With Iran’s nuclear program back at the center of world debate, it’s helpful to understand with more clarity the attempts to digitally sabotage that program. Stuxnet’s actual impact on the Iranian nuclear program is unclear, if only for the fact that no information is available on how many controllers were actually infected. Nevertheless, forensic analysis can tell us what the attackers intended to achieve, and how. I’ve spent the last three years conducting that analysis — not just of the computer code, but of the physical characteristics of the plant environment that was attacked and of the process that this nuclear plant operates. What I’ve found is that the full picture, which includes the first and lesser-known Stuxnet variant, invites a re-evaluation of the attack. It turns out that it was far more dangerous than the cyberweapon that is now lodged in the public’s imagination. …

Stuxnet’s later, and better-known, attack tried to cause centrifuge rotors to spin too fast and at speeds that would cause them to break. The “original” payload used a different tactic. It attempted to overpressurize Natanz’s centrifuges by sabotaging the system meant to keep the cascades of centrifuges safe. “Protection systems” are used anywhere where abnormal process conditions can result in equipment damage or threaten the health of operators and the environment. At Natanz, we see a unique protection system in place to enable sustained uranium enrichment using obsolete and unreliable equipment: the IR-1 centrifuge. This protection system is a critical component of the Iranian nuclear program; without it, the IR-1s would be pretty much useless.