Why am I convinced the Blackout was Caused by a Cyberattack, Even Though No Evidence has Been Presented?

Flame’s discovery was made public at the end of May 2012 after an investigation carried out between the International Union of Communications ( ITU ) and Kaspersky Lab, published here . They baptized it as the most complex cybernetic weapon created to date . Although it seemed to be something totally different from Stuxnet, the researchers realized that the creators of both projects maintained contact and shared source code and modules between both programs.

Then, in June 2012, US government sources confirmed to The Washington Post that the United States and Israel developed Flame jointly , to – again – attack Iran’s nuclear power plants. The newspaper confirmed that Flame was also created in the “Olympic Games” program created by Bush and later backed by Obama.

The initial objective of the virus was to gather information from the computer networks of various Iranian institutions, to plan a cyber attack. There is a very complete analyzes of its source code, made by IT security companies such as ESET.

Nitro Zeus

As if the “Olympic Games” operation was not enough, Obama also ordered the creation of a new program to carry out cyber-attacks against Iran, should the negotiations over its nuclear program fail. Obama wanted to have “another option on the table” in addition to the conventional military attack, so the Nitro Zeus plan was created: a way to defuse critical elements of the Iranian infrastructure without firing a shot.

“The plan was designed to disable air defenses, communications systems and crucial parts of Iran’s power grid “, The New York Times reported in an article written in 2016 by journalists David E. Sanger and Mark Mazzetti, based in turn on the documentary”Zero Days” (2016) directed by Alex Gibney.

Nitro Zeus took cyberwar operations “to a new level,” said one participant interviewed by the US newspaper. The plan was intended to “turn off the electricity grid in much of Iran” if the United States decided to go into military conflict with that country, notes The New York Times in another article, written in November 2018 by David E. Sanger . “Such use of cybernetic weapons is now a key element in the planning of a war by all the major world powers,” in what is now called “hybrid conflicts.”

The plan involved making “all electrical grid systems, Iranian communications and financial systems were infected or had back doors , ” says Business Insider According to the documentary, Nitro Zeus is incorporated into computer systems during the design phase without its users knowing, unlike Stuxnet, which load on a finished system using a pendrive or USB memory.” This built-in feature allows a more secure and effective cyber attack.”

As of January 2011, Beresford worked almost nonstop for two and a half months. He focused on investigating the line of programmable logic controllers (PLC) Siemens S7, which, as explained above, are used to monitor industrial equipment and machinery and, according to parameters read from their sensors, to activate, deactivate or modify their operation.

Like any good hacker, Beresford devoted himself to research and found an online source library, created by a German programmer, which included source code for a wide variety of computers and PLCs, including the Siemens S7. Night after night he studied them, focusing on the protocol used by the machine to communicate with other teams.

Beresford convinced his boss, of the computer security company NSS Labs, to buy him this equipment to make tests, and he agreed thinking about the free publicity that his firm would obtain for discovering security flaws.

When studying them, he found numerous security vulnerabilities in the computers, as well as backdoors that allowed him to read his internal memory and his passwords. In the book “Cyber ​​Shadows: Power, Crime, and Hacking Everyone”, written by Carolyn Nordstrom and Lisa Carlson, it is explained that Beresfold developed software very similar to Stuxnet to violate the Siemens S7 “in his room, in two and a half months , working in his spare time after returning from work, he did it with a limited budget and no previous experience in the industrial control software (ICS) that they were hacking. ”

In May 2011, Beresford sent its conclusions to the ICS-CERT (Cyber-Emergencies Response Team of Industrial Control Systems, institution of the Department of Homeland Security of the United States government ), who studied and confirmed their work . In an alert issued on July 5, the agency announced that it was working with Siemens to resolve the vulnerabilities of the S7.

Beresford boasted and explained that “any average man, your typical hacker, could replicate this very easily,” proving that a nation-state was no longer required to make attacks similar to Stuxnet. Beresford, in fact, used Shodan, a web browser for connected systems, by which he reported that, at that time, there were more than 100 Siemens S7 devices connected to the Internet, “all of them potential targets”.

