Power plants, oil refineries and water supplies increasingly dependent on the Internet are under relentless attack by cyber spies and thugs, according to a McAfee report released Thursday.

The "Critical Infrastructure in the Age of Cyber-War" analysis by the US-based Center for Strategic and International Studies said the price of "downtime" from major attacks exceeds six million dollars a day.

"If cyberspace is the Wild West, the sheriff needs to get to Dodge City," concluded the study commissioned by McAfee, which sells computer security software.

In most developed countries, operating systems of critical infrastructure including power grids and oil refineries are linked to the Internet where they can be targeted for attacks.

"There are absolutely foreign entities that would definitely conduct (cyber) reconnaissance of our power infrastructure," said Michael Assante, chief security officer of the North American Electric Reliability Corporation.

"They would be looking to learn, get a foothold and try to maintain sustained access to computer networks."

Researchers surveyed 600 IT and security executives from critical infrastructure enterprises in 14 countries in September of 2009.

Operators of enterprises reported that their networks and control systems are under repeated cyberattack, according to the study.

And while defenses were deemed acceptable, harsh economic conditions have tightened spending on computer security while attackers have grown more sophisticated, survey results indicated.

"There is no identifiable protection model that will keep pace with the evolution and sophistication of cyber threats," said Assante.

"In addition, innovative technologies, from cloud computing to Smart Grid meters and SCADA connectivity, continue to create new vulnerabilities."

While the most common target of attacks was financial information, operators of energy, oil, and gas facilities saw assaults on operational controls, according to the survey.

A third of the respondents saw the threat as growing, while two fifths said they expect a major Internet security incident in their sector within a year.

The United States said Thursday that Google's problems in China with cyberattacks could deter US companies from investing in the Asian economic powerhouse.

Google has threatened to abandon its Chinese search engine, and perhaps end all operations in the country over the recent cyberattacks. It has also said it is no longer willing to bow to Chinese government censors.

China has said the hacking charges were without foundation.

Critical systems operators feared the potential of cyber-war.

"Although attribution is always a challenge in cyberattacks, most owners and operators believe that foreign governments are already engaged in attacks on critical infrastructure in their country," the study said.

"Other cyberattackers range from individual hackers and e-vandals to organized crime enterprises. Financially motivated attacks like extortion and theft-of-service are widespread."

Oil and natural gas operations reported the highest rates of "stealth infiltration" with 71 percent claiming to have been targeted.

One-in-five critical infrastructure entities reported being the victim of extortion through cyberattack or threatened cyberattack within the past two years.

Extortion was described as demanding payment to appease attackers that say "hey, I can make the lights go out."

The study showed cyber-extortion to be most common in India, Saudi Arabia/Middle East, China and France.

China registered highest in infrastructure cyber-security while Italy, Spain and India were at the low end of the spectrum, according to the study.

"As long as major governments desire unimpeded operational freedom in cyberspace, it will continue to be the Wild West," researchers said.

"In the meantime, the owners and operators of the critical infrastructure which makes up this new battleground will continue to get caught in the cross-fire and may indeed need what amounts to their own ballistic missile defense."

UN chief calls for treaty to prevent cyber war
Davos, Switzerland (AFP) Jan 30, 2010 - The world needs a treaty to prevent cyber attacks becoming an all-out war, the head of the main UN communications and technology agency warned Saturday.

International Telcommunications Union secretary general Hamadoun Toure gave his warning at a World Economic Forum debate where experts said nations must now consider when a cyber attack becomes a declaration of war.

With attacks on Google from China a major talking point in Davos, Toure said the risk of a cyber conflict between two nations grows every year.

He proposed a treaty in which countries would engage not to make the first cyber strike against another nation.

"A cyber war would be worse than a tsunami -- a catastrophe," the UN official said, highlighting examples such as attacks on Estonia last year.

He proposed an international accord, adding: "The framework would look like a peace treaty before a war."

Countries should guarantee to protect their citizens and their right to access to information, promise not to harbour cyber terrorists and "should commit themselves not to attack another."

John Negroponte, former director of US intelligence, said intelligence agencies in the major powers would be the first to "express reservations" about such an accord.

Susan Collins, a US Republican senator who sits on several Senate military and home affairs committees, said the prospect of a cyber attack sparking a war is now being considered in the United States.

"If someone bombed the electric grid in our country and we saw the bombers coming in it would clearly be an act of war.

"If that same country uses sophisticated computers to knock out our electricity grid, I definitely think we are getting closer to saying it is an act of war," Collins said.

Craig Mundie, chief research and strategy officer for Microsoft, said "there are at least 10 countries in the world whose internet capability is sophisticated enough to carry out cyber attacks ... and they can make it appear to come from anywhere."

"The Internet is the biggest command and control centre for every bad guy out there," he said.

The head of online security company McAfee told another Davos debate Friday that China, the United States, Russia, Israel and France are among 20 countries locked in a cyberspace arms race and gearing up for possible Internet hostilities.

Mundie and other experts have said there is a growing need to police the internet to clampdown on fraud, espionage and the spread of viruses.

"People don't understand the scale of criminal activity on the internet. Whether criminal, individual or nation states, the community is growing more sophisticated," the Microsoft executive said.

"We need a kind of World Health Organisation for the Internet," he said.

"When there is a pandemic, it organises the quarantine of cases. We are not allowed to organise the systematic quarantine of machines that are compromised."

He also called fo a "driver's license" for internet users.

"If you want to drive a car you have to have a license to say that you are capable of driving a car, the car has to pass a test to say it is fit to drive and you have to have insurance."

Andre Kudelski, chairman of Kudelski Group, said that a new internet might have to be created forcing people to have two computers that cannot connect and pass on viruses. "One internet for secure operations and one internet for freedom."