Ask CFR Experts

PrintPrint CiteCite
Style: MLAAPAChicago Close


What does the worst-case scenario of a cyberattack on the United States by another state or by terrorists look like?

Question submitted by James Carli, from Seton Hall University, April 5, 2013

Answered by: Richard A. Falkenrath, Shelby Cullom and Kathryn W. Davis Adjunct Senior Fellow for Counterterrorism and Homeland Security


Cyber weapons are different from conventional weapons in that their effects do not directly manifest themselves in the "real world." There are three broad categories of potential effects of cyberattacks: personal, economic, and physical.

The personal effects of a cyberattack are the invasion of privacy, and associated embarrassment or shame, that a person endures when their personal data is improperly accessed, disclosed, or tampered with. While the nation as a whole does not suffer from the event, the affected individual may feel that the harm is devastating. Such losses are real but not quantifiable.

The economic effects of a cyberattack can range widely, from minor acts of fraud, to breaches of corporate computer systems that threaten the company's survival, to the large costs associated with expensive cybersecurity systems. In economic terms, the worst-case scenario would be a cyberattack that triggers or accelerates a liquidity crisis among systemically important financial institutions, potentially catalyzing a financial crisis like that of 2008. This has not happened yet, and there is no publicly available evidence that it is about to happen, but the possibility cannot be ruled out.

To date, cyberattacks have rarely resulted in physical damage to people or tangible assets. The principal exception was the Stuxnet attack on Iran's centrifuge program, which destroyed a few thousand centrifuges. There is no question that offensive information operations will be a feature of future major conflicts between major states.

But how bad could the worst case be? Given the extremity of the possibilities, the answers to this question are more likely to come from Hollywood than CFR. Indeed, technology gone wrong has been one of the great themes of science fiction, starting perhaps with Mary Shelley's novel Frankenstein. For a more recent depiction of a truly worst-case cyberattack, see James Cameron's 1984 film The Terminator and its dystopian sequels.