That article was full of inaccuracies. I’m shocked the Times would print something that got essential details so wrong.
For example, Stuxnet did not ‘destroy’ the centrifuges. It was much more clever than that. What it did was subtly alter the speed at which the centrifuges operated, speeding them up and slowing them down at various short intervals - just enough to prevent the uranium from being enriched. It then substituted the frequency feedback from the Siemens SCADA system with false data, so that the Iranians didn’t know the centrifuge speeds were changing. All they knew was that their enrichment process wasn’t delivering results, but they had no idea why. That caused them to spend a lot of valuable time trying to figure out what was wrong.
The worm would then go dormant for periods as long as three weeks to make sure it remained undetected for as long as possible. So even if the Iranians decided to do real-time monitoring sweep of their control system data with external hardware and software, they’d see nothing unless they just happened to be monitoring during one of Stuxnet’s active periods.
The worm was so sophisticated it even injected fake code into the design-time SCADA authoring software so that when software engineers in Iran downloaded and looked at what they thought was the code, what they saw was the original, untouched code, and not the malicious code that was actually running.
The article mentioned the worm targeting only facilities that had exactly 984 centrifuges running. That’s not correct, and would be far too crude. Centrifuges can go online and offline. A facility could add new ones or take old ones out of service. In fact, Stuxnet looked for a very specific type of motor speed controller operating at a frequency profile that would only be used or uranium enrichment. It also required that there be at least 33 identical controllers of this type. The type of controllers it was looking for are only made in Iran and Finland, and aren’t widely distributed. The worm was so specific it even required that Iranian speed controllers outnumber the Finnish ones, to make sure that only an Iranian facility would be affected.
As for the uranium being used for domestic nuclear power, Stuxnet appears to have specifically targeted the enrichment facility at Natanz, which we believe to be enriching far past the requirement for nuclear power fuel. The enrichment facility at Bushehr which can only enrich to the 3% level for uranium fuel, was apparently untouched.
It’s also not certain that America and/or Israel was behind this, although I consider it a good possibility. China had more information about the exact construction of that facility. So unless they passed the information on to the Americans or Israelis, they have to be considered possible suspects. It actually wouldn’t surprise me if this was a joint operation of a number of nations, actually. It beats the hell out of war, and from China’s perspective it also beat the hell out of sanctions that would affect their very lucrative exports to Iran. There are also fingerprints that point to Russia, as the original security breach that got the worm into Natanz in the first place seems to have originated in Russia. The article doesn’t mention that.
The article makes much out of the U.S. government working with Siemens to identify vulnerabilities in their SCADA hardware. What it doesn’t say is that the U.S. government does the same thing with most other SCADA manufacturers. The article says that the Siemens ‘cooperated’ with the government in early 2008. The first Stuxnet sighting was in January of 2009. For a worm of this complexity, and with the amount of testing that would be required, that seems like a pretty short timeframe. But of course, the project could already have been underway for some time before that, and Siemens might only have been called in because some problem held the project up and they needed more info from Siemens.