HL extension: Governance and human rights practice questions.

Malware discovered in 2010 changed the operating speed of centrifuges at the uranium enrichment plant at Natanz in Iran while feeding previously recorded normal readings to the engineers' monitoring screens. Which feature of this operation changed how states assess security threats?

• Software alone produced physical damage to industrial machinery
• The engineers' monitoring screens were switched off for the whole of the operation
• Personnel files held at the plant were copied and then published by the attackers
• The operation was run from a network that the plant's own engineers controlled

Answer: Software alone produced physical damage to industrial machinery

Until then, damage to plant and machinery was assumed to require physical access or a weapon, so an operation that reached industrial control systems through software moved industrial sites into the category of targets that a state must defend. The screens were not disabled but spoofed, which is the detail that made the sabotage last.

In May 2017 the WannaCry worm spread through unpatched Windows systems in many countries. Hospital trusts in England cancelled an estimated 19,000 appointments, although the National Health Service had not been singled out by the attackers. Which implication for security policy does the episode illustrate most directly?

• Hospitals were chosen as targets because patient records fetch high prices
• Encrypting patient records at rest would have prevented the worm from spreading
• Services with no role in the attackers' plan can still be badly disrupted
• The worm could spread only between machines sharing one network administrator

Answer: Services with no role in the attackers' plan can still be badly disrupted

The worm spread to whatever it could reach, so the harm fell on an unpatched public service rather than on a chosen adversary, which is why health ministries now treat patching as a civil protection duty. Encryption at rest protects confidentiality and would not have stopped a worm exploiting a network service.

In May 2021 ransomware encrypted the business and billing systems of the company operating a major fuel pipeline on the east coast of the United States. The company then halted deliveries itself for several days, and fuel shortages followed. Which conclusion about critical infrastructure does the episode best support?

• The attackers had gained direct control of the valves and pumps along the route
• Fuel deliveries stopped because the pipeline's control software had been encrypted
• A dependency on administrative systems can halt a physical service left untouched
• The shutdown was ordered by regulators once the intrusion had been reported

Answer: A dependency on administrative systems can halt a physical service left untouched

The operational technology that moves the fuel was not the system encrypted; the operator could not bill or schedule deliveries and stopped the flow as a precaution, which shows that the boundary between administrative and operational systems is a business decision rather than a physical fact. Treating only control systems as critical misses where the dependency actually sits.

A trojanised update to widely used network management software was distributed to roughly 18,000 customer organisations in 2020, yet only a small number of those organisations were then intruded upon further. Which distinction does the case make examinable?

• Between an update signed by the vendor and one downloaded from an online forum
• Between organisations exposed and organisations actually intruded upon
• Between a denial of service attack and the theft of personal data
• Between malware that spreads by itself and malware that needs to be opened

Answer: Between organisations exposed and organisations actually intruded upon

Headline counts describe how many organisations received the compromised code, not how many were selected for follow-on access, and conflating the two inflates the reported scale of an operation. For defenders the significant point is that a signed update from a trusted supplier bypassed the checks each customer had in place.

In June 2017 destructive malware distributed through an update to Ukrainian accounting software reached companies with no operations in Ukraine, halting container terminals run by a global shipping line for days. It displayed a ransom note, but files could not be recovered by paying. Which conclusion does the case best support?

• The malware could spread only to computers on which the accounting software was installed
• Shipping companies were the intended targets of the operation from the outset
• Paying the ransom restored the files of organisations that chose to do so
• Damage from an operation aimed at one country reached unrelated organisations

Answer: Damage from an operation aimed at one country reached unrelated organisations

The ransom note was cover for a wiper, so payment could not return the data, and the malware kept spreading through shared corporate networks far beyond the intended jurisdiction. The implication for insurers, ports and their customers is that a state-linked operation against one country becomes a supply chain event everywhere its partners trade.

Since 2014 states have met under the Convention on Certain Conventional Weapons to discuss systems that can select and engage a target without a person deciding on that particular attack. Which objection is central to those discussions?

• Such systems are more expensive to build than remotely piloted aircraft are
• Responsibility for a particular killing becomes difficult to place on a person
• Such systems can be operated only from within the territory of the deploying state
• The sensors that these systems use cannot function at night or in poor weather

Answer: Responsibility for a particular killing becomes difficult to place on a person

International humanitarian law assigns duties to commanders and operators, so a system that makes the engagement decision leaves no one who took the decision that the law addresses, which is the core of the accountability gap argument. Cost and sensor limits are engineering questions and change with the technology; the responsibility question does not.