The researcher planned to demonstrate what he had discovered at the TakeDown computer security conference in Dallas, Texas, entitled “Chain Reacts – Hacking a SCADA,” in which they would disseminate their findings about vulnerabilities in Siemens systems. A summary of the conference noted: “We will demonstrate how a group of motivated attackers can penetrate even the most heavily fortified facilities in the world, without the backing of a nation-state.” We will also present how to write industrial-grade malware without direct access to the target hardware. ”

But then they were contacted by representatives of the Department of Homeland Security of the US government and by the company Siemens, who asked him not to publicly disclose the findings . For that reason, they suspended the conference. “We were asked if we could refrain from providing that information at this time,” Beresford told CNET technology portal . “I decided on my own that the best thing would be not to disclose the information.”

Although one might think that Beresford was threatened, it is likely that the company NSS Labs for which he worked has taken the decision to suspend the conference, in order to maintain good relations with Siemens and be hired by it. Beresford continued working with Siemens looking for vulnerabilities in company equipment, and by 2015 had helped correct 18 critical vulnerabilities in industrial products of the German company.

Venezuelan journalist Ricardo Durán (killed by right wing mercenaries a few years back) made reference to this case in interviews conducted in 2011 on the Venezuelan broadcaster Alba Ciudad. He noted that Siemens industrial control equipment was used in the Venezuelan electricity industry and that two Venezuelan engineers who were sent to Canada at that time to sign a contract renewing the use of these equipment, were detained for a few days in the United States because they refused to sign an agreement that prohibited them to spread the vulnerabilities discovered in these teams.

After Stuxnet and Flame, other viruses, malwares and Trojans with capabilities to attack industrial control equipment, PLCs and SCADAs began to appear on the Internet.

We present below some of the best known cases, including the first cases of blackouts caused by cyber attacks.

Harvex

In June 2014 there were reports of attacks against several companies using Harvex, a remote access Trojan that collects data from SCADA systems. The Finnish antivirus company F-Secure discovered that among the victims were two large educational organizations in France, as well as a producer of industrial machinery in that country, and two German manufacturers of machines and industrial applications.

A company was also affected in California, United States. At that time , 88 variations of Harvex had been detected, used to “obtain access and collect data from networks and machines of interest”.

Ukraine: the first use of malware to cause electric blackouts

Although Stuxnet was used for an attack on Iran’s nuclear plants, there are no records that it has affected in any way the public services of that country.

It is considered that the first successful cyber attack against a country’s electrical network occurred on December 23, 2015 in Ukraine. The attackers were able to compromise the information systems of three power distribution companies and temporarily interrupt the supply of electricity in the Ivano-Frankivsk region, leaving 250,000 people without electricity at a time of the year when there is extreme cold .

The attackers used the BlackEnergy malware to have remote access to the computers of the power station, in an operation that took a while while using different techniques to steal passwords and information from the workers of the company. The computer security company ESET explains that the attackers sent emails with infected Microsoft Office documents, which when opened by workers from the electricity companies installed the BlackEnergy Trojan on their computer.

Once the computer was infected, the attackers used it to enter it without the workers of the electricity companies finding out, and thus they stole their passwords, they explored the company network and they investigated how to enter the SCADA of the control center, overcoming the computer security provided by firewalls, VPN and other mechanisms.

On the day planned by the attackers, they proceeded to cut off electricity, made massive telephone calls to power plants’ public service centers so that legitimate users could not communicate and report power failures, and tried to damage the configuration of the systems SCADA to hinder the reactivation of the electrical system.

For this, the attackers also used a malware called ” KillDisk “, which ices or freezes the computers of the operators when damaging the files of the operating system, and also damages the boot sector of the hard disks, in such a way that, if the operator decides to restart the computer, this one no longer loads the operating system.

According to Wired magazine, the most affected by the attack were the consumers of the energy company Prykarpattya Oblenergo, of which 30 electrical substations went out and approximately 230 thousand people were without electricity during a period between 1 to 6 hours. Two months later, the Ukrainian control centers had not yet fully recovered from the attack, according to a report by the US government .

The Ukrainian government and the Western media attributed these attacks to Russia, or Russian hackers, due to the tension that exists between these two countries after Russia regained Crimea in 2014. It is said that, since that conflict, thousands have been carried out of cyber attacks against Ukraine, allegedly by groups of Russian hackers.

However, Robert M. Lee, one of the experts cited by Wired, says that although the attack was very well planned and sophisticated, “it did not necessarily have to be done by a nation-state.” He found indications that multiple actors collaborated to create the attack.

