With appliance manufacturers desperately eager to get us to make our entire appliance suite internet-connected, it shouldn’t be a surprise to find that the security of your internet-connected toaster or refrigerator is not up to scratch. It is concerning that commercial refrigerators apparently have the same kind of vulnerabilities to malefactors on the internet:
Commercial refrigerators
Wikimedia Commons.
Refrigerators are probably the last thing anyone would consider a national security vulnerability, which is precisely why the unusual refrigeration failures at U.S. military commissaries deserve more attention than they are getting. There is no public evidence that the incidents were caused by a cyberattack or a foreign adversary, and they may ultimately prove to be nothing more than equipment, software, or maintenance failures. But when refrigeration systems at multiple military installations experience problems within a relatively short period and at Fort Huachuca all of the commissary’s freezers reportedly went into defrost mode overnight, leaders at the Pentagon should be asking a larger question: If a sophisticated adversary wanted to test its ability to disrupt the infrastructure supporting America’s military without firing a shot, is this what it might look like?
That question matters because China and other U.S. adversaries are no longer thinking about cyber warfare simply as stealing secrets or attacking classified networks. They are looking for ways to penetrate the infrastructure America depends upon and, when necessary, create disruption, confusion, and delay. It echoes the familiar warnings of a certain rail conductor from a beloved children’s television show about a talking train. U.S. intelligence and cybersecurity agencies have already warned that Chinese state-sponsored actors have gained access to American critical infrastructure and, in some cases, appear to be positioning themselves for potential disruption during a future conflict. A coordinated attack against something as ordinary as refrigeration would therefore not have to cause catastrophic damage to be successful. The objective could be much simpler: get inside, disrupt operations, complicate the response, and watch how America responds.
That is what makes the recent commissary incidents worth examining beyond the immediate loss of food or inconvenience to military families. If an adversary wanted to probe U.S. military infrastructure, attacking a commissary would carry considerably less risk than shutting down an airfield, disrupting a command center, or interfering with a weapons system. Yet it could still provide valuable intelligence about how quickly geographically dispersed incidents are identified, whether installations communicate with one another, when a maintenance problem becomes a cybersecurity investigation, which contractors and government agencies respond, and how long it takes the Pentagon to determine whether seemingly isolated failures are connected.
In other words, the purpose would not be the refrigerator, the purpose would be to learn how and when we would respond to the incidents.
