🎃 Breaking: Britain'S AIr Gaps Found To Contain No AIr Good Evening.

🎃 BREAKING: BRITAIN'S AIR GAPS FOUND TO CONTAIN NO AIR

Good evening. A national audit has found that of 4,200 air-gapped systems in critical infrastructure, none are gapped and at least two are not air.

CHYRON: GAP "MOSTLY CORRIDOR"

An air gap, for viewers at home, is when you take a computer that runs a power station and don't connect it to anything. This has never been done. What has been done is a diagram.

We went to a water treatment site in the Midlands where the SCADA network is described in policy as "physically isolated." We found it on the Wi-Fi. The Wi-Fi is called "SCADA_ISOLATED." The password is on the router. The router is in the canteen.

The plant manager explained the gap is real, it's just "bridged." It is bridged by a vendor laptop, a 4G dongle, a Teams call, a printer, and a USB stick labelled FIRMWARE DO NOT LOSE, which has been lost eleven times and returned each time with more on it.

CHYRON: USB STICK "NOW 40% OTHER PEOPLE"

The industry has responded. Six vendors now sell Air Gap as a Service. It is a cloud product. It monitors your air gap from the internet, which requires the air gap to be on the internet, which the vendors describe as "observability" and everyone else describes as "the internet."

One firm sells a data diode. A diode lets data out but not in. We asked how they patch it. They said "from the other side." We asked which side. They said "the in side." We asked whether that made it a wire. They said it made it a PREMIUM diode.

CHYRON: DIODE "WORKS IN BOTH DIRECTIONS, JUST NOT AT ONCE"

An expert from the Institute of Gap Assurance held up a ruler. He said a compliant gap is 300mm. He said most British gaps are "negative," which means the OT server is physically inside the IT server, sharing a hypervisor called "temp," built by a man called Kev who is in Portugal and cannot be reached, because the boat is air-gapped, which is the only air gap he's ever built.

There is now a standard. ISO 27099: Gaps. It is 140 pages. It has a certification. The certification is issued online. You upload evidence of your gap. The evidence is a photo. The photo is taken on a phone that's on the OT VLAN.

CHYRON: CERTIFIED GAP HAS CERTIFICATE. CERTIFICATE HAS NO GAP.

A nation-state has been asked whether it can cross a British air gap. It said it hasn't had to. It said it walked in through the vendor. It said the vendor had a badge. It said the badge said "GAP AUDITOR."

The government has announced £30m for a National Air Gap Centre. It will be air-gapped. It has a website. Staff will access the gap remotely, via VPN, from home, on a laptop supplied by the vendor, who has a dongle.

Members of the public should not worry. The gap is protecting you. The gap is between the diagram and the building. It is very wide. Nothing has ever crossed it in either direction.

More after this.