Did Stuxnet work? Not as well as we think, says Ivanka Barzashka in a new RUSI Journal article, Are Cyber-Weapons Effective? Assessing Stuxnet’s Impact on the Iranian Enrichment Programme:
[C]entrifuge numbers unexpectedly dropped after the first Stuxnet attack wave in June 2009. Inspectors’ records show that between May and August that year, while the total number of operational centrifuges decreased by more than 300, the amount of machines being installed grew by almost twice that amount – indicating either extreme confidence or a desperate attempt to try to keep enrichment production steady. This indicates that Iran was bringing in additional centrifuges, but fewer machines were actually working […] Consecutive Stuxnet attacks showed no net effect on centrifuge numbers at Natanz; in fact, the number of running centrifuges slightly increased after the malware’s second and third attack waves in March and April 2010 […]
In fact, uranium-enrichment capacity grew during the time that Stuxnet was said to have been destroying Iranian centrifuges. Iran produced more enriched uranium, more efficiently: the entire plant’s separative capacity per day increased by about 40 per cent, despite the fluctuations in centrifuge numbers, and the IR-1 centrifuges’ annual separative capacity jumped by about 60 per cent […]
Analysis of trends in centrifuge numbers shows a correlation between an unexplained drop in machines and the first Stuxnet attack in 2009, but not consecutive attacks – contrary to reports that the malware was wrecking Iranian machines in 2010. If sabotage did occur, it was short-lived and most likely happened between May and November 2009. The situation appears to have been under control by 2010. More significantly, Iran’s ability to successfully operate new machines was not hindered.
See, also, my book review in the FT of Thomas Rid’s Cyber War Will Not Take Place.