"That’s how modern systems fail," says Humphrey. "And our networks are so big and fast that things which seem damn near impossible happen every few days."

Not even loss of life necessarily means an event is a digital Pearl Harbor. Three years ago, four Marines were killed after a hydraulics failure on a V22 Osprey plane. They took all the proper measures, but because of software bugs, their plane still crashed. Few even heard of the event, never mind demanded more secure software as a result.

Those scenarios, no matter how dire, didn’t rise to the level of a Pearl Harbor because they failed to inflict significant, collective psychological damage. Before Internet security changes in fundamental ways, we will have to feel as shocked and vulnerable as all Americans did reading the newspaper and listening to the radio on the morning of Dec. 7, 1941 (or watching television on Sept. 11, 2001).

In a sense, this should be obvious. If digital Pearl Harbors were happening every day, they wouldn’t be Pearl Harbors. They’d have a name that conveyed their seriousness, but also their ubiquity and survivability. They’d have a name like "virus outbreaks."

Still, no matter how nebulous the name, we’re hurtling toward what many experts keep referring to, darkly, as the "point."

"The more complex you get, the more vulnerable you are," says Peter Tippett, CTO of TruSecure, a security services company, and noted security expert. Tippett argues that if we simply extend the present situation into the future, the level of complexity and vulnerability we would create will make a digital Pearl Harbor inevitable?and before 2010.

"For seven years, we’ve had these negative events," says Howard Schmidt, vice president and CISO of eBay and former vice chairman of the President’s Critical Infrastructure Protection Board, and, before that, CSO of Microsoft. "And every time there’s an event, it’s called a wake-up call. It’s like those alarms that crescendo to wake you up. We’re getting to that point, where it’s so loud, you wake up."


December 7, 2008: A Moment That Will Live in Cyber-Infamy
The alarm goes off in 2008. Several security experts’ composite picture of a digital Pearl Harbor looks like this (although given that the event is by definition unpredictable, it will, in fact, probably not look like this):

It is global and instantaneous. It is so fast?seconds long?that no one knows about it until it’s over. It does not attack PCs; it attacks the Internet infrastructure?such as domain name servers and routers?and industrial systems connected to the Internet, like utility control systems. It exploits an unknown or little-known vulnerability.