ukrainian parliament. When opened, the email’s attachment, a Word document, gave the attackers access to the system.
The Russian malware made it impossible for the Ukrainian engineers and technicians to control the electrical grid. Power at the main facilities, along with backup power, was completely disrupted. The computers controlling the utility’s management were wiped clean and could not be rebooted. Failure after failure cascaded through thirty substation systems. It took several hours to restore control, and only in a manual, heavily-restricted mode.
December 23rd marked eight years since Russia attacked Ukraine’s power grid with their BlackEnergy malware, a malicious computer virus that shut down the country’s energy supply. The attack took out power to over 250,000 homes and affected hundreds of thousands of people. (Above) Scene from Leave the World Behind – CNN broadcasts news of cyberattack
Their first wave of disruption would likely target large population centers like New York City, Los Angeles, Chicago, Houston, Phoenix, or Philadelphia. (Above) Scene from Leave the World Behind – Self-driving Telsa vehicles crash making roads impassable
The event that no one hoped would happen did – and it permanently changed the discussion around the security of power grids.
China would also attack critical infrastructure in Guam, the Pacific Ocean island nation that lies less than 2,000 miles from Taiwan. It’s here that U.S. forces would stage a military defense of Taiwan. Simultaneously, they’d target U.S. communications.
Again, the Kremlin provides the blueprint.
At the launch of the 2014 Russia-Ukraine war, Russia deployed a new cyber weapon striking out at the Ukrainian command-and-control infrastructure – cutting the lines of communication between the generals in Kyiv and their forces on the ground.
One of those weapons was given the name AcidRain. It struck high-speed modems that rely on satellites, making them inoperable, severing vital communication channels.
AcidRain didn’t stop there. The malware accidentally spilled over into Germany, a NATO partner, and knocked out control of 5,800 wind turbines.
It’s not the first time that a NATO nations has been hit by Russian attacks. The most devastating cyber strike in history was the NotPetya ransomware that jumped containment in Ukraine to infect nearly 100 companies, causing over $10 billion in damage — all from a single piece of code.
In response to these incidents, NATO Deputy Secretary General Mircea Geoană warned in January 2022 that further cyber warfare against NATO allies could be grounds to trigger an Article 5 response – collective retaliation – World War III.
In the days following this hypothetical Chinese attack on American infrastructure, China would launch its own military operations, knowing full well the United States was likely dealing with domestic disorder.
Based on Rumaan Alam’s 2020 novel, the film follows the Sanford family as they depart their Brooklyn apartment for a vacation at a plush modernist rental house on Long Island
But rest assured, even as Chinese and Russia have been preparing this digital battlefield for years so has the United States and its allies.
The U.S. public is not often aware of this cold cyberwar because much of it remains classified, and America’s authoritarian enemies are very good at silencing their domestic media. Though from time to time, news of this struggle will break through.
Never officially confirmed, Operation Olympic Games was a collaborative effort between the U.S. National Security Agency and Israel to successfully disable Iranian centrifuges.
Started by George W. Bush’s administration in 2006 and continued by President Obama’s administration, this sabotage operation sought to undermine Tehran’s race to build a nuclear weapon.
The U.S. deployed Stuxnet, the first true cyberweapon, which infiltrated Iran’s Natanz nuclear power plant causing it’s centrifuges, unbeknownst to the operators, to spin out-of-control. The malware first became known in 2010 when it was discovered by a Belarusian company.
Now, nearly two decades later, imagine what is available to the U.S. to hit back in the event that its adversaries ramp up hostilities.