Emmet Ryan: Panic over cyberattacks plays straight into the hands of those behind them

Put the kettle on. Right now, everyone would benefit from sitting down and taking a few minutes to have a cup of something.My weekend was largely spent calming people down after last week’s cyberattacks. Supermarket fridges got hacked, there were bomb threats to airlines and the week ended with several media organisations being evacuated due to more bomb threats.Plenty of otherwise rational people took this as a reason for all-out panic and as a sign of the need to prepare for the end of time. Civilisation isn’t about to collapse and it’s time you had that cuppa.All of the recent attacks or threats were designed to disrupt. That is in keeping with the experience of countries that previously held the presidency of the Council of the EU.READ MOREThere was certainly some fiscal impact but the core goal was to cause disorder. Some stock was lost from fridges, some flights were rescheduled and David McCullagh regretted not grabbing his jumper.Many people became preoccupied with thoughts of, “if the hackers could do this, then what else are they capable of?”. That’s the wrong question to ask. They are capable of far worse, but you should be asking if doing so is really in their interest.The big fear I kept hearing about was a national blackout. At their operational best, the most sophisticated hackers could knock out power in Ireland for about 12 hours. Weather is a far more powerful and probable threat to the grid than any malicious actor.The goal of these disruptions, which are almost always caused by state-backed actors, is to cause fear. It may be Russia today, North Korea tomorrow or the Federated States of Micronesia at the weekend. Instilling fear and uncertainty is a key part of the package.It probably doesn’t help that these attacks are usually backed up by disinformation campaigns. We need only look at how effective Russia’s disinformation campaign in Poland has been in damaging public support there for Ukraine to see how effective this can be.The playbook is awfully similar to what we’re seeing here. Some legitimate concerns – which we have had in Ireland following these attacks – are exaggerated to exacerbate fear.Having a range of goals also works in favour of cybercriminals. Some want to disrupt, some want to stoke fear, others want to steal information or money and quite a few have a cocktail involving elements of all of these. Variety of motive makes it tougher to defend as the method of attack will vary.No matter what the goal is, it is most unlikely that an all-out attack on Ireland’s core systems is uppermost in the mind of any attackers. The truth is that it does not make sense on a cost-benefit analysis to engage in something at that level. Attacking the fridges was a good test to see what could be done. Using anonymous accounts to spread bomb threats en masse was a low-to-no-cost means of causing disruption. Taking out the grid or worse? That involves a real commitment and potential blowback. Not from Ireland, oh no, but from those outside Ireland who would be irked. Multinational data centres and other tech infrastructure here make for tasty targets. Attacking one or a few is certainly a reasonably likely scenario that state-backed cyber attackers will consider. Going for a true shutdown? That gets the Americans angry because it disrupts their businesses. The US government is more than capable of striking back in kind.Ukraine blowing up three Yandex data centres caused chaos in Moscow. Cyber retaliation by the US government to a cyberattack on their tech giants would make that look like a nosebleed.Even if the US threat wasn’t there, while Ireland may punch above its weight for its population and economy size, we are far from the juiciest target in the EU, let alone globally.Besides, with far less risk and at far lower cost, those who caused chaos with our fridges, flights and media last week can get a great return on investment.They have already got plenty of people afraid. People are fretting about what they might need to do for an improbable attack. Many are realising that they aren’t really capable personally of doing much about it if anything did happen.Having a torch or a charged power bank is sensible at the best of times. As I said earlier, weather is a real threat to power in this State and winter is coming. There comes a point where obsessing over being ready for a threat you cannot do much about becomes unhealthy. It doesn’t take long for many people to hit that point.Between two decades of covering cybersecurity and a lifelong interest in dystopian fiction, I’ve done my share of thinking about worst-case scenarios. Dying carefree beats the hell out of living in fear.Yes, Ireland had a few mad days of it. It’ll have a few more wild ones in the days and weeks to come but UCD got promoted to football’s top domestic tier and you’ve made yourself a cuppa. Enjoy the good things and relax.