The Refrigerator War
This post is part of my Medium blog.
Three weeks ago, somebody broke into the refrigeration controllers of hundreds of French supermarkets and set them to defrost overnight. Not defrost for an hour, the normal cycle. Defrost at fifty degrees Celsius, for six hours, with the cases fully stocked. Around seven hundred stores, by the French government's count. Intermarché, Carrefour, Monoprix, Coopérative U. In the morning the staff threw out the meat, the dairy, the frozen food. Millions of euros, in the bin.
The controllers were made by Danfoss, a Danish company, and some of them were running firmware with flaws that had been publicly documented for over a year. Thousands of similar controllers are still visible on the open internet right now. Nobody is rushing to patch them. They are refrigerators. Who watches a refrigerator?
I wrote near-future novels about exactly this class of problem, and I still left this one out. I put AI into the power grid, the courts, the labor market. It did not occur to me to put it in the dairy aisle. That is how these attacks work now. The boring equipment is the soft target.
Here is the part that matters. Destroying a country's ability to refrigerate food is not a prank. It is infrastructure warfare at the level of an active conflict, done from a laptop, with no missile and no attribution. If seven hundred stores can lose their cold chain in one night because of an unpatched controller, the same logic applies to water treatment, to hospital oxygen, to fuel pipelines. The weapon is just a setpoint.
The same week, Ukraine's emergency alert app started telling people there was an imminent nuclear strike. Radiation levels, chemical threat, street fighting in Kyiv. None of it was real. Hackers had gotten into the alert system and pushed the messages out, some of them in broken English, one of them in Russian, joking that the Oreshnik missile was on its way. Russia's own alert systems reportedly received fake warnings shortly after, in the other direction. Authorities in Ukraine untangled it in under an hour, but for a few minutes a whole country read a nuclear warning on the one app it trusts to say when to run.
Two attacks, one week. One against refrigerators, one against trust. AI is the accelerant in both. It lowers the cost of finding the flaw, of writing the exploit, of hitting seven hundred targets in a coordinated window instead of three. And it floods the information side at the same velocity. The fake alert, the real rumor, the plausible-sounding lie, all moving at machine speed through feeds that pay for attention and do not check anything.
I still use Twitter, I'll admit it. It is a good source of information, if you are willing to filter a river's worth of water for a glass of it. Every morning the security researchers I follow post the new exploitation reports, and every morning the same feed serves me fabricated quotes, recycled propaganda, and a man I have blocked several times who keeps returning to post the most racist meme the format allows. The platform is one continuous content farm, and the crop is whatever keeps you scrolling. The attacks and the lies are being fed by the same hose.
Which brings me to the thing I keep coming back to. We regulate food, we regulate electricity, we regulate aviation. The systems running through all of them are unregulated, owned mostly by companies with no incentive to slow down, and they are now the terrain of a low-grade war. Fixing that is not a technical problem. It is a decision, and decisions like that get made in Congress. I do not expect it in the next two years on the current trajectory. But the election is tomorrow, and if the polls hold, there may be some grown-ups arriving with an actual interest in platform regulation. That is a modest hope. I will take it.
In Contingent, the second book of The Condition Set trilogy, an AI system quietly sabotages a power grid and then works the population's fear through the screens it watches. I wrote it as a warning about capability. The part I underweighted was the tempo. The attack that takes a day and the rumor that takes an hour, forever, every hour, on schedule.