Although he never spoke of it, the proportions of the room and the darkness were a sort of physical metaphor to Kim. The ranks upon ranks of empty chairs symbolized the common people of North Korea: voiceless and impotent in their numbers, and utterly in the dark. By contrast, Kim and his handful of trusted advisors basked in the light of knowledge, power, and privilege. Which was as it should be.
He motioned toward General Pan Sok-ju. “Tell me about the ship.”
The general’s head dipped in a gesture that might have been either a nod or a bow. “Sir, the Lecticula is passing west of Jamaica, and proceeding at normal speed. We expect the American blockade vessels to attempt intercept sometime in the next four to six hours.”
Kim nodded. “Is everything in place for our counter stroke?”
“I can only speak for the military preparations, sir,” the general said. “We have confirmation that the Kang Chul Poong is ready for combat. I assure you that the blockade will not prevent the Lecticula from reaching Santiago de Cuba.”
Cho Song-taek raised a tentative finger. “If one may ask, what happens after that? The Cubans have been warned about our ship, and they know the nature of its cargo. Even supposing that they are foolish enough to allow the ship to dock, there will be no chance of smuggling the missile launchers ashore. America’s surveillance drones and reconnaissance satellites are watching now.”
“The ship will not attempt to dock,” said Kim. “It now has orders to anchor in the harbor without offloading cargo.”
Cho Song-taek started to respond; then the set of his features changed as he began to recognize the propaganda potential in this new situation. “A message for our comrades in Havana?” he mused. “Armed nuclear warheads at the doorstep of Cuba’s second largest city?”
Kim Yong-nam didn’t answer. His headache — a continual and unwelcome companion for months now — was beginning to gain strength again. The pain was a distant throb, easily ignored for the moment, but it was definitely getting stronger. He would have to take the pills soon, before it gained momentum toward its full and crippling potential.
He looked toward the man who was essentially the Minister of Cyber Warfare. “What is the status of our diversion? Is that ready as well?”
“Of course, sir,” said Sun Jin-sung. “We await only your order.”
Kim consulted his watch: a Bulgari Magsonic Sonnerie Tourbillon that cost slightly more than a high-end Ferrari. “Initiate the diversion three hours from now. We will give the American Imperialists something to think about when the steel wind begins to blow.”
CHAPTER 15
In a strictly technical sense, the malware designated as Kumiho was not a virus. Nor was it a worm, a zero-day vector, or even a Trojan horse, although it shared certain properties of all those types of malicious code. Kumiho was a cyber weapon, custom-tailored for the SCADA protocol used by the power grid of the Eastern United States.
Developed and deployed by military hackers from Central Committee Bureau 121, the weapon was (ironically) woven into an authorized security update for the IEC 61131 industrial programming language. Folded safely into the script structure for Programmable Logic Controllers, the weaponized code was now recognized as an approved feature of the software, which made it impervious to virus scans and intrusion detection routines.
In Korean folklore, kumihos were malevolent nine-tailed fox creatures with magical powers. In the old stories, a kumiho could assume the guise of a beautiful woman to deceive young boys and devour their livers.
This Kumiho had no mystical abilities, but its powers of deception had enabled it to remain undetected since its insertion the previous September. And — while the weapon knew nothing of young boys or livers — it was no less dangerous than the mythical creature for which it was named.
After lying dormant for nearly half a year, Kumiho received its activation signal at 9:12 p.m. and eleven seconds. The malicious software went immediately to work. Following a predetermined sequence, it transmitted an electrical overload alert, a high temperature warning, and a major component malfunction report to the first transformer on the substation bus: a 230 kilovolt step-down unit that was roughly the size of a compact car. Any one of these fault conditions would have been enough to trigger the automatic load shedding routines built into the transformer’s programmable logic controller. Taken together, they constituted a serious enough threat to demand more drastic action.
The PLC had no way of determining that the fault signals were counterfeit. The unit did exactly what it was designed to do: it slammed the gigantic oil-cooled circuit breakers open to isolate the “damaged” transformer from the electrical bus, and forced an emergency shutdown.
But Kumiho wasn’t finished yet. Before transformer one could complete power down procedures, its PLC received an emergency restart signal, cancelling all previous alerts. The mammoth breakers slammed shut, bringing the still-charged transformer back into circuit without performing any of the usual safe-start procedures.
The instant the breakers closed, the cycle began again. A new set of counterfeit fault signals forced the giant transformer into isolation and shutdown mode.
Within seconds, the cyber weapon had instigated the repeating emergency cycle on every transformer in the substation. All along the power bus, breakers snapped open and closed with juttering metallic bangs.
The substation’s load balancers tried (and failed) to stabilize the wildly oscillating power output of the station. The quiet hum of normal operation was replaced by what sounded like an army of drunken carpenters blindly pounding on anything within reach of their hammers.
If properly trained human operators had been on hand, they could have manually switched the transformers out of circuit and shut down the PLCs at the first signs of failure. Most — if not all — of the ensuing hardware damage might have been prevented. But very few local power substations are manned, and this site was not one of the lucky exceptions.
The first physical destruction occurred in less than a minute. One of the abused breakers fused itself in the closed position and an attendant junction box arced with overvoltage and exploded into flames. This was quickly followed by a series of cascading equipment failures.
In a surprisingly short time, the Idylwood Substation was no longer a functional part of the eastern regional power grid. It had become a smoking chaos of berserk machine assemblies, rapidly tearing themselves to pieces.
Approximately thirty-four miles to the northeast and twenty-five miles to the southeast, variations of the attack were playing out at the Elkridge Substation in Baltimore, Maryland, and the Whittington Road Substation in White Plains.
By 9:16 p.m., all three substations were out of commission due to catastrophic equipment failure. The Idylwood and Elkridge sites were both shaping up into major fires.
The three affected substations formed a scalene triangle covering just under 421 square miles of territory. Within the boundaries of that triangle lay the cities of Washington, DC; Arlington, Virginia; and some forty-odd smaller cities, towns, and communities.
The North Korean cyber assault team had planned well. The average temperature in the Washington Metropolitan Area was 34 degrees Fahrenheit and falling when the capitol city of the United States lost all electrical power.