'Could Have Done Anything'
In Queensland, Australia, on April 23, 2000, police stopped a car on the road to Deception Bay and found a stolen computer and radio transmitter inside. Using commercially available technology, Vitek Boden, 48, had turned his vehicle into a pirate command center for sewage treatment along Australia's Sunshine Coast.
Boden's arrest solved a mystery that had troubled the Maroochy Shire wastewater system for two months. Somehow the system was leaking hundreds of thousands of gallons of putrid sludge into parks, rivers and the manicured grounds of a Hyatt Regency hotel. Janelle Bryant of the Australian Environmental Protection Agency said "marine life died, the creek water turned black and the stench was unbearable for residents." Until Boden's capture -- during his 46th successful intrusion -- the utility's managers did not know why.
Specialists in cyber-terrorism have studied Boden's case because it is the only one known in which someone used a digital control system deliberately to cause harm. Details of Boden's intrusion, not disclosed before, show how easily Boden broke in -- and how restrained he was with his power.
Boden had quit his job at Hunter Watertech, the supplier of Maroochy Shire's remote control and telemetry equipment. Evidence at his trial suggested that he was angling for a consulting contract to solve the problems he had caused.
To sabotage the system, he set the software on his laptop to identify itself as "pumping station 4," then suppressed all alarms. Paul Chisholm, Hunter Watertech's chief executive, said in an interview last week that Boden "was the central control system" during his intrusions, with unlimited command of 300 SCADA nodes governing sewage and drinking water alike. "He could have done anything he liked to the fresh water," Chisholm said.
Like thousands of utilities around the world, Maroochy Shire allowed technicians operating remotely to manipulate its digital controls. Boden learned how to use those controls as an insider, but the software he used conforms to international standards and the manuals are available on the Web. He faced virtually no obstacles to breaking in.
Nearly identical systems run oil and gas utilities and many manufacturing plants. But their most dangerous use is in the generation, transmission and distribution of electrical power, because electricity has no substitute and every other key infrastructure depends on it.
