The Future of Cybersecurity Could Be Sitting in an Office in New Jersey

Meet CyberCity, the model train town hoping to keep your home safe from attack.

The Sans Institute was founded in 1989, and currently leads information-security training for military, government, and civilian officials -- sessions that tend to specialize, these days, in digital forensics and network penetration testing. For the past few years, SANS has been running computer simulation training games (the aptly named "NetWars") for members of the military. But those simulations, officials realized, were insufficient to prepare people for the threats we face -- because cybersecurity, its name notwithstanding, doesn't merely concern cyber-environments. Our physical infrastructures -- our streetlights and power grids and airports and hospitals -- are also connected to, and reliant on, computer networks. Which means that, in a predictable yet fairly horrible twist, our cities themselves are vulnerable to cyber attacks.

So SANS, to account for all that, built a new model, this one intended to capture the "kinetic effects" of cyber warfare -- and meant to emphasize the connection between invisible data and physical destruction. And the game that SANS built, CyberCity, is equal parts hilarious and terrifying: a modified model-train town, 6 feet by 8 feet in width, constructed -- hilariously, terrifyingly -- with parts from a local hobby shop. The game that is trying to prepare the powerful for impending cyberwarfare is currently, Fast CoExist reports, "sitting in an office in New Jersey."

Here's Emily Badger, explaining the 21st-century version of a 19th-century amusement:

CyberCity has its own train network, a hospital, a bank, a military complex, and a coffee shop complete with--and this is crucial to the exercise at hand--free Wi-Fi. The town is virtually populated by 15,000 people, each with their own data records and electronic hospital files. Much of the model town literally came from a hobby shop, but the technology and systems that make it run are modeled on the real world. The power grid components, for example, are the same ones you'd find in an actual city.

CyberCity also has five cameras mounted around it, all of them feeding a live video stream for the high-stake game's players (who run through cyber-attack missions from remote locations). And computers, appropriately, control the scenarios that play out in the scaled-down city.

So in one training scenario, Badger notes, terrorists hack into the power grid, cause a blackout, and then -- eek -- reconfigure the power company's computers so that utility workers can't get into them. Students are then challenged to hack the computers to (somehow) get the lights back on. In another "mission," students have to halt the escape of terrorists from a city -- or at least attempt to do so -- by simultaneously turning every traffic light in town red. In another, they have to derail a train that's loaded with radiological weapons and speeding toward CyberCity. 

It should be noted: The game's scenarios are really just that -- scenarios. This isn't a working model of a town; it's just a model of a town. There's a whiff of security theater to all this -- theater rendered in adorably modeled miniature. The game is, compared to its interactive counterparts, low-budget and low-tech -- comically and terrifyingly so on each count. But that's part of the point. There's a psychic effect to the modeling here, a reminder of the kinetic effects of cyberwar. And it's easy to imagine a less quaint version of the game, one that actually is a working model of a power grid or a hospital or whatever -- one that exposes students to more realistic scenarios of attack. As it is, CyberCity, with its scaled-down and model-focused layout, emphasizes the connections between the cloud-connected world and the quotidian; in its way, it exposes the many vulnerabilities in the places we take most for granted. Including, yes, New Jersey. 

Hat tip J.J. Gould.