The Worm That Broke the Centrifuges

In the summer of 2010, a Belarusian antivirus firm called VirusBlokAda investigated a client's computer stuck in a crash loop and found something nobody had ever seen: a worm of extraordinary sophistication, exploiting four previously unknown Windows vulnerabilities, carrying stolen digital certificates from real companies, and — most strangely — doing absolutely nothing on almost every computer it infected. It spread worldwide on USB drives, but it was hunting one specific thing.

Its target was 1,600 kilometers southeast, buried under concrete in the Iranian desert: the uranium enrichment plant at Natanz. Researchers at Symantec and elsewhere eventually decoded the payload. The worm searched for Siemens S7-300 programmable logic controllers running a very particular configuration — the controllers driving Iran's IR-1 gas centrifuges. On any other hardware, it stayed dormant. On the right hardware, it went to work with diabolical patience.

The attack had two acts. First, the worm intermittently forced the centrifuges off their normal operating frequency of roughly 1,064 Hz (about 63,000 RPM), pushing them up toward 1,410 Hz and dropping them as low as 2 Hz — spinning the precision aluminum rotors far too fast, then nearly to a halt, over and over, in short bursts separated by weeks of normal operation. The mechanical stress was invisible but cumulative: rotors cracked, bearings seized. Between late 2009 and early 2010, Iran had to replace roughly 1,000 centrifuges at Natanz — machines failing for no reason its engineers could find.

That was the second act's doing. While the centrifuges were being torn apart, Stuxnet was recording weeks of normal sensor readings and looping the playback to the control room monitors — pressure normal, speed normal, everything fine. It was the security-camera trick from every heist film, executed on a nuclear facility. Iranian technicians replaced broken centrifuges with new ones, which the worm then quietly destroyed again. Some lost their jobs over a failure nobody could explain.

Two years later, the authorship story broke — and here honesty requires care. In June 2012, New York Times reporter David Sanger, in an excerpt from his book Confront and Conceal drawn from 18 months of interviews with current and former American, European, and Israeli officials, reported that Stuxnet was built by the United States and Israel under a program code-named "Olympic Games" — begun under President George W. Bush in 2006 and accelerated by President Barack Obama — with the NSA working alongside Israel's Unit 8200, partly to dissuade Israel from a preemptive airstrike on Iran. Washington Post and other reporting has corroborated elements of this account. But neither the United States nor Israel has ever officially confirmed it. The worm and what it did are documented technical fact, established by independent security researchers. Who built it remains reported, not admitted.

Stuxnet was the first weapon whose battlefield was code and whose casualties were machines — proof that a state could reach inside a buried, air-gapped nuclear plant and break it from thousands of miles away. It also proved something else: once released, even the most controlled weapon leaks. A coding error let the worm escape Natanz onto the open internet, which is why anyone found it at all.