Future Forecast

Larry Dean Farrell

INLS 187

The convergence of computers and terrorism was inevitable. Both tend to be poorly understood by the general public leading to inflated fears regarding each of them. Their merger results in a murky mess, even definitions of what it is vary, though many people cry out that it is only a matter of time before we’re struck by a massive cyberterror attack. Critics cite the example of 9/11, no one anticipated that either, so we need to be prepared. So, what are the major points of debate on cyberterrorism? Point number one is, what exactly is cyberterrorism, and secondly, what would a cyberterror attack look like?

What exactly is cyberterrorism? Definitions vary, and tend to concatenate the definitions of terrorism and computer crime. There are also those who argue that the definition should only encompass damage done to the computer systems themselves. Therefore a cyberterror attack under this definition could be one in which no one is hurt or killed, such as the nationwide ATM system being knocked offline. This, according to Sarah Gordon and Richard Ford is the definition of pure cyberterrorism, but according to them this definition is inadequate in its restrictiveness. Also, cyberterrorism is often confused with more mundane hacking, as the Council on Foreign Relations Q &A on cyberterrorism interchanges that term with cyberattacks, which are not necessarily the same thing. Perhaps a more useful working definition, one that melds elements of traditional terrorism with computers is provided by Mark Pollitt, “Cyberterrorism is the premeditated, politically motivated attack against information, computer systems, computer programs, and data which results in violence against non-combatant targets by sub-national groups or clandestine agents.” This definition is in no way authoritative, and what constitutes a cyberterror attack remains a topic of debate.

So what would a cyberterror attack look like? People’s expectations of what might happen tend to be rather grandiose, leaning towards setting off a nuclear device, bringing down the air traffic control system, opening dams, blowing up chemical plants, and the like. The only problem with such scenarios, according to Joshua Green and Mark Pollitt, is that they vary between basically being impossible to highly improbable. For example, according to them, nuclear weapons systems are in no way connected to the wider internet, while the air traffic control system is merely a very handy safety feature and pilots are in fact trained for the contingency that it might not be available. Green also points out that the computer systems and software used by the air traffic control system, chemical plants, and etc. tend to be so arcane that no one really understands their functionality save for a few insiders. Then, as writers such as Marcus Ranum argue, why would terrorists resort to cyberterrorism in the first place? It’s far easier and almost certainly more effective to plant a bomb somewhere. That’s terror. Knocking out a bank’s ATM system would certainly be inconvenient for those affected, but it can’t really be called terror as such.

Insiders are the one true cyberterror threat, though even the damage caused by an insider would probably be limited as systems tend to have safety features built into them, and as Pollitt points out, many scenarios work on the assumption that no one but the erstwhile hacker would be paying the slightest attention to what’s going on, though it does strikes me that writer’s such as Green underestimate this threat, as the Three Mile Island incident, though not terrorism as such, nearly turned central Pennsylvania into a wasteland 25 years ago, despite built in safety features and the vigilance of the attending staff.

In the end much of the discussion of cyberterrorism seems to quickly devolve from the grandiosity of cyberterrorism into the more mundane world of computer crime. From this vantage point basically anything could be equated with cyberterrorism including such ridiculous notions as those espoused by Sarah Gordon and Richard Ford for example, who seem to equate the fact that several of the 9/11 terrorists made travel plans and purchased tickets online as cyberterrorism, the only real remedy being to shut down the Internet.

Others, such as Green offer more cogent arguments such as, can defacing a government website with a message to overthrow George W. Bush be construed as cyberterrorism or an act of vandalism. Then what should the penalty be if it is deemed to be terrorism? Should it be as severe as other terrorist acts?

In the end cyberterrorism seems more scaremongering than reality with writers such Ranum and Green arguing that regardless of the threat it is the interests of a large number of individuals and companies to keep it in the public eye, particularly since the Dot.com crash, Internet security being one of the few growth areas the computer industry.

It strikes me as fairly unlikely that a major cyberterror attack against the United States is in the offing. Particularly given the shock value and effectiveness of attacks like those carried out on 9/11, and as authors such as Ranum point out, real, warlike attacks such as 9/11 make for spectacular TV and send a wave of fear through the target community. A major cyberterror attack, on the other hand, even if successful, a big if given the discussion above, would most likely have murky results. Depending on the nature of the attack people might ask, was it really a cyberterror attack, cybercrime, or merely a prosaic hardware, or software failure? It would potentially provide little in the way of spectacular results, as it would be much easier for the government to deny an attack’s realities, as a power outage is much easier to spin as merely a systems failure than bombs going off outside the White House.

In the end class breaks do happen. No one anticipated 9/11, and though the threat was played down in the articles I looked at, the threat is there, even if its results would probably be much less catastrophic than is often portrayed. Still it is imperative that users take security precautions such as firewalls, antivirus software, etc., be they Symantec, as recommended by Green whose work was funded by Symantec, or some other company.

Works Consulted:

Gordon. S. Cyberterrorism and the Home User. (September 2002). Symantec Security Response White Paper. [Downloaded 10/28/2004]. Available on the World Wide Web: (http://securityresponse.symantec.com/avcenter/reference/cyberterrorism.and.home.user.pdf).

Gordon, S. & Ford, R. (March, 2003). Cyberterrorism?. Symantec Security Response White Paper. [Downloaded 10/28/2004]. Available on the World Wide Web: (http://securityresponse.symantec.com/avcenter/reference/cyberterrorism.pdf).

Green, J. (2001). The Myth of Cyberterrorism. Washington Monthly. [Downloaded 10/28/2004]. Available from the World Wide Web: (http://www.washingtonmonthly.com/features/2001/0211.green.html).

Pollitt. M. M. Cyberterrorism - Fact or Fancy? [Downloaded 10/28/2004]. Available from the World Wide Web: (http://www.cs.georgetown.edu/~denning/infosec/pollitt.html).

Ranum, Marcus. (1994). Information Warfare: INFOSEC, COMPSEC, and JOBSEC. [Downloaded 10/28/2004]. Available from the World Wide Web: (http://ranum.com/security/computer_security/archives/infowar-jobsec.htm).

Terrorism: Q & A. ( 2004). Council on Foreign Relations in Cooperation with the Markle Foundation. [Downloaded 10/28/2004]. Available from the World Wide Web: (http://www.terrorismanswers.org/terrorism/cyberterrorism_print.html).