It must be taken into account that on November 21, 2015, one month before the blackout of December 23,Ukrainian ultranationalist groups placed explosives in power towers that carry electricity to Crimea, the Ukrainian region that was annexed or recovered by Russia in 2014, leaving two million inhabitants of that region without electricity, including a Russian naval base. Hence, some believe that Russia, Russian or Crimean hackers were the ones who carried out the attack in revenge.

However, experts agree that the computer attack on electricity companies in Ukraine had to be planned several months in advance, long before the attack on electricity pylons.

But we must also remember that, most of the time, cyber attacks are made using computers that have been penetrated by the attackers without their owners knowing. Only time will reveal who actually carried out the attacks on the Ukrainian electricity grid.

Industroyer

On December 17, 2016, a new power outage affected regions of Ukraine, including its capital, Kiev. The blackout lasted an hour and affected a fifth of the city’s consumption, according to the energy company Ukrenergo. It affected the Pivnichna substation on the outskirts of Kiev, and left 230,000 people without power in part of the Ukrainian capital and its surroundings.

On January 18, 2017, Ukrenergo company sources confirmed to Reuters that work stations and SCADAs linked to the 330-kilowatt substation “Norte” were affected by external attackers. “The analysis of the impact of the symptoms on the initial data of these systems indicates a premeditated and multilevel invasion” Ukrenergo said.

At that time, law enforcement officials and cyber experts were still working to establish a chronology of events, develop a list of compromised accounts and determine the point of penetration, while track potentially infected computers with malware.

The Ukrainian authorities determined that the flaw was due to a cyber attack using a new malware, called Industroyer. Computer security company Panda analyzed the virus, explaining that it has the abilityto “take over remotely the circuits that control a power plant.” To do this, it uses industrial communication protocols, used in all the world’s electricity factories, as well as control systems that are used in another type of industries such as water or gas supply “. The ESET company drew the same conclusions in its analysis .

Industroyer is much more worrisome than BlackEnergy or Havox for a simple reason: while the first two are spies, Industroyer is specifically made to look for industrial control systems and looks like Stuxnet in that they seek to destroy in their path .

According to the Omicrono website :

The key is that, to this day, electrical switches and circuit breakers are electronic . They can be programmed to perform various functions, and the functioning of the entire electrical network depends on them. These stations with Windows were directly connected to the protection systems, and that’s how Industroyer got out.

Once it has reached the electrical system, it waits patiently for it to arrive on December 17, 2016. When this date is reached, it executes an attack with several modules . These attacks are made to attack specific systems, taking advantage of specific vulnerabilities.

For example, one of the Industroyer modules uses a vulnerability present in Siemens SIPROTEC field devices (equipment to monitor, protect and control processes within power plants) that makes them useless. Industroyer just had to get to these devices, and I was programmed for it . He even had instructions to attack specific devices, such as those produced by General Electric .

Industroyer not only has surgical precision when attacking. In addition to deleting its trace, it also deletes several important entries from the system registry and overwrites the system files. In this way it prevents the computer from restarting, andit hinders the recovery of the electrical system .

Not only does it erase the evidence, it also tries to stop efforts to recover electricity after the attack.

They indicate that, with a few modifications to their code, this malware can attack a rail or maritime transport network, or even end the water or gas supply in an entire city.

Now that we know that the United States (and surely other countries and even groups of hackers and criminals) do have the ability to make cyber attacks on electrical installations, let’s see what happened in Venezuela on March 7.

The Venezuela case

As is well known, on Thursday, March 7 at 4:54 in the afternoon there was an electrical failure that interrupted the electric service almost nationally, at the time when hundreds of thousands of people left their jobs.

At 6:09 in the afternoon, the Venezuelan electricity minister, Luis Motta Domínguez, reported that it was an attack on the generation and transmission system at the Guri hydroelectric plant , which they estimated to recover within 3 hours. They still had no idea of ​​the magnitude of it. In any case, few people could hear it.

If a malevolent mind had to decide what time to start an electric sabotage in Venezuela to cause the greatest possible dislike in the population, assuredly it would choose the time of departure of work: it is the moment in which people are exhausted, just think about getting home, and the last thing they want is to have to face a collapsed public transportation system. In Caracas, the Metro depends entirely on electricity and serves two million people a day. In an outage, the buses become insufficient. The consequence: millions of people had to walk through the city, in some cases for several hours, until they reached their homes.

