State and Local Governments Combat Cyberterrorism

In this piece, I identify what measures state and local governments are using to combat cyberterrorism.

State and Local Government Responsibilities

The 50 states, 4 territories, and 87,000 local jurisdictions that comprise the United States maintain an important and unique role in protecting our critical infrastructures (CIs) and key assets (KAs). All U.S. states and territories have established Homeland Security liaison offices to manage their counterterrorism and critical infrastructure protection (CIP) efforts. In addition, the states possess law enforcement agencies, National Guard units, and other critical services that protect their communities (Anonymous, 2003a).

State, county, municipal, and local governments fund and operate the emergency services that would respond in the event of a terrorist attack. Ultimately, all manmade and natural disasters are local events – with local units being the first to respond and the last to leave. Since September 11, 2001, every state and many cities and counties have addressed homeland security issues either through an existing office or through a newly created office. Many have established anti-terrorism task forces. Many have published or are preparing homeland security strategies. Some of these strategies are based on existing plans for dealing with natural disasters. Each level of government must coordinate with other levels to minimize redundancies in homeland security actions and ensure integrated efforts (Anonymous, 2002a).  State and local government first responders also are responsible for dealing with the aftermath of cyberterrorism attacks.

State and Local Governments are Unprepared

In general, state and local governments have not organized effectively to deal with the changes in CI and information technology (IT). Many programs are badly underfunded and lag way behind the private sector. This shortcoming is systemic in many areas of protection capability at the prevention, mitigation, and reconstitution levels (Cordesman, 2002).  It is only a matter of time before cyberterrorists perpetrate an attack on a city or county government (Misra, 2003).  Only then will Congress funnel sufficient funds into the state and local counter-cyberterrorism efforts.

What State Government Could Do?

Now, we address what state government could do to make our CI organizations secure and to protect our citizens. First, we clearly need to define, through effective leadership and with a clear vision, what needs to be accomplished. Second, we need to address the need for a coordinated state strategy and a comprehensive threat assessment managed under the Lieutenant Governor’s office (Kobus, 2001).  The state government must be the driving force behind these efforts. The national government will not make it happen on the state level lest it be accused of meddling. With the exception of New York City and Los Angeles, most local governments do not possess the wherewithal to make it happen. Hence, the responsibility rests in the lap of the state government.

Cyberterrorism – Top-three Concerns

Biological attacks, chemical attacks, and cyberterrorism are the top three terrorism concerns for communities in the aftermath of the September 11, 2001, terrorist attacks. A survey carried out by the National League of Cities (NLC), Washington, DC, showed that the international terrorism threat has increased municipal officials’ security concerns. Many respondents indicated that they have not developed response plans, but all have developed greater cooperation with counties, civic organizations, nonprofit organizations, other municipalities, and even the media (Anonymous, 2002b).

Local Governments – a Growing Concern

Local governments constitute a growing concern among security experts. According to the NLC survey, only 43 percent of large cities and 26 percent of all cities have developed strategies to address cyberterrorism (Misra, 2003).  For local governments, protecting networks and computer systems is costly and time-consuming. In addition to expanding firewalls and intrusion detection, IT departments are busy installing anti-malware software to protect against pervasive worms and viruses as well as automatic patches for desktops and servers. Regular system audits and log checks further support those measures (Burkhammer, 2006).

Additionally, on the local level, the Community Emergency Response Teams (CERT) program trains citizens to be better prepared to respond to emergency situations in their communities. When emergencies occur, CERT members can give critical support to first responders, provide immediate assistance to victims, and organize spontaneous volunteers at a disaster site. CERT training includes disaster preparedness, disaster fire suppression, basic disaster medical operations, and light search and rescue operations (Bullock, Haddow, Coppola, Ergin, Westerman, & Yeletaysi, 2006).  I am a proud member of the San Marcos (California) CERT. In our certification training, we covered training unit 8, which is on “Terrorism and CERT.”

Sharing Information

With an increasing dependence on integrated systems, state, local, and federal agencies collectively must combat cyber attacks. Sharing information to protect systems is an important foundation for ensuring governmental continuity. States have adopted various mechanisms (such as teams, common databases, communications, and conferences) to facilitate information sharing on cyber attacks and incident reporting (Anonymous, 2003b).  Information sharing has been a huge problem in the past. However, things are improving in this area of concern.

Partnership is Key

A National Association of State Chief Information Officers (NASCIO) survey noted that our information infrastructure is continually under attack. As the fight against cyberterrorism continues, the survey makes it clear that a few key improvements by the Department of Homeland Security (DHS) – the first being a closer working relationship with state and local governments – could yield long-term benefits for state and local sectors as well as for the larger national effort (Burkhammer, 2006).  Partnering is a key mechanism in resolving this issue.

Conclusion

It is only a matter of time before cyberterrorists perpetrate an attack on a city or county government. All manmade and natural disasters are local events with local units being the first to respond and the last to leave. However, the state government must be the driving force behind the efforts of defining what needs to be done, establishing a coordinated statewide strategy, and performing a comprehensive threat assessment. Sharing information to protect systems is an important foundation for ensuring governmental continuity.  Partnering is a key mechanism in creating a closer working relationship among national, state, and local governments. If these things are done, we would have a much more effective effort in combating cyberterrorism at the state and local governmental levels.

References

Anonymous (2002a, July). National Strategy for Homeland Security. Washington, DC: Office of Homeland Security.

Anonymous (2002b, November). International threats hit home for local leaders. The American City & County, 117(16), pp. S12 & S14.

Anonymous (2003a, February). The National Strategy for the Physical Protection of Critical Infrastructures and Key Assets. Washington, DC: The White House.

Anonymous (2003b, February). The National Strategy to Secure Cyberspace. Washington, DC: The White House.

Bullock, J. A., Haddow, G. D., Coppola, D., Ergin, E., Westerman, L., & Yeletaysi, S. (2006). Introduction to Homeland Security, Second Edition. Oxford, United Kingdom: Elsevier Butterworth-Heinemann.

Burkhammer, L. (2006, March). The virtual enemy: Locals need more money and communication to defend against cyberterrorism. The American City & County, 121(3), pp. 32-35.

Cordesman, A. H. (2002). Cyber-threats, Information Warfare, and Critical Infrastructure Protection: Defending the US Homeland. Westport, Connecticut: Praeger Publishers.

Kobus, W. S., Jr. (2001, November). Executive guide for state governors: State plan for securing critical infrastructure private companies. Raleigh, North Carolina: Total Enterprise Security Solutions, LLC, 19 pp.

Misra, S. (2003, June). High-tech terror: Cities and counties need plans to respond to criminal efforts to destroy government computer networks and data. The American City & County, 118(6), p. HS6.

###