Is Someone Hacking the Pentagon's Refrigerators?

Bruce Schneier draws attention to a strange series of failures in the cooling systems of stores on American military bases. According to him, it's hard to chalk this up to mere coincidence.

Among the confirmed affected sites are Fort Irwin (California), F. E. Warren Air Force Base (Wyoming), Fort Huachuca (Arizona), Naval Station Newport (Rhode Island), Columbus Air Force Base (Mississippi), and Travis Air Force Base (California). The bases themselves reported these outages in their online announcements. In addition, M. Elizabeth, author of the Signal and Silence newsletter on Substack, wrote about disruptions at Naval Air Station Lemoore (California).

The Pentagon's Silence

Individual branches of the armed forces declined to answer questions about exactly how many bases were affected, redirecting everything to the Department of Defense. Pentagon officials did not respond to inquiries. Nevertheless, one department representative, speaking on condition of anonymity, acknowledged that the department was aware of a “possible disruption of refrigeration equipment at some Army and Air Force Exchange Service stores.” He was not authorized to comment on the situation publicly.

Schneier candidly admits that all of this is still just speculation. But finding another explanation for such a coincidence is no easy task.

A Lesson About Unnecessary Computers

The story is interesting not so much in itself as for the conclusion it invites. A sensible point came up in the comments under the post: devices that don't fundamentally need a computer to function should be designed so that they keep working without one. A kind of foolproofing for the world of cybersecurity: if a refrigerator can cool on its own, shutting it down with a remote attack would be far harder.

Still, as long as the Pentagon keeps silent, one can only guess what exactly happened to the military refrigerators — malicious intent, a firmware glitch, or a plain old malfunction that struck in several places at once.

Source: Schneier on Security