Many people who work in Caracas live in nearby cities and use the Valles del Tuy electric railway or the Los Teques Metro to get there. Even when the government of Miranda enabled buses, they were not enough either and thousands of people had to patiently wait in long queues that extended early on March 8 to reach their homes. The buses of the government worked heroically without stopping all that time.

The failure immediately affected all mobile cellular telephone systems of the three companies that provide the service in the country (two private and one public); It was impossible to make calls of any kind, or have access to Internet browsing. There was no signal. It was not until half an hour after the failure that some telephone companies began to operate.

Movilnet , the cellular telephone company of the State, experienced  persistent failures and it was impossible to communicate for at least 3 days in most of the country. Cantv, that provides fixed telephony, had serious problems, with sectors that for days did not have tone, or that had it but they did not leave messages, not even to other fixed telephones of the same Cantv. None of the companies has publicly denounced having been the victim of any sabotage.

Jorge Rodríguez, vice president of communication, explained on March 8 that there was a cybernetic attack against the automated control system ARDAS , which regulates the processes of the 20 generating machines of the Guri hydroelectric system.

He indicated that ARDAS is “a kind of computerized electronic brain that regulates the 20 machines of the Guri.” If there is an increase in voltage and electrical demand, the system tells the Guri machines that they must activate and increase the revolution so that If you are working too much, the system tells you to lower it a little bit. “When this system is attacked, for protection the Guri machines stop,” explained Rodríguez.

President Nicolás Maduro gave more details on Monday, March 11. “The first cyber attack went to the brain of the company Corpoelec in the generation there in Guayana, in Guri, in Macagua.” He indicated that it is the computerized system that processes, carries, conducts, directs and self-regulates the entire generation process and all the electricity transmission service in the country. “The screens went black, the driving map was lost. That’s how we stayed for more than 36 hours. ”

But it also revealed for the first time that there was another simultaneous cyber attack, from the outside to the distribution control center of the state energy company Corpoelec, which is in Caracas and that controls the transmission and distribution at the national level. “It is the national brain, to drive the electrical system, as in any country, which remains in Caracas, it was also black, canceled, was left dead”.

He also described that there were attacks on the transmission lines, which, he explained, would have been carried out “using mobile devices that emit electromagnetic signals.”

In addition, an electrical substation exploded on March 11 at dawn in La Ciudadela, Baruta, one of the 5 municipalities of Caracas, leaving half of the inhabitants of the municipality without electricity at a time when they had already recovered the service in almost the entire capital. Maduro described it as another phase of sabotage to the electrical system.

Maduro also said that “cyber attack against the electrical system, the telecommunications and Internet” was directed “from Houston and from Chicago, from two cities in the US , ” another speech on March 12 . It is important to note that the sabotage of public companies of the Venezuelan State have many precedents. The government of Maduro and its predecessor, Hugo Chávez, have been confronted frontally and permanently with the administration of the United States since 2001, when the approval of laws of agrarian reform and protection of the oil industry showed that Chavez was not a charlatan, but someone who was willing to carry out a nationalist revolution in his country to improve the living conditions of its citizens.

What is in dispute after the problems in Venezuela, is the control of the immense natural resources under its subsoil: oil, iron, bauxite, gold, diamonds, coltan and rare elements. In addition, there are immensely fertile and cultivable lands throughout the year and it has beautiful tourist potentials. All this is of great interest to the transnational corporations that make up the establishment American and European. The great closeness of Venezuela to the United States, in relation to other oil suppliers, is combined with the colonialist character that this country maintains with the Latin American nations, from whom it expects an attitude of submission. Not even Barack Obama, perhaps the most progressive of the US leaders in the last 20 years, was devoid of this attitude.

In April 2002, Chávez was on the verge of being deposed by a coup d’état, caused in large part by the United States’ interest in controlling the country and its oil industry. One of the triggers of the coup was that Chávez had removed, on April 8,  senior managers of the state oil company PDVSA, a group of technocrats who openly rejected and despised him for his past as a soldier, and who did not accept his intentions to know better how the industry worked, in order to make changes in it.

Chavez had appointed new PDVSA managers in February, who came from outside the industry, but the top managers rejected them, alleging that this broke the meritocratic culture of the organization. Chávez wanted to reduce the immense operating expenses of the state oil company and redirect a portion of its profits to the creation of social care plans that would help alleviate the problems of poverty and inequality.

After the April coup failed, Chávez adopted a conciliatory attitude, accepted the resignation of the PDVSA managers he had appointed and reinstated those he had fired. But these, in December, joined the Venezuelan opposition in a 62-day business strike that paralyzed the country.

