Cyber meltdown danger starts with smug complacency

Detective John McClane, played by Bruce Willis, above, fights off cyber-terrorists in Die Hard 4.0. AP Photo / Fox

When the financial crisis of 2008 hit, many shocked critics asked why markets, regulators and financial experts failed to see it coming. Today, one might ask the same question about the global economy's vulnerability to cyberattack. Indeed, the parallels between financial crises and the threat of cyber meltdowns are striking.

Although the greatest cyber threat comes from states with the capacity to develop sophisticated computer viruses, risks can also come from anarchistic hackers and terrorists, or even from computer glitches compounded by natural catastrophe.

A few security experts, including Jonathan Evans, the head of the British security service MI5, have voiced alarm. By and large, however, few leaders are willing to compromise growth in the technology sector or the internet in the name of a threat that is so amorphous.

It is difficult to overstate the dependence of modern economies on large-scale computer systems. But imagine if one day a host of key communications satellites were incapacitated, or the databases of major financial systems were erased.

Experts have long identified the electricity grid as the most acute vulnerability, since any modern economy would collapse without power. True, many sceptics argue that with reasonable, low-cost measures, large-scale cyber-meltdowns are highly implausible, and that doom-mongers overstate the worst-case scenarios. They say that the ability of cyber-terrorists and blackmailers to take the global economy to the brink, as in the 2007 Bruce Willis film Die Hard 4.0, is utterly fictional.

It is difficult to judge who is right. But there do seem to be an uncomfortable number of similarities between the political economy of cyberspace regulation and of financial regulation.

First, both cyber-security and financial stability are complex topics with which government regulators can hardly keep up. Industry remuneration for experts is far in excess of any public-sector salary, and the best minds are continually bid away. Some argue that the only solution is reliance on self-regulation by the software industry.

Second, like the financial sector, the tech industry is enormously influential politically through contributions and lobbying. In the United States, all presidential candidates must make pilgrimages to Silicon Valley and other tech centres to raise money.

Third, with slowing growth in advanced economies, information technology seems to hold the moral high ground, just as finance did until five years ago. And crude attempts by governments to enforce regulation are likely to prove ineffective in protecting against catastrophe.

Finally, the greatest risks come from arrogance and ignorance. Recent revelations about the super-viruses "Stuxnet" and "Flame" are particularly disconcerting. These viruses, apparently developed by the US and Israel to disrupt Iran's nuclear programme, embody a level of sophistication far beyond anything previously seen. Both are difficult to detect once inside a computer network. The Flame virus has the capacity to take over a computer's peripherals, record Skype conversations, take pictures through a computer's camera and transmit information via Bluetooth to any nearby device.

If the world's most sophisticated governments are developing computer viruses, what guarantee is there that something won't go awry? How can we be sure that they won't infect a much broader class of systems, or that rogue states or terrorists won't find a way to turn them on their creators?

Unfortunately the solution is not as simple as just building better anti-virus programs. A virus can be just a couple of hundred lines of computer code, compared with hundreds of thousands of lines for anti-virus programs, which must be designed to detect wide classes of enemies.

We are told not to worry about large-scale cyber meltdowns, because none has occurred. Unfortunately, another lesson of the financial crisis is that most politicians are congenitally incapable of making difficult choices until risks actually materialise. Let us hope that we are lucky for a while longer.

Kenneth Rogoff is a professor of economics and public policy at Harvard University, and a formera chief economist at the IMF

* Project Syndicate