Cyber Terrorism: Threat Assessment and Infrastructure Protection

Introduction: The Cyber Threat Landscape

Since the early 1990s, the internet has grown technologically faster and with more capabilities than any other type of technology in the world, leaving the United States with a sense of fear regarding this type of network being a risk to national security. While most people find the internet to be a great tool for information and unlimited capabilities, it can devastate us personally and financially. The internet can increase the risk of theft, fraud, and even the possibility of suffering from a cyber-attack or, worse, cyber terrorism, leaving our country at risk—especially those who work in government defense agencies and private corporations.

In 2003, the conflict with Iraq created speculation that the United States would experience cyber-attacks in revenge. However, since 1995, there have been no reports of cyber-attacks that would produce panic or damage U.S. infrastructure or affect military operations. This is not a result of inactivity by terrorist groups. Between 1996 and the end of 2001, there were 1,813 international terrorist attacks performed. Several involved citizen targets, including the Khobar Tower Bombing in June 1996, the Embassy Bombing in East Africa in August 1998, and the USS Cole attack in October 2000.

To compare these figures: between 1996 and 2003, there were approximately 1,813 terrorist attacks, 217,394 computer security incidents, and zero cyber-attacks on critical infrastructure. Reporters have noted that cyber terrorism against infrastructure is an unlikely threat to U.S. security. In 2005, cyber-attacks cost $48 billion to businesses and $680 million to consumers. While a physical attack involves weapons against a specific target, a cyber-attack uses code as a weapon to infect enemy computers in order to manipulate software, system configuration, or access to restricted computer systems.

Defining Cyber Terrorism and Cyber-Attacks

Although cyber-attacks have targeted critical infrastructure, industry, and companies, the gathered data cannot determine whether terrorist groups initiated these attacks. One concept creating significant concern regarding infrastructure is the term cyber terrorism. Cyber terrorism can be defined as the use of a computer as a weapon or target by any group that threatens to cause violence and fear with the purpose of influencing an audience or forcing a government to change its policies. Like traditional terrorism, cyber terrorism is used to intimidate the government to change its positions regarding social objectives. To be considered cyber terrorism, attacks against people or property should cause sufficient harm, such as attacks leading to death, explosions, and economic loss.

There are many reasons why terrorists might conduct cyber terrorism. First, cybercrime is a cheaper method consisting of computer use and online connections, without the necessity to purchase weapons or explosives. Second, cyber terrorism remains anonymous—terrorists can use unidentified users, and police forces will not be able to identify the attacker's real identity. Third, a tremendous number of people can be targeted as long as weaknesses are identified, including computers and networks of airlines, government agencies, public utilities, and individuals with high-level security clearance. Fourth, cyber terrorism does not require physical training, risk of death, or regular activities performed by traditional terrorists. Fifth, cyber terrorism has the ability to affect people directly, generating media coverage—which is what terrorists seek.

However, cyber-attacks are more common in daily life than cyber terrorism. In fact, there are no records of cyber terrorism in the U.S. According to the FBI, there are 18 cyber criminals most wanted due to racketeering, unauthorized computer access for financial gain, computer fraud, money laundering, and related crimes. These individuals are considered hackers with no political goals or desires and cannot be classified as cyber terrorists.

Based on the information above, it is difficult to determine the level of relevance or capabilities of terrorist groups to send effective cyber-attacks. Some observers conclude that Al Qaeda does not appear interested in cyber terrorism to achieve its goals because it prefers to cause human casualties. Other observers believe that cyber terrorism attracts terrorists in post-industrial societies, such as Europe and the United States, unlike international terrorists operating in regions with limited access to advanced technology.

Current Threat Assessment and Terrorist Motivations

We can agree that the cyber terrorism threat has been overstated, but we cannot ignore it. One reason for this may be the differences in goals and motives between terrorists. Terrorists attempt to make political statements and impose psychological and physical damage on their targets—goals that cannot be achieved through cyber terrorism if the effects may not even be noticed or, in scenarios of economic attacks, damage might be slow and cumulative. Terrorist goals are to create visible fear in the public and to cause physical harm to society. Cyber terrorism would not fulfill these objectives.

However, we have observed that aside from cyber-attacks, terrorists have begun using the internet as a source of communication to plan their attacks. Using the internet, they can communicate with other groups interested in participating in terrorist attacks and provide information to anonymous contacts. Consequently, terrorists prefer to use the internet for nonviolent acts because it is more effective for the group and the achievement of their goals. This suggests that the primary value of the internet to terrorist organizations lies in coordination and propaganda rather than in carrying out direct cyber operations.