The top managers and middle managers of the Venezuelan state-run PDVSA, including engineers and employees with university degrees who lived in the big cities, joined the strike, while the workers and technicians who lived in the oil fields, however, yes they were with Chavez. Because these middle managers controlled the electronic brain and automated systems for control of processing and distribution, they used their knowledge to paralyze and sabotage the industry and bring production to zero .

In fact, the oil brain of the industry was privatized . The private company Intesa, with  40 percent share in PDVSA and 60 percent held by the American company SAIC , was the one that administered the PDVSA system that controlled the industrial processes. SAIC’s own website showed and still shows with pride that several of its executives came from the US Army and had extensive experience working with intelligence agencies and branches of the armed forces of that country, in the development and consolidation of projects of all kinds. That is to say, PDVSA’s computer brain was under the control of the US agencies.

PDVSA was recovered thanks to the fact that a part of its professionals did not join the strike and they, working together with the workers of the industry and with the help of external technicians and engineers, regained control of the state oil company. A few weeks after the end of the strike, PDVSA was running again at 100 percent capacity.

Chávez was aware of the serious implications that the control centers and computer platforms of the Venezuelan companies and public institutions had been provided by corporations from First World countries, which could very easily look for a way to repeat a sabotage and a paralysis like the one in 2002. So the In December 2004, the president signed a decree to migrate the systems and platforms of the State to Free Software, called the “Presidential Decree 3,390”. This was a great news worldwide, but it was taken with a lot of skepticism and resistance in most public institutions. It was difficult for many to understand the need at a political and technical level of free software in institutions.

We, the members of the Free Software community, tried to explain its importance by reciting the famous four freedoms , as if we were religious evangelists. But more than installing Linux instead of Windows or changing Microsoft Office software by OpenOffice, what should be sought was that our engineers and technicians could understand perfectly how each piece and component of the systems worked in any industry: from machinery even the computers that controlled them (and their software), in such a way that, if any component failed, it could be repaired, modified, replaced or a solution could be devised by our own technicians,without having to resort to those foreign transnationals that could either refuse or implement components to spy on us or sabotage us.

That is the real sense of using Free Software and Free Hardware in the State. Venezuelans call this “technological independence.”

However, it is my opinion that the officials around Chávez in the areas of science and technology were not the best at explaining and motivating those changes. In fact, some of them changed sides and today they are radical opponents .

In the so-called “Free Software community”, to which I belong, many mistakes were also made. The vast majority were more able to change Windows to Linux in the computers and servers of public entities, when what should have been addressed from the very beginning were the SCADA and PLC applications of electronic brains and control centers of public institutions such as PDVSA, because these applications were provided – and continue to be provided – by transnationals from the United States and Germany.

However, a task like that is immense, expensive and requires many years of work.In institutions such as Pdvsa, Cantv or Corpoelec, this was treated with great secrecy and confidentiality, and the managers simply fled any project of migration of these electronic brains. They went the easiest way: to continue working with large corporations, which continued to install their powerful systems and were often “grateful”, paying “commissions” to the managers and managers who hired them (these “commissions” are illegal bribes and secrets that a corporation makes with public officials who make decisions in hiring, in order to “hook” them and ensure that they continue to hire them in the future).

Complaints by Ricardo Durán

But there were always people who denounced the inconvenience of this. The journalist Ricardo Durán, winner of the National Prize for Journalism and a person highly appreciated in Venezuela, made a series of investigations that he presented in 2011 about the problems in the Electric System of the country. Some of them were reflected in the portal of the Alba Ciudad radio station , where he was interviewed by Gustavo Villapol and Yrosva Michinaux.

Durán explained that a SCADA system was acquired between 1994 and 1996 by La Electricidad de Caracas (EDC), which was then a private company. It was implemented in 2000, when the revolutionary process had just arrived, when EDC was already owned by the transnational AES. They said that this SCADA had the function “to operate and maintain the distribution of energy in Caracas and throughout Venezuela.” The scope of work included the delivery of hardware, software, documentation and training. 

However, at that time the Venezuelan State made a study on the system and determined that “their vulnerabilities reached 50 percent” However, “in a strange way in 2010 “, when La Electricidad de Caracas had been nationalized and converted into part of Corpoelec, the same system was bought again, denouncing Venezuelan electrical engineers at that time. They were sent to Canada to sign the contract, but were detained for 10 days in the United States because they refused to sign an information privacy document that prohibited them from disclosing the vulnerability of the system.

