How vulnerable is the internet, really?

Recent attacks like the Mirai botnet have highlighted the possibility of massive network failures. But there are ways to fight back

he recent attacks on the internet would be great material for a movie. But it would be more of a horror film than an action flick — and it could be a low-budget production since the victims could just be you and me. No need to pay high-priced movie stars.

The screenplay would go like this: The powers of darkness introduce themselves, undetected, into playrooms, bedrooms and living rooms. That’s where they take possession of all the little helpers that are making our lives easier and more amusing. They capture baby phones and cable boxes, webcams, toasters and refrigerators, recruiting them for the army of evil ghosts, which marches out in crowds of hundreds of thousands to destroy the world.

Planes falls from the sky. Power plants explode. Dams break. The world economy is collapsing. But ... all hope is not lost. Enter the superheroes: An army of digital robots and weapons systems that fight back. In the end, the good guys win. The world is safe — at least for now. Because the powers of darkness are not defeated for good. They’ve only pulled back in order to plan their next attack.

That’s the film version. A real “denial of service attack” — a technical term used to describe what happens if the computer performance of hundreds of thousands of machines is bundled so as to overcharge the key section of a network and make it hang up — is equally dramatic, albeit a bit more complicated to explain.

In this autumn’s concrete example, the power of darkness was called Mirai. That’s the Japanese word for “future”. Hopefully it’s not an omen, because what a mess this so-called botnet made in the United States, Europe and Africa. By the end of October, half of the internet in the US was down. Shortly after that, there was an attack on Liberia that forced almost the whole country offline. The next attack hit Deutsche Telekom.

It could be argued that an evening without the internet actually benefits our social and family lives. And it’s true that no planes have fallen from the sky. Still, the Mirai attack in Liberia did a lot of harm to the national economy. For the American and German users, it was simply annoying.

The movie version, assuming it was successful, would certainly spawn a sequel. That’s the Hollywood way. And in real life? Are there more, bigger attacks to come? Quite possibly. This past September, ITsecurity expert Bruce Schneier wrote an essay titled ‘Someone is learning how to take down the internet’. In it, Schneier interpreted a series of attacks as preparation for a massive attack that aims at, literally, taking down the whole network.

And if that really happened? Right now, there’s no Plan B for how the world could function without the internet. Instead, the discussion focuses on “mobilising”. We’re being told to arm ourselves for such digital attacks, defend ourselves at all cost, develop weapons.

Targets in the digital world

Those who heed this advice will most certainly be able to fight off one attack or another. For companies and governments this is crucial — in the short run. But it doesn’t change anything about the fact that the so-called internet of things with its interconnected domestic appliances and clumsily cobbled-together protocols and our efficiency-oriented company networks remain targets in the digital world.

The problem is that we can’t rewind digital development, but we can remember how it all started. The internet was originally developed by the US Army’s Darpa (Defence Advanced Research Projects Agency) as a network for communication that could survive a nuclear war. And it still contains this original idea.

Strictly speaking, “the internet” doesn’t exist. It’s an umbrella term for an interconnected world, in which any imaginable processing device can be interlinked, whether it’s with a mainframe computer or a toaster.

And so it’s easy to imagine a single attack taking the whole thing down. But it doesn’t necessarily have to play out like that. In the long run, the internet will have to be regarded as the almost indestructible network of networks it was designed to be. Even if a branch falls off, the internet will find a way to fill the gap.

It’s a common error in reasoning to see the internet as the monolith of monoliths. And if the big digital players had their way, it would be. They’d like nothing more than to house the internet in one big room that they alone control. But that kind of thinking is exactly what makes the internet vulnerable to attack, what makes the danger of a digital collapse a real and horrifying possibility.

There are a couple of ways the internet could be revisited and redesigned. The programming collective Ushahidi in Nairobi, for example, has developed a modem for the Third World, making it possible to bypass power blackouts automatically by activating alternative network and energy sources within seconds. Scientist George Dyson, for his part, recommends renovating the old telegraph systems to create a sort of narrow-band internet that could stand in as an emergency backup system.

These approaches are as close to each other as judo and Ultimate Fighting. Defence through evasion, on the one hand. Counterattack, on the other. The destructive potential of frontal attacks is disproportionately large when it comes to the internet. That’s why defence alone isn’t enough anymore. Only if we understand the internet’s original powers of resistance can we guarantee digital safety in the long run.