The cyber world war: As WikiLeaks protestors launch computer attacks on their enemies a top thriller writer imagines a terrifying scenario

By Tom Cain
Updated: 09:54 EDT, 10 December 2010

This week, computer ­hackers sent one of the world’s biggest credit card companies into meltdown in revenge for cutting off donations to the WikiLeaks website. The attack by a group called ‘Anonymous’ said ­MasterCard had been targeted — along with ­PayPal — for freezing the account of the site. The cyber attack revealed the chaos hackers can achieve. So what would happen in an all-out cyber war between nation states?

Strategists call it the fifth domain of warfare. The first four are land, sea, air and space. The fifth is cyberspace: the virtual world, ruled by computers, linked by the internet and threatened by ­weapons that are no more than lines of software code, but are potentially as destructive as any gun or bomb could ever be.

And on December 9, 2015, as Britain entered its seventh exceptionally cold winter in a row, this was the domain within which anarchy and mayhem broke free.

It was not the first time, of course. In 1982, with the Cold War between East and West still at its height, U.S. agents managed to sabotage the trans-Siberian oil pipeline by sabotaging its control software.

The attack came imperceptibly when Shaheen Radan came into work. What his colleagues didn't know was that he was a sleeper agent for Iran’s Ministry of Intelligence and Security

In later years, the Russians themselves launched cyber attacks on their neighbours in Georgia and Estonia. The Chinese carried out continuous ­programmes of cyber-based industrial espionage and even sabotage, including an attack on Google in 2010.

That same year, Israel’s intelligence service Mossad planted the Stuxnet ‘worm’ — a self-­replicating form of malicious software — within the ­centrifuges which their Iranian enemies were using to produce weapons-grade nuclear material.

And in December 2010, the WikiLeaks site was both the subject of cyber attacks by governments trying to shut it down, and the cause of attacks by its supporters on a series of credit card companies.

By now, governments were taking the cyber threat very seriously indeed. In May 2010, the U.S. ­Pentagon formally established a new arm of the military: Cyber Command, which was led by General Keith B Alexander, director of America’s National Security Agency, or NSA.

In Britain, the new National Security Council listed cyber attacks as one of the most significant ‘Tier 1’ threats facing the UK. Even at a time of stringent ­government cuts, an additional £500m had been found to combat the threat posed by online criminals, terrorists and hostile powers.

But when disaster struck, the recently re-elected Prime Minister and Chancellor of the Exchequer would come to regret they had not added an extra nought to that amount.

The attack began imperceptibly when Shaheen Radan, a friendly, much-liked 37-year-old, came in to work one December morning at the National Grid Control Centre, at St Catherine’s Lodge in Sindlesham, Berks, the hub of the country’s entire electricity transmission system.

What none of his colleagues at the centre knew was that Radan was a sleeper agent for Iran’s Ministry of Intelligence and Security, an ­organisation as dangerous and ­unscrupulous as any terrorist cell.

Spy HQ: The MI6 building in London. Secret service agents  began to track down the people or organisation ­responsible for the attack. The Army was ­mobilised to assist emergency ­services

Radan stuck a memory stick into one of the centre’s computers. It ­downloaded a worm into the system. The worm, however, lay dormant, ­waiting for the signal that would ­trigger it, as a detonator triggers a bomb.

An hour later, the signal was sent remotely from a computer somewhere in England. The worm got to work, corrupting the software that ran the National Grid’s computers. Five ­minutes later, at 7.32am, a vast swathe of South-East England, including the whole of London, suddenly lost all its mains power.

The lights went out. Heating went cold. Trains on electrified commuter lines and the London Underground juddered to a halt. Diesel-powered trains kept running, but they did so on tracks that no longer had signals.

All the BBC’s main channels on TV and radio ceased transmitting. All mains-powered computers and ­appliances ceased to work. The ­telephone networks, traffic lights and internet crashed.

People started dying. There were countless multi-vehicle pile-ups. Two commuter trains collided outside Three Bridges station in West Sussex. Most hospitals had efficient back-up generators, but inevitably some were faulty and hundreds of patients were left without the equipment that kept them alive.

Government agencies swung into action. Computer specialists, many of them recruited from the ranks of the hacker community — the online ­version of poachers-turned-­gamekeepers — began working with the National Grid’s computer experts to get the system up and running.

At MI5, work began to track down the people or organisation ­responsible for the attack. The Army was ­mobilised to assist emergency ­services.

And then, at 8.32am, the worm ­suddenly stopped its attack. The grid began functioning again. The lights came back on. The world seemed to revert back to normal.

The worm, however, had not stopped working. It was teasing its prey, and using this ‘downtime’ to replicate itself and spread through the system. At 9am it received another trigger ­signal from the same remote ­computer and became active again. This time it did not just take out the South-East’s electricity supply, but the ­Birmingham and Manchester regions as well.

Computers hackers sent one of the world's biggest credit companies into meltdown

Now all the chaos had returned, but it was more widespread and the breakdown of all CCTV and burglar alarms led to frenzied looting across all major inner-city areas

The government declared an official nationwide state of emergency. But now a new problem arose.

The Menwith Hill Listening Station, which collects information from U.S. spy satellites and transmits it on to intelligence services on both sides of the Atlantic, is located near ­Harrogate, North Yorkshire, an area where the power was still on.

At 9.06am, ­Menwith Hill’s own ­computers were ­bombarded by a so-called Denial of Service attack.

