Many examples of catastrophic cyber attacks have already occurred

Claim: According to Jim, a cyber catastrophe captures our imagination, but as analysis, it remains entirely imaginary and is of dubious value as a basis for policy making. There has never been a catastrophic cyberattack.

My response: The Maroochyshire wastewater cyber-attack in 2000 dumped more than 750,000 liters of sewage. In 2010, Stuxnet damaged more than 1,000 centrifuges and may have delayed a shooting war. The Russian Triton cyber attack against a petrochemical plant in Saudi Arabia was not successful but not because of the lack of trying. This attack was meant to blow the plant up and kill people. The two Russian take-downs of portions of the Ukrainian distribution grids in December 2015 and 2016 demonstrate catastrophe-capable cyberattacks on critical infrastructures.

Claim: No one has ever died from a cyberattack, and only a handful of these attacks have produced physical damage.

My response: There have been more than 1,500 deaths to date and more than $70 Billion in direct damage from control system cyber incidents. Even though most incidents were unintentional, some were malicious. Moreover, a sophisticated attacker can make a cyberattack look like an equipment malfunction, and there is currently no cyber training for the control system engineers. Stuxnet caused significant physical damage but was not recognized as a cyberattack for more than a year. The Maroochyshire cyberattack caused extensive environmental damage. The 2011 China Bullet train crash was a malicious cyberattack on the signaling system killing 40 and injuring more than 190. The incident had a significant impact on the development of high-speed rail in China. There have been many catastrophic failures destroying equipment and killing people that were caused or exacerbated by electronic communications from instrumentation and control systems. All of these incidents could have been caused maliciously but without appropriate control system cyber forensics it is not possible to tell if they were malicious. Catastrophic incidents include the Texas City refinery explosion, Olympic Pipeline Company gasoline pipeline rupture, the San Bruno natural gas pipeline rupture, the 2008 Florida outage, among others.