US Is Unprepared for Attacks on Critical Infrastructure: RAND Simulation

Like Cyber Polygon, RAND’s ‘Inverted Rook’ wargame warns of catastrophic cyber attacks leading to societal breakdown: perspective

The United States is unprepared for attacks on critical infrastructure, according to a wargame simulated by the RAND Corporation.

Prepared for the head of the US spy community — the Office of the Director of National Intelligence (ODNI) — the RAND report, “Defending the United States Against Critical Infrastructure Attacks: Exploring a Hypothetical Campaign of Cascading Impacts” details a wargame from earlier this year called “Inverted Rook,” which simulated multiple attacks on critical infrastructure.

The authors note that although this scenario is a hypothetical use case of a future adversarial campaign, it is based on real-world examples that have targeted “communications, financial services, health care, municipal services, energy, transportation, and water.”

In this fictional scenario, the motivation behind the simulated attacks was to interrupt US involvement in a conflict overseas by creating havoc, chaos, and mayhem on American soil through a combination of physical and cyber attacks on critical infrastructure.

These include:

• Physical attacks on electrical substations
• Ransomware attacks on government services
• Malware attacks on power grids
• Disruptions in transportation
• Hackers remotely poisoning water treatment facilities
• Cyber attacks on Wall Street

The ripple effect from each attack, either simultaneously, or one after another would lead to:

• Government services being shut down
• Power outages affecting hospitals, transportation, refrigeration, heating, etc.
• Sickness and death from poisoned water, hypothermia, exposure, civil unrest, etc.
• Financial services being disrupted
• Splitting factions between those blaming domestic extremists, foreign adversaries, and their own government
• The inability of government to go after foreign adversaries in order to deal with all the domestic chaos

According to RAND, “The adversary uses a variety of tactics to create an atmosphere of mistrust in government, sow tensions among the general populace, saturate the news media, and totally consume the target state’s political bandwidth to reach its ultimate goal of preventing, delaying, or constraining the US response to the adversary’s actions abroad.”

Additionally, “Attacks intended to forestall a US response to aggression overseas could create fear among the general public, undermine social cohesion, and paralyze political decision making structures.”

At the end of the exercise, the authors concluded that the US government and other critical infrastructure “stakeholders” were not prepared for these types of attacks that “would rapidly stress national defense resources, creating acute tensions in resource management for which policymakers would have to prioritize, sequence, and deconflict many lines of effort.”

So, what are the some of the solutions they propose?

According to RAND:

• Federal and SLTT [state, local, tribal and territorial] governments and private-sector critical infrastructure stakeholders should work together to plan, resource, train, and exercise their detection and response capabilities, including their processes and mechanisms to achieve unity of effort in preparedness and response
• The federal government should continue to prioritize its relationships with SLTT governments and private-sector owners and operators of critical infrastructure
• The Pentagon should consider the support that it will need from the federal interagency, SLTT governments, and private-sector entities during a national emergency and work to develop those vital relationships
• Policymakers should take action prior to a crisis to prepare the United States to manage the homeland consequences of a coordinated attack on critical infrastructure while preparing for potential military mobilization and deployment to a contingency
• Policymakers should build societal resilience from the ground up
• Policymakers could work at all levels of government and with civil society to educate the public on emergency preparedness and foster dialogue within communities about the need to navigate uncertainty with attitudes of mutual respect and mutual support

The premise of this “Inverted Rook” wargame was that the attacks on critical infrastructure would come about due to US involvement in conflicts overseas.

The RAND report asks the reader to imagine that “an adversary launches a military invasion of a US-allied country or close partner” with the “ultimate goal of preventing, delaying, or constraining the US response to the adversary’s actions abroad.”

The Five Eyes nations, the US Cybersecurity and Infrastructure Security Agency (CISA), and the World Economic Forum (WEF) have all been forecasting that these types of attacks are likely to occur very soon due to the West’s unstable geopolitical relations with Russia, China, Iran, and North Korea.

Speaking at the 2023 WEF Annual Meeting in Davos, WEF managing director Jeremy Jurgens highlighted one such forecast from a recent survey on cybersecurity.