Cyberterrorism

In the summer of 2009, Paul Davis (2009), contributing editor of the International Association for Counterterrorism & Security Professionals (IACSP) interviewed Richard L. Cañas, the New Jersey Homeland Security Director. In the interview, Mr. Cañas discussed the four mega-disasters that concern him. These mega-disasters include hurricanes, a nuclear attack, a pandemic, and cyberterrorism … in that order. Hence, cyberterrorism is a major concern of homeland security professionals in the United States.

What is Cyberterrorism? According to the Federal Bureau of Investigation (FBI), cyberterrorism is any “premeditated, politically motivated attack against information, computer systems, computer programs, and data which results in violence against non-combatant targets by sub-national groups or clandestine agents.” Unlike a nuisance virus or a computer attack that results in a denial of service (DoS), a cyberterrorist attack causes physical violence or great financial harm. According to the U.S. Commission of Critical Infrastructure Protection, examples of cyberterrorist targets include the banking industry, military installations, power plants, air traffic control (ATC) centers, and water systems. Cyberterrorism is sometimes referred to as electronic terrorism or information war (Anonymous, 2007).

Increasing Cyberterrorist Threat. As businesses move from proprietary networks to web-based systems, they become increasing targets for terrorist attacks, according to security chiefs at the British Petroleum Company (BP). Rob Martin, manager of digital security services said, “Terrorism will increase. There’s been a lot of hype about cyberterrorism, and, in a sense, it’s been dismissed as a threat – but we have to look at how society has changed. Young terrorists have grown up with computers, and we’ve seen society become reliant on technology. They will use this against us” (Espiner, 2007).

British Petroleum said that it was difficult to monitor underground groups. However, Martin said that intelligence services informed the company how often cyberterrorism is being mentioned so that it can accordingly adjust its threat alert. Martin said that BP was more likely to be affected by cybercrime than cyberterrorism. However, the impact of terrorism was “likely to be far more significant” than cybercrime if it did occur (Espiner, 2007).

Critical Infrastructure at Risk of Cyber Attack. We need to know three things about cyber attack threats:

1. The threat is real
2. There will be more than one attack
3. Attacks will be directed at physical, critical infrastructure

It will hurt if even just one attack gets through. Think for a moment about what constitutes critical infrastructure. Broadly speaking, critical infrastructure elements include the following: (1) electrical power generation and distribution, (2) petrochemical production and distribution, (3) telecommunications, (4) the water supply, (5) food and agriculture, (6) hospitals and other healthcare services, (7) the transportation network, (8) law enforcement, and (9) the financial system (Gewirtz, 2009a).

Because of its long reach, cyberterrorism becomes more and more scary. In the days before the Internet, a well-trained terrorist cell could disrupt power distribution by gaining physical access to the power station, plant a bomb, and take out that power station. However, with Internet access, a single terrorist hacker from across the world could eliminate the entire U.S. power grid. The Internet becomes a force multiplier for terrorist organizations. An Internet attacker incurs no personal, physical risk and could attack multiple facilities (Gewirtz, 2009a).

As demonstrated on 9/11, even the Pentagon is not safe from physical attack. Furthermore, in November 2008, the Pentagon reported to Fox News that an adversary had cyber attacked its computer system in the form of virus or worms that spread rapidly through a number of military networks. Immediately after the attack, the Pentagon banned using external hardware devices, e.g., flash drives. Therefore, be careful, be smart, and pay attention to inherent, online risks (Gewirtz, 2009a).

Secret European Project to Battle Online Jihad. The United Kingdom (UK) collaborates with the German, Dutch, and Czech governments on a secret research project to block distribution of Islamic extremist online material. Officials throughout Europe express concerns about cyberterrorists hosting most jihadi websites outside of the European Union (EU). Hence, such websites cannot be eliminated from the Internet. These governments will explore technical measures such as filtering technologies plus cooperate internationally on removal notices issued to Internet Service Providers (ISPs). The European Commission will fund a project called “Exploring the Islamist Extremist Web of Europe – Analysis and Preventive Approaches,” which is led by the German interior ministry (Anonymous, 2009; Williams, 2009).

Using Twitter and Facebook to Prevent Attacks Before They Happen. If counterterrorism, homeland security, and law enforcement actively conduct a close watch on social networks such as Twitter, Facebook, and MySpace, they might prevent an attack, a crime, or a mass murder. That said, however, scanning Twitter feeds is not a license to be intrusive or to harass citizens unnecessarily. We should not be arbiters of political correctness (PC) or even to police obnoxious or even hateful postings. If we limit investigations to postings that are truly representative of potential trouble, law enforcement will more likely be able to pursue this technique to prevent man-induced disasters. However, overuse it, overly harass citizens, or get on ordinary American’s case for every moronic statement made, then, at some point, access to these tools for investigations would probably be curtailed by the courts. Therefore, we should use Twitter, Facebook, MySpace, and other social networking tools mainly to keep America safe, but we must also play fair (Gewirtz, 2009b).

Reference

Anonymous (2007, June 5). Cyberterrorism. SearchSecurity.com. Retrieved from searchsecurity.techtarget.com/sDefinition/0,,sid14_gci771061,00.html.

Anonymous (2009, Summer). Secret European project to battle online jihad. Counter Terrorism: The Journal of Counterterrorism and Homeland Security International, 15(2), p. 5.

Davis, P. (Fall 2009). An IACSP Q&A with Richard L. Cañas, the New Jersey homeland security director. Counter Terrorism: Journal of Counterterrorism & Homeland Security International, 15(3), 16-18.

Espiner, T. (2007, June 22). BP: Cyberterrorism threat is increasing. ZDNet UK. Retrieved from www.industrialdefender.com/general_downloads/news_industry/2007.06.22_cyberterrorism_threat_increasing.pdf.

Gewirtz, D. (2009a, Summer). How critical infrastructure is at risk of a cyber attack. Counter Terrorism: The Journal of Counterterrorism and Homeland Security International, 15(2), p. 5.

Gewirtz, D. (2009b, Fall). Using online social networks in counterterrorism and law enforcement. Counter Terrorism: The Journal of Counterterrorism and Homeland Security International, 15(3), pp. 8-10.

Williams, C. (2009, April 8). Secret European project to battle online jihad: ‘Significant’ international bid to block extremism. The Register. Retrieved from www.theregister.co.uk/2009/04/08/eu_extrmism_research/print.html.

###