digest
Introduction
This is Natanz, a nuclear facility approximately 200 miles from Tehran, and its goal is to develop Iran's first nuclear bomb. It's been built in the middle of a desert under a thick layer of concrete, guarded by an entire army and completely cut off from the rest of the world. Iran's efforts to get itself the bomb don't sit well with the United States, Israel, and a bunch of other countries in the region. Faced with this threat, some countries start a collective effort to find strategies and measures that could thwart Iran's ambitions. Of course, sanctions will affect us, but it only will delay our projects. After diplomatic efforts fail, the Allies zero in on another strategy. They create Stuxnet, the most powerful cyber weapon in the world. Stuxnet infected and damaged the Iranian nuclear program. Stuxnet is the first time where we've seen significant physical damage created by a cyberattack.
Natanz is cut off from the internet. The only way to get any malware inside the complex is to find a person who would physically go into the facility and install it on a computer system. That person is a Dutch spy who delivered the malware to Natanz and enabled the whole operation. Here is the story of Erik Van Sabben, the spy behind Stuxnet.
Creating Stuxnet
There were several reasons for the US to be wary of Iran developing weapons of mass destruction. For one, if Iran got its hands on nukes, all of its neighbors would do whatever they can to get them to. The most volatile region on Earth turned to nuclear. Another reason was pressure from Israel, an important ally of the US and a sworn enemy of Iran, to whom a nuclear armed adversary would mean an existential threat. Our second goal is to prevent regimes that sponsor terror from threatening America or our friends and allies with weapons of mass destruction.
But Iran perceived things differently. Constantly in conflict with most of its neighbors, it saw acquiring the bomb as the only way to ensure its own security. But you can't build a bomb without some serious investments. You need scientists, facilities, equipment, and most importantly, a massive amount of nuclear fuel. Quite a few countries managed to get all of that, though, such as Pakistan, who tested a nuke in 1998, and it gladly sold some of its know-how to Iran. With this head start, Iran took matters into its own hands and began setting up the production of nuclear fuel. Tens of thousands of centrifuges were set up in the tons and configured to produce weapons-grade uranium.
Initially, the Allies tried convincing Iran to stop the program, but by 2007, the only remaining option was to straight up fly in with bombers and level Natanz, which is what President George Bush seriously considered and rejected. By seeking weapons of mass destruction, these regimes pose a grave and growing danger. Such an attack would mean the start of another all-out war in the Middle East, and possibly beyond.
But there was another option. For a few years, the NSA was exploring the scenario of disabling Natanz with a malicious program. The man in charge of that research was Keith Alexander, the first director of the NSA with a background in computer science and a knack for grandiose operations. Under his leadership, the agency kept collecting every bit of intel about the Iranian nuclear program. They even seized some Pakistani equipment sold to Libya and built a replica of Natanz to test the attack. Alexander's project was approved by George Bush in 2008 and called Operation Olympic Games, and its result was nothing but groundbreaking. According to numerous researchers, it was a cyber equivalent of the Moon Landing Project. Revolutionary, stupendously expensive, and something we haven't seen ever since.
It cost up to $2 billion and took several years to develop. It also used four unique vulnerabilities in Windows code. Even one of those is extremely rare to find and could cost millions on the underground market. And here's how it worked. The malware would infiltrate Natanz, stay hidden, and destroy the centrifuges by slowly, very slowly, spinning some of them out of control. In the span of several months, the rate of critical failure would slightly increase, not enough to raise suspicion, but enough to throw a serious wrench into Iran's nuclear efforts. It was a genius solution to a difficult problem, but it had one fatal flaw: how to deliver a piece of malware to one of the most secure places on the planet.
By the way, if you like this video, please like and subscribe so you don't miss our next one. Thanks.
The Stuxnet Agent
It was the air gap, the most basic and the most effective form of network security. It's when you literally cut off your computers from all external connections, so there's no physical connection between them and the internet at large. Natanz had an expansive and complex internal computer system, but that system was separated from the rest of the world by miles and miles of desert. To deliver malware into the facility, you had to get there physically. And if you had seen at least one spy movie, you know this is where handsome, smartly-dressed people with a particular set of skills come in.
