How would we even know if they were acting, though? It's not like they're going to broadcast all the security steps they're taking. Just because we don't hear a strategy doesn't mean there isn't one.

The targets of those attacks are large numbers of private companies whose IT employs many of HN subscribers. If something was being done by the government to fix (or, more likely, mandate fixing) those networks, this community would see it.

> aren't actively forcing anything

You mean like a worm destroying Iranian PLCs?

That wasn't just the USA, and it turned into a boondoggle which embarrassed the perpetrators and gave the appearance that targeted cyberattacks were high-cost/low-impact.

I suppose that it is a diplomat's job to appear stupid until they have stolen your shoes, but I'm not sure anybody can act that well. My confidence in the West's ability to perpetuate an offensive cyber war is pretty low. Our main advantage is the quantity of servers/data that reside in/flow through our borders, but that's not too hard to dodge. Cryptocurrencies also erase the hammer of losing access to US financing.

The Iranian government is not a significant source of ransomware, to my knowledge, so I don't see how that's relevant at all.

Stuxnet was/is a worm that attacked air gapped PLC systems at Iran’s Natanz nuclear enrichment facility. It was the most sophisticated piece of malware ever discovered, allegedly by US/Israeli operatives.

The war is just beginning... they need to unplug critical systems even if a dropped USB stick could circumvent that.

Someone I know was happy because he could do his job remotely... controlling an hydroelectric plant... (that should not be possible).

How on Earth do you react with reasonable latency if you're N milliseconds away from all sources of truth, and or on a residential-class Internet connection without all kinds of SLAs?

That's a security problem in and of itself.

Humans don’t react on those timescales. These systems where operators are doing things remotely have low latency things for any automation. It’s the “management” interface we’re talking about here.

>So far Western governments aren't actively forcing anything

What would you call the regular use of sanctions or the recent "trade war" with China?

I don't agree with the statement that criminal hackers mean we are at war, but if you consider that kind of damage war the US has been an aggressor for years.