Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

230 13. ATTACKING IRANIAN NUCLEAR FACILITIES: STUXNETFIGURE 13.3 Posted in mid-April 2008 on the official Web site of the Iranian President a snapshot from his visit toNatanz revealing what was meant to be kept secret, below a crop with enhanced contrast.number of centrifuges taken offline is consistent with the timing and data structures ofStuxnet. IAEA reports show an increase in the amount of enriched uranium during the firstquarter of 2008. 36 It is also notable that in the summer of 2009—the approximate time ofStuxnet’s deployment to Natanz—Iranian officials estimated that in the then past half year,5723 kg of uranium hexafluoride had produced 500 kg of LEU, which an Institute for Scienceand International Security (ISIS) report estimates is a 20% increase in the daily production ofLEU. 37 However, this is considered to be an underperformance as at the time more centrifugeswere assembled into cascades and the rate of LEU production was increasing as well. 38Again, the timing of this stagnation in LEU production is also consistent with the acceptedtimeline of the Stuxnet deployment.The obvious alternative explanation for the failure is a manufacturing defect. The IR-1 gascentrifuge is commonly held to be rather unreliable with design problems and a shortlifespan. For instance, in 2011, the noticeably low output of 3.5% low-enriched uranium(LEU) was attributed to the breakage of these old model centrifuges. The poor conditionof the IR-1s might have been furthered by Stuxnet, which caused the centrifuges to spin atdifferent speeds. 39 However, the problems with the IR-1s could also hint at the inabilityon the part of the Iranians to maintain and repair, let alone manufacture these centrifuges facingshortages of key material due to import sanctions. 40 At the time of Stuxnet’s deploymentin at least one of the underground cascade halls at Natanz, the enrichment process employedexclusively the apparently targeted IR-1 centrifuges. However, as of November 2012, moreadvanced centrifuges are employed in the above-ground Pilot Fuel Enrichment Plant (PFEP)in the same military compound.Another aspect to consider is the intent of Stuxnet. There were two theories: the first beingthat the malware intended to immediately destroy centrifuges, while the second is that it ismore subtlety sabotaged centrifuges causing their output to be suboptimal over a relativelylong period of time. The first theory is largely based on the findings of Symantec 41 and ISIS, 42while the second is derived from the findings of Langner Communications. 43