STUXNET

THE CLAIM

That the United States and Israel jointly built and deployed a cyber weapon that physically destroyed Iranian nuclear infrastructure, and have never admitted it.

THE THEORY, AS ITS PROPONENTS TELL IT

Unusually for this cabinet, the evidence is the weapon itself, which anybody can still analyse.

Stuxnet targeted Siemens programmable logic controllers of a specific configuration, driving gas centrifuges at particular frequencies. It did nothing on machines that did not match. Where it found its target it varied rotor speeds to induce mechanical failure while replaying recorded normal telemetry to the control room, so operators saw nothing wrong until the hardware broke.

The sophistication is the argument. It used four zero-day vulnerabilities at once, which is extraordinarily expensive, and stolen but valid digital certificates from two Taiwanese companies. Analysts across the security industry concluded independently that this required state resources and detailed knowledge of the specific plant.

Attribution to a joint American and Israeli programme, reported as Olympic Games, comes from extensive reporting including David Sanger's, and from later leaked material. Neither government has confirmed it. The Iranian government has confirmed the damage.

WHAT IS KNOWN

The malware is real, was captured, and has been reverse-engineered publicly and repeatedly. Its targeting logic and payload behaviour are documented in technical detail by Symantec, Kaspersky and others.

Damage at Natanz is confirmed by IAEA inspection data showing an unusual number of centrifuges replaced during the relevant period, and by Iranian statements.

The escape is part of the story. Stuxnet spread beyond its target and was found on systems worldwide, which is how it was discovered at all. A weapon designed for one plant ended up in the hands of every security researcher on earth.

No formal acknowledgement has ever been made by any government. The 2013 leaks and subsequent reporting are the closest thing to confirmation, and they are not official.

EVIDENCE FOR

• The code itself, publicly analysed, with targeting logic specific to one plant's configuration.
• Four simultaneous zero-day exploits and stolen valid signing certificates, indicating state resources.
• IAEA data consistent with large-scale centrifuge replacement in the period.
• Extensive corroborated reporting naming the programme, never denied in specifics.

EVIDENCE AGAINST (FORMAL ATTRIBUTION)

• No government has acknowledged authorship, so attribution rests on technical inference and journalism rather than on admission or document.
• Technical attribution in this field is genuinely hard and has been wrong before, including deliberately, since sophisticated actors plant false flags.
• The specific division of labour between the alleged partners is reported rather than established.

ASSESSMENT

Confirmed as a state cyber weapon, formally unattributed, and included as the modern shape of everything else in this cabinet. There is no document to declassify here and there may never be one, because the operation left its evidence in a form that needed no leak: the weapon itself escaped and was dissected by the entire security industry. That is a new category. Compare OSA-114, where a fifty-year secret needed a journalist to break it, and note that this one broke itself within five years by accident.

WHAT WOULD CHANGE THE GRADE

• CONFIRMED as a state cyber weapon by the evidence anyone can still examine: the code itself, publicly reverse-engineered, with targeting logic specific to one plant's centrifuge configuration, four simultaneous zero-days and stolen valid signing certificates.
• To CONFIRMED as to authorship: an acknowledgement. No government has ever made one, so attribution rests on technical inference and corroborated reporting rather than on any document.
• Worth recording: this file broke itself. The weapon escaped its target network and was dissected by the entire security industry within five years, which is a new category of disclosure and needed no leak at all.

FURTHER READING

• Stuxnet · Wikipedia
• Symantec, W32.Stuxnet Dossier (2011) · the technical analysis
• David E. Sanger, Confront and Conceal (2012)