There are four types of attacks that can appeal to terrorists considering cyber terrorism. The first type is large-scale Distributed Denial of Service (DDoS) attacks used to target IT infrastructure. These attacks represent viruses, worms, and Trojan horses that control other computers. Distribution occurs through email, FTP transactions, media sharing, or concealed code in websites. For terrorists, DDoS attacks can be interesting because they can be rented to third parties as a source of income, used for terrorist propaganda, or deployed to bring down an adversary.

Types of Cyber Attacks and Attack Vectors

The second type of attack is conventional hacking to gain access to specific computers. If the attack succeeds and yields relevant data, terrorists can exploit it by stealing or damaging data such as financial institution records or military top-secret documents, which are not immune to such attacks. The third type is hybrid attacks, which can cause the utmost damage by combining the first two attack types with a bomb attack. The last type of attack points toward the physical world, manipulating IT systems that control physical infrastructure, such as railways, thereby causing damage to physical goods.

These four attack types can cause severe damage, but no human lives would be directly compromised. When human lives are not involved, it becomes questionable whether these attacks are an appealing option for terrorists. A terrorist's goal is to create fear in the public and inflict physical harm on society. Cyber terrorism alone would not fulfill this objective, which explains why terrorists have historically preferred conventional methods capable of producing immediate, visible casualties.

Even though there is no evidence of cyber terrorism, it is imperative that people be aware of the negative impacts it could create for our infrastructure. The Council of Europe's Convention on Cybercrime is one of the broadest instruments addressing computer crime. Articles 2 and 3 address illegal access and illegal interception; articles 4 and 5 address data interference and system interference, covering offenses against the confidentiality, integrity, and availability of computer data systems.

Critical Infrastructure and Government Response

The Department of Justice has an organization called the Computer Crime and Intellectual Property Section (CCIPS), responsible for implementing strategies to combat computer and intellectual property crimes worldwide. CCIPS works with other agencies to prevent, investigate, and prosecute computer crimes. The Department of Homeland Security has also collaborated to improve cyber security by utilizing the Secret Service to maintain Electronic Crime Task Forces (ECTFs). ECTFs focus on classifying and finding international cyber criminals linked to cyber intrusions, bank robberies, and other computer crimes.

The nation's critical infrastructures comprise both public and private institutions divided by sectors. These sectors include agriculture, food, water, government, emergency services, information and telecommunications, transportation, energy, banking and finance, chemicals and hazardous materials, and postal and shipping. This cyberspace represents the control system of our country, composed of thousands of unified computers, servers, and routers that permit critical infrastructure to function. Our critical infrastructure, as defined by the USA Patriot Act, consists of systems and assets so fundamental to the United States that loss or damage would have a devastating impact on security, national economic security, national public well-being, and related matters.

Securing Cyberspace: Vulnerability Reduction Strategies

There is a national strategy that every individual should follow to secure their personal assets and control the portions of cyberspace they operate. Securing our cyberspace is a challenging strategy requiring effort from all of society. By securing cyberspace, we can reduce vulnerability to cyber threats. The internet is also a source for conducting espionage against our government, universities, and private companies, which can erode public trust in information systems. If our systems become compromised by cyber terrorism, it would greatly affect our society.

Because everyone reacts differently to security breaches, some people will be directly affected by losses to a retail company's information; others will be distressed by attacks on their email and other electronics. Retail companies would suffer significant losses due to public panic. The importance lies in keeping our society informed about the consequences of cyber terrorism and aware of how to address threats if they occur. There are many steps each party involved can take. For example, groups directly affected must be more forceful in pursuing criminals. Though costly, if the criminal is caught, they must be prosecuted to the full extent of the law with harsh punishments to deter others from committing such acts.

Corporate organizations should be proactive about the possibilities of these attacks. By remaining updated on information and maintaining a security posture, companies can reduce risk. Organizations are responsible for increasing consciousness about cyber terrorism among their workers. We must understand that it is only a matter of time before terrorists attempt to penetrate our infrastructure with cyber terrorism. By following core values of integrity, we can supersede any cyber terrorism threats against our society. We must become more vigilant of our surroundings and become comfortable with the technology around us. Technology is a powerful tool that helps solve problems, and without it, combined knowledge would be lost.

Conclusion: Vigilance and Collective Responsibility

From our studies, we can determine that terrorists are opportunistic. They will exploit any single weakness we leave unprotected and will choose the right time and method of attack according to the weaknesses they observe. Terrorists plan for months, even years in some cases, to execute an attack without error, capable of affecting our society in ways from which we cannot easily recover, as exemplified by the 9/11 attacks. They also use pre-attack surveillance to provide information to terrorist leaders. We must always be vigilant about small details that can prove detrimental to our safety. If, as a society, we understand the importance of securing our information, we can significantly reduce America's vulnerability, especially to the most damaging attacks.