He also denounced at that time the preferences given by the Human Resources department of Corpoelec to hiring openly right wing people to place them in key positions in the company (which facilitated finding people willing to carry out sabotages or, at least, not to report them. ). Many of the people who were fired from PDVSA in 2003 for participating in the oil strike ended up working in Corpoelec, he explained.

And although the generation and transmission capacity of the National Electric System at that time was more than enough for the country, however, power cuts frequently occurred because they were made through computer systems.

The journalist Duran was murdered in January 2016, in a case that initially was spread as a robbery, although nothing of value was stolen. Then, the sicariato thesis gained strength. They  investigated fourteen active police of Chacao municipality. Twelve of them were released.  By the time of writing this article, results of the investigations and the causes of his death are still awaited.

Ricardo Durán, Corpoelec and SNC Lavalin

Durán also denounced at that time, in 2011, the Canadian company SNC-Lavalin, a giant transnational of the construction world that works with plants and hydroelectric power stations, of which he indicated that he was responsible for installing SCADA systems for the control and distribution of electric power.

In this regard, it is necessary to remember that the spokeswoman of the Russian Foreign Ministry, María Zajárova, declared on March 15, days after the blackout in Venezuela , that the Venezuelan electric power sector was the target of attacks from abroad, people who knew the operation of the Canadian electrical equipment used in the South American country.

Although the Russian official did not expressly indicate the Canadian company SNC Lavalin, this corporation has acquired a terrible reputation for being involved in very serious cases of corruption worldwide. It will be up to the Venezuelan authorities to investigate whether SNC Lavalin carried out acts of corruption to obtain its contracts with the Venezuelan electric power company Corpoelec, and if it used these to introduce equipment with vulnerabilities in the Venezuelan electricity system.

But it is impressive how SNC Lavalin has been involved in cases of corruption worldwide, related to the payment of bribes and commissions to officials to obtain contracts. A simple Google search shows that in 2013 SNC Lavalin was accused of corruption in countries such as Algeria, Cambodia, India, Libya, Nigeria, Kazakhstan or Bangladesh for commission payments to public officials. Notable cases were those of the Padma bridge in Bangladesh , and the construction of the McGill University Health Center (MUHC) in Canada itself, a mega-hospital that has been said to be “the biggest corruption scandal” in the country’s history. .

In 2012, the executive director of SNC Lavalin, Pierre Duhaime, was relieved of his duties in the company, although he received almost 5 million dollars in compensation . The company did internal investigations and discovered that Duhaime approved a series of”unauthorized payments” worth 56 million dollars, requested by the company’s former vice president of construction, Riadh Ben Aissa, in different countries. Financial Post notes that the payments were delivered by the company to people called “agents”: people and firms hired by SNC to “help the company to establish relationships with potential customers, obtain permits and, in general, provide assistance in places where wants to get contracts “: euphemisms for the delivery of commissions to corrupt officials. 

“Of the more than 600 companies that are listed as forbidden to do business with the World Bank for acts of corruption, 117 are Canadians,which makes the country accumulate the largest number of companies in all countries included. Of these, 115 represent SNC-Lavalin and its subsidiaries , “he said in 2013 the Canadian publication Financial Post . Today , SNC is facing trial in Canada in which, if proven guilty, he could stop for 10 years have contracts in Canada.

This scandal is causing very serious problems to the Canadian Prime Minister, Justin Trudeau , causing the resignation of several members of his cabinet and endangering his re-election, among other reasons, because he is accused of putting pressure on the former Attorney General, Jody Wilson- Rayboul, to avoid the prosecution of SNC through an extrajudicial agreement, with which she did not agree.

Conclusions

I know that many people find it difficult to trust the voices of the Venezuelan government. There is work done worldwide by the media and politicians against the government of Venezuela, from which they highlight their mistakes (real or supposed) and conceal their achievements, to convince the public that it is a gross and incapable government that They deserve to be evicted from power. This work of discrediting is at least 20 years old and has had consequences in the psyche of many people, who tend to  represent any information that comes from their spokespersons.