A DoS attack was the means by which the pro-WikiLeaks hacktivists had hit at credit card companies. The principle is very simple.

Using a large number of computers, all working as a coordinated mass, or ‘botnet’, a huge amount of data is sent to a particular internet server. This drowns out the work that the server is supposed to be doing, rendering it effectively useless.

When Menwith Hill was attacked, Western intelligence lost one of its most significant global assets. ­Suddenly terrorists, criminals and enemy agents could talk and email without fear of being overheard.

Now the U.S. was involved in ­Britain’s crisis. The UK simply did not have the resources to fight a war on two cyber fronts at once. Once again, as so often before, we were obliged to go cap-in-hand to Uncle Sam and beg for assistance in our hour of need.

The CIA and NSA’s own computer wizards got to work. They opened up routes through the British ­government’s secure servers, powered by generators independent of the National Grid to get at the crippled system at Menwith Hill.

Meanwhile, in Tehran, senior ­officials at the Ministry of ­Intelligence and Security were watching the whole drama play out with ­undisguised glee.

Things were going precisely to plan.

Paypal was targeted because it cut off donations to the WikiLeaks website

And then MI5 got a lucky break. A botnet — an attack by masses of ­computers — is usually diffused: a cloud of computers, scattered all over the world. But this particular botnet seemed different. This one was traceable.

As central southern England and the West Country joined the list of regions suffering from total power outages, a thought struck an analyst at Thames House, the London ­headquarters of MI5.

The computer sending the ­instructions that powered all these attacks did not have to be located in the UK.

But if it was, then it must surely be in an area that still had power and all the communications facilities that came with it. With every new replication of the National Grid worm, less and less of the country was still functioning.

That made the analyst’s life much easier. For as more and more of the country went dark, the search area was getting smaller by the hour.

In the end, it was relatively easy to pinpoint the source of the Denial of Service attack on Menwith Hill, which, the MI5 man reasoned, might well be the source of the worm that was affecting the National Grid as well.

A humble terrace house in the backstreet of Leeds was the Ground Zero for an assault that was, as one perceptive MI5 agent pointed out, occurring on 9/12. Under normal ­circumstances, the operation to take the house and seize the ­computers there would have required a great deal of detailed planning. But there wasn’t any time for that.

Armed officers from West ­Yorkshire Police were rushed to the scene. They went in hard, fast and in ­overwhelming numbers. They were met by an extraordinary sight. Every room of the house was filled with identical Hewlett-Packard ­laptops arrayed in rows on the bare wooden floor, on shelves, on ­tabletops — wherever there was space for them. There must have been 2,000 to 3,000 of them, all ­connected to the internet via a ­myriad of wireless boxes — yet there were no people anywhere.

Right across the Russian Federation, missile silos began to show signs of life

The officers who had smashed the door down fell silent. As peace descended, a new sound could be heard, that of Middle Eastern music coming from an upstairs room.

The commanding officer glanced up the stairs then flashed a series of silent hand-gestures that told his men exactly where to deploy.

Two black-clad policemen, with Heckler & Koch MP5 sub-machine guns in their hands, sped up the stairs on rubber-soled feet, as ­noiselessly as wraiths.

The landing was clear.

They gestured to their colleagues to follow them and another half-dozen men, including the ­commanding officer, went up to the first floor.

Now the music was louder. It was clearly coming from the front ­bedroom. Two men grasping a steel battering ram stood by the door. They looked back at their boss. He nodded. They swung their ­battering ram at the flimsy wooden door.

Inside the room an Iranian agent called Amir Moradi smiled to ­himself. He was sitting at a desk on which stood a computer and a CCTV monitor.

Moradi had been watching the police via concealed cameras since they had first pulled up outside his house. Now he had just two tasks to fulfil. As the door smashed open and the first police charged towards him, Amir Moradi did two things.

With his right hand he pressed ‘Send’ on a programme that was open on the computer screen. And with his left he depressed the ­control in his left hand, detonating the explosives that had been rigged throughout the house and instantly obliterating himself, his entire ­computer network and eight ­officers of the West Yorkshire Police.

The loss of the computers ended the Denial of Service attack on Menwith Hill. Within minutes, the intelligence data was flowing once again.

On the other hand, it ­compounded the problems faced by the National Grid. Had Amir Moradi’s computer been captured intact it would have proved an invaluable tool to ­decipher how the worm it had ­triggered actually worked. Without it, their task was as hard as ever.

The third effect resided in the ­programme Moradi had sent. It went to the server at Menwith Hill. There it did no harm at all. But it was able to find its way, via the server, into some other computers: the ones being used by the ­American technicians at the Pentagon.

Now it had a back door route into the entire U.S. defence network, including the North American ­Aerospace Defense Command located at its Cheyenne Mountain Complex in Colorado.

There, it found its way into the early-warning software and started corrupting the files to set off a false alarm.

Five minutes later its work was done, when an extraordinary sight greeted NORAD personnel ­watching the giant screen on which an electronic map of the entire world was displayed.

Right across the Russian ­Federation, missile silos began to show signs of life.

The signals were unmistakable. Missiles were being launched. Within seconds, NORAD’s ­computers had calculated their ­trajectories. The target was the U.S.

‘Get me the Pentagon,’ the duty officer gasped. ‘I can’t believe what I’m seeing. It looks like we’re going to war …’

Tom Cain’s latest novel, Assassin, is published by Bantam Press.