Freezer Hacks ‘a Wake-Up Call for Society’ Pentagon CIO Says

Kirsten Davies, the Pentagon’s Chief Information Officer, said the potential significance for the US of the recent supermarket freezer hacks in Europe dawned on her abruptly when she first read about them.

“Holy cow! What else uses refrigeration?” she recalled of her immediate reaction, in an interview with Bloomberg News.

Davies described the freezer hacks as “a wake-up call for society,” and she rattled off other vital functions that could be impacted by them, including at military bases: blood banks, plasma and organ donation, manufacturing and transportation of food. She portrayed cyberattacks against so-called operational technology — the software and hardware used for industrial processes and critical infrastructure — as surprisingly easy hacks that have a real-life physical impact, as if an attack is “reaching through digital wires and touching you.”

France this week blamed Iran’s Islamic Revolutionary Guard Corps for attacks on refrigeration units at more than 700 stores that resulted in spoiled food during October and November. Blood banks in France were also affected in early November incidents, although officials said no blood was spoiled thanks to early-warning systems.

Foreign Minister Jean-Noel Barrot vowed to seek sanctions and other unspecified measures. Iran has denied responsibility.

Six US military installations have also acknowledged in public statements that freezers at their commissaries, which sell discounted food to soldiers and their families, went out simultaneously during August. However, they haven’t provided a reason for the outages. Davies said she couldn’t comment on the incidents affecting US military facilities.

The Army Criminal Investigation Division has said it’s working with other investigators to determine the full extent of what occurred.

A Defense Department official said the Pentagon doesn’t comment on intelligence-related matters as a matter of practice and referred a reporter to the official French government statement attributing responsibility to Iran.

Along with one other senior Pentagon official, Davies is responsible for safeguarding US defense critical infrastructure on which the military system relies. Hacks against such technology underline the importance of boosting operational technology security – safeguarding physical equipment that may be connected to the internet, she said.

Davies described OT hacks against the military as “a real threat vector.” “Think about the Navy, and all of the ships and the submarines, and the airplanes, and the software platforms that actually run the way in which a plane would be operating,” she said of the potential hacking threat.

The US military, which employs about 3 million people, also relies on blood banks to treat wounded military personnel, in addition to civilian infrastructure for power, water and fuel systems that are susceptible to attacks against internet-connected machinery. Weapons systems could also potentially be affected in similar ways.

Davies said the Pentagon is “ramping up” its responses to the risks of what she described as relatively “easy to perpetrate” hacks, from basic cybersecurity hygiene to leaning on “agent swarms” —— a group of artificial intelligence agents that work together to accomplish a task assigned to them — to inventory defense critical infrastructure and problems afflicting it. She acknowledged the risks and opportunities from using AI agents, which recently have spun out of control in a number of alarming scenarios.

“We’re being very careful about how we program them, have guardrails around them, put them in sandbox environments to test it first,” she said. “Sandboxes” are an isolated virtual environment where AI agents can be safely tested.

Despite risks, Davies said AI can help address the scale of the problem.

“I think people have no idea how large we are,” she said of the inventory effort. “I haven’t found the edge of that yet.”

Photo: Photo credit: Wiktor Dabkowski/Bloomberg