I decided to write this article from Caracas, when it was still dark because of the blackout, and I started writing it, I barely had electricity. It took me several days, mainly doing it in my spare time, but I did it thinking about unifying in one place the great information that I have been handling for years on this subject, sure that, if this information was known by other people, they would not distrust so quickly the denunciations of the Venezuelan government regarding the cyber attacks, when in fact it is the obvious thing, the natural thing and what more could be expected, given the circumstances and the geopolitical context lived in the United States and in Venezuela.

On the issue of lack of maintenance in the Venezuelan electricity system, An article by Forbes, written on March 9 by Kalev Leetaru , an American academic and entrepreneur with more than 20 years of experience in the Internet world, points out that this could have been used by the US government as an excuse to deny their involvement in the attack on Venezuela. In fact, the lack of maintenance and the desertion of specialists is something that facilitates computer attacks.

Leetaru explained in Forbes that not only was it very likely that a hehco cyber attack had occurred in the United States, but the United States needed to deny it,and the best way to do it was to take advantage of the press information (real and supposed) that there were flaws in the maintenance of the Venezuelan electricity system, because that would make it easier to convince the public that they were not the cause.

It is no wonder then that, a few hours after the electrical failure, the Secretary of State of the United States, Mike Pompeo, has tweeted, blaming the “incompetence” of the Venezuelan government for the blackout , and saving his own government from any attack

Elliott Abrams, special envoy of the US government for Venezuela, also stuck to the script and said something similar on March 9, when he said that “the national blackout in Venezuela is a reminder that the infrastructure, once sophisticated in the country, has been looted and it has deteriorated under Maduro’s mismanagement. ”

We can not deny the problems that exist in the electrical system and in the country, but we can not deny that those problems also offer opportunities for saboteurs. The low salaries that are reported among the workers of the electrical industry facilitate finding willing people to sabotage the system in exchange for bribes, which is essential if you have to access the system remotely because you do not have an Internet connection, as Americans and Israelis must have done to implant the Stuxnet virus in Iran.

Maduro is aware that people within the industry who could help with the sabotage .” There are many infiltrators attacking the electricity industry from the inside, as happened in the 2002 and 2003 unemployments, but those moles will be discovered and punished,” denounced the head of state on March 9, when the blackout was still in the process of being resolved. .

The investigation

On March 12, President Maduro announced that a presidential commission was being created, which would be led by Vice President Delcy Rodríguez, vice president of the country, and will be invited by the Public Prosecutor’s Office, the National Scientific Council and the country’s scientific institutes, in order to investigate the blackout.

Maduro indicated that he has requested the incorporation of international specialists. “I will ask for the support of the UN, and also the active support of Russia, China, Iran, Cuba, countries with great experience in these issues of cyber attacks. We already have the support of these countries. ”

Russia responded a few days later, indicating that they are willing to collaborate in the investigations. “If an official request is received for our specialists to assist in the investigation, it will be considered very carefully,” said Russian Foreign Ministry spokeswoman María Zajárova on March 15.

However, it is necessary that specialists in computer forensics and other related disciplines collect evidence and present them, on the way in which the cyber attack was carried out in Venezuela. It is important to determine exactly how the cyber attack was carried out, in order to correct any vulnerability that still exists not only in the national electricity industry, but also in the control systems, SCADA, PLC and computer systems of any other national public company.This must be done as soon as possible.

Another very common problem is that when a computer suffers a hack or real computer attack, often the rush to resume regular operations make the staff format the computer and reinstall applications from scratch,thus losing logs, records and any evidence that can be used to determine who were the culprits. Therefore, it is better to protect the affected teams (or at least some of them) and not touch them until experts can review them.

And of course it is necessary for the government to answer many questions that we all ask ourselves.

• Why, with the country having so many thermoelectric plants in practically all the states, which could have been operational hours or minutes after the blackout, were they not activated?
• Corpoelec workers have been making public complaints for years about low salaries and the problems of job desertion that this has caused. In this regard, President Maduro also informed, in a visit he made this March 16 to the three hydroelectric power stations that exist in the Caroní River (Guri, Macagua and Cariachi) that there will be a profound restructuring in the public company Corpoelec.
• Nor have official explanations been given about the serious problems that the public telecommunications companies Movilnet and Cantv had during the blackout, although we did know about the hard effort made by their workers to recover their operation.

We hope that soon, in the near future, we will not only have much more information about this cyber attack, but that it will help to protect the Venezuelan electrical system, since circumstances like the ones that Venezuelans live on March 7 do not repeat themselves.