The NSA needed a secret agent who could breach Natanz, but it didn't have one. Well, sure, the NSA had lots of special agents, but not the ones that can waltz in and out of a secret military facility in the middle of an adversary's territory. So the agency shopped around for possibilities, and eventually found one. AIVD, the Dutch General Intelligence and Security Service. Basically, an equivalent of the CIA from the Netherlands. Being a close ally of the United States, it agreed to help sabotage Iran's nuclear program. It also had the perfect man to do that, Erik Van Sabben, a 36-year-old engineer with an Iranian wife. Crucially, Erik worked for a Dubai-based company that regularly smuggled sanctioned equipment to Iran. He was recruited by the AIVD in 2005, becoming a mole for law enforcement in a company that regularly breaks the law.
In 2008, he got a special assignment. He had to pay a 10-day visit to Iran, ostensibly to visit his wife's relatives and celebrate the New Year. During that visit, something strange happened. Suddenly, Erik became nervous and scared to the point of panic. He got out of Iran as quickly as possible, as if somebody was chasing him. In retrospect, it was quite unusual for a man who had worked for a company that did lots of illegal stuff, and even more so, considering that he spent years working undercover. Something during that visit scared him. Something he saw or experienced or did in Iran.
We may never know for sure, but some sources indicate that visiting relatives was just a cover story. In reality, Erik came to Iran to smuggle water pumps, sophisticated equipment sanctioned by the United Nations and nearly impossible to acquire for Iran. Those water pumps were installed in Natanz, and one of them had a nasty surprise, a copy of Stuxnet, left there by the NSA. According to Dutch Special Services, the Americans didn't even notify AIVD about this mission. They just used their spy to gain access to Iran's nuclear facility, which eventually led to a bit of a diplomatic clash between the US and the Netherlands.
As for Erik himself, his nervousness and a hasty flight from Iran shows that he most likely knew what happened, or at least suspected something. Whatever the case, he didn't have much time left. Several weeks later, in January 2009, Erik was riding his motorcycle through Sharjah, near Dubai. Suddenly, he lost control of the machine and fell. In a matter of seconds, his neck was broken, and the Dutch secret agent was no more.
For over a decade, nobody knew how Stuxnet got into Natanz. Many theorized it was one of the workers of the facility who willingly or unwillingly snuck it in on a USB stick. In 2019, an investigation by several journalists revealed that Dutch intelligence services were involved. But what exactly this meant remained a mystery. Only in 2024, after an extensive search for witnesses, a Dutch newspaper, deVolkskrant, finally revealed the truth. Numerous officials from the Netherlands, Israel, and the United States confirmed the role of Van Sabben and his water pumps.
This doesn't mean we have to dismiss that previous story about Stuxnet being delivered a USB stick. There were three versions of the malware, each more destructive than the last. The development project was passed to the Obama administration, which renewed it with vigor. The initial plan was deemed too slow. The new versions of the worm were designed to work faster and more aggressively. Van Sabben delivered just one Stuxnet version out of the three. Two more got into Natanz some other way, maybe through other agents, smugglers, or USB stick-wielding scientists. We may never know. The people behind those attacks may be alive and well, or caught by Iran, or...
Investigation
When Dutch journalists talk to people close to Van Sabben, both his relatives and the first responders who got to the scene after his motorcycle accident, all of them agreed. There is no indication that the agent's death was anything but an accident. No signs of attack, no traces of tampering on the motorcycle, nothing. But then one anonymous AIVD employee did not agree with that. "He paid a high price," the employee said. Was Erik really killed for what he did? And if so, who accomplished that? Was it Iran's retaliation or somebody tried to tie up loose ends?
The existence of Stuxnet was revealed only in 2010 when the third version of the malware began spreading through the world. Researchers combed through the code and eventually found out what it did. By then, Iran developed an antidote to the worm, and the work at Natanz resumed. According to various estimates, Stuxnet destroyed around a thousand centrifuges and held up the nuclear program for a year or two. Experts agree that its efforts on the target were mixed at best, or at least not particularly reflective of its estimated cost. But this wasn't the largest impact of Stuxnet. Many call it the first true cyber weapon, or at least the first one that caused destruction in the real world. It started the age of cyber warfare, and that start was marked by the work of one person named Erik.
We hope you enjoyed this video. Check out the description for the sources we used. There's lots of fascinating stuff there. If you'd like to see more videos about cyber warfare, cyber crime, and anything in between, we have playlists of videos that might scratch that itch. Thanks for watching.